In the rapidly evolving cybersecurity landscape, traditional annual IT security roadmaps are becoming obsolete. Insight Global’s John Dickson has faced a common challenge that many Chief Information Security Officers (CISOs) encounter today: the swift adoption of artificial intelligence (AI) tools by employees outpacing the ability of security teams to monitor and secure them. Instead of waiting for a delayed response, Dickson and his team proactively constructed capabilities for AI discovery, observability, control, and reporting, including thorough visibility into non-human identities (NHIs) like service accounts and AI agents.
This shift highlights a broader trend among security leaders, who recognize that static roadmaps simply don’t suffice in an age marked by uncertainty. According to Gartner's recent survey involving over 1,000 CISOs, agility—a prerequisite for adapting security initiatives—is essential for adequately addressing evolving business risks. As a result, CISOs are increasingly splitting their planning into long-term foundational strategies and agile, short-term actions.
Shifting the Planning Paradigm
Security plans that previously stretched over two or three years are now being divided into distinct cadences. Major architectural decisions, compliance commitments, and high-level principles may still be mapped out years in advance. However, the tools and methods deployed to manage threats are now adjusted monthly, weekly, or even in real time. This flexibility reflects a growing recognition that ambiguity has become the new normal in cybersecurity.
Chris Cochran, field CISO at the SANS Institute, emphasizes that today’s threat environment demands intellectual agility. Without the ability to pivot quickly, organizations risk falling behind—especially when AI deployments bring new vulnerabilities requiring immediate attention. Similarly, Joe McManus, CISO at Grafana Labs, exemplified this rapid adaptation when his AI agents flagged misconfigurations. By responding immediately rather than waiting for an annual review, he integrated new measures into Grafana's security agenda.
Adapting Strategies to Meet Immediate Needs
For many organizations, the luxury of a three-year plan that can simply be "set and forget" is a relic of the past. McManus believes such a long-term strategy has become nearly impossible to implement, given the rapid advancements in AI technology coupled with shifting threats. Instead, Grafana has shifted towards tactical sprints with agile review cycles, eschewing long model engagements for responsive and iterative improvements.
As Jacob Berry, CISO at Fable Security, points out, the conventional linear approach to security is outdated. Rather than waiting for complete reviews before launching products, security teams are now embedded in engineering processes, which enables quicker feature releases while maintaining oversight. Security tools are also evolving into systems that respond continuously to threats, necessitating that CISOs adjust their strategies accordingly.
Long-term Objectives Still Matter
Despite the push for agile responses, many security leaders still value long-term strategic roadmaps, particularly for complex threats like quantum computing. The KPMG 2026 Cybersecurity and Technology Risk Survey indicates that while AI threats are anticipated to be significant, organizations continue to maintain longer-term commitments to initiatives like data governance and platform upgrades.
Insight Global’s long-term planning aligns with efforts around core modernization, while Fable Security’s Berry produces an outline he prefers to label a "direction and resourcing plan" rather than a rigid roadmap. SANS Institute's Cochran suggests there's no universal guideline for the duration of a roadmap, emphasizing that as business needs shift, so too should strategies; unpredicted budget changes or gaps in executive backing can disrupt even well-laid plans.
Defining Priorities and Governance
When classifying projects, Berry advises his team to evaluate initiatives based on the level of coordination required and their connection to existing business commitments. Initiatives that entail broader collaboration and tie into strategic goals receive longer planning horizons; in contrast, more contained projects undergo continual reviews. The key lies in distinguishing between transformative commitments that endure and specific technologies that may only deliver temporary solutions.
The Evolving Role of Governance
As roadmaps shift from static multi-year plans to agile frameworks revisited quarterly, governance must adapt accordingly. Cochran points out a differentiating factor among organizations is the approach to governance. CISOs that prioritize communication and collaboration create more adaptive governance models. They ensure alignment with organizational objectives as plans evolve. This entails engaging boards in meaningful discussions about the current security posture and the associated risks.
Today, board inquiries revolve around tangible evidence of security practices—what technology is in use, who is responsible, and what data is exposed—rather than simply verifying if the organization is secure. KPMG’s findings reveal an additional challenge: 42% of security leaders struggle to demonstrate the return on investment for their cybersecurity initiatives, amplifying the importance of adapting roadmaps.
Ultimately, the evolving landscape of cybersecurity does not signal the end of roadmap planning; rather, it demands a transformation in how these strategies are conceived and executed. As Dickson summarizes, the key to an effective security roadmap lies in its ability to adapt in response to an ever-changing environment while retaining its long-term vision.
