Attributed metadata history

The 7 biggest issues CISOs and security teams face today

Year after year CISOs see the volume, velocity, and sophistication of attacks increase. They also see their attack surfaces expand and increase in complexity. Advances in artificial intelligence and the rapid growth of AI use in business are also impacting the security agenda, introducing novel attacks, broadening the attack surface to include AI infrastructure, and presenting governance and security control challenges and complications — especially as agentic systems come online. As a result, 68% of security leaders report that their roles have become more stressful over the past five years, according to the 2026 State of Cybersecurity survey from ISACA, with 71% of CISOs citing the increasingly complex threat landscape as their main stressor, up from 63% in 2025. Moreover, the introduction of Mythos-class AI models has 50% of CISOs considering exiting the profession entirely, according to a recent survey from Absolute. To tackle this increasingly complex and intense security environment, security leaders must sharpen their strategies — and their teams’ skills — around the most pressing issues they and their CISO colleagues are facing today. To help with that, we spoke with security chiefs and cyber experts to identify the seven biggest issues CISOs need to address, with insights on how to tackle the challenges. 1. Preventing compromise — with increased emphasis on resilience and recovery Although CISOs are increasingly taking on governance responsibilities and business risk mandates, broadening their remit, Kyle McMillan, chief cybersecurity officer at Siemens USA, says all the work in the security organization is still “framed in the context of preventing a compromise.” It’s a monumental task, McMillan says, as there’s no one formula for the right defense that will work for every CISO. Rather, CISOs must know the specific risk profile of their organizations, the specifics of their IT environment, and the general threat landscape, as well as any threats particular to their industry — and then use all that to formulate a unique plan of defense based on the resources available. “And there are always trade-offs to be made,” McMillan adds. While it’s true that thwarting attacks as much as possible and minimizing the damage in the event of a successful breach has always been job No. 1 for CISOs, research shows it’s one they continue to struggle with. The State of Incident Response Readiness, a 2026 report from incident response company Sygnia, found that 73% of CISOs weren’t fully ready for a major cyberattack. That — and the rise of AI-assisted attack volumes and speed — is contributing to a mindset shift from prevention to resilience. Yes, prevention remains job No. 1, but ensuring business continuity and resilience in the event of an incident is becoming a key emphasis and addition to CISOs’ playbooks. That means honing incident response plans, conducting more relevant tabletop exercises, and sharpening team operations to accelerate cyber recovery. According to Foundry’s forthcoming Security Priorities Study, 69% of security leaders are currently undertaking this shift. 2. Leading a security program aligned with the organization’s specific needs One of the biggest issues CISOs continue to face is accurately assessing their organization’s processes, infrastructure, and risk profile and then building a program tailored to their unique security requirements, says Ira Winkler, veteran cybersecurity leader and now CEO and program director of CruiseCon, which offers professional education for security leaders. “CISOs are not monoliths,” Winkler points out. Some CISOs struggle to patch all the critical vulnerabilities in their environments fast enough, whereas others struggle to tackle essential work with the staff and budgets they have; still others find themselves falling short in taking a strategic approach to their role. What this often

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.