The institutionalization of Forrester’s Zero Trust (ZT) model of information security is a foundational shift from perimeter-based assumptions to operating on the premise of constant compromise. As ZT becomes an expected and increasingly mandated approach, security and risk pros face pressure to demonstrate effectiveness through metrics that satisfy execs, guide practitioners, and reflect real risk reduction. ZT metrics enable security leaders to measure their firm’s ability to defend its employees, customers, and sensitive intellectual property. Security leaders can use this report to craft meaningful strategic, operational, and tactical metrics to track their progress toward ZT maturity.

Black Hat 2026 generated more questions than it answered. Are we headed for a vulnerability apocalypse (aka vulnpocalypse), or are we clearing a backlog of flaws that AI can now find with ease? Can organizations patch fast enough? What should buyers expect from vendors when software can reason? Will AI be our undoing or our […]

Of the challenges security decision-makers have faced in 2026, the evolving nature of external security threats was the most common, just edging out other interlinking challenges. This data underscores how the dynamic nature of the external threat environment amplifies challenges in the internal ecosystem. Security leaders must demonstrate how protecting against these threats allows the organization to grow — and get buy-in for programs that continuously adapt, prioritize, and prove business resilience to key externalities.

Security vendors are building AI capabilities into their tools and services at a breakneck pace, including capabilities that focus on security leadership. These capabilities differ significantly from vendor to vendor, especially based on use case. Forrester analyzed data from 17 security leadership and strategy vendor respondents to discover how they are using AI in their products and services, what they perceive as customer value, and the biggest barriers to adoption. Security leaders can use this report to understand the AI features security leadership and strategy tools deliver today and how they should think about the value derived from those capabilities.

Security vendors are aggressively building AI capabilities into their tools and services. These capabilities differ significantly from vendor to vendor, especially based on the use case. Forrester analyzed data from 17 security vendor respondents that are focused on securing AI to discover how they are using AI in their products and services, what they perceive as customer value, and the biggest barriers to adoption. The primary use cases of customers include accelerating workflows and increasing productivity. Security leaders can use this report to understand the AI features that tools for securing AI deliver today and how they should think about the value derived from those capabilities.

Our team of analysts discusses what we've learned, heard, and experienced while working with clients as they adapt to new advanced AI model releases, including Fable and Mythos.Key takeaways: Learn how clients are shifting to proactive security to contend with frontier model vulnerability discovery capabilities.Listen in as we share the tips, tricks, and lessons learned as CISOs and tech leaders work with Fable, Mythos, and other advanced AI models.Target audience level: all levels

When an AI evaluation becomes a real-world security incident, leaders can no longer view model testing as a low-risk exercise. The OpenAI and Hugging Face incident reveals how agentic AI can cross trust boundaries, exploit vulnerabilities, and create business risk long before deployment.

Join “Mr. Prediction” Mike Proulx, VP, Research Director, as he leads an exciting interactive discussion with Forrester’s experts and your peers examining the status of Forrester’s 2026 predictions for cybersecurity and risk. Key takeaways: See which predictions have come true or on track to come true, and the global factors triggering them. Uncover new insights into why some predictions haven’t or won’t come true in 2026 based on Forrester’s expert analysis. Prepare your team and organization for the second half of 2026 with a bonus prediction.Target audience level: all levels

Uncertainty and change aren’t new for cybersecurity; they are its operating system. Security leaders must now handle a threat landscape influenced by two forces that don’t politely take turns: breakneck AI innovations and geopolitical volatility. This webinar lays out the five threats that will impact security teams the most in 2026: near-autonomous attacks from nation-states, concerns over AI agent threats, non-negotiable AI software supply chains, provenance and IAM risks of AI agents, and digital sovereignty spanning regions and tech stacks. Join this webinar to understand, prioritize, and respond to these threats in 2026.Key takeaways: Explore how advanced AI is reshaping cyber espionage and the defensive strategies organizations must adopt to stay ahead.Learn why organizations need to track and govern autonomous AI agents to prevent unchecked decision-making at scale.Discover critical strategies for safeguarding interconnected AI systems, from vendor transparency to Zero Trust principles.Understand why traditional IAM approaches fall short and how new standards can help secure AI agent identities and activities.Dive into the complexities of sovereign AI solutions and the risks they pose to global tech stacks and regional independence.Target audience level: all levels

Security and risk leaders enter 2027 with two near-term inflection points converging on the same budget cycle: Agentic AI is moving from pilot to production at enterprise scale, and post-quantum cryptography migration timelines are accelerating ahead of original NIST guidance. Forrester data indicates that boards and CFOs are still funding the work — most CISOs expect another year of budget growth — but the budget mix matters far more than the total number. This data-and-insights-driven report provides spending benchmarks and concrete invest, divest, avoid, and experiment recommendations to align your 2027 security budget to the threat and capability shifts that will define the next 24 months.