No matter what the weather forecast says in January, only by October can you say the year had good or bad weather.

When we first published our list of top challenges for CISOs in January, the challenges were predictions made by our experts on the weather of cybersecurity. Nine months of fresh research and observations later, we have already seen which challenges held and which ones shifted.

We have observed that despite fewer CISOs expecting a material cyber attack in the next 12 months, their job hasn’t gotten any easier. Risk has remained where it was (people, data, and AI), but its severity has increased.

Here are the seven challenges that shaped and will shape their 2026, along with some tips that security leaders can use to address the challenges.

What has changed in nine months?

Sources: Proofpoint Voice of the CISO 2025 and 2026; Verizon DBIR 2026.

Human risk has climbed up as the biggest risk reported by CISOs among Gen AI and third-party breaches.

The top 7 challenges for CISOs in 2026-27

Here are some of the top CISO challenges for 2026-27:

#1 AI-enabled attacks and attacks on AI

In short

AI attacks have become faster and cheaper for attackers, and AI systems deployed by organizations have themselves become targets.

Attackers are using AI to drive faster and more persistent campaigns that are more difficult to detect. This is why one in four breaches today are AI-enabled, causing more damage.  It is also why one in four data breaches were AI-enabled, a 56% increase from last year (IBM Cost of Data Breach report 2026). Breaches have also become costlier, with the average cost of a data breach climbing to $6 million, higher than the global average of $4.99 million.

What can CISOs do:

• Enable round-the-clock monitoring that matches machine-speed attacks.
• Use human expertise to fine-tune workflows, monitoring, and oversight on AI-driven defense.
• Add an additional layer of verification for payment approvals and credential resets as a measure against deepfake impersonation.
• Take an inventory of AI models and applications in use, and monitor them, treating them as any other critical assets.

#2 Shadow AI and AI governance

In short

Employees often adopt multiple AI tools for faster productivity, many times before they are vetted by security teams, creating a security challenge related to AI governance and security.

78% of CISOs, according to Proofpoint, now see GenAI as a security risk, a rise from 60% last year. 85% of CISOs have reported that the safe use of AI assistants, copilots, and automation has become a top priority for them in the next two years.  

With 79% of CISOs expecting to manage AI-related risks without a rise in resources or expertise, it has become one of the toughest challenges to address.

What can CISOs do:

• Create and publish a detailed AI usage policy with a list of approved tools that is updated regularly.
• Apply data loss prevention controls to prompts and uploads, not just email and file sharing.
• Give AI agents their own identities and apply least-privilege access with logging.

#3 The rise of human risk

In short

CISOs ’ worries have shifted from the perimeter to the human firewall, with many CISOs reporting gaps in human awareness and preparedness as weaknesses to be addressed.

79% of CISOs have identified human risk as their biggest vulnerability, up from 66% in 2025. With 62% of data breaches caused by the human factor, CISOs are under increased pressure to proactively identify and address weaknesses in the human firewall.   There has also been a reported rise in identity theft activity, with over 1803 data compromises in the first half of 2026 (Identity Theft Resource Center).  

What can CISOs do:

• Implement data security controls, limiting access, and enabling alerts on exfiltration attempts.
• Tighten offboarding so access and copies are removed on the last day.
• Train people based on their roles, covering different phishing types, not just email-based phishing, but also vishing and smishing.

#4 Third-party risk

In short

With the rising third party/supply chain breaches, vendor security posture has become a top priority item for CISOs.

Supply chain breaches like Klue and Instructure formed a part of more than half of the reported breaches in the first half of 2026. Third-party security failures now account for 48% of data breaches, up from 30% in the previous year (Verizon, DBIR 2026), with authentication failures, missing MFA, and stolen credentials being the common factors. Prioritizing third-party risk management is no longer optional for organizations.

What can CISOs do:

• Take an inventory of vendors, including their data access, and continuously monitor the critical ones.
• Monitor vendors for security risks.
• Enforce MFA across vendors.

#5 The rising skills gap

In short

The shortage isn’t just about manpower but also specialized expertise lacking in the team.

Lack of expertise in specific cybersecurity skills has been a persistent challenge preventing organizations from proactively identifying and addressing gaps across their security posture. Last year, 95% of organizations reported having at least one skills gap with 36% of them reporting budget cuts and 72% reducing security staff that overall increased their likelihood of exposure to threats (ISC2, 2025).

What can CISOs do:

• Determine the skills gap in your organization by mapping the team’s skills against actual tooling (SIEM, EDR, cloud, AI).
• Consider training the workforce on emerging technology to supplement staff.
• Outsource specialized functions like threat hunting and incident response through MDR and managed SOC.

#6 Changing compliance environment

In short

As compliance expectations keep shifting, CISOs face increased pressure to align. Building a control that maps to many regulations might solve it.

Whether it is the EU AI Act coming into force on 27 July 2026 or mapping third-party obligations to DORA for financial institutions, there are many major changes in compliance regulations that organizations are expected to adhere to. CISOs face the challenge of timely aligning the security posture to these obligations without causing operational disruption.

What can CISOs do:

• Instead of auditing controls in isolation, map them to gold standard frameworks (like ISO27001 and NIST CSF) and applicable regional regulations.
• Automate evidence collection to avoid last-minute scrambling (See how STRIEGO does this).
• Align detection and reporting with the expected data breach notification windows.

#7 Increased expectations from CISOs

In short

CISOs face multi-directional expectations, from owning AI risk and board communication to ensuring business resilience.

While 85% of CISOs report seeing eye to eye with their board on cybersecurity, 77% of CISOs have reported that they face excessive expectations. 79% say that they don’t have proportional resources or expertise to match AI risk (Proofpoint, Voice of the CISO, 2026).

What can CISOs do:

• Report to the board in terms of business impact – downtime, exposure, and recovery time.
• Assign clear owners of AI risk across legal, HR, IT, and security.
• Track resilience metrics like Mean Time to Detect and Mean Time to Respond.