Cybersecurity considerations 2026 - KPMG

Technology is advancing at unprecedented speed, unlocking new opportunities for growth while simultaneously amplifying cyber risk. Organizations now face a broader, more complex threat landscape shaped by AI, geopolitics, regulatory pressure, supply‑chain disruption, non‑human identities, hyperconnectivity, and the looming reality of quantum decryption. For cyber leaders, the challenge is no longer just protecting the enterprise but strengthening resilience while enabling innovation at scale, across an expanding digital and operational attack surface. Cybersecurity considerations 2026 explores eight key considerations leaders should prioritize as cybersecurity becomes central to enterprise resilience and innovation. The report helps Chief Information Security Officers (CISOs) and senior executives navigate a rapidly evolving risk environment, while supporting the adoption of AI and other transformative technologies, to help drive growth, resilience, and competitive advantage. Drawing on insights from more than 20 KPMG cyber leaders worldwide, alongside perspectives from senior executives at Google, Microsoft, Palo Alto Networks, and ServiceNow, the report is further enriched by findings from KPMG global and regional surveys. At a time of heightened uncertainty, Cybersecurity considerations 2026 underscores the increasingly strategic role of the CISO — not only in managing risk, but in turning cyber risk into a catalyst for trust, resilience, and stronger organizational performance. Cybersecurity considerations 2026 Building trust and enabling innovation in a dynamic world Download the report opens in a new tab Explore eight key cybersecurity considerations for 2026 Preparing the cyber workforce for autonomous security As security becomes automated, agents are taking on more intelligence-driven tasks, in the security operations center (SOC), as well as compliance and risk management, and identity management. Autonomous security is set to play a critical role in identifying and monitoring non-human identity activity. Navigating geopolitics, building resilience and compliance Both digital defenses and physical assets are threatened by potential attacks from hostile nations. Organizations should assess potential risks and use AI, automation, and analytics to streamline controls, speed up evidence collection, and boost regulatory compliance. Safeguarding AI systems As AI becomes deeply embedded in enterprise operations, its security is emerging as a critical priority. Safeguarding AI is no longer a technical challenge alone, but a strategic imperative that intersects with compliance, trust, and operational resilience. Managing non-human identities In increasingly digitized and automated environments, non-human identities such as AI agents, service accounts, and machine credentials now outnumber human users. Organizations must rethink identity governance to include the full lifecycle of both human and machine actors. Enabling trusted IT/OT hyperconnectivity Embedded sensors, IoT devices, and fully connected environments are becoming commonplace. Aiming to secure hyperconnected systems demands a dynamic mesh architecture, clarity of ownership, and monitoring across cyber-physical boundaries. Transitioning to post-quantum cryptography The transition to post‑quantum cryptography (PQC) is increasingly anticipated on a global scale and is unlikely to be avoided. Around the world nations are implementing guidance and regulations to migrate encryption in order to manage quantum cyber risk. This will be a major challenge and, for sectors like finance and defense, an existential one. Protecting the supply chain through detection and response Today’s complex supply chains create a vast digital attack surface that includes AI and a myriad of IoT devices. Organizations should extend the scope of third party risk management with continuous monitoring and oversight to maintain operational resilience. Broadening the role and influence of the CISO The scope and responsibilities of the CISO continue to expand as security becomes more deeply integrated into business and operations, converging the cyber and physical domains. At the same time, CISOs must manage the opportunities and threats associated with widescale AI adoption. Our insights KPMG Recognized as a Leader in The Forrester Wave™: Cybersecurity Consulting Services In Europe, Q4 2025 KPMG firms were specifically recognized for continuously adapting their “innovation roadmap based on threat intelligence, client priorities, and technology trends.” Read more Invisible access, visible risk Making non‑human identities a cybersecurity priority Read more Global tech report 2026 Explore how organizations navigate today’s emerging tech — and prepare for what’s next. Read more Dual threat In a volatile global economy, progressive companies do more than survive the impact. They’re transforming operations to thrive in it. One way is by boldly grabbing onto AI, from generative to agentic. Read more High visibility Managed services create a unified view of cyber risk Read more Our people Laurent Gobbi Global Cybersecurity and Tech Risk CoE Leader KPMG in France mail Jim Wilhelm Global Cyber Investment Leader KPMG in the U.S. mail Dani Michaux EMA Cyber Security Leader, EMA Women in Cyber Leader and Partner Ireland mail call Motoki Sawada Partner KPMG in Japan Prasanna Govindankutty Americas Cyber Security Leader KPMG in the U.S. mail Item 1 Item 2 3 4 5