The CISO’s job is no longer just defence. KPMG’s Balancing speed and safety: The CISO’s evolving role report, based on its 2026 Cyber and Technology Risk Survey, says security leaders must now help the business move at speed without losing trust. The survey covers 310 US security leaders at firms with revenue of $1 billion or more, and was conducted in October 2025.
Attacks are rising
Some 83% of organisations saw more cyberattacks in the past year. Phishing, denial-of-service and ransomware were the most common. The report says the question is no longer if a breach will happen, but how ready a company is when it does.
AI cuts both ways
Leaders expect AI-powered attacks to be the top threat over the next two to three years. They also rank AI as the most effective future defence, especially for fraud prevention (57%) and predictive threat analytics (56%).
Adoption is still early. Only 24% have fully integrated AI into cyber operations, while 53% have done so in specific areas. The biggest hurdle is trust: can AI’s recommendations be seen as accurate, reliable and explainable?
Basics still matter
KPMG argues that advanced tools cannot make up for weak fundamentals. Only 14% of firms have reached an advanced, predictive approach to vulnerability management. Complexity of IT infrastructure (47%) and fragmented security systems (45%) are the main barriers.
The payoff for getting the basics right is visible. Organisations with high cyber maturity were nearly twice as likely to report zero breaches (22%) as those with moderate maturity (12%): data security and privacy top current budget priorities.
The quantum clock
Quantum computing is a looming worry. Attackers can steal encrypted data today and decrypt it later. Yet only 27% of firms are actively implementing post-quantum cryptography, while 57% are still exploring or piloting.
Speaking the board’s language
Some 42% of respondents struggle to demonstrate the return on investment from cyber spending. KPMG says CISOs should move away from crowded dashboards and report a few business-linked measures, such as dwell time, patching cadence and phishing success rates. Already, 53% use threat intelligence platforms and 49% use formal risk quantification methods such as FAIR.
People and machine identities
The talent gap is the top challenge, cited by 53% of respondents. Even so, 74% expect their security headcount to grow by more than 11% in the next two to three years. About 41% are turning to outside partners for expertise.
Machine identities are an emerging blind spot. Service accounts, API keys and AI agents now outnumber human users 82 to 1, the report says, citing CyberArk. Some 60% of respondents call the risk very significant.
What CISOs should do next
The report ends with six steps:
- Build a formal AI security and governance programme, with humans in the loop for critical decisions.
- Master data protection and identity governance.
- Unify security data architecture.
- Govern human and nonhuman identities.
- Start planning for post-quantum cryptography.
- Vet partners for real technical depth.
The takeaway is that the CISO must evolve from defender of technology to protector of business value. As the report puts it, the real mandate is “speed with safety.”
One caveat: the survey sample is entirely US-based, and KPMG sells cybersecurity services, so Indian readers should read the numbers as a directional guide.
