Gartner has published five concrete measures that Chief Information Security Officers should initiate before the end of 2026 to address risks posed by AI agents, deepfakes, and quantum computing.
The recommendations, released in late September 2026, call on CISOs to integrate AI governance, strengthened identity verification, and preparation for Post-Quantum Cryptography (PQC) into corporate decision-making processes rather than reacting only after incidents occur.
1. Clarify accountability for AI security
CISOs must clearly define their role in securing AI applications. Protection must extend beyond the model itself to the underlying infrastructure, surrounding software tools, and execution logic. Security leaders should participate in both internal governance and technical implementation while helping other executives evaluate AI-related risks.
2. Treat AI agents as insider threats
Permissions for autonomous AI systems should be granted according to the actions they can perform, not assumptions about model intelligence. A Gartner survey of 297 cybersecurity executives conducted in Q2 2026 found that 54 percent of organizations either had no defined approach for restricting AI agent access or simply reused existing human access rights. For multi-agent systems, Gartner recommends deploying Guardian Agents to monitor agent-based workflows and limit potential damage.
3. Stop accepting voice or image recognition as identity proof
With rising deepfake incidents, organizations must revise processes that rely solely on a familiar voice or appearance for approvals. Gartner advocates a layered approach combining deepfake detection technologies with contextual information, additional authentication factors, and content provenance checks.
4. Budget for preventive security capabilities
AI is lowering the time and skill required to discover and exploit vulnerabilities. Another Gartner survey of more than 300 risk executives showed that 76 percent of CISOs now rank AI-assisted discovery of cyber weaknesses among their top ten emerging risks. Beyond detection and response, CISOs should fund preventive measures such as dynamically changing system environments, concealment of internal technical details, and honeypot systems that expose attacker activity. Predictive threat analysis should also be used to identify potential attack paths early.
5. Begin post-quantum cryptography pilots
CISOs should launch initial pilot projects to migrate toward Post-Quantum Cryptography. A separate Gartner survey revealed that 51 percent of CISOs had not yet started any PQC-related activities. Organizations that wait until after 2027 to begin testing are projected to face at least 200 percent higher migration costs. Preparation extends beyond technical algorithm replacement and requires adjustments to the security operating model. One highlighted risk is the current harvesting of encrypted data for future decryption once quantum computers become available.
