Artificial Intelligence, non-human identities, post-quantum cryptography, the evolving role of the CISO, and security culture are among the topics gaining traction on the corporate agenda.
Cybersecurity is undergoing a period of rapid transformation. Advances in Artificial Intelligence, the growing automation of IT environments, and increasing operational complexity are expanding not only technological possibilities but also organizations’ risk surface.
This scenario demands a shift in mindset from security leaders. Rather than merely keeping up with new tools, CISOs must ensure that their ability to execute, prevent, and respond evolves at the same pace as new threats and technologies emerge.
Based on discussions at the RSA Conference 2026, held in San Francisco, Gabriel Loschi, CISO at Foursys, highlights five trends that are likely to influence companies’ cybersecurity agendas over the next few innovation cycles.
Artificial Intelligence has moved beyond purely experimental applications and is now integrated into critical security operations, with agents and models being used in the day-to-day operations of Security Operations Centers.
With this evolution, the challenge is no longer merely technological but has also become one of governance. As AI agents access systems, perform tasks, and influence decisions, it becomes essential to maintain control over their actions through access policies, audit trails, secure architecture, and clear mechanisms for interruption.
In this context, an approach that Gabriel Loschi calls AISecOps is gaining traction, based on the idea that AI initiatives must be built with security, governance, and validation built in from the very beginning.
Agents, service accounts, workloads, keys, and tokens are occupying an increasingly large portion of corporate infrastructure. As a result, so-called non-human identities are no longer a secondary issue but have become part of the core strategy for control and security.
Without proper inventory, defined responsibilities, and access reviews, organizations risk losing visibility precisely in the areas where automation is growing the fastest.
The challenge, therefore, is to ensure that governance keeps pace with the expansion of automation. Otherwise, operational scale may grow faster than the capacity for control.
The discussion on quantum computing and post-quantum cryptography has also taken on a more practical approach.
At this point, the priority is not to immediately migrate the entire cryptographic infrastructure, but to develop the ability to adapt. This includes mapping dependencies, identifying keys and certificates, understanding exposures, and building an inventory of the current environment.
This preparation is essential because advances in quantum computing, combined with artificial intelligence, could significantly accelerate the ability to exploit cryptographic vulnerabilities in the future.
So-called “crypto-agility” is thus becoming a strategic component of companies’ preparedness for new risk scenarios.
The CISO’s role has been expanding beyond the technical protection of infrastructure.
Topics such as Artificial Intelligence, the supply chain, organizational culture, innovation, and corporate risk have become part of the security agenda. At the same time, this expansion of responsibilities is not always accompanied by a proportional increase in resources.
This scenario demands an increasingly important skill: translating technical risks into business language.
The CISO must not only understand the business operations but also anticipate how new technologies may create future risks and how these risks should be communicated to executive leadership in a clear and strategic manner.
Even in an increasingly automated environment, the human factor remains central to organizational security.
The difference is that security culture and awareness programs need to evolve. Instead of generic initiatives, the trend is toward role-specific training, accompanied by metrics capable of demonstrating real behavioral changes.
This approach aligns safety culture with corporate risk management and transforms awareness into an operational component of the protection strategy.
The trends observed at the RSA Conference 2026 underscore a dilemma that is increasingly present in organizations: how can we innovate quickly without increasing exposure to critical risks?
The answer does not lie in choosing between innovation and security, but in developing frameworks capable of advancing both in an integrated manner.
AI governance, non-human identity management, preparation for post-quantum cryptography, the evolving role of the CISO, and the strengthening of security culture all point in the same direction: security must be embedded in business decisions from the very beginning.
For organizations that manage to balance speed, control, and adaptability, cybersecurity ceases to be merely a layer of protection and takes on a strategic role in supporting innovation.
Source: Content adapted from an article published in Security Leaders featuring Gabriel Loschi’s analysis of the key trends observed at the RSA Conference 2026.