Cybersecurity teams have more data than ever — so why does insight still feel out of reach?

Most enterprise security functions have solved the data problem. But what they have not yet solved is the insight problem — and the gap between those two things is where risk quietly accumulates. This piece examines why visibility and understanding are not the same capability, what the cost of that gap looks like in practice and what it takes to move from a security function that reports to one that reasons.

Marc Moesse
read

There is a version of cybersecurity that looks, from the outside, like it is working. The dashboards are populated. The reports go out on schedule. The tools are generating data — and plenty of it.

But when the CISO sits down with the board, one question cuts through everything else: "Are our controls actually protecting us?" Not in theory, not in the aggregate, on the systems and assets that matter most right now. For too many, answering that question confidently proves difficult — not because the organization doesn't have the right controls, or because teams are focusing on the wrong priorities, or because the data to prove chosen controls are effective does not exist, but because the path from data to defensible insight has never been properly built.

This is both an outcome of the sheer number of cybersecurity tools available and an insight problem — and the gap between those two things is wider than the industry tends to acknowledge.

More data is a good start. Turning it into insight is the harder part.

The past decade of cybersecurity investment has been, in large part, a bet on data. More tools. More telemetry. More metrics. The logic was sound — if you can see everything, you can protect everything.

Visibility matters enormously in cybersecurity — but seeing everything and understanding anything are genuinely different capabilities.

61 security tools, 58 dashboards, one question nobody can answer with confidence: are our controls working? Source: Panaseer 2026 Security Leaders Peer Report

According to Panaseer's 2026 Security Leaders Peer Report, the average enterprise now runs 61 different security tools and navigates 58 separate dashboards. Each tool comes with its own definitions, its own asset population and its own reporting logic. When you try to aggregate those into a coherent picture of control performance, you don't get clarity — you get conflict.

Different tools report different asset counts. Coverage figures do not reconcile. The number your vulnerability management platform gives you does not match what your endpoint tool reports, and neither agrees with what the configuration management database (CMDB) says should exist.

The result is a security team with enormous volumes of information and a genuine need for something else: a single, trusted picture of what is actually happening.

This is not a marginal inefficiency.

For many organizations, the weeks before a major audit or board report are defined by intensive, manual effort to reconcile data that should already be reconciled, constructing a narrative from sources that do not naturally agree. More than 400 enterprise security leaders told us last year that they spent an average of eight working days prepping for each audit — both internal and external. When cybersecurity functions face around 28 audits every year, the hours very quickly stack up.

The dashboard instinct is well-intentioned. But it tends to compound the problem.

The natural response to a visibility problem is to build more ways of seeing. More dashboards, more views, more ways of slicing existing data. The intent is right — but it tends to create a new challenge of its own.

Organizations layer reporting tool on reporting tool, build environments on top of security information and event management (SIEM) outputs, and create executive scorecards sitting alongside operational dashboards sitting alongside compliance reports — each requiring maintenance, each a potential new source of disagreement.

The result is metric overload — for analysts and leaders alike. What a CISO needs before a board meeting is five metrics they can defend with complete confidence. 30 metrics with varying degrees of certainty is a different kind of pressure, with 30 potential lines of challenge and the cognitive weight of knowing which ones will hold up under scrutiny.

Having a lot of tools is not the same as having control. More tools equal more complexity — and that complexity is leading directly to control gaps and failures.

Panaseer
2026 Security Leaders Peer Report

For years, the industry has attempted to solve the problem by creating more elaborate or complex dashboards. But the question isn't, "How do I get more data into a dashboard?" but, "How do I get the right insight, at the right time, grounded in data I can stand behind?"

What the data-to-insight gap actually costs

It is worth being specific about what this insight gap costs, because the consequences tend to be felt in ways that make them easy to absorb rather than address.

The Panaseer 2026 Security Leaders Peer Report puts numbers to what many already know from experience:

84% of organizations suffered a breach linked to control failures in the past year
54% say control failures go undetected until after an incident occurs
61% say their controls environment is too complex to manage without automation
45% struggle to communicate cyber risk to non-technical stakeholders

Behind each of those numbers is a specific, familiar cost:

Time. Skilled security professionals spending hours every week on manual data reconciliation and analysis, pulled away from the work that actually requires their expertise.

Credibility. The CISO whose numbers differ from what internal audit is seeing, or who cannot defend a metric under board challenge, loses standing. In regulated environments, that erosion is not only uncomfortable but carries real consequences for how the function is perceived and trusted.

Control. When teams are focused on explaining what happened, they are less focused on determining what to do. The gap between knowing and acting widens, and risk reduction slows.

Compliance standing. Regulators — particularly under frameworks like the Digital Operational Resilience Act (DORA) and the Network and Information Security Directive (NIS2) — are asking for evidence of continuous controls assurance. They require proof that controls were working last quarter, last month and last week, and that gaps were identified and addressed as they arose. Retrospective, manually assembled reporting cannot reliably produce that evidence, drawing regulatory scrutiny rather than deflecting it.

Source: Panaseer 2026 Security Leaders Peer Report.

The data is there. The problem is what happens — or doesn't happen — between data and decision, because organizations have failed to get the right information into the hands of the right people.

The shift: from reporting to reasoning

The organizations beginning to close this gap are rethinking what they expect from their security data entirely, often finding that the data they already have can do considerably more than it currently does.

It requires a shift away from simply reporting toward insight and reasoning. From a system that shows you what happened, to one that tells you what it means and what to do next.

This is where AI becomes genuinely relevant to cybersecurity, and specifically to controls assurance.

There's a distinction between a conversational interface that retrieves information and a generative capability that actively reasons over it — finding patterns in your own data, surfacing the changes that matter, connecting control performance across domains and business units, and translating all of it into plain language that a security analyst, a governance, risk and compliance (GRC) lead, a CISO and a board member can each use in their own context.

The difference between a dashboard and insight.

The difference is not cosmetic. A reporting tool answers the question you know to ask; a reasoning capability surfaces the question you did not know you needed to ask — the control domain that has quietly deteriorated, the business unit whose patch compliance has drifted, the combination of gaps that individually look manageable but together create an exploitable path. That is the shift that changes what the security function can offer the rest of the business.

A dashboard presents data well. An analytics AI partner goes further by reasoning over it: asking why a metric shifted, which business units are driving the change, how performance compares to the previous period and what the most impactful next action would be — all grounded in cleansed, normalized and verified controls data.

The output is a defensible, evidence-backed position that moves directly into a board pack, a risk committee update or a remediation brief.

What good generative AI for cybersecurity insights looks like

The security leaders getting ahead of this challenge are treating AI as a reasoning partner, not just a reporting accelerator.

They are asking their systems to do the analytical work — the cross-domain synthesis, the trend identification, the contextual explanation against organizational policies or business needs — so that their teams can focus on decisions and actions rather than data wrangling.

When that shift happens, a few things change:

Board reporting becomes an on-demand capability rather than a quarterly production exercise.
Audit preparation becomes a confident retrieval of data that has been continuously maintained.
The conversation between the security function and the rest of the business moves from "here is a dashboard" to "here is what the data means, and here is what we recommend."

That is essentially what AI-powered cybersecurity insight looks like in practice. The right insight, grounded in trusted data, delivered in the language of the person who needs to act on it.

The gap between where most organizations are today and where they need to be is significant. And it is a gap that better reasoning — applied in the right way to the data already in front of security teams — is well-placed to close.