John Dickson, a CISO at Insight Global, faces a common challenge as organizations increasingly adopt AI tools faster than security teams can manage. His team is tasked with gaining visibility over non-human identities (NHIs) in their environment, an objective initially planned for the next year. However, Dickson opted to accelerate the timeline by implementing AI discovery and observability measures immediately, demonstrating a shift towards proactive management.
This shift underscores a broader trend where security leaders are abandoning the notion of a static yearly roadmap in favor of more flexible strategies. In recent discussions, Gartner highlighted that the definition of agility for security leaders now encompasses the ability to promptly adjust roadmaps and investments to counter evolving business risks.
Agility as a New Standard
As organizations confront an environment characterized by rapid change, leading CISOs are optimizing their strategic planning processes. Rather than a traditional two- to three-year roadmap, their strategies exist at two paces: long-term planning for foundational elements combined with agile, short-term revisions to tools and tactical responses. Such a bifurcated approach allows security leaders to remain relevant amidst uncertainty and constantly evolving threats.
Chris Cochran, field CISO with SANS Institute, reflects on this new paradigm. He states, “We’re operating with more genuine uncertainty than ever before.” This sentiment highlights the necessity for intellectual flexibility within security teams as they navigate a landscape where delays in response can lead to vulnerabilities.
The Need for Immediate Action
Joe McManus, CISO at Grafana Labs, encountered urgent challenges when AI agents created by citizen developers identified misconfigurations in their systems. McManus realized that waiting for a structured planning cycle would hinder necessary updates. He thus integrated controls and audits into their immediate strategy to maintain security integrity.
He characterizes long-term planning beyond one year as nearly futile due to the rapidly shifting technological landscape. Although Grafana maintains a goal map for the next two years, priorities continuously adjust based on current threat dynamics. Transitioning from infrequent planning to agile sprints, McManus’s team now emphasizes tactical responses over static models.
Collaboration and Acceleration
Fable Security's CISO, Jacob Berry, recognizes a significant shift in how security integrates with product development. The traditional security review sequence, which relied on lengthy evaluations, has been replaced by a more collaborative model where security teams work closely with engineering. This ensures that security measures evolve alongside rapid product iterations, fostering an environment of continuous oversight rather than one governed by long delays.
Raja Chris, founder of AIVONS, advocates for modern security tools that behave as dynamic systems, capable of evolving in response to new discoveries. He suggests that CISOs should also evolve their strategies to reflect this shift towards ongoing adaptation rather than rigid adherence to outdated models.
Long-Term Planning in an Uncertain Environment
Despite moving towards more agile methodologies, many security leaders continue to create multi-year plans focusing on long-term commitments, such as compliance and AI migrations. The KPMG 2026 Cybersecurity and Technology Risk Survey indicates that while threats like quantum computing are on the radar, security leaders expect AI-driven attacks to be a significant concern within the next couple of years.
Dickson’s team at Insight Global incorporates long-term commitments related to things like data governance, showing that even while they embrace agility, foundational strategies still hold importance. However, Cochran warns that these longer-term plans remain vulnerable to disruption due to factors like shifting executive priorities or budgetary constraints.
Classifying Strategic Initiatives
Determining whether a project necessitates a long-term vs. short-term approach doesn't have to be arbitrary. Berry's team evaluates each initiative based on the level of coordination required and its alignment with established business commitments. Initiatives that involve extensive collaboration and are closely tied to strategic goals are assigned longer timelines, while narrowly focused tasks are integrated into ongoing review cycles.
This strategy ensures that while overarching goals remain intact, specific tactics can shift fluidly based on immediate needs and insights. Chris emphasizes that security outcomes should be durable, but the technologies that deliver those outcomes tend to change rapidly. Therefore, reassessing what is classified as strategy can help maintain credibility.
Governance in an Agile Framework
A roadmap that adapts every quarter requires governance that aligns with its dynamic nature, moving away from rigid oversight. Cochran explains that successful CISOs facilitate ongoing communication rather than adhering to a static compliance mindset. This approach includes keeping boards informed about how security measures align with business operations and the risks introduced by speed to market.
As boards demand more accountability, it's clear they’re shifting from simply asking if an organization is secure to wanting concrete evidence of risk management and response practices. Chris notes that clarity in reporting is essential; differentiation between diligence and negligence in security checks is vital to maintaining trust.
The challenge of demonstrating both the value of security investments and the tangible risks of potential vulnerabilities reflects the ongoing evolution of the security roadmap. While long-term planning hasn't disappeared, what leaders are willing to document and commit to has shifted significantly.
"The static roadmap is no longer viable," Chris affirms. Echoing this, Dickson remarks, "A long-range roadmap still has its place, but it must be flexible enough to adapt to ongoing changes." This sentiment encapsulates the evolving mindset among CISOs striving to protect their organizations in an unpredictable landscape.
