News Summary:

  • Business software provider Zoho released on Tuesdaythe "Workforce Password Security Status Report"showing that despite underinvestment in foundational security tools such as identity management and zero-trust networks, companies remain fully confident that AI will improve their cybersecurity posture.
  • The report found a mismatch between confidence in AI and actual deployment readiness: a huge gap exists between the proportion of companies expecting AI to bolster security and those prepared to put that potential into practice.
  • The report also includes data on the percentage of companies that recently suffered cyberattacks and corporate spending plans in the security sector.

Deep Insights:

The gap between AI enthusiasm and AI readiness is one of the top findings Zoho highlights in the report. 90% of respondents said AI can strengthen their cyber defenses, but only 8% said they are currently ready to deploy AI-driven security tools.

"The 82-percentage-point gap between belief and deployment readiness defines the most critical inflection point in workforce security," Zoho said.

Meanwhile, many companies lack a firm grasp on core cybersecurity practices. About three-quarters of respondents said they lack complete visibility into their identity ecosystems—that is, they are unclear about who has access to which systems. Of these, 36% reported only partial visibility, 38% said visibility was limited, and another 14% admitted to having no visibility at all.

"This 'identity visibility gap' is not a marginal issue," Zoho warned. "It is a core vulnerability driving unauthorized access, insider threats, and compliance failures."

On the key metric of zero-trust networks—designing systems to anticipate breaches and limit their impact—about two-thirds of companies said they have not yet formulated any implementation strategy. Of these, about half plan to develop such a strategy within the next three years, which Zoho believes creates a "critical window of vulnerability" for credential-based attacks.

More than half of companies said the "runaway" growth of identity ecosystems makes implementing zero-trust networks difficult; another third of respondents said they lack the proper processes and tools.

The report is based on a survey of 3,300 cybersecurity professionals across nine global regions and six industries. It also found that one-third of companies suffered a cyberattack in the past year, while another 7% were "unsure whether they had been attacked."

Regarding AI for security, the technical capabilities companies prioritize most are: detecting anomalous activity and threats (68% listed it as a desired feature), automating policy enforcement (61%), and analyzing employee behavior (54%). However, multiple factors are hindering their AI adoption, with outdated technology, concerns about migration complexity, and budget constraints leading the list.