Cybersecurity Awareness Month Quotes and Commentary from Industry Experts in 2026

For Cybersecurity Awareness Month 2026, the editors at Solutions Review have compiled a list of quotes, predictions, and commentary from leading experts across industries.

As part of this year’s Cybersecurity Awareness Month, we invited the best and brightest minds in the enterprise technology market to share their best practices, predictions, and personal anecdotes about the impact of artificial intelligence on their careers, companies, and more. The experts featured represent some of the top influencers, consultants, and solution providers with experience across industries, and each projection has been vetted for relevance and ability to add business value.

Cybersecurity Awareness Month Quotes from Industry Experts in 2026

Shiv Agarwal, Co-Founder and CEO at Singulr AI

Cybersecurity has always relied on human decision-making, but AI fundamentally changes that dynamic. Employees are no longer just interacting with static software; they are working alongside AI systems that access sensitive data, make recommendations, and, increasingly, take actions on their behalf.

This shift creates a significant control gap. In working with dozens of enterprises, we’ve found that more than 75 percent of employees were actively using unsanctioned AI tools before centralized controls were established. When someone pastes sensitive information into a prompt, acts on a hallucinated response, or approves what appears to be a routine request, the consequences can spread quickly. Give an AI agent excessive permissions, and a single mistake can trigger a chain of automated actions across enterprise systems and data.

The answer isn’t to place the burden on employees or simply ban AI tools. Shadow AI is often driven by people trying to work faster and more effectively, not by malicious intent. Security leaders need real-time visibility into how AI is used, what data it can access, what permissions agents have, and what actions they take. They also need runtime guardrails that continuously enforce policy and require human approval for sensitive or high-impact actions.

For Cybersecurity Awareness Month, the overall lesson is simple. AI doesn’t remove humans from the security equation it amplifies the consequences of their decisions. As AI becomes more autonomous, security must evolve with it, combining human judgment with continuous, enforceable guardrails that allow organizations to innovate while preventing an honest mistake from becoming a serious security incident.

Josh Bartolomie, VP, Global Head of Threat Intelligence at Doppel

AI is making social engineering faster, more scalable, and harder to distinguish from legitimate communication. The last few steps of a threat campaign typically include reading a compromised mailbox, identifying who can authorize a payment, and deciding who to impersonate, which used to take real-time and skill. That effort is what kept the volume down. Automating it has removed the only meaningful brake, allowing cyber-criminals to rapidly adapt and scale across channels such as email, SMS, chat, voice, and social media. This means we need to add more friction to our defenses and build a strategy around how threats actually unfold.

A mailbox compromise, for example, can be used to get one step ahead of the attacker. Look at what an attacker viewed or searched to identify the people, vendors, or transactions they may target next. This can help alert those at risk before stolen intelligence is used in a successful scam.

Similarly, ensuring employees are ready for today’s tactics can help slow these coordinated campaigns. Reusing the same training templates teaches people to recognize tests. Focus on training against what’s actually used in your industry, and make suspicious interactions easy to report by building independent verification into consequential requests. Attackers will continue to find new ways to make their jobs easier, and our focus should be on making every step of the attack harder.

Husnain Bajwa, SVP of Product, Risk Solutions at SEON

AI is making a lot of the old fraud signals less useful. A new device used to be suspicious. A login from an unusual location could set off an alarm. Activity happening faster than a human could realistically manage was another obvious clue. Now AI is letting anyone create convincing identities, make payments, and take over accounts in ways that look increasingly normal on the surface. The problem isn’t that we have fewer signals. It’s that any one of them can tell you a pretty convincing lie.

That gets even harder as AI agents start handling tasks for consumers, from shopping and banking to account management. We’re moving from asking ‘who is doing this?’ to ‘what is doing this, and should I trust it?’ You can’t answer that by checking a device or an identity once and calling it good. You have to connect the dots across someone’s digital history, the device, the network, and how the individual or agent is behaving in that moment.

That’s the shift security teams need to make. Stop looking for the one signal that tells you something is fraud. Look at whether the whole story makes sense. A device might look clean. An identity might check out. A transaction might look normal. But put those signals together, and you may see a completely different picture.

Ran Ben-David, Founder and CEO of Unibeam

Traditionally, the cybersecurity industry has spent a lot of time trying to teach people how to become better digital defenders when it comes to authentication. But as social engineering becomes increasingly sophisticated, there’s a limit to how much of our security strategies can depend on people consistently recognizing when they’re being manipulated.

As the industry has added more barriers to deter attackers, it has also inadvertently made human judgment a vital part of the authentication process – and attackers have learned to exploit that. We’ve effectively turned users into part of the security infrastructure, shifting some of the responsibility for preventing unauthorized access onto the very people authentication is supposed to protect.

In practice, this means we’ve made security awareness an unofficial part of the authentication process. A user may enter the correct password, use the correct device, and complete every authentication step successfully, but the security of that process can still depend on whether they correctly recognize the circumstances of the request. Unlike the technical factors we rely on to establish identity, human judgment can change with context, pressure, and increasingly convincing manipulation.

Cybersecurity Awareness Month is an important reminder that teaching people to recognize phishing and social engineering still matters, but we shouldn’t measure good security by how well we’ve trained people to compensate for an authentication process that still depends too heavily on their judgment. The industry needs to evolve authentication design to rely on stronger signals that establish identity, rather than on users recognizing threats in the moment. Security awareness should reinforce authentication, not function as an unwritten requirement for making it secure. After all, users shouldn’t have to get every security decision right when an attacker ultimately only needs them to get one wrong.

Gina Cardelli, a Principal Security Strategist at Fortra

Get the basics right before chasing advanced threats.

Most attackers still succeed through the old, familiar weaknesses: compromised credentials, excessive privileges, exposed systems, and just bad security hygiene. AI may make attackers faster and more scalable, but it doesn’t make those fundamentals less important. If anything, it raises the cost of ignoring them.

Limit your blast radius and assume something will eventually go wrong.

AI is changing the threat landscape, but it doesn’t replace the basics. The entry point could be phishing, stolen credentials, prompt injection, or an abused AI agent, but your goal should be the same: containment. Understand what your AI can reach and do, and understand the worst-case scenario for your AI use case so you can plan for it. Use least privilege, segmentation, human approval for actions, logging, and continuous monitoring. You won’t get perfect prevention, but you can try to make every step of the attack harder, noisier, and less consequential.

Sivasankaran Chandrasekar, Chief AI Compliance and Security Officer at Eightfold AI

AI has changed the security landscape for everyone, attackers and defenders alike. The same frontier models that can find a flaw in seconds are now available to anyone who wants to exploit one, so the old rhythm of periodic reviews and annual pen tests can no longer keep pace. The organizations that stay ahead will be the ones that leverage AI on their own systems first, and do it continuously, before an adversary can.

That means security can’t be a checkpoint at the end of development. It has to be built into every stage: code reviewed as it’s written, systems scanned every day rather than once a quarter, new features tested against realistic attacks before they ship, and alerts triaged around the clock so human experts can focus on the threats that actually matter. AI won’t replace the judgment of skilled security teams, but it changes what those teams can do and how fast they can do it. This Cybersecurity Awareness Month, my message is simple: in the age of AI, security is a posture, not a project, and it has to move at the speed of the technology it protects.

