ISACA’s State of Cybersecurity 2026 survey of more than 1,800 security professionals contains a finding that is easy to overlook. Among respondents with understaffed teams, 39% still conduct cyber-risk assessments only once a year. Overstaffed teams assess more often.
The report explains why. The two biggest obstacles to running an assessment are the time it takes (35%) and not having enough people to do it (29%). Fifty-eight percent of respondents say their security team is understaffed, and the median team is still eight people.
Put those together and cadence stops looking like a discipline problem. It’s a labor problem. How often a team assesses depends on how many people it has.
Hiring won’t close that gap soon. Forty-nine percent of respondents report unfilled security roles, and 24% say a non-entry-level role takes more than six months to fill. So, teams are turning to automation. Thirty-five percent now name greater reliance on AI or automation as their main way to close technical skill gaps, up from 23% a year ago.
That’s the right instinct. But the same survey shows why automation alone won’t rescue the teams that need it most.
The controls ask for a rhythm
I pulled NIST’s machine-readable OSCAL release of the SP 800-53 Rev 5 catalog and baselines. The moderate baseline selects 287 controls. Filtering to the ones a network policy plane enforces or evidences — boundary protection, flow enforcement, remote access, internal connections, information exchange, network disconnect, traffic monitoring — leaves roughly two dozen. That slice is my own, drawn by hand; NIST publishes no such mapping. The members are familiar: SC-7 Boundary Protection, AC-4 Information Flow Enforcement, CA-9 Internal System Connections, SI-4(4) Inbound and Outbound Communications Traffic.
Six of those carry an organization-defined frequency or time period. SI-4(4) has two on its own.
A frequency parameter changes the obligation. Once an organization fills in that blank, it’s no longer asserting a state. It’s asserting a rhythm. A rhythm can’t be shown with a screenshot; it needs a record that spans time.
The profession is moving the same way. ISACA’s updated IT Audit Framework widened the audit’s scope to include continuous assurance, and Mary Carmichael describes the shift as a move from periodic review toward ongoing insight. FedRAMP 20x goes further. A provider seeking Class C certification must supply at least six months of history for every applicable Key Security Indicator. Not a snapshot at submission. Six months of trend.
Gap one: getting the automation
The tooling to meet this exists. Continuous controls monitoring platforms, OSCAL-native compliance tools and cloud configuration history can keep results over time and test them against a committed interval. Cloud providers publish reference architectures for exactly this.
But the ISACA survey suggests tools aren’t the main barrier. The cost of tools (18%) and lacking the right tools (18%) rank well behind time and people. Fifty-five percent say their security budget is underfunded. Building a continuous-assurance pipeline takes engineering time: connecting sources, defining intervals, maintaining integrations. That’s time an eight-person team is already spending on the assessment itself.
Overstaffed teams already assess more often and have room to build. Teams stuck in an annual cycle are the least able to automate their way out of it.
Gap two: trusting the automation
Adopting automation doesn’t end the labor. It moves it.
FedRAMP’s guidance to 20x assessors is blunt: “Automation is not proof by itself.” Assessors are told to test whether validation runs at the stated cadence, covers the full scope and gives consistent results. They are also told to scrutinize evidence from tools nobody can explain.
That is the new work. Someone must understand the pipeline well enough to vouch for it: that a missed run shows up as a gap rather than silence, that scope has not drifted, that the interval being checked is the one committed to in the security plan. Automated evidence is only as trustworthy as the people who can explain how it was produced. A system’s report on itself is just another output you have to trust.
The survey shows how thin that capacity is. AI now automates routine security tasks at 40% of enterprises, up 12 points in a year. Yet only 8% run AI-related incident response exercises regularly, and LLM SecOps is now the second-largest skill gap at 45%, up from 33%. The report’s own conclusion is plain: Adoption is outpacing readiness, and AI hasn’t reduced the need for skilled practitioners or human oversight.
This also answers a newer concern. ISACA’s audit evidence discussion has turned to whether a submitted artifact can be authenticated at all. A machine-generated series with clear provenance survives that question. A screenshot doesn’t. But the series only survives if someone can explain the machine.
The cost nobody is counting
There is a quieter risk in the report’s conclusion. As routine work becomes automated, new professionals get fewer chances to build hands-on skills. Forty-two percent of respondents already manage staff with fewer than three years of experience.
The people best equipped to verify automated evidence are the ones who once gathered it by hand. They know what a missed scan looks like, where scope quietly shrinks and which exports mislead. Automate that work away without a plan to teach it, and the pool of people who can check the automation shrinks too.
What closing it looks like
For the adoption gap, start small, with the controls that carry frequency parameters. Keep every result by control and timestamp and store the interval the security plan committed to right next to it. That pairing is what makes a missed check visible: A missed scan leaves no record of its own. It’s a narrow, affordable place to begin.
For the trust gap, treat the pipeline as something to assess, not just something that produces assessments. Document how it works, test it against the cadence it claims and make sure more than one person can explain it. Use it to teach junior staff what the evidence means, not just where it lives.
Among the lessons FedRAMP published from its 20x pilot is that trending validation data over time builds confidence in a provider’s security program. Not the scan. The trend.
ISACA’s survey reaches the same place from the practitioner’s side. Teams that can’t staff their way to a faster cycle are telling us the cycle is set by how long it takes to gather evidence, and increasingly by how few people can vouch for it.
Build the record. Then keep the people who can read it.
Harshad Sadashiv Kadam is a senior infrastructure security engineer at Indeed, where he architects zero trust, SASE and edge-native security across multi-cloud infrastructure at enterprise scale. He builds open source security tools, including MCP Threat Trap. KubeTrap and FlareGuard, and speaks at security conferences on AI security, deception engineering and edge infrastructure. A CISM-certified practitioner, he serves on ISACA’s Emerging Trends Working Group and Academic & Workforce Development Advisory Group and is founding chapter lead of AI Security Engineers Austin.
——————————————————-
Click Here For The Original Source.
