{"id":9976,"date":"2026-10-12T08:25:00","date_gmt":"2026-10-12T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9976"},"modified":"2026-10-12T08:25:00","modified_gmt":"2026-10-12T08:25:00","slug":"the-7-biggest-issues-cisos-and-security-teams-face-today","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9976","title":{"rendered":"The 7 biggest issues CISOs and security teams face today"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity.<\/p>\n

Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agenda, introducing novel attacks, broadening the attack surface to include AI infrastructure, and presenting governance and security control challenges and complications \u2014 especially as agentic systems come online.<\/p>\n

As a result, 68% of security leaders report that their roles have become more stressful over the past five years, according to the 2026 State of Cybersecurity survey from ISACA<\/a>, with 71% of CISOs citing the increasingly complex threat landscape as their main stressor, up from 63% in 2025.<\/p>\n

Moreover, the introduction of Mythos-class AI models has 50% of CISOs considering exiting<\/a> the profession entirely, according to a recent survey from Absolute.<\/p>\n

To tackle this increasingly complex and intense security environment, security leaders must sharpen their strategies \u2014 and their teams\u2019 skills \u2014 around the most pressing issues they and their CISO colleagues are facing today.<\/p>\n

To help with that, we spoke with security chiefs and cyber experts to identify the seven biggest issues CISOs need to address, with insights on how to tackle the challenges.<\/p>\n

1. Preventing compromise \u2014 with increased emphasis on resilience and recovery<\/h2>\n

Although CISOs are increasingly taking on governance responsibilities and business risk mandates<\/a>, broadening their remit<\/a>, Kyle McMillan, chief cybersecurity officer at Siemens USA, says all the work in the security organization is still \u201cframed in the context of preventing a compromise.\u201d<\/p>\n

It\u2019s a monumental task, McMillan says, as there\u2019s no one formula for the right defense that will work for every CISO. Rather, CISOs must know the specific risk profile of their organizations, the specifics of their IT environment, and the general threat landscape, as well as any threats particular to their industry \u2014 and then use all that to formulate a unique plan of defense based on the resources available.<\/p>\n

\u201cAnd there are always trade-offs<\/a> to be made,\u201d McMillan adds.<\/p>\n

While it\u2019s true that thwarting attacks as much as possible and minimizing the damage in the event of a successful breach has always been job No. 1 for CISOs, research shows it\u2019s one they continue to struggle with. The State of Incident Response Readiness<\/a>, a 2026 report from security software maker Sygnia, found that 73% of CISOs weren\u2019t fully ready for a major cyberattack.<\/p>\n

That \u2014 and the rise of AI-assisted attack volumes and speed \u2014 is contributing to a mindset shift from prevention to resilience. Yes, prevention remains job No. 1, but ensuring business continuity and resilience in the event of an incident<\/a> is becoming a key emphasis and addition to CISOs\u2019 playbooks. That means honing incident response plans<\/a>, conducting more relevant tabletop exercises<\/a>, and sharpening team operations to accelerate cyber recovery<\/a>.<\/p>\n

According to Foundry\u2019s forthcoming Security Priorities Study, 69% of security leaders are currently undertaking this shift.<\/p>\n

2. Leading a security program aligned with the organization\u2019s specific needs<\/h2>\n

One of the biggest issues CISOs continue to face is accurately assessing their organization\u2019s processes, infrastructure, and risk profile and then building a program tailored to their unique security requirements, says Ira Winkler, veteran cybersecurity leader and now CEO and program director of CruiseCon, which offers professional education for security leaders.<\/p>\n

\u201cCISOs are not monoliths,\u201d Winkler points out. Some CISOs struggle to patch all the critical vulnerabilities in their environments fast enough, whereas others struggle to tackle essential work with the staff and budgets they have; still others find themselves falling short in taking a strategic approach to their role.<\/p>\n

What this often boils down to is a leadership issue. Setting the right security strategy aligned to your specific business, managing resources well, and ensuring teams can execute on the details remain key leadership skills security leaders must develop \u2014 both for themselves<\/a> and their deputies<\/a>.<\/p>\n

For Winkler, this is evidenced by the systems, processes, and controls a CISO puts in place and how well those help the organization as a whole respond to change.<\/p>\n

