This article on CSOonline made me think (“The 7 biggest issues CISOs and security teams face today”, Mary K Pratt, 12 October 2026)
In my view, the biggest challenges facing CISOs and security teams today are not necessarily the ones dominating cybersecurity conferences, vendor presentations or industry headlines.
Of course, ransomware, artificial intelligence, supply chain attacks and the growing sophistication of cybercriminals are serious concerns. But focusing exclusively on the evolving threat landscape risks missing the more fundamental problems that continue to undermine cybersecurity effectiveness across large organisations.
After more than two decades of working with cybersecurity leaders and executive teams, I see seven structural challenges still worth highlighting.
1. The persistent failure to treat cybersecurity as a business leadership issue
This remains the most fundamental problem.
Too many organisations continue to approach cybersecurity primarily through technology, compliance and operational risk management, rather than as an integral part of their business protection strategy.
CISOs are still frequently expected to solve problems that originate outside their authority, within business processes, organisational structures, investment decisions or executive priorities.
Until CEOs and executive committees genuinely assume ownership of cybersecurity as a business issue, security teams will continue to struggle with responsibilities that exceed their ability to act.
The challenge is not to make cybersecurity more visible to business leaders, but to make business leaders genuinely accountable for cybersecurity outcomes.
2. The inability to translate cybersecurity strategy into sustainable execution
Many organisations have cybersecurity strategies, roadmaps and transformation programmes in place. Far fewer have developed the governance structures, operating models and management discipline necessary to execute them consistently over time.
Security initiatives are frequently launched in response to incidents, audits or regulatory pressure, only to lose momentum as business priorities change.
This creates a recurring cycle of tactical remediation, fragmented investment and limited long-term progress.
For CISOs, the real challenge is not producing another strategy document. It is embedding cybersecurity into the organisation’s management practices, decision-making processes and operational responsibilities.
Cybersecurity transformation is not about launching more projects or buying more tools. It is about changing how the organisation operates around security.
3. The growing complexity of organisations and the erosion of effective control
Large organisations have become extraordinarily complex.
Cloud computing, digital transformation, several outsourcing and insourcing waves, hyperconnected supply chains, and now AI-driven automation, not to mention the survival of legacy systems: All those aspects have created environments in which accountability is increasingly fragmented.
Security teams are expected to protect assets, processes and information flows over which they may have limited visibility and even less direct control.
The emergence of non-human identities, autonomous AI agents and increasingly interconnected digital ecosystems makes this problem particularly more acute.
But the underlying issue is not technological complexity alone. It is the inability of traditional governance and organisational structures to keep pace with changes in business operations.
The biggest risk is not complexity itself, but the widening gap between organisational complexity and management’s ability to control it.
4. The confusion surrounding the CISO’s role, authority and accountability
Despite decades of discussion, many organisations still lack a coherent understanding of what they expect from their CISO.
Should the CISO be a technical expert, a risk manager, a compliance leader, a transformation executive or a strategic business adviser?
In practice, the role frequently combines all these expectations without providing the corresponding authority, resources or executive support.
The endless debate about whether the CISO should report to the CIO, CEO or another executive often distracts from the real issue: the distribution of responsibilities and decision-making authority across the organisation.
Reporting lines matter, but they cannot compensate for ineffective governance or weak security culture.
The CISOs cannot be held accountable for business protection outcomes that the organisation has not empowered them to influence.
5. The obsession with technology and the failure to manage cybersecurity investment effectively
The cybersecurity industry has spent years promoting the idea that organisations need more investment, more tools and more sophisticated capabilities to address an ever-expanding threat landscape.
Some organisations undoubtedly remain underfunded. But in many large firms, the fundamental problem is different.
Security budgets have grown, technology portfolios have expanded and security teams have become larger, yet demonstrable improvements in protection and resilience have not always followed.
Fragmented purchasing decisions, overlapping technologies, poor prioritisation and weak execution frequently undermine the value of those investments.
The challenge for CISOs is to move away from technology-led spending and demonstrate how investment supports measurable business protection objectives.
Quite often, cybersecurity is not underfunded as much as it is undermanaged.
6. The emergence of AI as a governance and identity management challenge
Artificial intelligence is creating genuinely new security challenges, but the industry’s fascination with AI-powered attacks risks obscuring more immediate structural concerns.
The proliferation of AI agents, machine identities, automated workflows and interconnected systems is fundamentally changing the way organisations allocate access, privileges and operational authority.
Non-human identities are becoming central to business processes, often without sufficiently mature ownership, lifecycle management or oversight mechanisms.
This creates a significant governance challenge: organisations must understand not only what their AI systems can do, but who is accountable for their actions, what authority they possess and how that authority is controlled.
For CISOs, this requires moving beyond the deployment of additional security tools towards a much closer integration of identity governance, business accountability and technology architecture.
In many ways, AI is just accelerating an existing governance problem: organisations are delegating authority faster than they are developing the mechanisms to control it.
7. The dominance of short-term thinking over long-term resilience
Perhaps the most damaging challenge is the persistent short-termism that characterises cybersecurity decision-making.
Major incidents generate urgency, executive attention and emergency funding. But once the immediate crisis passes, attention frequently shifts elsewhere, leaving underlying organisational weaknesses unresolved.
This is precisely the dynamic I have described for years as the Cybersecurity Spiral of Failure.
CISOs are repeatedly pushed towards tactical firefighting, while the structural changes necessary to improve resilience require sustained executive commitment over several years.
Breaking that cycle means moving beyond the narrow objective of dealing with past incidents towards building an organisation capable of anticipating disruption, absorbing shocks, maintaining critical operations and recovering effectively.
That requires clear governance, leadership continuity, organisational discipline and long-term investment in capabilities rather than products.
Resilience cannot be purchased in response to a crisis. It has to be built through sustained management commitment.
The underlying problem: Cybersecurity is still being managed from the wrong end
These seven challenges have one common denominator: they are fundamentally management and leadership problems, even when they manifest themselves through technology.
The cybersecurity industry has become remarkably effective at developing new tools, identifying new threats and creating new technical specialisms. But the management structures through which organisations direct, govern and sustain their cybersecurity efforts have not evolved at the same pace.
For CISOs, the priority should therefore be to reposition cybersecurity as a core business protection discipline, supported by clear executive accountability, effective governance and sustainable execution.
For CEOs and boards, the challenge is to recognise that cybersecurity cannot simply be delegated to specialists and addressed through periodic investment decisions.
The next stage of cybersecurity maturity will not be defined by the sophistication of the technologies organisations deploy, but by their ability to turn cybersecurity into a consistently managed business capability.
That, in my view, is where the real challenge lies — and where meaningful progress must begin.
JC Gaillard
Founder & CEO
Corix Partners
Contact Corix Partners to find out more about developing a successful Cyber Security Practice for your business.
Corix Partners is a Boutique Management Consultancy Firm and Thought-Leadership Platform, focused on assisting CIOs and other C-level executives in resolving Cyber Security Strategy, Organisation & Governance challenges.