Most organizations need six months or longer to roll out new security controls
Cisco surveyed 8,000 security professionals in 30 markets about how well their organizations defend against AI-era threats, and only 8% landed in the top group. Cisco gave the most weight in its scoring to internal friction, meaning the delays and turf problems inside a company that slow a security team when something changes.
Cisco says frontier AI models can find software vulnerabilities at a scale and speed no human team working alone can match. Fewer than one in ten respondents are confident they can stay ahead of the flood of new threats. Their answers put the slowdown inside the company: procurement delays, infrastructure decisions that IT owns, and priorities the C-suite sets elsewhere. Cisco says teams have the tools, and the drag comes from how the organization runs.
Months to switch on a control
Only 21% of organizations say they can switch on a new security control within six months, and that clock starts after budget and approval have cleared. In the top group, 52% manage it in that window. Data eats time too. Cisco reports that 40% of teams spend more time collecting and matching up data from different systems than they spend chasing the threat.
Asked what would have made the biggest difference in a recent incident or near-miss, a CSO in India said a clearer escalation path would have, because during the incident there was “confusion about who had the final authority to shut down the affected systems.”
Money did not fix it
Among organizations that raised security spending, 41% saw fewer incidents. In the top group, 71% reported fewer incidents from their bigger budgets. The report does not say whether the two figures rest on the same base, so treat the comparison loosely. Cisco reads the gap as a sign that what a company buys matters more than how much it spends.
Read the ranking with care
Friction makes up half of the 100-point score, so the top group is defined partly by having little of it. Finding that those companies report less friction is close to built in. The figures are also respondents describing their own organizations. The open-ended answers carry more weight, because practitioners kept asking for the same things: ownership, defined communication channels and faster communication between departments.
A team that cannot say who may shut down a compromised system will lose time no matter what it has bought.
Cisco’s first fix is to hand out decision rights before an incident starts. Its other four are to unify data into one picture, run playbooks under pressure, let constrained automation handle the first ten minutes, and make the secure option the easiest one to follow.
Webinar: Closing the accountability gap in AI-assisted delivery
