Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity.
Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agenda, introducing novel attacks, broadening the attack surface to include AI infrastructure, and presenting governance and security control challenges and complications — especially as agentic systems come online.
As a result, 68% of security leaders report that their roles have become more stressful over the past five years, according to the 2026 State of Cybersecurity survey from ISACA, with 71% of CISOs citing the increasingly complex threat landscape as their main stressor, up from 63% in 2025.
Moreover, the introduction of Mythos-class AI models has 50% of CISOs considering exiting the profession entirely, according to a recent survey from Absolute.
To tackle this increasingly complex and intense security environment, security leaders must sharpen their strategies — and their teams’ skills — around the most pressing issues they and their CISO colleagues are facing today.
To help with that, we spoke with security chiefs and cyber experts to identify the seven biggest issues CISOs need to address, with insights on how to tackle the challenges.
1. Preventing compromise — with increased emphasis on resilience and recovery
Although CISOs are increasingly taking on governance responsibilities and business risk mandates, broadening their remit, Kyle McMillan, chief cybersecurity officer at Siemens USA, says all the work in the security organization is still “framed in the context of preventing a compromise.”
It’s a monumental task, McMillan says, as there’s no one formula for the right defense that will work for every CISO. Rather, CISOs must know the specific risk profile of their organizations, the specifics of their IT environment, and the general threat landscape, as well as any threats particular to their industry — and then use all that to formulate a unique plan of defense based on the resources available.
“And there are always trade-offs to be made,” McMillan adds.
While it’s true that thwarting attacks as much as possible and minimizing the damage in the event of a successful breach has always been job No. 1 for CISOs, research shows it’s one they continue to struggle with. The State of Incident Response Readiness, a 2026 report from security software maker Sygnia, found that 73% of CISOs weren’t fully ready for a major cyberattack.
That — and the rise of AI-assisted attack volumes and speed — is contributing to a mindset shift from prevention to resilience. Yes, prevention remains job No. 1, but ensuring business continuity and resilience in the event of an incident is becoming a key emphasis and addition to CISOs’ playbooks. That means honing incident response plans, conducting more relevant tabletop exercises, and sharpening team operations to accelerate cyber recovery.
According to Foundry’s forthcoming Security Priorities Study, 69% of security leaders are currently undertaking this shift.
2. Leading a security program aligned with the organization’s specific needs
One of the biggest issues CISOs continue to face is accurately assessing their organization’s processes, infrastructure, and risk profile and then building a program tailored to their unique security requirements, says Ira Winkler, veteran cybersecurity leader and now CEO and program director of CruiseCon, which offers professional education for security leaders.
“CISOs are not monoliths,” Winkler points out. Some CISOs struggle to patch all the critical vulnerabilities in their environments fast enough, whereas others struggle to tackle essential work with the staff and budgets they have; still others find themselves falling short in taking a strategic approach to their role.
What this often boils down to is a leadership issue. Setting the right security strategy aligned to your specific business, managing resources well, and ensuring teams can execute on the details remain key leadership skills security leaders must develop — both for themselves and their deputies.
For Winkler, this is evidenced by the systems, processes, and controls a CISO puts in place and how well those help the organization as a whole respond to change.
“The quality of a CISO depends on the quality of the systems they put in place on a daily basis,” he says, adhering to the adage that a good cyber security program is like a ship, in that the CISO must build a program capable of sailing forward and staying afloat regardless of the issues that arise.
“You’re always going to deal with something; there’s always something happening,” he says, “so the question is do you have a system in place so that it’s just a little wave pushing you off course or do you not have it in place and it’s going to feel like a large wave? Good CISOs understand the processes they manage and understand what type of operational and technical tools can secure those processes with the resources they have.”
Winkler says CISOs who build seaworthy ships capable of navigating even without a captain on the bridge are at the top of their game.
3. Rethinking cybersecurity for the AI era
To defend against the rise of AI-fueled attacks, CISOs must now design a security program capable of effectively using AI. Alex Levy, CISO of BNSF Railway and the inaugural TIME + Commvault CISO of the Year, lists that as one of the most consequential issues for security leaders today.
Levy is creating a security program for a world where hackers of even moderate skills can use AI to launch the types of sophisticated attacks previously created and executed only by highly resourced nation-state actors. And, Levy notes, his security program must be able to respond to attacks that can be created and launched at a staggeringly fast pace, thanks to AI.
That has put the pressure on him and other CISOs to integrate AI into their security departments, to help speed and scale their capacity to fight these AI-enabled attacks. That includes not only embracing the tools but also preparing teams to collaborate with agentic AI.
Marty Barrack, CISO and chief legal and compliance officer at healthcare IT company XiFin, sees the rise of AI forcing CISOs to rethink the full gamut of their security strategies.
“AI is affecting security on so many different levels that it has made the CISO job a very difficult job,” says Barrack, who is also a member of the ISACA Emerging Trends Working Group. “That is really driving how CISOs think about patching and end of life and thinking about automation and using tools and prioritizing. It’s a totally different environment now. You can’t do things the way you did one, two, three years ago. We ask about any repetition task how we can automate it or reduce the burden on the team while getting the business risk addressed.”