Kevin Charest, CISO and VP of Cyber Governance Services at Netrio

Mid-market organizations face the same security threats as large global enterprises, but they do so with a fraction of the resources. What I repeatedly see is understaffed IT teams trying to stitch together fragmented tools, resulting in a reactive posture rather than a resilient one.

Mid-market IT leaders need to focus on three fundamentals: clear visibility across their environment, outcome-driven security aligned to regulatory requirements, and a realistic plan to address ‘unpatchable’ technical debt through compensating controls. Cybersecurity can’t be treated as a luxury line item anymore; it determines how quickly you can withstand and recover from attacks in order to protect your day-to-day operations. It must be a top priority for businesses of any size.

Tim Chase, AVP Cybersecurity at Fable Security

For years, phishing dominated the Cybersecurity Awareness Month conversation, with employees taught to constantly scrutinize suspicious emails, links, and attachments. Those threats remain, but AI has greatly expanded the challenge for everyday workers. Employees must now question whether a job candidate is real, whether the familiar face on a video call is a deepfake, and if a request delivered in their CEO’s voice actually came from their CEO. Today, your boss’s voice or a colleague’s face on Zoom is no longer enough proof.

These risks are already showing up inside real organizations. Earlier this year, suspected North Korean IT workers used manipulated identities to secure jobs at healthcare and financial services companies. In another incident, attackers used a deepfake of an executive during a video call to convince a cryptocurrency executive to install malware. In 2024, a Ferrari executive received a call that appeared to come from CEO Benedetto Vigna, complete with a convincing clone of his voice and accent. The fraud was only exposed when the employee asked a personal question the caller could not answer.

Security awareness programs need to reflect the speed and ambiguity of these ordinary workplace moments. The people targeted in these incidents were not necessarily careless; they were experienced professionals working under pressure and relying on familiar signals of trust. But that’s exactly the point. These tactics rely on you simply being human. Organizations should focus on giving employees opportunities to experience these situations before they encounter them in real life, using current threats and realistic decisions rather than generic examples from last year. The real test of awareness comes when an employee pauses, verifies, and stops a convincing fake from becoming a real incident.

Jack Cherkas, Global Chief Information Security Officer at Syntax

Cybersecurity Awareness Month is usually a reminder to get the fundamentals right, and that is still absolutely critical. This year, however, the National Cybersecurity Alliance has adopted the theme “Don’t Make It Easy for Them,” and that message should also prompt organizations to consider a growing source of risk: artificial intelligence (AI).

As organizations and individuals adopt AI, we need to remember that AI is not just another technology. It has the potential to be transformational. It can hold accounts and permissions, see whatever you give it access to, and take actions on your behalf. Many organizations and individuals have never considered the implications of these actions.

So, as the world embraces AI, we must determine three things before access is granted: what it can see, what it can do, and who is responsible for it. And we also must remember that, in many cases, AI appears even when we never chose it. It’s in the tool approved three years ago that quietly shipped an AI-infused update, the browser extension or the application add-in. Some AI adoption arrives without a decision, and the things nobody decided on are the things nobody is watching.

“Don’t Make It Easy for Them” is the right tagline for this year. For organizations, that means adopting AI in a pragmatic, secure, and responsible manner. For individuals, it means 10 minutes in your settings. Neither is hard. Both are overdue for many.

Andrew Costis, Engineering Manager of the Adversary Research Team at AttackIQ

A security control that has never been tested against the behavior it’s supposed to stop is still an assumption. Cybersecurity Awareness Month should encourage organizations to challenge more of those assumptions.

Would an endpoint control catch the lateral movement technique your threat model says you’re worried about? Would an identity control interrupt privilege escalation? If one defense failed, would another detect or stop the attack before sensitive data was reached? These questions can, and should, be tested before an incident.

CTEM gives organizations a continuous way to identify and prioritize exposure. Adversarial exposure validation adds evidence by testing defenses against real-world attacker tactics and techniques. The result goes beyond a theoretical risk score. Teams can see where tested protections work, where they fail, and whether remediation closed the gap.

Awareness helps you understand what attackers might do. Validation shows how your defenses respond when those behaviors are tested.

Frank Cotto, Field CTO, Infrastructure Management & Operations at Progress

Cybersecurity Awareness Month offers a valuable opportunity to reassess whether cybersecurity is keeping pace with AI adoption. As technology becomes embedded across applications, networks, and devices, IT environments are becoming increasingly complex, making it harder to maintain visibility and control. This gap is growing within US businesses; while 39% of U.S. organizations piloting agentic AI say they’re prepared in risk, security, and governance, a staggering 70% of U.S. leaders say they don’t feel they can adequately trust and govern AI agents.

Addressing this disconnect means building cyber resilience into infrastructure from the outset. Businesses need visibility across networks, applications, and devices so teams can identify unusual activity and respond quickly when something goes wrong. But visibility alone is not enough. Security and operations teams need to work more closely together, sharing intelligence and context across the same infrastructure rather than operating in isolation. As AI becomes more distributed, this joined-up approach will be critical to maintaining control and supporting the technology securely at scale.

Anthony Cusimano, Solutions Director at Object First

In 2026, the cybersecurity conversation needs to move beyond whether an organization can prevent an attack to whether it can actually recover from one. Ransomware is increasingly testing the systems businesses depend on after an attack, yet there is still a major gap between knowing what good cyber resilience looks like and putting it into practice. A majority (93%) of technology leaders believe backup storage should remain protected even if administrative credentials are compromised, but only 16% have implemented storage with Absolute Immutability.

Arguably more important than the business repercussions, the preparedness gap is taking a significant toll on the people responsible for protecting them. Our latest research found only 37% of IT and security professionals are confident they could completely recover their company’s data after a ransomware attack, while 91% report being uncomfortably stressed at work over IT security risks.

This Cybersecurity Awareness Month, organizations need to recognize that cyber resilience is also about giving IT teams the confidence, tools, and support to respond when an attack happens. Simplifying recovery, protecting backup data from modification or deletion, and regularly testing recovery plans can reduce uncertainty for the people on the front lines while making the business more resilient. The goal isn’t just to survive an attack, but to know that the business and the people responsible for its recovery are prepared when one happens.

Daniel DeCloss, Chief Customer Officer at Brinqa

Organizations need to confront an uncomfortable reality this Cybersecurity Awareness Month: despite having more security tools than ever, have they actually reduced their risk of a cyberattack?

Tool sprawl is flooding security teams with disconnected findings, making it harder to determine what vulnerabilities matter. Treating each as equally urgent only compounds the problem, slowing down remediation and burning out practitioners.

As attackers use AI to move from discovery to exploitation faster, organizations need a unified view of exposure that connects severity with exploitability, asset criticality, existing controls, and business impact. This context allows teams to identify the risks most likely to cause harm and act before attackers do. Trying to close the most tickets is a losing game in the AI era. Organizations must measurably reduce their most consequential risks. That is the only way cybersecurity awareness translates to meaningful and sustained resilience.