\u201cThe quality of a CISO depends on the quality of the systems they put in place on a daily basis,\u201d he says, adhering to the adage that a good cyber security program is like a ship, in that the CISO must build a program capable of sailing forward and staying afloat regardless of the issues that arise.<\/p>\n

\u201cYou\u2019re always going to deal with something; there\u2019s always something happening,\u201d he says, \u201cso the question is do you have a system in place so that it\u2019s just a little wave pushing you off course or do you not have it in place and it\u2019s going to feel like a large wave? Good CISOs understand the processes they manage and understand what type of operational and technical tools can secure those processes with the resources they have.\u201d<\/p>\n

Winkler says CISOs who build seaworthy ships capable of navigating even without a captain on the bridge are at the top of their game.<\/p>\n

3. Rethinking cybersecurity for the AI era<\/h2>\n

To defend against the rise of AI-fueled attacks, CISOs must now design a security program capable of effectively using AI. Alex Levy, CISO of BNSF Railway and the inaugural TIME + Commvault CISO of the Year<\/a>, lists that as one of the most consequential issues for security leaders today.<\/p>\n

Levy is creating a security program for a world where hackers of even moderate skills can use AI to launch the types of sophisticated attacks previously created and executed only by highly resourced nation-state actors. And, Levy notes, his security program must be able to respond to attacks that can be created and launched at a staggeringly fast pace, thanks to AI.<\/p>\n

That has put the pressure on him and other CISOs to integrate AI into their security departments, to help speed and scale their capacity to fight these AI-enabled attacks. That includes not only embracing the tools<\/a> but also preparing teams to collaborate with agentic AI<\/a>.<\/p>\n

Marty Barrack, CISO and chief legal and compliance officer at healthcare IT company XiFin, sees the rise of AI forcing CISOs to rethink the full gamut of their security strategies<\/a>.<\/p>\n

\u201cAI is affecting security on so many different levels that it has made the CISO job a very difficult job,\u201d says Barrack, who is also a member of the ISACA Emerging Trends Working Group. \u201cThat is really driving how CISOs think about patching and end of life and thinking about automation and using tools and prioritizing. It\u2019s a totally different environment now. You can\u2019t do things the way you did one, two, three years ago. We ask about any repetition task how we can automate it or reduce the burden on the team while getting the business risk addressed.\u201d<\/p>\n

4. Securing AI use and AI infrastructure<\/h2>\n

Doug Kersten, CISO of tech company Appfire, points out another key issue he is facing: securing the AI increasingly being deployed by his company.<\/p>\n

The vast majority of CISOs are in the same boat. According to the Proofpoint\u2019s 2026 Voice of the CISO report<\/a>, 78% of global CISOs believe generative AI use is a security risk to their organization and 88% list enabling the safe use of AI assistants, copilots, and automation technologies as a top priority for the next two years.<\/p>\n

Kersten is collaborating with his company\u2019s AI council, the chief legal officer, head of IT operations, and the engineering team to ensure the AI governance policies<\/a> set by leadership are followed throughout the organization. Together, they\u2019ve also appointed AI leads in every department to train their colleagues on governance and to ensure that any new AI tools used within their departments fall within the approved safe use standards and guidelines set by security.<\/p>\n

Kersten also monitors for unauthorized use of AI, which CISOs also cite as a big issue, with 68% of CISOs having found unauthorized AI use in their organization, according to the Okta\u2019s Global CISO Insights 2026 report<\/a>.<\/p>\n

Moreover, CISOs need to strategize how to secure their organizations\u2019 AI operations<\/a> and AI infrastructure<\/a>, including the very tricky task of securing and controlling AI agents<\/a>. To protect these newer, growing attack surfaces, 43% of CISOs report increasing their investment in AI security posture management (AI-SPM) tools<\/a>, topping Foundry\u2019s Security Priorities list, with 34% of CISOs also saying that securing agentic AI is a key area their teams need to develop greater expertise with over the next 12 months, No. 2 to cloud security.<\/p>\n

5. Addressing skills gaps \u2014 for today and tomorrow<\/h2>\n

Speaking of expertise, another top issue for CISOs is ensuring their teams have the skills needed to secure the organization now and into the future.<\/p>\n

\u201cThe first issue I would put on the table is whether security teams have the skills and capacity to do everything being asked of them. A CISO can have a talented team and still face a serious gap in a particular area, whether that is cloud security, AI security, risk assessment, or responding to a new kind of attack,\u201d says Casey Marks, COO of ISC2.<\/p>\n

