Cybersecurity risk shifts into organizational workflows, research shows

The 2026 Voice of the CISO research indicates a fundamental shift in cybersecurity, where risk is increasingly moving into active workflows. While fewer Chief Information Security Officers (CISOs) expect material cyberattacks or sensitive data loss in the coming year compared to 2025, the nature of the threat landscape is evolving.

Over a five-year period, the role of the CISO has transitioned from managing simple escalations of attacks to navigating a convergence of AI governance, human risk, and board scrutiny. The research suggests that security leaders must now focus on protecting sensitive data as it moves across cloud platforms, SaaS applications, collaboration tools, and AI-enabled workflows, rather than merely reacting to external threats.