Avani Desai, CEO at Schellman

There’s a saying we use as auditors: trust, but verify. It holds especially true today. Trust isn’t built by saying the right safeguards are in place. It’s built by being able to prove they actually work.

Cybersecurity Awareness Month is a good reminder that security can’t be a check-the-box exercise. If organizations think about cybersecurity as simply a compliance exercise, they are missing the point. The question isn’t just whether you have the right controls on paper. It’s whether they are actually working and protecting the business.

Technology is moving faster than humans can keep up, and AI is accelerating that even further. What worked six months ago may not be enough today. As AI becomes embedded across the business, organizations have to answer some fundamental questions: Who has access to the data? How are decisions being made? Where are the risks changing? And who is accountable when something goes wrong?

We’re already seeing a gap between confidence and reality. Schellman’s 2026 State of AI Governance research found that 74% of organizations believe they could pass an AI compliance audit today, but only 27% say their governance programs are fully mature. That gap matters. Passing an audit or having a policy doesn’t automatically mean you have strong security. You have to be able to prove that your controls are working consistently in practice.

Security has to evolve as quickly as the technology and threats around it. That means continually understanding where your risks are changing, testing whether your controls are actually working, and making accountability clear across the business.

Victoria Dimmick, Chief Executive Officer at Titania

Cybersecurity Awareness Month’s theme, “Don’t make it easy for them,” is a useful reminder that many successful attacks don’t start with a highly sophisticated technique. They start with an opportunity we’ve left open. Attackers rarely need to innovate when basic network infrastructure remains neglected and exposed.

That could be an unpatched vulnerability, an unnecessary route to the internet, an overly permissive access rule, or a temporary exception that was never removed. Individually, these can seem like small issues. But attackers increasingly use automation and AI to find and exploit weaknesses faster, making the basics more important, not less.

The challenge is that organizations often assume the controls they have put in place are still working as intended. Networks change constantly. Devices are added, firewall rules are updated, permissions change, and configurations drift. A policy that was correct six months ago does not tell you whether your network is secure today.

Making life harder for attackers means reducing the opportunities available to them. Harden your infrastructure. Segment your network. Remove access that isn’t needed. Apply least privilege and, importantly, regularly validate that those controls are actually being enforced.

Good cybersecurity isn’t just about responding quickly when something goes wrong. It’s about making sure attackers have fewer places to go in the first place. Verify it. Don’t assume it.

Carolyn Duby, Field CTO and Cybersecurity Lead at Cloudera

Cybersecurity conversations around AI often center on familiar risks such as data leakage, model vulnerabilities, and overly broad access permissions. While important, these risks obscure a larger reality: most enterprise security controls were designed around human behavior, whereas AI agents operate fundamentally differently.

AI agents can consume vast datasets, interact across disparate systems, and execute autonomous actions at a speed no human can match. In doing so, they expose assumptions and systemic weaknesses in data security and governance that a human user may never encounter or exploit.

Enterprises need to limit an agent’s potential blast radius, continuously validate its behavior, and apply consistent security and governance to the data it interacts with, wherever that data resides. Whether AI runs in the public cloud, a private environment, or across both, those controls cannot disappear at infrastructure boundaries.

Cybersecurity Awareness Month is a timely opportunity to reinforce a principle that extends well beyond October. Security must evolve alongside the technologies it is designed to protect. As enterprises give AI agents greater autonomy and responsibility, cyber resilience will increasingly depend not on assuming those agents will remain within their guardrails but on having the visibility and controls to monitor, contain, and audit what happens when they do not.

Ross Filipek, CISO at Corsica Technologies

A company can have endpoint protection, backups, and MFA and still have a very bad day if nobody knows who is supposed to make the first call. It’s that part of cybersecurity, the dysfunction, that often gets overlooked.

For midmarket businesses, incidents land in the hands of small IT teams every day, and they’re expected to investigate the attack, keep employees working, communicate with leadership, and coordinate recovery all at once.

Preparation should reflect that reality. Organizations need to know which systems absolutely have to stay running. They need recovery plans people have actually practiced. Leadership should understand when outside help gets involved. Employees should know where suspicious activity gets reported without having to hunt for the right process during an emergency. Cybersecurity awareness isn’t only knowing how attacks happen. It’s also knowing how your organization will function after one does.

Elyse Gunn, Chief Information Security Officer at Nasuni

As a security practitioner, I’ve seen firsthand how quickly cybersecurity risks escalate as organizations scale new technologies, and AI is no exception. Companies are investing heavily in governance, guardrails, and the security of AI applications and agents themselves, but it is just as important to understand and protect the data foundation beneath them. Nasuni found that 71% of organizations experienced a cyberattack in the past year, while only 26% said they were able to easily detect, mitigate, and recover from those attacks. As enterprises continue to scale agents across distributed environments, that gap in resilience becomes harder to ignore.

Cybersecurity Awareness Month is a good reminder that protecting AI cannot stop at the application layer. Data attacks do not always look like traditional attacks, which makes visibility, governance, and recovery capabilities across the data layer critical. Enterprises should know what data they have, where it lives, who can access it, and what happens if that data is compromised. Building protections such as immutable snapshots, anomaly detection, and rapid recovery into the data environment can give teams another layer of defense and help them respond and recover faster when threats emerge.

Mathi Gurusamy, Chief Strategy Officer at Lantronix

Having fallback infrastructure is critical: you need it to maintain operations and ensure security in the event of an outage or a cyberattack. During Cybersecurity Awareness Month, we can further reflect on the importance of systems that support business continuity before they’re needed. Out-of-band management is core security infrastructure. It separates routine administration from the production network. It’s not a luxury, but an independent, trusted access path when primary controls are unsafe.

Nabil Hannan, Field CISO at NetSPI

This Cybersecurity Awareness Month, it’s becoming clear that AI is changing some of the assumptions security programs were built around. AI systems can operate across applications, data, and team boundaries, while attackers can use the same technology to move faster and explore more paths into an organization. Security teams need to understand not only individual weaknesses, but how those weaknesses connect and what an attacker could do with them.

As AI becomes more capable, human expertise becomes more valuable, not less. AI can give defenders greater speed and coverage, but that puts an even greater premium on the context and judgment needed to understand business logic, anticipate attacker intent, and decide how to respond. The advantage comes from pairing that scale with people who can interpret what they’re seeing, think like an attacker, and turn those insights into action.

Brittney Harrell, Head of Information Security at Nabla

Cybersecurity Awareness Month is a good reminder that security is fundamentally about education. When someone introduces risk into an organization, it may be because they don’t fully understand the security implications of what they are trying to do. Security teams have an opportunity to close that knowledge gap rather than simply becoming the ‘department of no.’

I like to start by asking questions. What are you trying to achieve? Are you aware of the constraint? Is there another way we can accomplish the same goal? The answer may still be no, but explaining why helps people better understand the risk and makes security a partner in the process.

That matters even more in healthcare because of the data we’re responsible for protecting. Patient information is incredibly sensitive, and everyone who works with that data has a role to play in protecting it by understanding the risks and knowing when to ask for help.

