CISOs have been striving to evolve their security programs and focus more on addressing business risk issues than on responding to tactical security events. In 2008, we will see executives and business managers recognize the changing goals of security programs, and support efforts to align security structure, focus, and practices with these new goals.