Bitdefender has released its 2026 Cybersecurity Assessment Report, based on an independent survey of 1,201 IT and security professionals at organisations with 500 or more employees across France, Germany, Italy, Singapore, the United Kingdom and the United States.
The report focuses on how security teams are responding to AI-driven risks and an expanding attack surface, and highlights gaps between management perceptions and practitioner experience, including around the use of “shadow AI” tools and personal accounts for work.
According to the survey, 51.8% of respondents said their organisations have full visibility into sanctioned and unsanctioned AI usage. Another 47.4% reported only partial or no visibility into individual AI tools or personal accounts used for work. The report also found a split between managers and practitioners: 57.8% of managers said they have full visibility compared to 45.9% of practitioners, while 0.5% of managers reported zero visibility versus 4.5% of practitioners.
When asked which environments are of most concern, 45% of respondents identified internal AI systems and large language models as their primary concern, followed by cloud infrastructure and application environments at 44%. Identity and access management systems were third at 33.3%. Despite ranking AI systems as the top concern, 20.4% of respondents rated employees leaking sensitive data into public LLMs as a low or extremely low risk, which the report characterised as a gap between perceived threat and exposure.
The survey also examined incident response and disclosure. Among respondents who experienced a security incident or breach in the past 12 months, 55.2% said they were told to keep it confidential despite believing it should have been reported to authorities. The report said this was down from 57.6% in 2025 but higher than the 42% reported in 2023. By country, the report cited the United States at 68.6%, followed by Germany and the U.K. both at 57.2%.
On incident types, cloud infrastructure or application breaches were most commonly reported (41.8%), followed by business email compromise resulting in financial or data loss (35.9%), and ransomware (25.6%). The report said 59.2% of respondents experienced AI-driven social engineering attacks in the past 12 months.
Data sovereignty emerged as a procurement issue, with 76.1% of respondents saying they would likely switch cybersecurity vendors due to concerns about data sovereignty, jurisdiction or foreign government access to their data. The report cited the United States at 87% and the U.K. at 85%, with Germany at 77%. Managers were more likely than practitioners to say they would switch vendors (79.4% versus 72.8%).
“The expanding attack surface, the rapid proliferation of AI-powered threats, and persistent operational pressures are forcing organisations to rethink how they approach security from the ground up,” said Andrei Florescu, president and general manager of Bitdefender Business Solutions Group. “The findings in this report make clear that modern security strategies must go beyond reactive defences to continuously reduce risk, govern AI adoption, and ensure compliance across an environment where adversaries are faster, more adaptive, and increasingly automated.”
Bitdefender said it commissioned Censuswide to conduct the survey and analyse results, with data collection running from April 2026 through June 2026. Bitdefender noted Singapore as the report’s Asia-Pacific market and the closest geographic reference point for Australian organisations, while figures cited in the report are global unless a specific country is named.
You can read the full report here.