Andrew Hartnett, Chief Technology Officer at Bitwarden

AI is expanding the number of identities and access paths organizations need to secure. As these tools become embedded in everyday work, organizations should apply privileged access principles to any AI system that can access sensitive data or act on their behalf. That means granting only the permissions required for a defined task, defaulting to read-only access where possible, requiring human approval for consequential actions, and removing access when it is no longer needed.

Organizations already face a privileged access gap, and AI is raising the stakes by adding more identities and access paths to govern. Recent Bitwarden research found that 84% of respondents rated securing privileged account access as extremely or very important, yet 55% said their organizations had no PAM solution in place.

Strong access controls still depend on securing the underlying identities and credentials. Human accounts should use phishing-resistant authentication such as passkeys where available, or strong, unique passwords stored in a password manager and protected by multifactor authentication (MFA).

Machine credentials such as API keys and shared secrets should be tightly scoped, securely stored, rotated, and retired when no longer needed. Regularly reviewing connected applications and revoking unused access can help prevent a compromised account or overly permissive AI integration from becoming a much larger security incident.

Ryan Ikeler, President at MOXFIVE

Cybersecurity Awareness Month advice usually focuses on faster patching, more training, and better backups. That advice isn’t enough anymore. AI is helping attackers map victim environments faster and more deeply than many organizations can defend against, making containment harder when defenders lack visibility into their own environments.

Closing one access path doesn’t end an incident if the attacker still understands your environment better than you do. Awareness of this threat is no longer enough. If every secret in your environment had to be rotated today, how long would that take? Could you hold the perimeter while it happened? The organizations that recover fastest already know the answer and can give their forensics team the right logs just as quickly.

Al Iverson, Industry Research and Community Engagement Lead for DigiCert

Before shoppers click buy this season, it takes two seconds to make sure they know who they’re dealing with. The good news is that trusted brands are showing their credentials in your inbox. A logo next to the sender’s name, backed by a Verified Mark Certificate or Common Mark Certificate, means an independent authority has confirmed the brand behind that email, and a blue checkmark goes one step further by confirming the logo is the brand’s registered trademark.

On a checkout page, the padlock means the connection is encrypted, so payment details can’t be read in transit. Shoppers will likely also start seeing a small icon on photos and videos online, which shows where the content came from and whether it’s been edited. If any of these signals are missing, shoppers need to slow down before sharing any information.

Ron Kerbs, Founder and CEO of Kidas

AI voice cloning has made scam calls much harder to catch, because the voice on the line can sound just like a coworker, a manager, or someone from your bank. So this Cybersecurity Awareness Month, I’d push back on the idea that people should be able to hear a fake, especially when the caller sounds stressed, and the instinct is to help. Scammers also adjust quickly once a tactic gets flagged or blocked, which is why advice built around specific red flags tends to go stale.

What concerns me more is how little skill this now takes. Scam kits are sold ready to use, with fake bank websites, forms, and messaging channels already built, and scammers pair them with data from breaches that occurred years ago, allowing them to reach a specific bank’s customers by name. Calling back to a number you know is still good practice, but it shouldn’t all come down to the person who answered the phone. The better answer is catching the cloned voice during the call, so nobody is left trying to figure out whether it’s real.

Joseph Kim, CEO of Druid AI

Attackers don’t need to fool your employees anymore — they just need to fool your agents. One hidden instruction, buried in an email, a support request, or a web page, is enough to make an agent do something its creator never intended. Every agent a company deploys is a new hire with system access, and no one hands a new hire the keys to every database on day one. An agent built to handle a billing problem should never be able to export the customer list.

Here’s the standard: give every agent its own identity, the minimum access it needs to do its job, a full log of everything it touches, and a kill switch a human can hit without asking permission. Then test it. Who gets notified when the agent behaves strangely? How fast can you cut its credentials? Can your audit log actually show what it accessed, or just that something happened?

Cybersecurity Awareness Month has spent years telling people to stop and think before they click. That same discipline now applies to the software clicking on their behalf. Build these controls in from day one, and you move fast with confidence. Bolt them on later, and you’ll learn the hard way.

Poonacha Kongetira, CEO and Co-founder of Classie AI

Cybersecurity Awareness Month is a good time for enterprises to ask a question that has become surprisingly difficult to answer: do we know what AI is running inside the business?

Shadow AI is no longer just an employee opening ChatGPT in another browser tab. AI is appearing across browsers, endpoints, and SaaS applications, while agents are being connected to company data, business systems, and credentials so they can do work on a user’s behalf. Some of that activity will have been formally approved, and some will not, but from a security perspective, the problem starts in the same place. If you cannot see it, you cannot understand what it can reach or what it is doing.

AI does not behave like traditional software that can be tested once and expected to keep doing the same thing. Its behavior changes with the user, the context, the data it encounters, and the tools it can access. Cybersecurity teams therefore need to know more than which AI tools have been approved. They need comprehensive visibility into how users are using AI tools and connected enterprise information. This high bar is what is needed to keep the enterprise secure.

Dan Lohrmann, Field CISO at Presidio

This Cybersecurity Awareness Month, everyone is understandably very concerned about AI risks. But there’s another significant cybersecurity threat being overlooked: Ransomware attacks are quietly surging, hitting critical sectors like healthcare and utilities (including water systems), and making it harder for organizations to recover.

The stakes are higher than ever for unprepared companies, which often don’t have sufficient visibility and control over their IT environments, especially with the addition of AI agents. Deploying AI responsibly means working with the right partners, ones who think of security as a key part of the integration from the beginning, not an afterthought or add-on. In most cases, this means deploying non-human identity governance, a zero-trust architecture, and strict network micro-segmentation.

Jon Lucas, Co-Founder and Director at Hyve Managed Hosting

Cybersecurity Awareness Month is also an opportunity for organizations to look beyond the threats and technologies that receive the most attention and examine the infrastructure they rely on every day. File transfer systems are a good example. They can move sensitive information between employees, customers, partners, and critical applications. Yet, because that activity is so routine, these systems can become an overlooked part of the enterprise attack surface. Security teams should ask whether access is appropriately restricted, authentication is strong, and the underlying infrastructure is consistently patched and monitored.

It is also a good time to think about sensitive data in motion. Organizations cannot just think about where that data ultimately resides. They need visibility into how files move between users, systems, and environments, who can initiate or receive those transfers, and whether unusual activity can be identified quickly. Ultimately, strong security means giving all systems equal attention, from the everyday tools to the more visible parts of the stack.

Andy Lunsford, CEO at BreachRx

The question is not if, but when an organization faces a cyber incident is truer now than ever before. Offensive AI is increasing the volume, speed, and sophistication of attacks. It gives adversaries more opportunities to create noise, launch related activity in parallel, and force decisions before the facts are fully clear.

This is where cyber readiness becomes a business issue. Security may be able to contain part of the activity quickly, but leaders still need to decide whether to take a system offline, notify customers, involve outside counsel, or communicate with employees and the board. Those decisions carry legal, operational, and reputational consequences. They also need to be made before anyone has a complete picture.

