Cybersecurity responders say a sustained surge in attacks and AI-discovered software flaws is leaving teams swamped, with some investigations now requiring five to 20 people. The strain is not just a technical arms race: it is landing on the people tasked with sorting real threats from a growing pile of alarms and failed exploits.
Watch Desk analysis
What happened
In a report published on 30 October, Axios describes a relentless workload for incident-response and threat-intelligence teams. Palo Alto Networks’ Troy Bettencourt told the outlet demand for his team’s services had risen by double digits over the previous six weeks. Investigations that one consultant could once handle now take teams of five to 20, he said.
Armadin’s Samantha Lewis told Axios that her team spent days sorting through hundreds of purported exploits related to AI-discovered flaws, many of which did not work. The report says firms are shifting staff into incident response and exploring AI and automation to help investigate threats. It also notes workers’ concern that the tools meant to ease the load could eventually replace them.
Why it matters
Finding software weaknesses faster does not automatically make them easier to defend against. Security teams still have to determine which reports are credible, which systems are exposed and which attacks pose a real danger. That triage takes skilled people, and the report describes teams already struggling to keep pace.
The tension is particularly sharp when automation is presented as the answer to overwork while staff fear it may make their jobs less secure. AI may help defenders process the flood, but it does not make the workload or the people carrying it disappear by magic. Annoying, but still true.
Our read
This is a people story about a technical shift, not evidence that every cyber incident is caused by AI. The concrete warning is that faster discovery and more threat data can create more work for defenders before automation meaningfully reduces it. Security leaders should measure whether new tools cut investigation time and false alarms, rather than treating “AI-powered” as a staffing plan.
What to watch
- Whether incident-response demand continues rising, and how firms staff for it.
- Whether automation reduces time spent checking false or ineffective exploit reports.
- Whether workers’ fears about replacement affect adoption of the tools intended to help them.
Discussion spark: If AI helps generate more vulnerability reports than security teams can assess, should companies prioritise automated triage, or invest first in more human responders?
Sources and evidence
- The humans burning out on AI's cyber frontlines (30 October 2026, 08:45 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.