All security leaders have policies and need them. However, writing good, effective policies all too often seems elusive. Clear, well-written cybersecurity policies drive intended outcomes and behaviors whereas long, overly wordy, and confusing policies can result in unintended consequences such as bottom-line impact via breaches, lawsuits, sanctions, and fines. Security and risk leaders can use this report to understand the foundations for developing good cybersecurity polices and some of the most common issues that come up.

The cybersecurity industry continues to focus almost exclusively on technology. This comes at the expense of people — the heart of cyberdefense — as high expectations and limited resources cause stress and harm their well-being. Even as burnout continues to wreak havoc on workers’ productivity, retention, and mental and physical health, the discussion remains subdued. CISOs who hope to support their teams must better understand the nuances of this epidemic, which they can’t mitigate with exhortations to meditate or practice yoga. This report examines burnout in cybersecurity and guides CISOs on how to address it based on their teams’ profiles and the causes of their burnout.

RSAC Conference 2026 has come and gone. Gone, too, are the petting zoos of yesteryear, replaced this year by — of all things — pop-up tattoo parlors. Or as one attendee observed, “We’ve traded livestock for live needles.” This year’s attendance of over 43,500 was flat compared to 2025, but the sessions and exhibit floor […]

The annual RSAC Conference in San Francisco is the cybersecurity industry’s biggest event of the year. For the analysts attending, RSAC Conference week provides an opportunity to learn about cybersecurity trends and topics, meet with vendors and clients, and share our insights and observations. It’s also an excellent opportunity to meet our daily step goals […]

So you’ve decided to run an executive tabletop exercise (TTX) and pulled off the Herculean feat of getting it scheduled. Will this be a career-limiting move or career highlight? Let’s go for the latter. Done right, a good TTX will drive tremendous value for the company and garner you accolades. I have yet to do […]

Government agencies at the federal, state, and local levels must prepare for a future where they experience uncertainty, headcount reductions, contract cancellations, and budget cuts. This is gut-wrenchingly difficult to process, yet remaining leaders must figure out how to move forward to serve the mission. For public sector cybersecurity leaders, this is even more paramount. […]

In the wake of the July 19th CrowdStrike global outage, technology and security leaders are evaluating their vendor relationships, risk exposure, and strategies. Join Forrester experts and fellow technology and security leaders in a discussion about navigating the long-term repercussions of the situation. Peer discussions are available exclusively to Forrester Decisions VIP Leader and Leader license holders for their own participation.

After the immediate crisis is over, the long-term crisis will just be unfolding. Given the magnitude and impact of the event, every Security and Tech leader must be prepared to respond to urgent questions from their executives, their board, and even their customers and employees. To ensure the organization isn’t susceptible to such an event again, Security and Tech Leaders will need to reexamine their overall concentration risk, third party and supply chain risk, and overall security strategy. It will also demand a reexamination of how IT manages and monitors its critical IT infrastructure, and how robust and automated its capabilities are for incident response, remediation, and crisis management and communication.Key takeaways: Learn about the short-term and long-term implications of this event for Security Leaders, Tech Leaders, and the security industry itself.Hear key recommendations from Forrester analysts on next steps.Ask the analysts for insights and advice live.Target audience level: all levels

Technology leaders woke up this morning to find that a software update by cybersecurity vendor CrowdStrike had gone badly wrong. Get updates on the steps that your organization should take now and in the long term as a result of the CrowdStrike outage.

The cybersecurity threat landscape has become a volatile mix of threats driven by rising uncertainty and increased complexity. Uncertainty generated by narrative attacks, deepfakes, and AI responses make it difficult to separate fact from fiction. The AI software supply chain and nation-state espionage risks add additional layers of complexity to an already convoluted threat environment. This session will explore the top cyberthreats organizations are facing, ways that you can gain visibility into these threats, and recommendations to mitigate the impact of them. Join Brian Wrozek, principal analyst at Forrester, for an interactive discussion with other security and risk leaders. Please bring your questions, learnings, and recommended practices to share with the group. Peer discussions are available exclusively to Forrester Decisions VIP Leaders and Leader license holders for their own participation.