Cybersecurity leaders create the most value when they help executives navigate disruption, not just respond to risk.
- Gartner client? Log in for personalized search results.
Technology disruption is expanding the cybersecurity mandate
Cybersecurity leaders must guide their executive teams and Boards to see around corners. As AI, autonomous systems and quantum computing reshape business operations, effective cybersecurity leaders aren’t waiting for an invitation. They are proactively engaging executives for guidance on what these technologies mean for the organization and facilitating decisions on around much cyber risk the business is willing to take on. This proactive, value-enabling stance differentiates effective cybersecurity leaders: While much of the conversation around emerging technology focuses on potential threats, the bigger challenge is helping organizations make risk acceptance decisions amid uncertainty.
“The greatest opportunity (and risk) for cybersecurity leaders lies in their ability to influence executive decision making ahead of disruption — not merely show up to secure environments after decisions have been made.” says Christopher Mixter, Vice President Analyst at Gartner.
The decisions leaders make now about AI governance, identity, cyber defense and quantum readiness will shape how effectively their organizations navigate the next wave of technological change.
You might also like this webinar: Cybersecurity and AI: Strengthen Cyber Defense While Securing AI
Five decisions to make now in order to set the organization up for long-term optimized performance
To help organizations navigate this period of uncertainty, Gartner highlights five strategic decisions for cybersecurity leaders.
Establish authority over AI safety
AI safety is becoming a governance challenge, not just a technical one. Cybersecurity outcomes depend as much on securing AI infrastructure and understanding how models interact with surrounding systems as on model safety itself. As oversight evolves, cybersecurity leaders should help define accountability, test AI safety scenarios and build governance approaches that extend beyond individual models.
Govern AI by actions, not intelligence
Cybersecurity incidents are driven by ungoverned actions, not model intelligence. Yet, Gartner finds that 50% of organizations have no defined approach to limiting AI agent access and 63% rely on standard security controls for AI use cases. Organizations should treat agentic AI as a privileged internal actor — an insider risk — and apply controls accordingly.
Replace recognition as proof of identity
Deepfakes are exposing weaknesses in workflows that rely on familiar voices, faces or videos to authorize actions. According to Gartner, 41% of CISOs reported at least one deepfake audio social engineering incident during the past year and 35% reported a video deepfake incident. Organizations should separate identity recognition from authorization and use layered controls to verify trust.
Invest in preemptive cybersecurity
AI is enabling adversaries to scale existing attack techniques more quickly and efficiently. Seventy-six percent of CISOs rank AI-driven discovery of cyber vulnerabilities among their top 10 emerging risks. To combat this, CISOs should shift emphasis from detection and response alone toward exposure management, predictive threat intelligence, deception and other preemptive capabilities.
Begin postquantum cryptography migration now
Postquantum cryptography is becoming a business issue rather than a future technology discussion. Gartner predicts that organizations that do not begin piloting postquantum cryptography by 2027 will face at least 200% higher costs during full migration. Yet 51% of CISOs have not begun PQC-related activities. Early pilots can help reduce future costs and improve readiness.
Next-generation cybersecurity FAQs
Why is AGI not the primary cybersecurity concern?
AI systems do not need artificial general intelligence to create significant cyber risk. What matters is whether they can affect enterprise operations or execute actions within enterprise environments. Focusing too heavily on future AGI scenarios can distract organizations from the governance and security controls needed for AI systems already in use today.
How should organizations govern agentic AI?
Organizations should treat agentic AI deployments as privileged internal actors and govern them based on autonomy, access and actions rather than intelligence. Controls such as guardian agents, privileged access restrictions and sandboxed environments can help reduce the impact of unintended or unauthorized actions.
Why should organizations start PQC pilots before 2027?
Organizations that delay postquantum cryptography pilots until after 2027 are expected to face significantly higher migration costs. Early pilots help identify critical systems, establish governance and build the organizational capabilities needed for a broader transition. Because postquantum readiness requires changes across multiple teams and technologies, waiting increases both complexity and cost.
Attend a Conference
Experience IT Security and Risk Management conferences
With exclusive insights from Gartner analysts on the latest trends, sessions curated for your role and unmatched peer networking, Gartner conferences help you accelerate your priorities.
7 – 9 Dec 2026
Gartner Identity & Access Management Summit
Las Vegas, NV
Drive stronger performance on your mission-critical priorities.