Vendors state that AI will help them achieve autonomous security operations and agentic AI frameworks and orchestration. These capabilities will shift security operations from reactive workflows to proactive, self-directed systems that reason, plan, and act with minimal oversight. However, this autonomy introduces new risks: goal hijacking, cognitive corruption, and privilege overreach that demand robust governance and continuous risk management and human oversight.

The Security Operations Center Struggles To Find Valuable Metrics The security operations center provides visibility of the environment, detects and responds to threats, and gives input to the overall security program. This extremely technical and tactical part of the security program provides key capabilities to protect the organization, but many people inside and outside of the security team don’t understand exactly what it does.

Digitizing operations: 26%. Procuring data center infrastructure — servers, storage, and networking equipment — with reduced environmental footprint: 25%. E-waste management, device circularity, and asset disposal optimization for data center infrastructure: 25%. Figure 1 Supplemental Material Research Methodologies Forrester’s Infrastructure Survey, 2025

Figure 14 Security And Risk Management This bar chart shows the breakdown of security and risk management inquiries by subtopic, according to Forrester’s inbound inquiries, from July 2024 through June 2025. The leading categories were cybersecurity and privacy (35%), governance, risk, and compliance (19%), security and risk management (15%), security operations and program governance (14%), identity and access management (11%), Zero Trust (4%), and business resilience (1%).

The most commonly selected actions included expanding cloud-native platforms to improve scale and resilience (27%) and increasing automation of platform operations (26%). Other leading priorities included upskilling teams on platform engineering practices (24%), rationalizing application portfolios (23%), strengthening lifecycle and reuse governance (23%), and consolidating legacy platforms to reduce technical debt (23%).

Although this compliance-first mindset often conflicts with agility and modernization goals, it can propel lagging security programs forward, linking regional viability with necessary data security and privacy controls. Translating technical risk into business language to meet board expectations. Board oversight amplifies governance demands, requiring security leaders to justify investments in terms of business outcomes. Failure to adapt risks funding shortfalls and misaligned priorities.

As B2B organizations develop varied and sophisticated partner ecosystems to drive new sources of growth, the added complexity they bring to partner operations is exposing architectural limitations in traditional PRM platforms. PRMs were built to focus on managing linear, transactional partner programs.

This reframing protects security leaders from robbing critical programs to fund AI controls and forces accountability where the risk originates. What to know. AI security costs scale with AI adoption, not with traditional security infrastructure. The attack surface expands beyond the CISO’s traditional remit as AI models and AI costs proliferate across marketing, operations, and product.

Programmable governance tightens control. A common misconception is that autonomous payments reduce oversight. In reality, agentic payments allow finance leaders to replace manual approvals with programmable governance. Coupa’s agentic AP tools go beyond static rules flagging payments that deviate from a supplier’s historical spending patterns, surfacing anomalies that a human reviewer would likely miss and catching in seconds what would take a finance team hours to trace manually.

This data-driven report outlines important cybersecurity operational benchmarks from Information Services Group (ISG) for cost allocations; budget percentages; headcount; security operations; vulnerability risk management; identity and access management; privacy; data security; and governance, risk, and compliance.