He points to ISC2\u2019s 2025 Cybersecurity Workforce Study<\/a>, which found that 95% of security professionals reported at least one cybersecurity skill need.<\/p>\n

Meanwhile, the ISACA survey found that 58% of organizations believed their cybersecurity team is understaffed, up from 55% in 2025. And cybersecurity leaders reported skills gaps among their team, including in soft skills (57%), LLM SecOps (45%), cloud computing (31%), data security (31%), and ML SecOps (31%).<\/p>\n

McMillan says the only way he can execute his security strategy is by having a workforce equipped with the necessary skills. He admits he\u2019d \u201clove to hire a stable of cybersecurity unicorns, people who are well suited to everything they lay their hands to, but they don\u2019t exist.\u201d Instead, he hires people who can \u201cgrow and develop as fast as the market evolves\u201d and have a solid tech background, understand the company and what it does, and have strong interpersonal skills.<\/p>\n

McMillan also works to create an environment where people can grow and develop to ensure staffers can upskill as needed. \u201cA large part of my day to day is spent trying to create these spaces for teams and individuals to have [learning] exchanges and opportunities,\u201d he adds.<\/p>\n

The ISACA survey found that to build and maintain their teams, 68% of cybersecurity leaders said they\u2019re offering cybersecurity team members professional development training (up from 60% last year), paying for certification fees (61%, up from 54% in 2025), and paying for certification maintenance fees (59%, up from 52%).<\/p>\n

6. Establishing agile security practices and teams to keep pace<\/strong><\/h2>\n

The pace of security today is another top issue for security leaders and their teams. The velocity of attacks, the increasingly shorter required response time, and rapidly evolving IT landscape all put pressure on security pros to move ever faster, says Jenai Marinkovic, CISO\/CTO for Tiro Security and a member of the ISACA Emerging Trends Working Group.<\/p>\n

\u201cThe entire incident response process has been turned on its head,\u201d she says. \u201cWe no longer have hours to respond. AI-driven attacks are happening sub five minutes, where they can get in, identify the one place in the environment they can exploit, find where it\u2019s not backed up, and execute a ransomware attack.\u201d<\/p>\n

Barrack also cites the need for security to move increasingly faster all the time as one of the biggest issues the profession faces today.<\/p>\n

\u201cMonth to month, companies come out with new direction, new tools, new functions, and new features that have to be considered by security. There are so many innovations, and you just have to keep up. It takes a personal commitment and good prioritization processes and skilled people on your team,\u201d he says.<\/p>\n

7. Being flawless at the fundamentals<\/h2>\n

While AI is transforming everything, including how enterprise security teams operate, CISOs can\u2019t let up on any of the longstanding fundamental practices that form the foundation of the security function<\/a>.<\/p>\n

\u201cIt\u2019s easy to chase the shiny new object, and there will always be a shiny new object in cybersecurity, but you can\u2019t fall off those basic principles,\u201d says Grant Yacomeni, CISO at tech company Gigamon. \u201cThat includes vulnerability management, identity management, cryptography, supply chain management, endpoint protection. Those basic foundational tasks remain important.\u201d<\/p>\n

Yacomeni acknowledges that being flawless at the fundamentals \u2014 a longstanding core tenet in cybersecurity \u2014 is tough. \u201cIt\u2019s not easy. Cybersecurity is not an easy career field, it\u2019s not an easy job,\u201d he says.<\/p>\n

To ensure he gets the fundamentals right, Yacomeni leans on prioritizing work and building processes, using his Lean Six Sigman skills (he\u2019s a Green Belt) to succeed in those tasks.<\/p>\n

\u201cI don\u2019t like firefighting. I don\u2019t want a simple thing to become a massive thing,\u201d he explains. \u201cBut it is easier to say that than do it. So developing processes and people [is critical]. You have to lay the foundation with talented, passionate people who want to be there, processes, policies and measuring your effectiveness. And even if your [security function is] mature, the organization and the threat landscape are always changing, so you have to always be making micro-adjustments and improving over time.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity. Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agenda, introducing novel attacks, broadening the attack surface to include AI infrastructure, and […]<\/p>\n","protected":false},"author":0,"featured_media":9977,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9976","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9976"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9976"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9976\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9977"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9976"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9976"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9976"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}