8 things CISOs can’t afford to get wrong in 2026

Cybersecurity leaders have a lot to consider when trying to keep their organizations safe. But some things stand out more than others — or might be under the radar.

As a new year dawns, here are some things CISOs should avoid falling short on in 2026.

Get complacent about identity controls in the face of rising AI agents

The deployment of AI agents is growing rapidly, as enterprises look to take advantage of the automation and efficiency they offer. The global AI agents market size was estimated at $5.40 billion in 2024 and is projected to reach $50.31 billion by 2030, according to Grand View Research.

The increased use of AI agents presents a cybersecurity challenge for enterprises, especially in terms of identity controls. Potential threats include identity spoofing and over-permissioned access. Cyber criminals can exploit agents through prompt injection or malicious instructions to bypass controls and gain unauthorized access to systems and applications.

“Get identity — including AI agents — right and you control who can do what at machine speed,” says Morgan Adamski, deputy leader for cyber, data, and tech risk at consulting firm PwC.