Cybersecurity Awareness Month is a good opportunity to ask hard questions. When several things are happening at once, how will we know which facts are solid enough to act on? Can the organization distinguish confirmed facts from open questions? Is it clear who has authority to make a decision? Can the company communicate carefully as the picture develops? AI will continue to change the threat environment. Sound judgment and clear accountability will matter even more when multiple events are moving at the same time.

Ross McKerchar, CISO at Sophos

The expectations put on CISOs and their teams are at an all-time high. Today’s security leaders are expected not only to manage threats, but also to communicate risk to boards, navigate regulatory requirements, and guide business decisions while maintaining an extremely secure environment.

AI is only adding more pressure to the equation, with security teams finding themselves in what we call a triple bind: AI is accelerating vulnerability discovery, introducing a growing population of AI agents that need to be secured, and enabling more code to be written and reviewed than teams have historically been staffed to manage. Each of these trends increases workload on its own, but together they fundamentally reshape how security teams prioritize their work.

As those demands continue to grow, many organizations are finding themselves competing for a limited pool of senior security talent capable of managing both today’s security risks and tomorrow’s business challenges. The organizations that will be most resilient are those that treat cybersecurity as a shared business responsibility and ensure security leaders have the support, visibility, and resources they need to succeed.

Scott Miserendino, Chief Technology Officer at DataBee, A Comcast Company

Cybersecurity Awareness Month shouldn’t just be about reminding employees not to click suspicious links. It’s an opportunity for organizations to examine how they manage risk, govern emerging technologies such as AI, and ensure that security practices keep pace with a rapidly changing threat landscape.

Employee awareness training remains one of the most effective security investments organizations can make. While phishing continues to be a major threat vector, security leaders also need to educate employees about newer risks, including unsanctioned AI tools, data exposure, and the growing sophistication of AI-assisted attacks.

AI governance shouldn’t be treated as a bolt-on initiative. It should be integrated into an organization’s broader cybersecurity, risk management, and governance framework so that policies, controls, and oversight evolve together.

Every major technology shift creates new risks, but it also creates an opportunity to modernize. Security leaders should use the urgency around AI to revisit broader governance, visibility, and risk management challenges that may have been sitting on the back burner. The organizations that take a holistic approach will be better positioned for what’s next.

Corey Nachreiner, Chief Security Officer at WatchGuard

Every Cybersecurity Awareness Month, I give the usual tips: patch your stuff, use a password manager, don’t click that link. Those still matter. But AI is the first technology since the smartphone that everyone adopted before anyone secured it, and that’s where the spotlight belongs this year. People are already trusting AI with work tasks, everyday questions, and deeply personal conversations. Before you type, ask three things: What am I sharing? Who can see it? What is this tool allowed to do on my behalf?

That third question is the one changing fastest. AI has moved beyond chat and is starting to take action for us. When you connect an agent to your email, files, calendar, or financial accounts, you’re not giving it a tool; you’re handing it your keyring. Whatever you can do, it can do. And so can anyone who gets into that account.

Your AI login has quietly become the skeleton key to your digital life, which makes it an increasingly attractive target for threat actors. Protect it like your primary email or your bank: turn on multi-factor authentication, stay skeptical of unexpected links and login prompts, and pause before approving a new integration or pasting something sensitive. Know what you’re trading, because with many free AI services your data is part of the price. Check what the tool says it does with your conversations.

For businesses, the risk is shadow AI, and it’s bigger than the chatbot in a browser tab. It’s the plugin, the extension, the integration nobody told security about. You can’t secure what you can’t see. Organizations need to know which AI tools are in use, where their data is going, what their license and data agreements actually permit, and what privileges those tools hold. Visibility first, then policy, then enforcement. That’s the order we followed at WatchGuard to build our own shadow AI safeguards, and it’s what lets a team decide what’s allowed, what gets switched off, and where controls belong.

Edwin Ng, Chief Information Security Officer of LogicGate

This Cybersecurity Awareness Month is an ideal time for CISOs and risk management teams to rethink their governance, risk, and compliance (GRC) practices as an essential strategy for tackling modern cybersecurity challenges.

As AI fundamentally changes the game for how cybersecurity teams navigate new risks, GRC serves as a “secret weapon,” helping organizations holistically assess where their greatest vulnerabilities lie, fortify areas of their business where unaddressed cyber risks may create the most damage, and proactively plan ahead to prevent those threats from happening in the first place.

However, to mitigate risk in an increasingly AI-centric digital environment, GRC can’t be deployed in a vacuum; it needs to be built on a cybersecurity foundation that prioritizes safe AI deployment and proper human oversight. That’s why organizations must start with the fundamentals: defining their AI risk appetite, establishing clear governance parameters, and breaking down departmental silos to build a unified view of risk. It also means establishing a culture of accountability that sets clear rules of ownership and creating a common security language company-wide to maintain consistency. Once those fundamentals are established, organizations can unlock the full value of GRC and balance AI innovation with responsible governance to maximize ROI of their solutions.

Jaren Nichols, President and COO of PDQ

While it takes more than a single initiative to build resiliency, promoting fundamental security practices throughout the year is important for improving cybersecurity posture. This starts with having awareness of the endpoints, applications, and users in your environment. Keeping your software and operating systems up to date, using strong forms of authentication such as multi-factor authentication, and teaching users to identify phishing are several ways to start.

However, automating many routine tasks for maintaining and securing endpoints allows IT teams to focus on preparing for disruption, building out incident response and business continuity capabilities, and supporting the rest of the business throughout the year. Awareness needs to become business as usual and not a yearly campaign. Cybersecurity awareness is most effective when it becomes part of daily operations – not a once-a-year exercise.

Cynthia Overby, Director of Strategic Security Solutions, ZCOE, at Rocket Software

As organizations recognize Cybersecurity Awareness Month, the conversation around enterprise security is shifting from whether protections are in place to whether they can keep pace with a rapidly changing threat landscape.

While 69% of IT Leaders cite data security as their top modernization concern, only 24% are extremely confident in their organization’s ability to address mainframe vulnerabilities over the next year. AI is increasing the speed and scale at which vulnerabilities can be identified and exploited, while hybrid environments create more connections between systems and more potential paths to critical data. Security teams need to account for that complexity by understanding where meaningful risk exists across the entire technology estate.

Security teams need a more consistent way to understand how their environments are changing and where new risks are appearing. That means regularly checking for vulnerabilities and missing patches, testing whether controls are still working as intended, and determining which issues need attention first. This becomes even more important as organizations add AI and modernize systems that support critical business operations. Security needs to be built into that work from the start, so teams are not trying to catch up with new risks after the fact.

Daniel Pataki, CTO at Kinsta

A breach doesn’t end when a website comes back online. If someone gained access, the team still needs to know what changed, whether customers saw those changes, and which backup is safe to restore from. That’s difficult to work out for the first time while the site is down.

Businesses should test their recovery process before they need it and keep a clear record of who can make changes to the site. Getting back online quickly matters, but restoring a compromised version puts customers right back where they started. You need to understand what happened before you can say the site is safe to use again.

Katie Paxton-Fear, Staff Security Advocate at Semgrep

There’s an awkward reality coming to light in the cybersecurity world: developers are being told to ship faster at the exact moment security teams need more scrutiny over what gets shipped. Most developers want to build securely, but they’re also under real pressure to get code out the door.

