Faced with enormous, endless challenges, security and risk (S&R) leaders must adapt their programs to the evolving business, customer, technology, and threat landscape and maintain a program that serves as the foundation of the trusted business. This effort requires a cultural shift as S&R leaders adopt competence, integrity, and transparency as guiding principles. Using these levers of trust as their lodestar, S&R leaders can deliver on their security program vision by employing six actions: align, lead, develop, influence, assure, and empower. Read this report to learn how CISOs can transform their security programs from their current state to a high-performing organization and culture built on trust.

In less than 12 months, wars escalated and reescalated, markets swung wildly, trade tensions intensified, and even rice prices elevated, causing chaos. The pace of change has been relentless, and that’s before considering the volatility facing security leaders from AI or cybersecurity threats. Also, less than a year ago, I published a blog on human […]

Effective security programs focus on customers and corporate goals and now must also understand how new tech like genAI and autonomous agentic systems shape business models, decision-making, and risk. To become or remain trusted businesses, firms must evolve their culture to not only protect systems and data but also govern how humans and machines make decisions. CISOs must continually assess activities and goals that foster business alignment and empowerment via effective leadership, organizational development, influence in the organization, and an assured security posture. Use the Forrester High-Performing Security Program Model to become a trusted business in an AI world.

AI adoption is accelerating, but confidence in its outcomes isn’t. At Forrester’s AI Forum 2026, security and risk leaders will learn how to shift from traditional protection to a trust-and-assurance mandate — with practical frameworks, real-world perspectives, and strategies to secure an increasingly agentic enterprise while enabling innovation.

Building a strong security culture is no easy task; it requires strategy, vision, people, and the right attitude to change behavior and set a cultural shift in motion. CISOs can use a catalog of activities to move beyond online training courses and more effectively engage the hearts and minds of employees, who are an essential part of any security strategy. This report highlights some of the best influence and engagement activities that security leaders around the world use to engage and influence a culture of security among employees.

Building a strong security culture is no easy task; it requires strategy, vision, people, and the right attitude to change behavior and set a cultural shift in motion. CISOs can use a catalog of activities to move beyond online training courses and more effectively engage the hearts and minds of executives and the board, whose advocacy sets the tone from the top and is crucial to security’s funding and success. This report highlights some of the best influence and engagement activities that security leaders around the world use to engage and influence a culture of security among execs and boards.

Building a strong security culture is no easy task; it requires strategy, vision, people, and the right attitude to change behavior and set a cultural shift in motion. CISOs can use a catalog of activities to move beyond online training courses and more effectively engage the hearts and minds of business and technology functions, whose buy-in is essential to ensure security’s involvement at the business or project levels. This report highlights some of the best influence and engagement activities that security leaders around the world use to engage and influence a culture of security among business and tech leaders and staff.

Have a great story about leveraging security, privacy, and risk management to drive trust, resilience, and responsible innovation? We'd love to hear from you.

On May 1, 2026, six national cybersecurity agencies — CISA, the NSA, Australia’s ASD ACSC, and their counterparts in Canada, New Zealand, and the UK — published “Careful adoption of agentic AI services.” This joint guidance is the first coordinated multigovernment security guidance specifically targeting agentic AI systems, and it carries the full weight of […]

The cybersecurity industry continues to focus almost exclusively on technology. This comes at the expense of people — the heart of cyberdefense — as high expectations and limited resources cause stress and harm their well-being. Even as burnout continues to wreak havoc on workers’ productivity, retention, and mental and physical health, the discussion remains subdued. CISOs who hope to support their teams must better understand the nuances of this epidemic, which they can’t mitigate with exhortations to meditate or practice yoga. This report examines burnout in cybersecurity and guides CISOs on how to address it based on their teams’ profiles and the causes of their burnout.