On October 12, 2026, Gartner published its first Hype Cycle for AI-Driven Cybersecurity. It maps how security teams use AI in their own programs, from AI SOC agents to AI in cyber-risk management. Akto is named a Sample Vendor in two of its innovation profiles: AI Runtime Defense and AI Security Testing.
Both categories apply AI to the job of protecting AI applications and agents. Gartner places them under application security, where generative AI first shows up as specialized runtime defense and security testing for the new attack surface that AI applications and agents create. AI security testing automatically generates and runs adversarial prompts against an AI application before it ships. AI runtime defense applies intent-based policy and anomaly detection to models and agents once they are live.
What the report covers
Gartner published two Hype Cycles on the same day. The Hype Cycle for Secure AI covers how to protect the AI an organization adopts and builds. The Hype Cycle for AI-Driven Cybersecurity covers how security teams can use AI to run their own programs, from AI SOC agents and AI usage control to AI in cyber-risk management.
The report is frank about value. Gartner notes that the most frequent question it has been asked about AI in cybersecurity for more than three years is which use cases work best, a sign of both interest and lasting uncertainty. In its survey data, 58% of cybersecurity leaders say generative AI delivers significant innovation today, while 72% say GenAI features and products are far too expensive for the value they provide.
That cost gap is pushing teams to build. Gartner reports that 63% of organizations saw significant improvement from generative AI by working with existing AI teams through cybersecurity AI enablement initiatives (40%) or by building AI cybersecurity solution engineering functions with dedicated in-house engineers (24%). Only 26% of cybersecurity teams plan to rely exclusively on off-the-shelf GenAI.
AI built for security is an attack surface too
Gartner calls the temptation to build ambitious custom AI tools both compelling and dangerous. AI-assisted development lowers the barrier to building an app, but the report stresses that it does not remove the need for architecture, governance, testing, and life cycle management. It warns that "vibe coding" creates technical debt that teams without dedicated resources cannot sustain.
Security is part of that debt. A SOC agent that reads alerts, a triage assistant that queries ticketing systems, or a policy chatbot that answers employee questions all take untrusted input and many call tools. If an attacker can plant instructions in an alert, an email, or a document the agent reads, the agent can be turned against the team that built it.
The report makes the link to securing AI applications directly. In its profile on AI cybersecurity solution engineering, Gartner notes that building AI engineering capabilities in-house gives security teams a direct opportunity to test their own guidance on securing AI applications.
The report also flags a budget risk. Another planning assumption in the report says that by 2029, one in five material cybersecurity incidents will result from C-level executives shifting funds from essential cybersecurity controls to AI-driven initiatives. New AI projects need security budgets of their own, without draining the controls already in place.
Where AI runtime defense and AI security testing fit
The report places AI runtime defense and AI security testing under application security, as the specialized controls that secure the new attack surface AI applications and agents create.
AI Runtime Defense | AI Security Testing | |
|---|---|---|
Benefit rating | High | Moderate |
Position on the curve | Peak of Inflated Expectations | Innovation Trigger, climbing toward the Peak |
Years to mainstream adoption | 2 to 5 | 5 to 10 |
Market penetration | 5% to 20% of target audience | 5% to 20% of target audience |
AI security testing here means testing AI systems themselves, with adversarial prompts and scans of AI components. It is a different profile from agentic application security testing, which uses LLMs to scan application code and appears separately on the same Hype Cycle.
Akto covers both of the profiles it is named in. On the testing side, it uses AI to run scans and adversarial probing against internally built AI applications and agents before they ship.
On the runtime side, it uses AI to apply runtime controls: it enforces guardrails, applies least privilege on each agent action, adds MCP security controls, and shows what agents do as they execute. That applies to a security team's own agents as much as to customer-facing ones.
What the report advises for AI-driven security programs
Gartner's recommendations for building AI-driven security capabilities apply directly to securing AI applications and agents. We map four of them below.
Think big, start small, measure often. Gartner warns that many end-to-end AI security solutions look great on slides, and advises small steps that each deliver measurable progress. For AI security, that means starting with the agents exposed to untrusted input, testing them, and extending runtime controls one agent at a time.
Separate AI engineering from vibe coding. Gartner recommends dedicated AI engineering resources and a commitment to maintain what teams build. Adversarial testing and runtime controls belong in that life cycle, as they would for any production application.
Close gaps before replacing tools. Gartner advises prioritizing projects that close gaps over those that replace existing practices or tools. AI security testing and runtime defense fill that kind of gap. The companion Secure AI report notes that existing application security tools have not yet fully evolved to include AI-specific tests.
Define metrics before and after. Gartner recommends success metrics aligned with cybersecurity objectives that teams can measure before and after an AI implementation. For AI security, track how often adversarial tests succeed and the false-positive and false-negative rates of runtime controls.
A six-month review checklist
The report's third planning assumption favors short cycles. By 2028, Gartner expects organizations using six-month AI roadmap reviews to secure 25% more cybersecurity funding and double the project success rates of traditional three-year plans. Its advice for solution engineering follows the same idea: think big, start small, measure often.
We'd add these security questions to each six-month review:
Is every AI tool the team built or adopted since the last review in the inventory?
Has each one been tested since its last change to prompts, models, or tools?
Which agents gained new tools, MCP connections, or permissions, and were those reviewed?
Do runtime controls cover every agent in production, and what are their false-positive rates?
Did any AI project pull budget from an existing security control?
Which milestones delivered measurable progress, and which pilots should stop?
Akto's Gartner recognition in 2026
Akto is also named a Sample Vendor in both categories in the companion report published the same day, the Hype Cycle for Secure AI, 2026.
Earlier this year, Akto was named a Pioneer in the 2026 Gartner Emerging Market Quadrant for AI Application Security, Startup Vendors. It was also named a Sample Vendor for AI Security Testing in the Hype Cycle for AI Services, 2026, and for AI Runtime Defense in the Hype Cycle for AI Governance Technologies, 2026, and the Hype Cycle for Data Security Technologies, 2026.
Link to the report - Hype Cycle for AI-Driven Cybersecurity, 2026
Source: Gartner, Hype Cycle for AI-Driven Cybersecurity, 2026, Jeremy D'Hoinne, Craig Porter, Josh Murphy, Christine Lee, 12 October 2026.
Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. GARTNER is a registered trademark and service mark, and HYPE CYCLE is a registered trademark, of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved.
Experience enterprise-grade Agentic Security solution