AI has poured gasoline on that tension. A developer can now generate a feature, integration or entire block of application logic before a traditional security review would have even started. The model may produce perfectly functional code. It may also choose an insecure function, misunderstand a trust boundary, or introduce a vulnerability the developer doesn’t know to look for.

“Write this securely” isn’t enough context for an LLM. Security has to move closer to creation. Code should be checked while it’s being written. AI-generated changes should get the same scrutiny as human-written ones. Findings also need sufficient context to explain whether a weakness is genuinely exploitable, rather than burying developers in another pile of warnings. The goal is to help developers move quickly without making security another obstacle to getting good code out the door.

AI isn’t removing developers from the security process. It’s making good developer guardrails more important. If software creation is going to accelerate, secure development can’t remain the part everyone waits on at the end.

Steve Povolny, Vice President of AI Strategy & Security Research at Exabeam

The security industry has spent years teaching people what suspicious looks like: bad grammar, strange links, logins from impossible locations. Attackers have been adapting to those lessons, too.

A stolen session token can authenticate normally. A compromised employee can use applications they’re supposed to use. A North Korean IT worker can enter through the hiring process rather than an exploit chain. An AI agent can take authorized actions and still produce an outcome nobody intended.

That’s why individual events are less meaningful in isolation. Modern detection has to understand behavior over time. What does this identity normally access? Which systems and applications does it use? How does today’s sequence compare with its behavior over the past several months?

The signal may not be one dramatic action. It may be a series of legitimate actions that have never occurred together before. Employees can and should report an unusual request or interaction, but we can’t expect them to recognize a valid login, an approved tool, or a sequence of routine actions that only becomes concerning in context. Security programs and detection need to account for that ambiguity. Sometimes the credentials are valid, the tools are approved, and each action looks normal. Behavioral context is what gives security teams a chance to see when those normal-looking pieces stop adding up.

Scott Richards, SVP of AI & Discovery and Cybersecurity at OpenText

Every major technology shift creates pressure to rethink security, and AI is no exception. What we’re discovering, however, is that AI isn’t replacing security fundamentals. It’s exposing where organizations failed to implement them in the first place. As enterprises adopt AI-powered development and autonomous agents, Cybersecurity Awareness Month serves as an important reminder that visibility, identity, governance, and accountability remain the foundation of cyber resilience.

For years, security teams have focused on finding a single critical vulnerability that could lead to a breach. In the age of AI, the bigger concern may be how attackers can use automation to identify and exploit dozens of seemingly minor weaknesses at scale. Organizations need to move beyond evaluating risks in isolation and start understanding how vulnerabilities interact across the broader environment.

Cyrus Robinson, SVP of Security Operations at C3

Cybersecurity awareness cannot stop at completing annual training or simply recognizing phishing emails. Organizations need to understand what happens when something gets through the first line of defense, which alerts require action, who owns the response, and how that response will be carried out. A security tool does not answer those questions on its own.

Putting that awareness into practice means helping teams recognize what needs their attention and understand what to do about it. That becomes harder when teams are overwhelmed by alerts, which is why reducing noise matters. Dozens of alerts may relate to the same activity, and sending every alert to a client does not improve security.

The goal should be to connect related activity, determine what is actionable, and escalate it to the right people with the context they need to respond. That requires documented playbooks, clear ownership, and human-in-the-loop analysis. Compliance requirements, including CMMC where applicable, are important, but they should be treated as a baseline for security readiness, not the end goal.

Maintaining those capabilities can be difficult for organizations without a large security team. Continuous monitoring and response should be paired with advisory support that accounts for the organization’s regulatory environment, business priorities, and existing technology. When the same team can monitor, investigate, and respond without unnecessary handoffs, teams are better prepared to understand what happened, decide what to do next, and make cybersecurity awareness part of everyday practice.

Dave Russell, SVP of Strategy at Veeam Software

For years, cybersecurity awareness meant spotting phishing emails and bracing for ransomware. That playbook is now dangerously incomplete. In the agentic era, awareness means knowing what your AI agents are accessing, whether the data they’re acting on is trustworthy, and how fast you can recover when an agent, or an attacker posing as one, takes the wrong action. At machine speed, there’s no time to assume trust. It has to be engineered in and verified continuously.

So, here’s my challenge this Cybersecurity Awareness Month: stop talking about trust and start proving it. That means recovery you’ve actually tested, data you know is clean, and certainty that what you restore isn’t the attack coming back in. Resilience you can’t prove is just optimism.

Jackson Schultz, CEO and Co-Founder of ArgusEye

Cybersecurity teams have long relied on vulnerability severity to decide where to focus their attention. But as more software becomes embedded in systems and devices that interact daily with the physical world, technical severity alone doesn’t always reflect the full risk level. A vulnerability that appears critical on its own may pose limited real-world risk, while a less severe one could seriously disrupt operations, damage equipment, or put people in harm’s way.

Securing cyber-physical systems requires organizations to understand more than individual vulnerabilities. They need visibility into how devices and software are connected, what an attacker could potentially access through those connections, and what those systems ultimately control. Securing each component individually doesn’t necessarily mean the broader system is secure—particularly when connections between them can create hidden attack paths.

That also means the same vulnerability can have very different levels of risk depending on where it exists. For example, a flaw in two identical devices may carry the same level of technical severity, but if one sits at the edge of an isolated system and the other provides a path to shut down machinery on a factory floor or interfere with systems controlling a water treatment facility, treating them as equivalent misses a fundamental part of the risk.

None of this means that technical severity should be disregarded. Rather, it should be treated as a starting point for understanding risk, not the final answer. Organizations need to pair it with an understanding of how a vulnerability fits into the broader system, the pathways an attacker could exploit, and the real-world consequences that could follow. This Cybersecurity Awareness Month, the goal shouldn’t simply be to find and fix more vulnerabilities—it’s to understand which ones have the potential to cause the most harm before that risk becomes a real-world consequence.

Piyush Sharrma, co-founder and CEO at Tuskira

Picture two vulnerabilities. One carries a critical severity score but sits on an isolated system with strong controls around it. The other looks far less dramatic. It happens to connect an exposed application to a privileged identity and then to production. Which one gets fixed first?

For years, vulnerability management has made it too easy to answer that question based solely on severity. Attackers aren’t working from a sorted CVE list. They’re looking for combinations of weaknesses that get them somewhere useful.

AI-assisted attack-path analysis can trace those combinations across identity, cloud, network and application environments. It can show which weaknesses are actually reachable. It can also identify whether an existing control cuts off the path before an attacker reaches something valuable. Organizations don’t need more awareness of how many vulnerabilities they have. Most already know the number is uncomfortable. They need a better understanding of which ones can become a breach.

Akinobu Shimada, CEO of Hitachi Vantara and President of Hitachi Vantara Japan

Cyber resilience requires businesses to be prepared to continue operations and recover quickly when an attack succeeds. Critical data must remain protected, trusted, and recoverable, even when systems or credentials are compromised. AI is providing organizations with new ways to protect data, but as recent headlines have shown, AI-powered cyber-attacks are also posing a greater threat to businesses, governments, and society at large. AI attackers can operate with greater speed, scale, and sophistication than human hackers, meaning that it’s only a matter of time before your data is potentially compromised.

