Five Key Actions for CISOs to Take by the End of 2026
As AI-powered cyberattacks accelerate and emerging technologies introduce new security challenges, chief information security officers (CISOs) are being urged to take five strategic actions to strengthen organizational resilience, enhance cyber defenses and prepare for the evolving digital threat landscape.
Cybersecurity leaders are uniquely positioned to influence executive decision-making and board-level strategy, helping organizations navigate risks associated with artificial intelligence, deepfakes and quantum computing.
1. Strengthen Leadership and Authority in AI Safety
Securing AI infrastructure and understanding the interactions between models and their supporting systems are becoming increasingly important. CISOs can guide executive leaders beyond AI hype by establishing internal governance frameworks and driving practical implementation.
As organizations expand their use of AI, cybersecurity leaders have an opportunity to assume a central role in enterprise AI safety and strategic decision-making.
2. Treat Advanced AI Deployments as Insider Risks
A survey of 297 cybersecurity leaders in the second quarter of 2026 found that 54% of organizations had no defined approach to limiting AI agent access or relied on predefined human access controls.
AI systems do not need to achieve artificial general intelligence to pose significant cybersecurity risks. The ability to affect enterprise operations can be enough to create serious exposure.
Organizations should govern autonomous, multi-agent systems according to their action privileges rather than their intelligence. They should also use guardian agents to safeguard AI-driven workflows and limit the potential impact of unintended or malicious actions.
3. Move Beyond Recognition as Proof of Identity
Deepfake threats have become increasingly widespread, forcing organizations to reconsider how identities are verified and decisions are authorized.
CISOs should lead enterprise-wide process redesign to ensure that visual or voice recognition alone is not accepted as sufficient proof of identity or authorization.
A multilayered security approach should combine deepfake detection technologies with contextual signals, additional authentication measures and content provenance checks to protect organizations' digital identities and brands.
4. Invest in Proactive Cybersecurity Capabilities
Artificial intelligence is reducing the time and expertise attackers need to exploit organizational vulnerabilities.
In a second-quarter 2026 survey of more than 300 enterprise risk leaders, 76% of CISOs ranked AI-driven discovery of cyber vulnerabilities among their top 10 emerging risks.
Traditional detection and response capabilities are no longer sufficient on their own. Organizations should prioritize proactive measures, including automated moving target defense, advanced obfuscation, deception technologies and predictive threat intelligence, to identify and mitigate risks before attacks succeed.
5. Begin Preparing for Postquantum Cryptography
Organizations that delay piloting postquantum cryptography (PQC) until after 2026 could face significantly higher migration costs. One industry forecast estimates that organizations failing to begin pilot programs by 2027 could incur at least 200% higher costs for full migration.
A survey of cybersecurity leaders found that 51% had not yet started any PQC-related activities.
Preparing for the postquantum era requires more than a technical upgrade. Organizations need to assess cryptographic dependencies, identify sensitive data and develop migration strategies to address threats such as harvest now, decrypt later (HNDL) and harvest now, forge later (HNFL).
Early planning and testing can help organizations protect sensitive information and maintain long-term cryptographic resilience.
Building Cyber Resilience Beyond 2026
As AI adoption accelerates and quantum computing advances, cybersecurity leaders must move beyond reactive defense toward a proactive, strategic approach. Strengthening AI governance, controlling autonomous systems, modernizing identity verification, investing in preemptive defenses and preparing for postquantum cryptography will be essential to managing emerging risks and protecting the enterprise.
Source: Gartner