In ISACA’s 2026 State of Cybersecurity survey, 68% of security leaders said work stress had increased over the past five years. A growing threat landscape was a major stressor for 71% of CISOs, up from 63% in 2025. A survey by security firm Absolute found that amid the emergence of Mythos-class AI models, 50% of CISOs were considering leaving the cybersecurity industry.

Against this backdrop, corporate security executives and experts identified seven priorities for CISOs. The first is preventing breaches while strengthening resilience and recovery. Kyle McMillan, chief cybersecurity officer at Siemens USA, said CISOs need to understand their organization’s risk profile, IT environment, overall threat trends and industry-specific threats, then set a defense strategy that fits available resources. There is no single strategy for every company, he said, and trade-offs among competing needs are unavoidable. In Signia’s 2026 Incident Response Readiness report, 73% of CISOs said they were not adequately prepared for a large-scale cyberattack. As AI-enabled attacks grow in scale and speed, maintaining business continuity and resilience during an incident has become as important as prevention. Priorities include improving response plans, running exercises based on real threats and organizing security teams to speed recovery. Foundry’s Security Priorities survey found that 69% of security leaders were pursuing this strategic shift.

The second priority is building a security program suited to an organization’s workflows, infrastructure and risks. Ira Winkler, CEO of CruiseCon, said companies face different challenges, including patching vulnerabilities, shortages of staff and budgets, and strategy development. CISOs need a business-aligned strategy, resource-management skills and the ability to guide their teams’ detailed work. They also need to develop their own leadership and cultivate the next generation of security leaders. Winkler said leadership is reflected in how well systems, procedures and controls adapt to organizational change. Companies need processes and operational and technical tools that keep disruptions manageable when problems arise, and systems must remain stable even when a leader is absent.

The third priority is redesigning cybersecurity strategy for the AI era. Alex Levy, CISO of BNSF Railway, said AI lets hackers with moderate technical skills carry out sophisticated attacks that previously required the resources of state-sponsored hacking groups. Attack development and execution are also faster, requiring security teams to increase their response speed and capacity. Priorities include adopting AI security tools and preparing security teams to work with agentic AI (AI systems that take actions toward assigned goals). Marty Barrack, CISO of Zyfin, said AI’s spread is changing patch management, responses to end-of-support technology, automation, tool use and work prioritization. He said organizations cannot work as they did one to three years ago and are considering how to automate repetitive tasks or ease team workloads while addressing business risks.

The fourth priority is securing corporate AI use and infrastructure. In Proofpoint’s 2026 report, 78% of CISOs worldwide said generative AI use posed security risks to their organizations, and 88% named enabling safe use of AI assistants, copilots and automation as a top priority for the next two years. Doug Kersten, CISO of Appfire, works with the AI committee, legal leaders, IT operations and engineering teams to oversee executive compliance with AI governance policies. AI leads in each department handle employee training and ensure new tools meet approved safety standards; Kersten also monitors unapproved AI use. In Okta’s 2026 Global CISO Insights report, 68% of CISOs said they had found instances of unapproved AI use within their organizations. Controlling AI agents is another challenge. Foundry found that 43% of CISOs were increasing investment in AI Security Posture Management (AI-SPM), the largest share among areas seeing increased investment. Another 34% named agentic AI security as an area where their security teams would build expertise over the next 12 months, ranking it behind cloud security.

The fifth priority is closing current and future security skills gaps. In ISC2’s 2025 Cybersecurity Workforce Study, 95% of security professionals said they needed at least one additional skill. ISACA found that 58% of companies considered their security teams understaffed, up from 55% in 2025. Security leaders cited gaps in soft skills (57%), large language model security operations (LLM SecOps, 45%), cloud computing (31%), data security (31%) and machine learning security operations (ML SecOps, 31%). McMillan said it is difficult to hire large numbers of people skilled in every area, so he looks for candidates with technical backgrounds, business understanding and interpersonal skills who can grow as the market changes. His organization i

In ISACA’s 2026 State of Cybersecurity survey, 68% of security leaders said work stress had increased over the past five years. A growing threat landscape was a major stressor for 71% of CISOs, up from 63% in 2025. A survey by security firm Absolute found that amid the emergence of Mythos-class AI models, 50% of CISOs were considering leaving the cybersecurity industry.