During Cybersecurity Awareness Month, it is important to recognize that cyber resilience is a leadership responsibility. Business leaders must broaden their approach to focus on resilience as much as prevention. Responsible AI adoption depends on a well-managed data foundation, with resilience built in from the beginning. This helps AI operate effectively and create value.

Aaron Smith, Head of Threat Hunting at Tanium

As the country embarks on our next 250 years, security operations teams need to account for two things happening at once right now: attackers are getting faster and quieter. AI is shrinking the window between a vulnerability being disclosed and exploited, while attackers are getting quieter as they increasingly use legitimate tools, valid credentials, and normal user behavior to blend in.

The issue is that most security teams are still structured reactively, not proactively — waiting for an alert, then investigating. That model breaks down the moment attackers stop generating the kind of activity alerts are tuned to catch. I’ve seen organizations go from over 700,000 unresolved alerts to fewer than 100 a day — not because threat volume dropped, but because a governed hunting engagement moved them from chasing alerts to a continuously hunted view of their environment.

To get there, organizations need two things: a clear baseline of what normal looks like, so outliers actually stand out, and hunting treated as its own discipline. Not something the SOC picks up in its downtime. A team whose actual job is hypothesis-driven hunting, not just alert triage.

That means assuming adversaries are already inside and going looking for them: denying them dwell time and disrupting their process before they ever get to impact, instead of waiting for them to make noise. Their tools will keep changing, but a proactive hunting mindset is what lets organizations stay ahead of the threats that never trigger an alert at all.

Kara Sprague, Chief Executive Officer for HackerOne

October is Cybersecurity Awareness Month. Three days before it began, CISA retired the weekly vulnerability bulletin it had published for more than twenty years.

The agency’s explanation was straightforward: a list of thousands of flaws and severity scores wasn’t helping defenders decide what to fix first. As its branch chief for vulnerability response put it: ‘Not all vulnerabilities matter.’

Awareness matters, but security teams already know about far more problems than they can fix. We see this on the H1 Platform: critical vulnerabilities are being fixed more than 50% faster than a year ago, yet the backlog of unresolved critical findings grew 29-fold.

Two Citrix flaws disclosed last week illustrate the problem. Both were rated 9.5 out of 10. One required a specific feature to be enabled. The other affected default installations, and scanning began within minutes of a public exploit appearing. The scores were identical. The exposure was very different.

This October, I’d like to see more attention on a practical question: which known vulnerabilities can attackers actually reach and exploit in your environment? Finding more won’t help much if the most consequential problems remain unresolved. What matters is how quickly we fix them.

Phil Swain, CISO & VP of Information Security at Extreme Networks

As AI agents become more common across the enterprise, today’s security teams need to consider more than what those agents can access. Agents communicate with applications, data, devices, other agents, and infrastructure, making it critical to have a complete picture of those relationships and what typical behavior looks like across the organization’s environment.

The network is where many of those relationships become visible. Network telemetry can show which systems an agent interacts with, where traffic flows, and when behavior begins to deviate from expectations. An individual action may appear legitimate, while the pattern of interactions around it tells a different story.

That changes the security question from simply “was this agent allowed to do this?” to “does what this agent is doing make sense in the context of everything else happening across the environment?” As agents operate with greater autonomy, that context will be critical to understanding their behavior, spotting activity that access controls alone may not reveal, and effectively managing risk in today’s enterprise.

Nick Tausek, Lead Security Automation Architect at Swimlane

The modern SOC doesn’t have an information problem. It has a decision problem. Analysts already have alerts, threat intelligence, identity data, and endpoint telemetry. The slowdown happens when someone has to figure out which signal deserves attention, what context is missing, and what should happen next.

The AI SOC needs to earn its keep. Not every incident needs the same level of intelligence. Routine cases can be handled by deterministic automation. More ambiguous activity may need AI-assisted investigation. A smaller group of complex threats can justify fully agentic analysis. Human judgment stays focused on the decisions where experience matters most.

Cybersecurity Awareness Month is a useful reminder that faster detection alone isn’t enough. Security operations need a way to turn what they know into action without forcing analysts to manually rebuild context every time something goes wrong.

John Toney, Senior Vice President of Security Services at Thrive

Some of the biggest cybersecurity risks still come down to the basics. Organizations are investing heavily in AI and advanced security tools, but none of that replaces knowing what is actually in your environment. Asset discovery, patching, and understanding where your data lives may not be the newest topics in cybersecurity, but they are foundational. You cannot defend your enterprise if you do not know where the fence line is.

Security teams also cannot afford to wait for perfection. Teams can often get stuck in “analysis paralysis” when they should be strengthening their defenses as they go. The threat landscape is moving too quickly for that, and AI is only increasing the speed and scale at which both defenders and attackers operate. A thoughtful, well-reasoned approach matters, but so does speed. The bigger risk is waiting.

For Cybersecurity Awareness Month, security leaders should focus on knowing what they have, keeping it patched, understanding where their exposures are, and making sure their teams can respond quickly when something changes. Cyber resilience is built by consistently getting those fundamentals right.

Andy Ulrich, Chief Information Security Officer at Vonage

During National Cybersecurity Awareness Month, it is important to remember that fraud remains one of the most immediate cybersecurity threats facing individuals and organizations. The technology behind an attack may be advanced, but the tactic is often simple: convincing someone to trust a message, click on a link, or share information.

AI is making these attacks more convincing and empowering malicious actors to operate at scale, but that does not mean organizations need to abandon the fundamentals of cybersecurity. Organizations should focus on the basics by training employees to spot suspicious messages, monitoring for unusual activity, and establishing clear channels to report potential fraud. Technology can help reduce risk, but security still depends on people having the confidence to pause before they act.

Mayank Upadhyay, Chief Security and Trust Officer at Snowflake

So much of the risk I see in enterprise security comes down to a simple reality: the secure path is too painful, so people take the easy workaround. That is how we accumulate security debt over time. If the easier path always wins, why aren’t we using AI to make the secure option the path of least resistance?

Take the access we give AI agents. An agent doing one task should not inherit every permission you’ve accumulated over a career. Pushing every decision to a ‘human in the loop’ doesn’t solve this. Too often, that just creates friction masquerading as oversight, as people rubber-stamp prompts to keep work moving.

That is where automation belongs. Enforcing Restricted Session Scopes in Snowflake places an explicit ceiling on what an agent can touch, matching permissions strictly to the immediate task and expiring them the moment the work is finished.

Save human attention for the exact moment an agent attempts to cross a boundary you set. If moving fast requires zero human errors, you’ve already lost. Security has to scale automatically as agents run on their own.

Dr. Jesse Van Griensven, Chairman and Founder of EigenQ, and adjunct professor at the University of Waterloo

AI-enabled attacks, persistent data theft, and quantum computing’s challenge to conventional cryptography. RSA and elliptic-curve cryptography (ECC) are both more than 30 years old, while computing power and cryptanalytic capabilities have advanced enormously.

