New ISACA research finds cybersecurity professionals are becoming more involved in AI implementation and policy development, highlighting potential gaps in AI governance. TeamMate’s Sandy Buchanan discusses the implications for cybersecurity and GRC professionals
AI is becoming embedded across organizations, but cybersecurity and GRC professionals are not always involved in implementing the technology or developing the policies governing its use.
That is a key finding from ISACA’s 2026 State of Cybersecurity survey, sponsored by Wolters Kluwer TeamMate. The survey of more than 1,800 cybersecurity professionals worldwide found that only 51% of respondents are involved in developing, onboarding or implementing AI solutions, while 56% said they or someone on their team had helped develop a policy governing AI use.
We spoke with Sandy Buchanan, Lead Product Manager at Wolters Kluwer TeamMate, about the findings. Buchanan brings more than a decade of experience in cybersecurity consulting and GRC. He joined StandardFusion in 2025, before its acquisition by Wolters Kluwer. At StandardFusion, he led GRC practices and explored how automation and generative AI can make security and risk work more effective.
Why was it important for TeamMate to work with ISACA on this year’s State of Cybersecurity research?
ISACA is the premier certification body for GRC and risk management professionals globally. Its State of Cybersecurity report is a must-read for me every year because it gives great insight into the challenges and opportunities colleagues across the industry are facing.
For TeamMate, that insight is important because it helps us understand where we can provide the greatest support to our customers. It gives us a view into where practitioners are feeling pressure, how risks are changing and where technology can make a meaningful difference.
What stood out to you most in this year’s findings?
The gap between how quickly AI is being adopted and how quickly governance and risk practices are adapting around it.
AI has been a major topic for several years, but we are now seeing much broader adoption across businesses, including large enterprises. Organizations are extracting real value from AI, but broader adoption is also changing the risk landscape GRC professionals have to manage.
As AI adoption expands across enterprises, how is that changing the risk and governance challenge?
Organizations need to be able to govern AI risks in a consistent and centralized way. The research shows why that matters. Cybersecurity professionals are increasingly involved in implementing AI solutions and developing policies governing their use, but that involvement is not yet universal.
For GRC teams, AI governance is becoming an increasingly important part of managing organizational risk. Practitioners need visibility into where AI is being used, the risks it introduces, and whether the appropriate governance and controls are in place.
The report highlights continuing challenges around workload, stress and retention. What role could AI and automation play in addressing them?
I expect organizations will increasingly look to AI to help alleviate some of that pressure. There is an opportunity to offload work to AI where it makes sense and help bring employee workloads to more sustainable levels without simply requiring teams to keep growing.
We can already see some movement in that direction. The research found that 35% of cybersecurity teams are increasing their reliance on AI or automation to address technical skills gaps, up 12 percentage points from last year.
For GRC professionals, the goal should be to automate the high-effort, lower-skill parts of managing risk and compliance, allowing practitioners to focus their expertise where it is most valuable: assessing and managing risk to the organization.
What do these findings mean for TeamMate and how you are thinking about supporting customers?
These findings reinforce what we are hearing from customers across Internal audit, risk, and compliance organizations. Practitioners recognize the opportunity AI presents for their teams and organizations and they wish to capture the benefits of AI while maintaining strong governance, transparency, and accountability.
Our focus is on delivering practical, secure AI directly within the workflows professionals use every day. By grounding it in team and organizational context, we can help professionals work more effectively while keeping professional judgment, expertise and oversight at the center.
As AI adoption continues to accelerate, TeamMate is helping customers strengthen governance, leverage trusted organizational context, and turn connected audit and GRC information into better decisions and greater organizational value.