4 Issues Holding Back CISOs’ Security Agendas

Why It Matters

These constraints erode an organization’s ability to prevent or respond to attacks, slowing digital transformation and increasing overall cyber risk.

Key Takeaways

• 76% CISOs expect material breach within year.
• 58% say organization unprepared to respond.
• Only 28% have AI in security operations.
• Talent shortage cited by 83% as major obstacle.
• Lack of training hampers team prioritization.

Pulse Analysis

The perception that a breach is "not if, but when" is now backed by hard data: 76% of CISOs anticipate a material incident within twelve months, and 80% feel extreme pressure. This climate forces security leaders to prioritize ruthlessly, yet many still centralize decision‑making, leaving teams without the authority to act on critical priorities. Empowering staff through clear prioritization frameworks and targeted training can distribute workload, reduce burnout, and accelerate response times, directly addressing the 58% who feel unprepared for an attack.

AI promises efficiency, but most security functions lag behind business adoption. While 83% of organizations have deployed AI, only 13% maintain strong visibility into data handling, and a mere 28% have integrated AI into security operations. The gap creates shadow AI, unmanaged agents, and opaque data flows that expand the attack surface. Organizations that treat AI as a distinct identity, establish governance teams, and apply risk‑based profiling can harness AI’s productivity gains—evidenced by 63% of early adopters reporting significant operational improvements—while mitigating new vulnerabilities.

Compounding these challenges is a deepening talent shortage. Over 80% of executives cite cyber‑skill deficits as a major obstacle, with 59% flagging AI and cloud security as critical gaps. Beyond technical expertise, CISOs need "middle" skills—risk management, change management, and business alignment—to translate security controls into actionable business value. A strategic talent approach that emphasizes competency‑based hiring, continuous upskilling, and cross‑functional security liaisons can alleviate the shortage, enabling teams to keep pace with evolving threats and technology.