Technology is advancing rapidly, forcing businesses to confront a broader and increasingly complex cyber threat landscape, according to KPMG’s Cybersecurity considerations 2026 report.

The report, drawing on insights from more than 20 KPMG cyber leaders worldwide as well as senior executives from Google, Microsoft, Palo Alto Networks and ServiceNow, examines eight priorities for organisations as cybersecurity becomes increasingly central to resilience, innovation and growth.

KPMG said the rapid adoption of artificial intelligence, geopolitical tensions, fragmented regulation, supply-chain disruption, hyperconnectivity and the emergence of non-human identities are all changing the responsibilities of chief information security officers (CISOs).

At the same time, the report warns that the prospect of quantum computing capable of breaking existing encryption is becoming a medium-term cybersecurity concern.

AI is described as a double-edged sword for cybersecurity teams.

Defenders can use AI to identify and respond to threats more quickly and efficiently, but attackers can also use the technology to automate and scale attacks while developing more sophisticated methods of breaching defences.

The growing use of agentic AI and digital agents is also increasing pressure on organisations to manage non-human identities, including AI agents, service accounts and machine credentials.

KPMG said these identities already outnumber human users in increasingly automated environments, requiring organisations to rethink identity governance across the entire lifecycle of human and machine actors.

Regulation is another growing challenge, as governments introduce increasingly fragmented requirements covering digital safety, data sovereignty and operational resilience.

The report said CISOs and chief risk officers are becoming more involved in meeting these obligations, placing additional demands on cybersecurity teams responsible for keeping information secure and private.

Geopolitical tensions are also creating new cyber risks, particularly as organisations reconsider where they operate and who they source products and services from.

Changes to trading relationships and supply chains can expose companies to threats from nation states, while also creating cybersecurity risks during transitions to new suppliers.

KPMG said the visibility and responsibility of the CISO continues to grow as cybersecurity becomes a business-wide responsibility.

CISOs must raise awareness, encourage responsible digital behaviour and communicate cyber risk in business terms to executives, employees, suppliers and partners.

The report advocates a principle of “radical transparency”, allowing organisations and their wider partner ecosystems to make decisions based on risk, intelligence and emerging signals.

Post-quantum cryptography represents another significant challenge, with the transition expected to require major changes across organisations.

KPMG said countries worldwide are developing guidance and regulations to encourage migration towards new encryption methods, while sectors such as finance and defence could face an existential threat if they fail to prepare for quantum-related cyber risks.

The increasing connection between digital and physical systems is also exposing operational technology environments to new vulnerabilities.

Utilities, oil and gas, natural resources, manufacturing and telecommunications companies are particularly exposed through the growing use of internet-connected devices.

Data centres are increasingly regarded as critical infrastructure, while their heavy electricity requirements are placing additional pressure on power and utility facilities.

The construction of new power plants and reopening of older facilities could create further operational technology risks, particularly where obsolete legacy systems remain in use.

KPMG said organisations were effectively “building the plane as they fly it” as technology develops, but argued that cybersecurity can help businesses adopt new technologies responsibly while strengthening trust.

The report points to KPMG’s 2025 CEO Outlook, which identified cybersecurity and digital risk resilience as one of the top pressures influencing investment decisions.

By making operations safer and more resilient, KPMG said CISOs can strengthen stakeholder trust, reduce the cost of capital and support new product development.

The eight priorities identified for 2026 include preparing the cyber workforce for autonomous security, as automated agents take on more tasks across security operations, compliance, risk and identity management.

They also include securing IT and operational technology hyperconnectivity through dynamic “mesh” architectures, clear ownership and the ability to monitor cyber and physical environments.

Other priorities are navigating geopolitics while strengthening resilience and compliance, transitioning to post-quantum cryptography, safeguarding AI systems and protecting increasingly complex supply chains through continuous detection and response.

The final priorities are managing non-human identities in the age of AI and broadening the role and influence of the CISO as cybersecurity becomes more deeply embedded across business operations.

KPMG said the growing convergence of cyber and physical security means CISOs must increasingly balance the opportunities offered by widespread AI adoption with the risks it creates.