What a security strategy that survives 2027 looks like
CSO Online ·
Equifax CISO Jeremy Koppen sees the same dynamics most security chiefs are facing: hackers on the one side using AI to perform more sophisticated attacks at unprecedented speed, and defenders on the other adopting AI to match that volume and velocity. “AI is changing the pace on both sides,” he says. “Attackers are using it to operate at greater scale, and Equifax is using it to innovate more quickly.” In the next year, Koppen will continue to evolve Equifax’s security strategy to keep with an accelerating threat environment. “That means building on the security already embedded across our design and development process, so checks run early and automatically,” he says. “It also means expanding how we use AI in our own security operations to handle routine work, so our experts can focus on the threats and initiatives that matter most. Done well, security becomes one of the reasons a product can launch sooner.” As for the rising tide of AI agents entering enterprise workflows, Koppen says that “identity controls are central” to his 2027 security strategy. “Across the industry, more activity on enterprise networks now comes from AI agents, bots, and automated workflows, and most traditional security controls were designed with a human user in mind,” he explains. “That’s why we’re applying the same rigorous verification to these identities that we apply to people.” Of course, Koppen, like other seasoned security leaders, knows his IT security strategy must evolve to address more than just AI. Geopolitics, the anticipated arrival of quantum computing, and increasingly interconnected systems, are also changing the threat landscape and attack surface — sometimes in radical ways — and should prompt strategic changes, too. That in turn is putting pressure on CISOs to rethink their practices, policies, and approaches as we head toward a new year likely to be at least as wild of a ride as 2026 has been. “CISOs realize they need to transform, because their current state isn’t working. And it’s going to be a pretty significant transformation over the next few years for CISOs to be successful,” says Omar Khawaja, a CISO, a faculty member at Carnegie Mellon University’s CISO program, and a board member at HITRUST and FAIR Institute. Of course, transformation, as always, is a work in progress, Khawaja says; as a result many security execs are still working out what needs to change in 2027 and how to make those changes happen. Still, Khawaja, Koppen, and others stress that transformation is not an option; the safety of the organization depends on strategic evolution from its cybersecurity teams. So what exactly needs to change? Security leaders point to specific elements that won’t work as well in the year ahead and what needs to be in place instead to more adequately secure the organization in 2027 and beyond. Static credentials need to go Koppen believes static credentials are on their way out. “No matter how strict the policy, passwords still end up looking like a favorite sports team or the current season with an exclamation point at the end. That makes them trivial targets for brute-force attacks,” he says, noting that his company eliminated passwords across its 22,000 employees and contractors and is now extending its passwordless standard to its B2B customers. More manual SOC work must be automated The new command for security teams is to move at machine speed. “We’re not able to deal with attacks and vulnerabilities manually anymore. AI is making that impossible,” says Florida State University CISO Bill Hunkapiller. His security strategy reflects this new reality. He has been implementing autonomous agents to replace routine security operations tasks, and his 2027 plans call for expanding the number of tasks handled by machines. Most CISOs are on this path. The State of Incident Response Readiness from Sygnia found that 32% of organizations have extensive AI use across most or all threat detection and incident response (IR) activities, up from 25% in 2025. And 63% expect to have extensive AI use in place for threat detection and IR activities in 2027. Generic severity scores are out, risk ratings tailored to the organization are in Equifax’s Koppen declares that generic severity scores are no longer effective. “A vendor’s ‘critical’ rating doesn’t know if a system holds sensitive data, is externally facing, or sits behind other controls,” he says, noting that Equifax has its own quantitative risk engine that factors in that context so its teams “can focus on issues that pose real risk to the business.” Hunkapiller, who is also chief privacy officer and an adjunct professor at FSU, also sees a need to understand how common vulnerabilities and exposures pose a risk to his organization in particular, rather than relying on ratings. To that end, he’s exploring services that could create a digital twin of his environment to simulate how hackers could exploit vulnerabilities in his organization. This service would give Hunkapiller near-real-time information on which vulnerabilities pose the most significant risks to FSU, allowing him to accurately prioritize fixing those quickly, he says. Thus far, he’s impressed with the capability, saying it’s like “attack surface management on steroids.” Continuous patching is now the goal Security used to have Patch Tuesday, a moniker that reflected the regularly scheduled work of applying newly released fixes to software flaws. Although security teams today may not adhere to Tuesday specifically for the work, many still patch on a set schedule — and many still take weeks to patch. Verizon’s 2026 Data Breach Investigations Report puts the median time to remediate known exploited vulnerabilities at 43 days, up from 32 days in 2025. That won’t fly in 2027 , says Hugh Thompson, program chair for the RSA Conference. “We used to do patching very methodically. If a patch came out for a system, we didn’t want to roll it out right away [for fear] it could break something. So we took time and tested it out and scheduled the work. That’s not going to work now, because the speed at which these AI attackers can take advantage of vulnerabilities or discover new ones is greater than ever,” he says. “We need automation in patching.” Jason Rader, CISO for technology solutions and systems integrator Insight, has been accelerating his company’s patching program, bringing patch windows down to seven days for its most critical components — a significant accomplishment given the size of the IT environment and the number of patches being released. Still, he wants to do better, saying he’s aiming to increase speed for patching in all areas of the IT environment in 2027 and noting that he’d like to eventually get to continuous patching. Different treatment for agent and NHIs needs to end With AI agents doing more work that was, until recently, performed by humans, it’s becoming increasingly clear that security can’t treat machine identities — whether agents or systems or APIs — differently than humans, Rader says. To that end, he’s already “managing agents like people,” applying equally diligent attention to managing identity and associated permissions — and, thus, access to data and systems — to ensure that each entity can access only what is appropriate for its role. This includes managing machine identities throughout the lifecycle of those machines, just as security should for human workers, and applying proper governance, Rader adds. Agility and adaptability must be part of the 2027 strategy Some CISOs still take a set-and-forget approach to policies, procedures, and standards, says Prakash Venkata, a cyber, data, and tech risk partner at PWC and the firm’s security, risk, and engineering practice leader. That approach never worked well, as there has always been a need to improve and evolve policies, procedures, and standards as the threat landscape and the attack surface changed, Venkata explains. But the pace of change now is so fast that CISOs need to build agility and adaptability into their strategies simply to keep up and meet industry standards. Thompson likewise preaches the need for more agility in security strategies and advises security leaders to “be prepared for agility more than we had to or could stomach in the past because problems will emerge that you can’t anticipate.” He notes, too, that CISOs need to work with other departments, such as procurement, to bring that needed agility to security. For example, if the CISO needs to quickly buy and implement new technology to reduce a recently identified risk or defend against an emerging threat, CISOs will need procurement procedures to move as fast as security must move. Detached AI security and governance strategies become obsolete There has been a rise of AI governance and security strategies that are detached from the organization’s overall governance and security strategy, says James Lyne, CEO of SANS, a security training and certification organization. Lyne believes that the attention on AI governance and security is critical. However, he thinks having fully segregated AI governance and security strategies will be increasingly detrimental in 2027 and beyond. That’s because they’re not different and separate from enterprise governance and security. “An AI app exposed to malicious inputs is an app security problem,” he says. “AI agents accessing unauthorized things is a privilege management and operation security issue [no less than] if people had unauthorized access.” To ensure organizations have an effective, coordinated approach to governance and security capable of protecting the entire organization, where elements work together with no siloes or redundancies, CISOs and their organizations need a unified security strategy that addresses all actors — “whether they’re human, software services, or AI agents, or automated workflows,” he says.