“Harvest Now, Decrypt Later” creates immediate exposure: adversaries can collect encrypted information today for future decryption, threatening medical records, financial information, intellectual property, and national security data. Existing confidentiality and data-protection duties already make this a regulatory concern, with potential liability for failing to address foreseeable risks. Regulators explicitly recognize quantum risk within existing security obligations. Future upgrades cannot protect copies already harvested by attackers.

NIST’s ML-KEM (Kyber) and ML-DSA (Dilithium) provide a strong foundation, but effective protection requires more: unpredictable keys from validated entropy sources, secure key management, and hardware acceleration for demanding workloads. Validated quantum random-number generation can strengthen that foundation. Mythos demonstrated a certificate-forgery exploit, while Astra demonstrated capabilities to discover and exploit previously unknown software vulnerabilities.

These findings reinforce the need to secure the surrounding infrastructure. Quantum resilience must extend across the entire security stack, including public-key infrastructure (PKI), certificates, certificate authorities, roots of trust, secure boot, firmware updates, and communications. Strong algorithms cannot compensate for compromised keys or exploitable implementations.

Organizations should fund migration now, inventory vulnerable cryptography, prioritize information requiring long-term confidentiality, and demand credible supplier roadmaps. CNSA 2.0 sets quantum-resistant requirements for national-security systems, with guidance expecting compliant new deployments from January 1, 2027, subject to applicable profiles.

The Presidential Executive Order of June 6, 2025, imposed federal requirements to support transition preparation; the June 2026 order further accelerated migration. Purchasing decisions must examine key quality, hardware protection, certificate readiness, operational performance, and cryptographic adaptability. Companies must emphasize integrating standards-based post-quantum cryptography, strong key generation, and hardware acceleration into deployable infrastructure that protects information throughout its required lifetime.

Pieter Vanlperen, Chief Information Security Officer (CISO) at AlphaSense

One of the biggest challenges security teams face is introducing probabilistic systems into a security environment largely built around deterministic behavior. Traditional security tools are very good at identifying deviations from an expected pattern. With AI, the harder question is whether that deviation is actually dangerous. An AI system might take a different path to accomplish the same task every time, so detecting that something unusual happened is no longer enough. Security teams need to understand the context and intent behind what the system is doing.

That becomes even more important as AI moves from answering questions to taking actions. It’s no longer enough to ask whether a user or AI agent has permission to access a system or perform a task. Security teams also need to assess whether that level of privilege makes sense in that particular situation. An agent might legitimately have access to a tool or dataset, but that doesn’t mean every use of that access is appropriate. Authorization needs to become much more contextual.

For security leaders, that makes observability foundational. You need visibility into what AI systems are doing, where they’re doing it, and how they’re interacting with other systems before you can effectively secure them. The organizations that adapt successfully won’t throw out the security fundamentals they’ve spent decades building. They’ll understand where those controls still work, where they need to evolve, and where AI requires an entirely new intervention.

Frank Vukovitz, Chief Security Scientist at Delinea

While organizations might be more cyber-aware than ever, far fewer are cyber-ready. 87% of organizations claim their identity security posture is prepared to support AI automation at scale, yet nearly half (46%) admit their AI-related identity governance is deficient.

This readiness gap becomes more consequential as AI moves from generating outputs to taking action. While initial AI concerns focused on hallucinations and generating incorrect information, we’re now seeing AI agents use enterprise access to act independently on that flawed data, exacerbating existing excessive permissions issues. But initial identity vulnerabilities are only part of the problem. The OpenAI/Hugging Face incident demonstrates how unexpected agent behavior can quickly turn into real-world consequences.

2 in 3 organizations admit that when security requirements conflict with business speed, they are not consistently enforced. However, AI makes both automation and attacks faster, meaning organizations cannot afford to treat security as a backseat discipline in their pursuit of speed. Security awareness must move beyond human users and include AI and machine identities with real enterprise access. In practice, this means scoping all agent access as temporary and task-specific, and authorizing agent permissions at runtime rather than treating access as a one-time decision.

Clyde Williamson, Senior Product Security Architect at Protegrity

Cybersecurity Awareness Month has always been about helping everyday people build safer habits online, and those same principles now apply to the growing use of AI assistants and agents. Security is no longer just the responsibility of IT. Employees across every function, from accounting and legal to sales and marketing, need to understand what data AI tools can access, what actions they can take on their behalf, and how to recognize unusual behavior. While the technology may be new, many of the risks are familiar: oversharing sensitive information, granting excessive permissions, and trusting actions without verification.

The difference is that AI operates at a speed and scale that can magnify the impact of a mistake. Good AI hygiene starts with simple habits like limiting access to sensitive data, regularly reviewing permissions, and verifying important actions before they are executed. Building that awareness today will help people use AI confidently and securely as these technologies become a routine part of everyday life.

Wade Woolwine, Senior Director of Product Security at Rapid7

The hardest part of a security analyst’s job has rarely been a lack of data. It’s the time spent stitching data together: jumping between consoles, writing one-off scripts, and copying results from one tool into the next. That’s where AI is earning its place.

That matters because the time between learning about a weakness and seeing it exploited keeps shrinking. In Q2, Rapid7 found that 62% of newly exploited vulnerabilities required no login or user interaction. With no employee involved, nobody gets the chance to catch those attacks. Security teams have to know what’s exposed and reachable before attackers do. When analysts spend hours gathering context, that awareness comes too late. For CISOs, the question isn’t whether every vulnerability becomes an exploit. Most won’t. The question is how much of their exposure they’re willing to make reachable and exploitable.

This month and moving forward, organizations should direct AI at the stitching work. In exposure management, AI can drive APIs and CLI tools to pull asset, vulnerability, and configuration context into one view, so teams fix what’s actually reachable instead of chasing every CVE.

In detection and response, AI can query the SIEM, run threat intel lookups and parse logs, so analysts start from an evidence-backed summary instead of a blank search bar. It can also turn technical metrics into business language for the CFO or board. AI speeds up the analysis, but experts still own the verdict. Attackers have compressed the time it takes to strike, and defenders need to compress the exposure they leave open.

Grant Yacomeni, CISO at Gigamon

This year’s Cybersecurity Awareness Month theme, ‘Don’t Make It Easy for Them’, needs to start with closing the gap between what organizations think is happening and what is actually happening across their infrastructure. AI is making that harder. Employees are adopting their own tools, developers are embedding models into applications, and agents are creating new interactions with data and systems that security teams may never see. It’s no surprise that 80% of CISOs cite inadequate governance around unsanctioned AI as a top security challenge.

Policies alone cannot govern activity that organizations cannot see. As AI adoption accelerates, security teams need continuous visibility into how sanctioned and unsanctioned AI interacts with applications, infrastructure, and sensitive data. That context allows teams to validate whether controls are working and identify activity that falls outside policy.

Cybersecurity fundamentals still matter, but AI is compressing the time attackers need to exploit weaknesses. The harder organizations make it for attackers to find and exploit gaps in policy and controls, the less advantage their speed provides.

Want more insights like these? Register for Insight Jam, Solutions Review’s enterprise tech community, which enables human conversation on AI. You can gain access for free here!