At the Gartner Cybersecurity & Risk Management Summit 2026 in London, analyst Niyati Daftary presented eight cybersecurity projects that, according to Gartner, security teams should prioritise in 2026. Four of the projects focus on AI, the other four on resilience and infrastructure. The list ranges from AI registers to post-quantum cryptography and deepfake defence.
Gartner states that the eight projects reflect the changing needs within IT security and prepare organisations for the further scaling of AI. Daftary divided the recommendations into two categories: AI cybersecurity projects and projects concerning resilience and infrastructure.
Governance and visibility of AI use
The first project centres on hybrid cybersecurity governance as a response to AI regulation. Gartner advises having security, legal and compliance work closely together and recording technical and security controls in so-called AI Model Cards or System Cards. By incorporating this documentation into AI TRiSM (Trust, Risk and Security Management) frameworks, security teams gain better visibility of risks such as model drift and data provenance, according to the firm.
The second project focuses on mapping the AI footprint. Daftary indicates that in many organisations AI models and agents are deployed without this being known centrally. The analyst recommends that CISOs work with Infrastructure & Operations to set up a searchable AI register containing applications, data used, agents, versions and ownership.
Development workflows and the SOC
The arrival of AI coding assistants is changing software development. Gartner advises building AI-specific security testing into CI/CD pipelines. Daftary cites offensive AI security testing, protection of sensitive data, maintaining Software Bills of Materials (SBOMs) and human oversight through human-in-the-loop.
The fourth AI project concerns the organisational model of the Security Operations Center. According to Gartner, the SOC is changing as a result of the deployment of AI agents. AI should support analysts and reduce their workload, while human judgement remains paramount in incident response and resilience strategy.
BIA and identities
Among the resilience projects, the Business Impact Analysis (BIA) comes first. Gartner recommends revising the BIA and focusing security measures on Tier 0 to Tier 2 critical assets, such as network infrastructure, identity management and core applications. The outcomes should guide protection, detection, response and recovery, supplemented by regular scenario testing.
The firm also advises reducing the attack surface of Identity and Access Management (IAM). Daftary identifies IAM as a primary target for attackers. According to the analist, organisations should map human and machine identities, clean up their IAM hygiene and monitor SaaS environments, supplemented by Identity Threat Detection and Response (ITDR).
Post-quantum and deepfakes
To prepare for post-quantum cryptography, Gartner advises building an organisation-wide cryptographic inventory to limit the risk of harvest-now-decrypt-later attacks. Existing technical debt initiatives can be leveraged for this. The firm cites a Cryptographic Center of Excellence and the collection of Cryptographic Bills of Materials (CBOMs) from suppliers as means of achieving crypto-agility.
The eighth project is a deepfake defence programme. Daftary states that the use of AI-generated deepfakes for identity fraud and disinformation is increasing rapidly. The analyst recommends a defence-in-depth approach that combines detection technology with adapted verification processes, employee awareness and organisational resilience.
Selection over completeness
Daftary stressed that organisations do not need to launch all eight projects at once. According to Daftary, CISOs would do well to assess the list against their current strategy, roadmap and existing investments. Gartner advises scoping the chosen projects so that they can be delivered within twelve months.
This article was originally published in Dutch on MSP Business. Read the original →