Against this backdrop, corporate security executives and experts identified seven priorities for CISOs. The first is preventing breaches while strengthening resilience and recovery. Kyle McMillan, chief cybersecurity officer at Siemens USA, said CISOs need to understand their organization’s risk profile, IT environment, overall threat trends and industry-specific threats, then set a defense strategy that fits available resources. There is no single strategy for every company, he said, and trade-offs among competing needs are unavoidable. In Signia’s 2026 Incident Response Readiness report, 73% of CISOs said they were not adequately prepared for a large-scale cyberattack. As AI-enabled attacks grow in scale and speed, maintaining business continuity and resilience during an incident has become as important as prevention. Priorities include improving response plans, running exercises based on real threats and organizing security teams to speed recovery. Foundry’s Security Priorities survey found that 69% of security leaders were pursuing this strategic shift.

The second priority is building a security program suited to an organization’s workflows, infrastructure and risks. Ira Winkler, CEO of CruiseCon, said companies face different challenges, including patching vulnerabilities, shortages of staff and budgets, and strategy development. CISOs need a business-aligned strategy, resource-management skills and the ability to guide their teams’ detailed work. They also need to develop their own leadership and cultivate the next generation of security leaders. Winkler said leadership is reflected in how well systems, procedures and controls adapt to organizational change. Companies need processes and operational and technical tools that keep disruptions manageable when problems arise, and systems must remain stable even when a leader is absent.

The third priority is redesigning cybersecurity strategy for the AI era. Alex Levy, CISO of BNSF Railway, said AI lets hackers with moderate technical skills carry out sophisticated attacks that previously required the resources of state-sponsored hacking groups. Attack development and execution are also faster, requiring security teams to increase their response speed and capacity. Priorities include adopting AI security tools and preparing security teams to work with agentic AI (AI systems that take actions toward assigned goals). Marty Barrack, CISO of Zyfin, said AI’s spread is changing patch management, responses to end-of-support technology, automation, tool use and work prioritization. He said organizations cannot work as they did one to three years ago and are considering how to automate repetitive tasks or ease team workloads while addressing business risks.

The fourth priority is securing corporate AI use and infrastructure. In Proofpoint’s 2026 report, 78% of CISOs worldwide said generative AI use posed security risks to their organizations, and 88% named enabling safe use of AI assistants, copilots and automation as a top priority for the next two years. Doug Kersten, CISO of Appfire, works with the AI committee, legal leaders, IT operations and engineering teams to oversee executive compliance with AI governance policies. AI leads in each department handle employee training and ensure new tools meet approved safety standards; Kersten also monitors unapproved AI use. In Okta’s 2026 Global CISO Insights report, 68% of CISOs said they had found instances of unapproved AI use within their organizations. Controlling AI agents is another challenge. Foundry found that 43% of CISOs were increasing investment in AI Security Posture Management (AI-SPM), the largest share among areas seeing increased investment. Another 34% named agentic AI security as an area where their security teams would build expertise over the next 12 months, ranking it behind cloud security.

The fifth priority is closing current and future security skills gaps. In ISC2’s 2025 Cybersecurity Workforce Study, 95% of security professionals said they needed at least one additional skill. ISACA found that 58% of companies considered their security teams understaffed, up from 55% in 2025. Security leaders cited gaps in soft skills (57%), large language model security operations (LLM SecOps, 45%), cloud computing (31%), data security (31%) and machine learning security operations (ML SecOps, 31%). McMillan said it is difficult to hire large numbers of people skilled in every area, so he looks for candidates with technical backgrounds, business understanding and interpersonal skills who can grow as the market changes. His organization i