Security Culture
Insights
Blog
HRM Grows Up: Introducing Forrester’s 2026 Human Risk Management Solutions Landscape
Forrester announced the shift of the legacy security awareness and training (SA&T) market in 2024 to human risk management (HRM), introducing a profound change of mindset, strategy, process, and technology for managing human-related breaches. These risks posed by and to humans continue to be expansive and include established and emerging attacks, such as deepfakes, misuse […]
Blog
Announcing Forrester’s 2026 Security & Risk Enterprise Leadership Award Winner: CITGO
CITGO is the winner of Forrester’s 2026 Security & Risk Enterprise Leadership Award. See how the company embeds security, risk management, and trust into business decisions, operations, and emerging technology planning.
Blog
Embrace Responsible AI To Forge The Trusted Future
As AI systems become more autonomous, security alone isn’t enough to build trust. Learn how responsible AI helps organizations govern AI agents, manage emerging risks, and keep systems aligned with business goals and values.
Blog
Four Things You Should Know About Security Champions Networks (But Probably Don’t)
Long before I joined Forrester, or even before I worked in cybersecurity, I volunteered with an informal group supporting my previous company’s security team. That experience stayed with me. It sparked my interest in cybersecurity and ultimately led me into the profession. Fast-forward to 2026, and I was thrilled to be asked to update our […]
Blog
The Future Of AppSec May Be Autonomous, But The Present Is Surprisingly Practical
AI is no longer a future feature in application security; it is rapidly becoming a core part of how application security (AppSec) tools identify, prioritize, and remediate risk. Yet despite aggressive vendor investment, adoption remains constrained by trust concerns, questions about value, and uncertainty about pricing models. In our new report, The State Of Artificial […]
Blog
An AI Security Facepalm: OpenAI’s Evaluation Became Hugging Face’s Incident
When an AI evaluation becomes a real-world security incident, leaders can no longer view model testing as a low-risk exercise. The OpenAI and Hugging Face incident reveals how agentic AI can cross trust boundaries, exploit vulnerabilities, and create business risk long before deployment.
Blog
Human Risk Management MythBusters: What’s True, What’s False, And What’s Evolving
In less than 12 months, wars escalated and reescalated, markets swung wildly, trade tensions intensified, and even rice prices elevated, causing chaos. The pace of change has been relentless, and that’s before considering the volatility facing security leaders from AI or cybersecurity threats. Also, less than a year ago, I published a blog on human […]