Digital trust is huge, and it starts with fundamentally understanding where your data is, who is using it, how it is being used, and whether or not you can protect it effectively regardless of where it sits. For us, digital trust means our customers must be absolutely comfortable that the data we send them is exactly what they are expecting, and that it is actual and factual.

–VP, Medical Technology Company

A classic example is the restriction of personal webmail. Employees often complain that blocking these services prioritizes administrative inconvenience over actual security, which can inadvertently drive them toward bypass behaviors—introducing even greater "shadow IT" risks.

When addressing these concerns, we ask users to walk us through what workarounds they are considering. This opens a dialogue to help them understand that personal email remains a premier, highly active entry point for sophisticated phishing campaigns. Because we cannot extend our enterprise email security stack (like automated sandbox analysis or advanced threat protection) to personal accounts, bypassing this control exposes the organization to severe risk. We back up the policy with real-world examples of incidents we have successfully mitigated or observed due to this exact vector.

–CISO, Healthcare Company

One of the most effective things we did early on was create a newsletter for our IT business partners that showcased exactly where cyber "saved the day" or where we enabled the business to execute a new initiative they couldn't do before because it wasn't secure enough. That resonated extremely well and equipped our IT partners to use those specific stories with their business counterparts. Ultimately, demonstrating value comes down to a lot of storytelling—and conducting regular tabletops, which we've found the business is very hungry for.

–VP, Medical Technology Company

The most critical missing piece is the education of mid-tier management, particularly operations leaders like plant managers. While executives and boards fully grasp security risks today, mid-tier managers are driven by local metrics. If cybersecurity measures negatively impact their numbers, they push back—even if the action protects the enterprise.

We need to close this education gap so they understand why systems are taken down, while simultaneously establishing governance paths that allow them to explain localized operational impacts up their management chain.

–VP, Medical Technology Company

There is an immense amount of value in having a standardized platform because you know exactly what you're getting, though you always have to strike the right balance with the company's internal political climate.

For example, when looking at our international regions, a decentralized setup does limit lateral blast radius—if one country has an incident, it won't easily bleed over. However, the brand risk remains. To address this, we are looking at ways to standardize while still offering local control. When one of our countries asked to migrate off our central tenant, our solution was: We can give you your own local administrative controls to manage, while you continue "drinking from the central fountain" of our standardized security baseline.

–CISO, Healthcare Company

We look at advancing trends and actively plan now so we are never surprised overnight. For instance, agentic AI attack swarms, which use distributed AI agents to overwhelm, adapt to, and infiltrate their targets, require automated, real-time defenses. To combat an AI attack swarm, we must deploy an AI defense swarm capable of automated, closed-loop response, even if that means autonomously taking a critical system offline to protect the enterprise.

Staying ahead doesn't always require massive capital; it requires proactive, low-cost preparation. For example, within three months of a recent GenAI application release, we secured an out-of-band enterprise license approved by the board. This small investment allowed our security team to analyze how threat actors could weaponize the tool, giving us the speed to build automated defensive playbooks first.

And although quantum capability is still three to four years out, we are already doing the pre-quantum preparation. When encryption suddenly dies overnight we will already have a plan to rapidly implement government-approved post-quantum cryptography.

–VP, Medical Technology Company

The future of cyber is going to be defined by autonomous machine-on-machine battles. We will see agentic AI attack swarms pounding on enterprise environments 24/7 with hundreds of thousands of bots. Because of this scale, agentic AI is absolutely a greater threat than an employee oversight. While an employee can only make one or two mistakes, an automated attack swarm will relentlessly scan 24/7 to find and weaponize those exact mistakes instantly.

To survive, we must transition to automated, agentic defending swarms that detect exploits and push out mitigations across production systems in near real-time.

–VP, Medical Technology Company

AI is both a helper and a threat, but we have to actively lean into it to keep things equal. Threat actors have immense incentives and are not held back by the politics of corporate infrastructure. In the near future, we are going to learn a lot of lessons through massive, AI-accelerated attacks as the threat landscape continues to advance and pivot quickly. Because of this, the way we defend must evolve—we cannot keep chasing known bad actors.

Ultimately, whether the next shiny object is AI or quantum computing, the security basics remain exactly the same: Who has access to the data, where is it stored, and how is it protected?

–CISO, Healthcare Company