Cyberattacks are costing Indian enterprises more and taking longer to recover from. Fortinet’s India Cybersecurity Skills Gap survey, which polled 60 IT and security decision-makers in December 2025, links part of that damage to a shortage of skilled people. Their response is to lean on AI. That choice raises a harder question: who is accountable when AI acts?
94 percent of respondents reported at least one cyberattack they partly attribute to missing skills. 49 percent reported five or more, up from 34 percent a year earlier.
The financial damage is growing too. Among organisations that were hit, 74 percent say attacks cost them more than US$1 million, against 60 percent a year earlier. The mean cost rose to US$2.7 million from US$2.2 million. Recovery is slower as well. 82 percent took a month or longer, and half took four months or more. The mean recovery time is 4.0 months, up from 2.1.
The response: tools first, people second
So what do organisations do after an attack? The most common answer is to buy new AI-enabled security tools, at 61 percent. Mandating certifications and expanding the team follow at 59 percent each. Team expansion was the choice of 76 percent a year earlier, so hiring is losing ground to technology.
Employee awareness programmes fell furthest, to 43 percent from 72 percent. That is a risky cut, because lack of security awareness is the cause respondents name most often, at 63 percent. Insider threats were reported by 29 percent of those attacked, up from 13 percent.
Trust in AI is running ahead of understanding
This shift towards AI comes with a lot of confidence. 95 percent of users are experimenting with AI-powered security. Live use, at 67 percent, is flat from a year ago, so the rise comes from trials. The striking number is how much freedom leaders would give it. 63 percent would trust AI to act independently on core security functions, and a further 25 percent would accept limited oversight. Only 10 percent want significant human oversight.
Yet 52 percent say they struggle to understand and manage the risks AI introduces. 73 percent expect more demand for AI oversight and governance roles within three years. And only 62 percent believe their board is fully aware of AI risk, down from 66 percent.
Ownership is where this lands on the CIO. Asked who drives AI adoption in security, 35 percent name the CIO or IT leadership. Only 13 percent name the CISO or security leadership. If the CIO’s office approves the autonomy, it will also be asked to explain it.
Boards talk about security more than they fund it
That accountability is not abstract. 78 percent say cybersecurity is a business priority for their board to a great extent, but only 58 percent say it is a financial priority to the same degree. Board attention has also eased, with 70 percent reporting more focus than the year before, against 88 percent previously.
The personal stakes are clear. 67 percent say a board member or executive at their organisation has been penalised after an attack. Fines were cited by 50 percent, loss of position by 48 percent and jail time by 13 percent. Even so, 67 percent struggle to get approval for extra security talent, while 97 percent expect their teams to grow.
Why certifications may not close the gap
Hiring is hard, which is part of why AI looks attractive. 68 percent say finding people with AI experience in security is a top recruiting challenge, and 47 percent cannot match what other employers pay, up from 36 percent.
Certifications remain the usual filter. 95 percent prefer certified candidates, and 97 percent would pay for an employee to earn one, up from 82 percent. But look at the reasons. Of those who prefer certifications, 67 percent say they prove familiarity with vendor products. Only 37 percent say certified staff perform better at their jobs, down from 55 percent a year earlier and 72 percent in 2022. A certification shows product knowledge. It does not show results.
How far to trust the numbers
This is a small sample. With 60 respondents, the margin of error is ±12.7 percent, and wider for questions asked only of organisations that were attacked. Small year-on-year moves are noise. The big swings, in recovery time, insider threats and awareness spending, deserve attention.
Technology companies make up 45 percent of respondents, and the report comes from a security vendor. The 94 percent figure covers attacks partly blamed on skills shortages. It does not show how often Indian enterprises are breached overall, and it does not prove that skills caused the attacks.
What a CIO should take from it
Three points follow. First, treat AI autonomy as an accountability decision before a technology one, because the board will ask the CIO’s office for answers. Second, fund oversight roles and employee awareness alongside the tools, since awareness is the cause respondents cite most and the spending they are cutting. Third, ask what a certification actually certifies before using it as a hiring shortcut.
These organisations know the skills gap is costing them. They are covering it with AI before deciding who watches the AI.