Our annual award recognizes organizations that exemplify Forrester’s trust imperative by embedding security, privacy, risk management, and trust into leadership decisions, governance, operations, and culture. This year’s submissions reflected the growing importance of securing AI, improving resilience, and demonstrating measurable business outcomes.

For that reason, Forrester is proud to recognize CITGO as the winner of the 2026 Security & Risk Enterprise Leadership Award. CITGO distinguished itself by showing how trust can be operationalized across a complex enterprise where cybersecurity directly affects operational safety, business continuity, and organizational performance.

Trust Built Into The Business

As a major petroleum refining and marketing company, CITGO operates a complex technology environment. Cybersecurity leaders must protect both traditional enterprise IT and operational technology (OT) systems.

What set CITGO’s submission apart was its deep integration of security, privacy, and risk management into the core of the business. The company consistently frames cybersecurity in terms of operational reliability, safety, financial performance, and reputation. Security is treated as a business capability. Whether securing refinery operations, pipeline infrastructure, trading platforms, terminal automation systems, or retail environments, the company’s security program is centered around supporting safe, reliable, uninterrupted operations. The result is a security organization that is closely aligned with how the business creates value and manages risk.

Elevating Executive Engagement And Information Sharing

Another area of distinction was the depth and maturity of CITGO’s executive engagement. The company has established a structured governance model that brings cybersecurity, privacy, compliance, and enterprise risk discussions directly into executive and board-level decision-making. Leadership receives regular updates on threat activity, regulatory developments, program performance, incident readiness, compliance initiatives, and emerging technology risks. These discussions occur through a combination of board briefings, executive committees, operational reviews, ethics and compliance meetings, and dedicated governance forums.

The judging panel highlighted the frequency and breadth of these conversations. Security and risk leaders have created a consistent cadence for sharing information, discussing priorities, and building alignment across business and technology stakeholders.

In addition, security and risk leaders actively engage executives on emerging topics such as agentic AI, quantum computing, and other developing technology risks. By helping executives understand both the opportunities and the investments required to manage these risks, CITGO demonstrates that trust leadership requires preparing for the future as much as managing the present.

A Commitment To Preparedness

The organization conducts extensive tabletop exercises across corporate systems, refinery operations, pipeline infrastructure, terminal automation systems, and retail environments. These exercises involve a broad set of stakeholders, including business leaders, cybersecurity teams, legal counsel, communications professionals, treasury teams, and executive leadership.

Notably, CITGO has partnered with external organizations including the CISA, TSA, and the Department of Homeland Security to conduct large-scale exercises involving senior leadership. These simulations help leaders understand the operational, financial, regulatory, and reputational implications of significant cyber events while strengthening organizational preparedness.

Judges noted the scope of participation across both business and technology leadership, as well as the company’s emphasis on realistic scenarios involving critical operational environments. The program reflects a belief that trust is built through preparedness, coordination, and the ability to respond effectively when business operations are under pressure.

Proactively Managing Emerging Risk

The company has begun integrating AI governance, identity-centric agentic controls, data protection, privacy oversight, and quantum computing risks into its broader enterprise risk management discussions. While many organizations remain focused primarily on experimentation, CITGO is working to establish governance, oversight, and accountability mechanisms that support responsible adoption of emerging technologies.

The judges viewed this balance between innovation and discipline as an important characteristic of trust leadership. Organizations must be prepared to embrace new technologies, but they must do so in a manner that maintains confidence among employees, partners, customers, regulators, and shareholders. CITGO demonstrated a clear commitment to that objective.

We look forward to welcoming CITGO at our Security & Risk Forum 2026 in Washington, DC, where we’ll host a live discussion with its CIO and security executives and present the award in person.

Share