2026 Predictions: SecurityBiaS Advisors and Staff
We asked our advisory team and executives to predict what they see for 2026 and a prevalent theme quickly emerged, system level thinking for AI. We move to value delivery with a focus on having AI fully automate processes, a shift to system level thinking. See what these experts predict!
We demonstrate our contribution over and above AI making sense of this new paradigm, while AI continues to improve moving toward system level functionality.
AI-driven systems and processes will present new challenges to organizations as AI, specifically LLMs, replace job functions. Yes, work can be done faster using AI and we all benefit from this increased ability to complete tasks quickly. It has to be the right type of work or system level thinking where processes are automated for this to be effective. This means businesses can operate with fewer human resources and you may have more time for your family. More work needs to be done here, but the path is fairly clear if you are engaged and using AI for a multitude of purposes. “When a machine writes out otherwise interesting insights, the author’s joy of discovery is absent.”
What I have noticed from student's submissions is something that will impact us at an increasing level in 2026 (and beyond). THERE IS NO JOY in AI generated responses. It takes longer to read and get the same points from a paper written with AI than when a human synthesizes data across sources. A human is excited when they take time to triangulate research across sources and find an interesting point to note. For example, an explanation on why a threat actor may have particular objectives tying back to cultural norms that stretch back a century can be written cut and dry or with excitement on the discovery of unique insights. The author’s excitement shines through when these discoveries occur. LLMs are not excited with such findings and lack the ability to innovate or draw these interesting conclusions. At some point, we'll reach a tipping point and there will be a correction for this problem either in improvements to AI or integrating humans into some work processes that have been automated.
Technical Evolution Expectations:
Attacks will continue. The supply chain will be targeted with social engineering with AI used to increase the success rate of the attacks. AI will continue to be used to defend against attacks. Companies that use AI as a proactive layer on top of solid security controls, built-in, will fare better in the end.
Non-human identity (NHI) and the authentication used for those identities will evolve further in 2026. Industry should begin to show where each of the methods are preferred such as HTTPSignatures, workload identity tokens (WIT), and workload identity certificates (WIC), and X.509 Certificates with mTLS. This applies to all API connections, including those related to AI.
Additional refinement of AI related protocols will occur, enabling improved interoperability.
Defacto standards should emerge more clearly tied to use cases and may also be driven by vendor ecosystems.
“2026 Will be the Year of the AI Coworker”
We now have the ability to gather massive amounts of data across systems, correlate it at machine speed, and combine the results into stories that a human can analyze and act against. This story-telling moves us from raw telemetry to narrative intelligence and helps us unlock true operational value.
A strong early example is already starting to emerge in SOC and security management.
Here, AI can sit directly inside the data stream, continuously running pattern detection, statistical outlier analysis, and long-horizon trend modeling. Instead of surfacing or suppressing every alert, log event, and edge-case anomaly, it will contextualize them reducing the overall noise and strengthening the likely issue signals.
The AI coworker arc looks like this: Data collection → Feature extraction → Behavioral clustering → Narrative synthesis (aka storytelling) → Actionable output.
We start to see an AI Coworker capable of summarizing security posture across millions of assets, identifying meaningful deviations, and presenting conclusions as structured stories that mirror how humans reason. We will see advancements for SOC teams first. False positives fall. Pattern confirmation accelerates. Incident mitigation happens faster than ever before because analysts can now validate the one already surfaced with context and causality attached.
2026 The Year of Governance
The Digital Operational Resilience Act (DORA) turns one, and EU states that missed the NIS2 deadline will scramble to catch up; accelerating a wider shift in accountability from IT to the board.
Firms that have done the upstream work (responsibility, oversight, decision-making) won’t just manage incidents better downstream; they’ll also be able to signal to regulators, investors, and counterparties that legal duties were understood, owned, and acted on.
“AI Moves from Novelty to Necessity.”
Everything points to moving from AI experimentation to AI value delivery. Sure, it’s fun to vibe code or see what AI can cook up for images and videos. But are these activities saving time and does the result perform as expected? 2026 is the year AI moves from novelty to necessity, demanding a strategic pivot from experimentation to demonstrable ROI. True value will emerge not from the technology, but from re-engineering core processes to deploy AI for routine tasks or big data analysis and free up strategic and creative talent. With AI, security is paramount. Privacy and data must be protected. Choose AI solutions that build privacy in. In these early days where AI companies are far from profitable, you are often exchanging your data for free or low-cost tools. Until security is at the forefront, proceed with caution.
Whether you are an attacker or a defender, AI will raise the floor, lower the staffing required to hit it, and expose organizations that were confusing headcount with capability.
AI’s rapid evolution and expanding use cases will favor organizations that have agile processes to optimize new use cases and workflow with AI augmentation and substitution to drive the greatest business value.
Identity becomes the battlefield—especially non-human identity. How do you know who/what is doing things—and whether it’s authorized?
Identity compromise is increasingly about token theft, OAuth abuse, recovery-path exploitation, and workload/service identities. Phishing-resistant MFA becomes table stakes in 2026 after years of lagging with full MFA deployments. Expect that attackers will scale bypass techniques and exploit the seams (exceptions, legacy protocols, and enrollment gaps).
Perimeter thinking collapses into continuous, identity-enforced access at the edge. How do you manage access to systems, SaaS, and data?
Service Edge (SSE/SASE) and identity enforcement (plus WAF/API controls where applicable) become the practical perimeter, so internal network trust will continue to erode. CISOs will measure progress by how quickly they can reduce implicit trust and isolate blast radius across cloud and SaaS.
AI “democratizes” baseline security—creating a new minimum standard while hollowing out the middle of the cyber labor market. How do you redesign roles and workflows so AI raises capability without hollowing out accountability?
In 2026, more organizations will run “good enough” security programs because AI-assisted tooling (policy generation, control mapping, detection engineering, triage, and response playbooks) lowers the skill and staffing threshold for competent execution. The downside is a two-speed labor market: high leverage roles (security architecture, identity/PKI, cloud platforms, incident command, and governance) remain scarce and expensive, while mid-tier operational roles compress as automation absorbs queue work and employers demand deeper, cross-domain capability from fewer people. The net prediction: security maturity rises at the bottom end, but talent strategy becomes a differentiator—firms that redesign roles and workflows around AI will outperform those that simply “add AI” while keeping the same org chart.
Identity in the Age of AI: Strengthening Agent Verification and Human Data Sovereignty
As the world becomes dependent on AI, there is a race to ensure we can protect the AI infrastructure beginning with the "non-human identities". The focus by industry will be in strengthening the required means to securely identity and verify these "agents".
On the flip side, self-sovereign identities will grow in adoption to enable humans to better control their data governance.
