**AI, Geopolitics, and Quantum Threats Put Businesses on Cyber Alert**
In an era of rapid technological advancement, businesses are facing an increasingly complex cyber threat landscape, according to KPMG's latest report, "Cybersecurity Considerations 2026." The report, which incorporates insights from over 20 KPMG cyber leaders and executives from major tech firms like Google, Microsoft, Palo Alto Networks, and ServiceNow, outlines eight critical priorities for organizations as they navigate the evolving cybersecurity environment.
The KPMG report highlights several factors contributing to this complex landscape, including the swift adoption of artificial intelligence (AI), geopolitical tensions, fragmented regulatory environments, supply chain disruptions, hyperconnectivity, and the emergence of non-human identities. These elements are reshaping the responsibilities of Chief Information Security Officers (CISOs) and their teams.
AI is characterized as a double-edged sword in the realm of cybersecurity. While defenders can leverage AI to detect and respond to threats more efficiently, malicious actors can also exploit the technology to automate attacks and develop sophisticated methods to breach defenses. This duality necessitates a reevaluation of security strategies as organizations grapple with the implications of AI on their cybersecurity frameworks.
The report emphasizes the growing prevalence of non-human identities, such as AI agents and machine credentials, which now outnumber human users in many automated environments. This trend compels organizations to rethink their identity governance strategies, ensuring they can effectively manage the lifecycle of both human and machine actors.
Regulatory challenges are also on the rise, as governments implement increasingly fragmented requirements related to digital safety, data sovereignty, and operational resilience. The report notes that CISOs and Chief Risk Officers are becoming more integral to meeting these obligations, adding pressure to cybersecurity teams tasked with safeguarding sensitive information.
Geopolitical tensions further complicate the cybersecurity landscape, as businesses reassess their operational strategies and supply chains. Changes in trading relationships can expose companies to threats from nation-states, while transitions to new suppliers may introduce additional cybersecurity risks.
As the visibility and responsibility of the CISO continue to expand, the report underscores the importance of raising awareness about cyber risks across the organization. CISOs are urged to foster responsible digital behavior and communicate risks in business terms to executives, employees, suppliers, and partners. KPMG advocates for a principle of "radical transparency," enabling organizations and their partner ecosystems to make informed decisions based on risk intelligence and emerging signals.
The threat posed by quantum computing is also highlighted as a significant concern. The potential for quantum technologies to break existing encryption methods is becoming a medium-term issue for cybersecurity. KPMG emphasizes the need for organizations to prepare for a transition to post-quantum cryptography, with guidance and regulations being developed worldwide to facilitate this shift.
The increasing interconnection between digital and physical systems is exposing operational technology environments to new vulnerabilities. Industries such as utilities, oil and gas, manufacturing, and telecommunications are particularly at risk due to their reliance on internet-connected devices. The report warns that the heavy electricity demands of data centers, now considered critical infrastructure, may further strain power and utility facilities, especially as older systems remain in use.
KPMG asserts that organizations are often "building the plane as they fly it" in response to rapid technological changes. However, the report argues that robust cybersecurity measures can help businesses adopt new technologies responsibly while enhancing stakeholder trust. The findings align with KPMG’s 2025 CEO Outlook, which identified cybersecurity and digital risk resilience as key factors influencing investment decisions.
To address these challenges, KPMG outlines eight priorities for organizations in 2026:
1. **Preparing the Cyber Workforce for Autonomous Security**: As automated agents take on more responsibilities, organizations must equip their workforce to manage these changes effectively.
2. **Securing IT and Operational Technology Hyperconnectivity**: Implementing dynamic "mesh" architectures and clear ownership will be crucial for monitoring both cyber and physical environments.
3. **Navigating Geopolitics While Strengthening Resilience and Compliance**: Organizations must adapt to changing geopolitical landscapes while ensuring compliance with evolving regulations.
4. **Transitioning to Post-Quantum Cryptography**: Preparing for the shift to new encryption methods will be essential to mitigate the risks associated with quantum computing.
5. **Safeguarding AI Systems**: Protecting AI technologies from cyber threats is increasingly important as their use becomes more widespread.
6. **Protecting Complex Supply Chains**: Continuous detection and response mechanisms will be vital to secure intricate supply chains.
7. **Managing Non-Human Identities in the Age of AI**: Organizations must develop strategies to govern the identities of AI agents and other non-human actors effectively.
8. **Broadening the Role and Influence of the CISO**: As cybersecurity becomes more integrated into business operations, the role of the CISO will need to evolve to encompass broader responsibilities.
In conclusion, KPMG's report underscores the necessity for organizations to adapt to the rapidly changing cybersecurity landscape, balancing the opportunities presented by AI with the inherent risks. As the convergence of cyber and physical security continues, the role of the CISO will be pivotal in guiding businesses through these challenges and fostering a culture of cybersecurity awareness.