AI investment rises as security teams battle skills shortages

Splunk has published its "State of Security 2025" global research report, detailing the challenges currently faced by Security Operations Centres (SOCs) in managing cyber threats and operational demands.

The report identifies significant trends affecting security teams worldwide, including the growing role of artificial intelligence (AI) in security operations, persistent understaffing, and the complications arising from fragmented security toolsets. According to the report, 59% of security professionals surveyed stated that AI has moderately or significantly improved their efficiency. In Australia and New Zealand (ANZ), 71% of organisations are increasing their investment in AI and machine learning technologies.

Staffing shortfalls also remained a concern, with 49% of respondents identifying understaffing and skills gaps as critical issues for their security teams. These shortages, combined with technological inefficiencies, are contributing factors to operational delays and increased workload pressure.

A notable 78% of survey respondents reported difficulties stemming from dispersed and disconnected security tools, which impacts their ability to respond promptly and effectively to threats. The research found that 59% of organisations view tool maintenance as their biggest source of inefficiency, with 46% indicating they spend more time on maintaining tools than on defending their organisation from threats.

When examining the consequences of these challenges, the report revealed that 66% of organisations experienced a data breach in the past year, making it the most commonly reported security incident. The reliance on manual processes and inadequately integrated tools was cited as a significant contributor to these breaches.

Despite the increased adoption of AI, only 11% of organisations indicated full confidence in AI's role for mission-critical tasks. This cautious approach reflects broader industry sentiment on the limitations and risks of fully delegating key security decisions to automated systems.

Michael Fanning, Chief Information Security Officer at Splunk, observed, "Organisations are increasingly leaning on AI for threat hunting and detection, and other mission-critical tasks, but we don't see AI taking complete oversight of the SOC – for good reason. Human oversight remains central to effective cybersecurity, and AI is used to enhance human capabilities to help where it truly matters: defending the organisation."

Nate Lesser, Chief Information Security Officer at Children's National Hospital, added, "As cyber threats grow in volume and sophistication, security teams are under constant pressure. According to Splunk's State of Security report, the industry is struggling with escalating workloads, alert fatigue, and a shortage of skilled talent. Integrating AI and automation helps us address these risks and empowers our teams with smarter tools to ensure our organisation remains resilient."

Many organisations are also seeing value in collaborating more closely between security and observability teams. The report indicates that 78% believe sharing data with observability teams leads to quicker incident resolution. In addition, 69% of respondents noted that disconnected and dispersed tools create moderate to significant challenges for their SOCs, hampering their ability to address evolving threats effectively.

The ANZ region exhibited distinctive trends, as highlighted by Shannon Davis, Global Principal Security Researcher at Splunk. Davis stated, "Security teams in Australia and New Zealand (ANZ) are stretched thin, and it's starting to show. Critical projects are being delayed and teams asked to do more with less."

He continued, "What's unique to ANZ is how quickly organisations are moving from awareness to action. Seventy-one percent are ramping up AI investment, not just for threat detection, but to help overburdened teams reclaim time and consistency in day-to-day operations."

Commenting on regional developments in cybersecurity practices, Davis explained, "We're also seeing early traction around Detection as Code or DAC in this region, with a third of ANZ organisations having adopted it. It's an emerging approach to help SOC and engineering teams respond to fast-moving threats. Combine that with growing observability maturity, and ANZ businesses laying down a more resilient foundation, the region is starting to respond to what modern cyber defence demands."

The findings from the "State of Security 2025" report suggest that while organisations globally are facing a combination of internal and external pressures, focused efforts on AI investment, tool integration, and human-centred security operations are shaping the ongoing response to a shifting threat landscape.