Top Five Actions for CISOs to Take by End of 2026 (Gartner)

Abstract

Gartner press release of 30 September 2026 identifying five actions CISOs should take by the end of 2026, with two directly relevant to agent identity and access control. Verbatim: "Fifty-four percent of organizations have no defined approach to limit AI agent access, or rely on predefined human access, according to a Gartner survey in 297 cybersecurity leaders in the second quarter of 2026." Verbatim recommendation: "CISOs should govern autonomous multiagent systems based on action privileges rather than model intelligence and safeguard agentic workflows using guardian agents to constrain blast radiuses." The other four actions, also quoted: "Cement Role and Authority in AI Safety" (securing AI infrastructure and understanding the interaction between models and harnesses is more important than the safety of the model itself); "Replace Recognition as Proof of Identity" (discard recognition as an acceptable basis for decision or action authorization, augmenting deepfake detection with contextual signals, additional authentication layers and content-provenance checks); "Budget for Preemptive Cybersecurity Capabilities" (76% of CISOs ranked AI-driven discovery of cyber vulnerabilities among their top 10 emerging risks in a survey of over 300 enterprise risk leaders in Q2 2026); and "Begin Piloting Postquantum Cryptographic Migration" (organizations that do not begin piloting PQC by 2027 will face at least 200% higher full-migration costs; 51% of surveyed CISOs had not begun any PQC-related activity).