Key Takeaways
- Nearly half of organizations lack full visibility into how employees use AI tools, creating a significant “shadow AI” risk.
- Decision‑makers overestimate control over AI usage compared with technical staff, highlighting a perception gap.
- Internal AI systems and large language models are the top cybersecurity concern, followed closely by cloud infrastructure and Identity‑and‑Access‑Management.
- More than half of security‑incident victims were told to keep the breach confidential, a practice that remains widespread despite a slight decline.
- Cloud‑infrastructure breaches and Business Email Compromise (BEC) attacks are the most frequently reported incidents, while AI‑powered social engineering targets nearly six in ten organizations.
- Reducing the attack surface is hindered by operational‑disruption fears, resource limits, legacy‑system complexity, and insufficient visibility into needed tools.
- Data sovereignty now drives vendor choice, with over three‑quarters of respondents willing to switch providers over jurisdictional or foreign‑access concerns.
- AI‑generated threats—such as self‑evolving malware, deepfakes, and AI‑powered evasion techniques—are viewed as high‑risk, though attackers mainly use AI to refine existing tactics rather than invent wholly new malware families.
Limited Visibility into AI Use and Perception Gap
The Bitdefender Cybersecurity Assessment 2026 reveals that only 51.8 % of surveyed professionals claim complete visibility into both authorized and unauthorized AI usage within their organizations. Conversely, 47.4 % admit they have only partial or no insight into Shadow AI tools or personal AI accounts employed for work purposes. This lack of oversight creates a blind spot where employees may inadvertently expose sensitive data through uncontrolled AI interactions. The study further uncovers a perception gap: 57.8 % of decision‑makers believe their firms have full control over AI usage, while only 45.9 % of technical specialists share that confidence. Bitdefender interprets this disparity as evidence that senior management may be underestimating the organization’s actual exposure to AI‑related risks.
Top Security Concerns: Internal AI Systems, Cloud Infrastructure, and IAM
When asked to rank their foremost worries, 45 % of respondents placed internal AI systems and large language models (LLMs) at the top of the list. Cloud infrastructure and applications followed closely, cited by 44 % as a primary concern, while Identity and Access Management (IAM) systems ranked third at 33.3 %. Interestingly, despite AI being perceived as the leading threat, one in five respondents rated the leakage of sensitive information by employees into public LLMs as a low or very low risk. This contradiction suggests that while organizations recognize AI as a concern, they may not fully appreciate the specific pathways through which data can be exfiltrated via AI interactions.
Widespread Concealment of Security Breaches
More than half (55.2 %) of professionals who experienced a security incident in the past year reported being instructed to keep the breach confidential, even though they believed it should have been disclosed to the appropriate authorities. Although this figure has dipped slightly from 57.6 % in 2025, it remains well above the 42 % recorded in 2023, indicating that the habit of hiding incidents is still deeply ingrained globally. The United States exhibits the highest concealment rate at 68.6 %, with Germany and the United Kingdom each reporting 57.2 %. The trend cuts across both managerial and technical roles, underscoring a cultural reluctance to transparency that hampers collective defense and regulatory compliance.
Common Incident Types: Cloud Breaches, BEC, Ransomware, and AI‑Powered Social Engineering
Breaches affecting cloud infrastructure or applications emerged as the most frequently reported security incident, impacting 41.8 % of surveyed organizations. Business Email Compromise (BEC) attacks followed, causing financial or data losses for 35.9 % of firms, while ransomware was cited by 25.6 % of respondents. Additionally, 59.2 % of participants said they had been targeted by AI‑powered social engineering attacks during the previous year, confirming that cybercriminals have already integrated artificial intelligence into their toolkit. These statistics illustrate that cloud environments, email‑based fraud, and AI‑enhanced deception are presently the dominant threat vectors facing enterprises.
Challenges in Reducing the Attack Surface
Although organizations acknowledge the necessity of shrinking their attack surface, many struggle to do so without disrupting business continuity. The principal obstacles identified include the effort required to maintain security rules and exceptions (38 %), concerns about operational disruption (35.4 %), limited resources (34.6 %), the complexity of securing legacy systems (34.5 %), and insufficient visibility into which legitimate tools users actually require (33.8 %). In the United States, visibility gaps are especially pronounced, with 48.8 % of organizations reporting significant shortcomings—well above the global average of 33.8 %. These barriers highlight the tension between security hardening and maintaining agile, productive IT environments.
Data Sovereignty Driving Vendor Selection
Data sovereignty has become a decisive factor when choosing a cybersecurity provider. Over three‑quarters of respondents (76.1 %) indicated they would likely switch vendors due to worries about data jurisdiction, sovereignty, or the prospect of foreign governments accessing their information. This concern is most acute in the United States (87 %), the United Kingdom (85 %), and Germany (77 %), and is more prevalent among decision‑makers (79.4 %) than technical specialists (72.8 %). Bitdefender links this trend to tightening regulatory regimes such as NIS2 and DORA, which compel organizations to demand greater transparency regarding where data resides and who can access it, thereby influencing procurement decisions.
Emerging AI‑Driven Threats
The report finds that AI‑related threats are widely perceived as posing high or very high risk. Respondents ranked AI‑generated self‑evolving malware as the top concern (55.9 %), followed by the disclosure of sensitive information through public AI models (53.5 %), AI‑powered evasion techniques capable of bypassing traditional defenses (52.5 %), and the use of deepfakes or voice cloning for fraud and BEC attacks (51.9 %). Although self‑evolving malware leads the list, current threat intelligence shows that cybercriminals are primarily employing AI to accelerate and refine existing attack methods rather than to create entirely new malware families. Notably, agentic AI—systems capable of autonomous goal‑directed behavior—is viewed as a particularly significant risk in Singapore (64 %) and the United States (61.6 %).
Conclusion and Recommendations
The Bitdefender Cybersecurity Assessment 2026 underscores that organizations today grapple with a confluence of AI opacity, breach concealment, cloud vulnerabilities, and tightening data‑sovereignty demands. To address these challenges, firms should invest in comprehensive AI‑usage monitoring tools that illuminate both sanctioned and shadow AI activities, bridge the perception gap between executives and technical staff through regular risk‑awareness training, and enforce clear incident‑reporting policies that discourage concealment. Strengthening cloud security posture, adopting zero‑trust principles for IAM, and leveraging AI‑based detection for social engineering can mitigate the most common attack vectors. Simultaneously, organizations must streamline attack‑surface reduction efforts by consolidating legacy assets, allocating adequate resources, and maintaining clear inventories of essential tools. Finally, selecting cybersecurity partners with provable data‑locality guarantees and compliance with frameworks such as NIS2 and DORA will become increasingly vital as regulatory scrutiny intensifies. By integrating these measures, enterprises can move from reactive defenses to a proactive, risk‑based security posture capable of withstanding the evolving AI‑enhanced threat landscape.