4. Securing AI use and AI infrastructure
Doug Kersten, CISO of tech company Appfire, points out another key issue he is facing: securing the AI increasingly being deployed by his company.
The vast majority of CISOs are in the same boat. According to the Proofpoint’s 2026 Voice of the CISO report, 78% of global CISOs believe generative AI use is a security risk to their organization and 88% list enabling the safe use of AI assistants, copilots, and automation technologies as a top priority for the next two years.
Kersten is collaborating with his company’s AI council, the chief legal officer, head of IT operations, and the engineering team to ensure the AI governance policies set by leadership are followed throughout the organization. Together, they’ve also appointed AI leads in every department to train their colleagues on governance and to ensure that any new AI tools used within their departments fall within the approved safe use standards and guidelines set by security.
Kersten also monitors for unauthorized use of AI, which CISOs also cite as a big issue, with 68% of CISOs having found unauthorized AI use in their organization, according to the Okta’s Global CISO Insights 2026 report.
Moreover, CISOs need to strategize how to secure their organizations’ AI operations and AI infrastructure, including the very tricky task of securing and controlling AI agents. To protect these newer, growing attack surfaces, 43% of CISOs report increasing their investment in AI security posture management (AI-SPM) tools, topping Foundry’s Security Priorities list, with 34% of CISOs also saying that securing agentic AI is a key area their teams need to develop greater expertise with over the next 12 months, No. 2 to cloud security.
5. Addressing skills gaps — for today and tomorrow
Speaking of expertise, another top issue for CISOs is ensuring their teams have the skills needed to secure the organization now and into the future.
“The first issue I would put on the table is whether security teams have the skills and capacity to do everything being asked of them. A CISO can have a talented team and still face a serious gap in a particular area, whether that is cloud security, AI security, risk assessment, or responding to a new kind of attack,” says Casey Marks, COO of ISC2.
He points to ISC2’s 2025 Cybersecurity Workforce Study, which found that 95% of security professionals reported at least one cybersecurity skill need.
Meanwhile, the ISACA survey found that 58% of organizations believed their cybersecurity team is understaffed, up from 55% in 2025. And cybersecurity leaders reported skills gaps among their team, including in soft skills (57%), LLM SecOps (45%), cloud computing (31%), data security (31%), and ML SecOps (31%).
McMillan says the only way he can execute his security strategy is by having a workforce equipped with the necessary skills. He admits he’d “love to hire a stable of cybersecurity unicorns, people who are well suited to everything they lay their hands to, but they don’t exist.” Instead, he hires people who can “grow and develop as fast as the market evolves” and have a solid tech background, understand the company and what it does, and have strong interpersonal skills.
McMillan also works to create an environment where people can grow and develop to ensure staffers can upskill as needed. “A large part of my day to day is spent trying to create these spaces for teams and individuals to have [learning] exchanges and opportunities,” he adds.
The ISACA survey found that to build and maintain their teams, 68% of cybersecurity leaders said they’re offering cybersecurity team members professional development training (up from 60% last year), paying for certification fees (61%, up from 54% in 2025), and paying for certification maintenance fees (59%, up from 52%).
6. Establishing agile security practices and teams to keep pace
The pace of security today is another top issue for security leaders and their teams. The velocity of attacks, the increasingly shorter required response time, and rapidly evolving IT landscape all put pressure on security pros to move ever faster, says Jenai Marinkovic, CISO/CTO for Tiro Security and a member of the ISACA Emerging Trends Working Group.
“The entire incident response process has been turned on its head,” she says. “We no longer have hours to respond. AI-driven attacks are happening sub five minutes, where they can get in, identify the one place in the environment they can exploit, find where it’s not backed up, and execute a ransomware attack.”
Barrack also cites the need for security to move increasingly faster all the time as one of the biggest issues the profession faces today.
“Month to month, companies come out with new direction, new tools, new functions, and new features that have to be considered by security. There are so many innovations, and you just have to keep up. It takes a personal commitment and good prioritization processes and skilled people on your team,” he says.
7. Being flawless at the fundamentals
While AI is transforming everything, including how enterprise security teams operate, CISOs can’t let up on any of the longstanding fundamental practices that form the foundation of the security function.
“It’s easy to chase the shiny new object, and there will always be a shiny new object in cybersecurity, but you can’t fall off those basic principles,” says Grant Yacomeni, CISO at tech company Gigamon. “That includes vulnerability management, identity management, cryptography, supply chain management, endpoint protection. Those basic foundational tasks remain important.”
Yacomeni acknowledges that being flawless at the fundamentals — a longstanding core tenet in cybersecurity — is tough. “It’s not easy. Cybersecurity is not an easy career field, it’s not an easy job,” he says.
To ensure he gets the fundamentals right, Yacomeni leans on prioritizing work and building processes, using his Lean Six Sigman skills (he’s a Green Belt) to succeed in those tasks.
“I don’t like firefighting. I don’t want a simple thing to become a massive thing,” he explains. “But it is easier to say that than do it. So developing processes and people [is critical]. You have to lay the foundation with talented, passionate people who want to be there, processes, policies and measuring your effectiveness. And even if your [security function is] mature, the organization and the threat landscape are always changing, so you have to always be making micro-adjustments and improving over time.”
No Responses