Gartner has identified five actions CISOs should take by the end of 2026 as AI-augmented attacks, AI safety concerns and emerging quantum-computing risks reshape enterprise security. The research and advisory firm said cybersecurity leaders are uniquely placed to guide board and C-suite decision-making through this period of technological disruption.
“AI-augmented cyberattacks, AI safety debates and emerging quantum computing risks create persistent uncertainty across the enterprise,” said Christopher Mixter, vice-president and analyst at Gartner. “Cybersecurity leaders have a career-defining opportunity to guide executive decision making through this period of accelerating technological disruption.”
Gartner’s first recommendation is for CISOs to cement their authority over AI safety. It argues that securing AI infrastructure and understanding how models interact with harnesses matters more than the safety of an individual model.
CISOs are increasingly becoming the de facto enterprise authority on AI safety, creating an opportunity to shape governance and implementation across the business.
AI agents need tighter controls
Second, Gartner advises organisations to treat frontier AI deployments as insider risks. A survey of 297 cybersecurity leaders in the second quarter of 2026 found that 54% have no defined approach to limiting AI-agent access, or rely on access controls designed for humans.
Gartner recommends governing autonomous multi-agent systems according to the actions they are authorised to perform, rather than their level of intelligence. It also suggests using guardian agents to constrain the potential impact, or “blast radius”, of agentic workflows.
Third, CISOs should stop treating recognition—such as a familiar face or voice—as sufficient proof of identity. With deepfake threats now mainstream, Gartner says organisations should redesign processes so that sensitive decisions and actions require additional authentication, contextual signals and checks on content provenance, alongside deepfake detection technology.
Prevention and quantum readiness
Fourth, Gartner urges security leaders to budget for preemptive cyber security capabilities. It found that 76% of CISOs ranked AI-driven discovery of cyber vulnerabilities among their top 10 emerging risks in a survey of more than 300 enterprise risk leaders.
“Detection and response capabilities are no longer sufficient,” said Luis Castillo, senior director analyst at Gartner. “Organisations should prioritise preemptive cybersecurity capabilities such as automated moving target defense, advanced obfuscation, deception and predictive threat intelligence, to gain a measurable advantage over attackers.”
Finally, Gartner recommends beginning pilots of postquantum cryptographic (PQC) migration. It predicts that organisations that do not begin PQC pilots by 2027 will face at least 200% higher costs for full migration, while 51% of surveyed CISOs have yet to begin any related activity.
“Postquantum readiness requires a comprehensive cybersecurity operating model transformation, not just a technical upgrade,” Mixter said.
