“However, as cybersecurity increasingly influences business strategy and becomes a key differentiator, we’re seeing a shift,” he explains in an email interview. Jones says this reflects a broader trend to CISOs as strategic advisors impacting business decisions. “In my view, CISOs need to be increasingly capable of understanding legal principles yet recognize when they need to be seeking genuine legal counsel on a matter,” Lindahl-Wise says. A closer relationship would allow both parties to properly understand the risks and what appropriate responses look like. “CISOs have largely always relied on key business partnerships to succeed,” he says. He adds it may cause more organizations to move security into more traditionally mature hands such as finance or legal.
Below we’ve highlighted key points from the report, bolstered with new insights from our Office of the CISO. By exploiting weak trust boundaries in shared multi-tenant architectures, threat actors such as the ShinyHunters group moved beyond targeting individual schools to attacking the centralized vendors that thousands of institutions rely on. This episode explores the shadowy world of foreign interference, transnational repression, and the alarming rise of youth radicalization within violent extremist movements. Against https://givewebhosting.com/what-is-wcpss-technology.html a backdrop of low trust in government data handling—a sentiment especially pronounced among Māori respondents—the public is strongly backing tougher laws and large fines to hold organizations accountable.
With the limitations outlined above, teams are doing what they can to manage and respond to shadow AI threats wherever possible. Canadian CISOs stood out from the group, believing their biggest barrier to securing the agentic enterprise lies in a lack of an industry standard (65%). Across maturity levels and regional differences, security leaders found common ground in their biggest barriers to securing AI. “I love my teams using AI, but it’s almost like the AI tools are designed to make you want to overshare them.” Outside of breaches, 81% of global security leaders are deeply concerned about excessive AI access not being properly reviewed.
The results highlight critical areas of focus for security leaders, providing valuable insights into how organizations are preparing to navigate emerging threats, regulatory changes, and evolving business demands. This fall, we, at PurePoint International, conducted a survey of CISOs to better understand their challenges, priorities, and strategies for the year ahead. As we move into 2025, the role of the Chief Information Security Officer (CISO) continues to evolve amidst an increasingly complex cybersecurity landscape.
Deloitte offers a unified approach to help you tackle obstacles and build new capabilities fast. They are the foundation upon which you can create a resilient and forward-thinking cybersecurity strategy that not only protects your organization but also empowers it to achieve its objectives. It requires a concerted effort to integrate cyber risk with enterprise and technology risks, ensuring that all stakeholders—including board members, executives, and IA—have a comprehensive understanding of the threat landscape.
The risks and expectations testing enterprise cyber resilience aren’t new, but they’re evolving fast. Responding with urgency requires fresh thinking across capabilities, talent and technology. This is your moment to lead with resilience and build a future in which trust and innovation scale together. That means elevating cyber from control to catalyst, shaping strategy with the C-suite, and translating risk into metrics the whole business understands.
Vulnerability management teams use Cymulate to identify exposures that are not just present but exploitable within their specific environments. This enhances offensive testing capabilities while scaling red team efforts efficiently. The best security professionals understand that the paradigm has shifted. Cymulate can map threat resilience against frameworks like MITRE ATT&CK, giving you easily digestible, strategic reporting that shows where your investments should go next. As an adviser, you often need to balance innovation and speed with safety.
Blocking access when shadow AI is detected isn’t a scalable strategy on its own because it drives usage further underground rather than solving the underlying demand. Governing AI agents through shared credentials or broad-permission service accounts is a legacy human-identity habit that creates unnecessary blast radius when an agent is compromised. US organizations show the highest breach anxiety (84%) and high concern over overprivileged agents (65%), but they’re better positioned for success because a majority of their boards (54%) see security as a business enabler.
Most cybersecurity leaders expect that AI will continue to dominate the cybersecurity conversation in 2026. Jason Ingalls, Chief Cybersecurity Officer at C3 Integrated Solutions, makes a similar point, arguing that strengthening operational decision-making across the cyber lifecycle is key to improving resilience. Key priorities should be implementing zero trust, securing AI use, and moving from static controls to continuous validation of trust and access, Kamane suggests. “Our priority is to focus on security outcomes, performance, and recovery, not on security as an activity.” But if there is a vulnerability, it’s important to have controls in place to prevent attackers from being able to move laterally. https://adeptiv.ai/ai-compliance-platform-guide/ Phishing and social engineering continue to be a top concern for security teams.
Boards play a critical role in building crisis readiness to help companies withstand shocks and recover stronger in a volatile world. Examine the key differences between SEC and DORA reporting requirements. You’re being asked to interpret and operationalize evolving expectations and work closely with the C-suite and board to stay aligned.
Unsurprisingly, the cyber threat landscape continues to evolve as criminals — both organized and state-backed — seek new opportunities to create chaos and extract profit. Just as we were catching up and securing our new IT environment, circumstances changed once more as geopolitical tensions created an increasingly polarized world. Today’s CISO is more frequently involved in strategic conversations and needs a sound understanding of overall business priorities in order to build programmes that manage risk exposure effectively. Finally, CISOs must continue to engage more broadly with business to understand its priorities. They will tap into its analytic powers and automation capabilities to craft proactive and adaptive strategies that reduce their reliance on traditional rules-based detection and manual effort. We also focused heavily on innovations across our security portfolio, designed to deliver stronger security outcomes and enable every organization to make Google a part of their security team.