Insight powered by the IBM Institute for Business Value

By Mark Hughes | Global Managing Partner Cybersecurity Services

President Trump recently signed the Cyber Strategy for America. It is one of the most significant shifts in national cybersecurity posture in years. The strategy calls for more active defense and offensive cyber operations against adversary networks. It commits to zero trust and quantum-safe cryptography across federal systems. It details a clear role for securing and leveraging the AI tech stack. And it explicitly calls on the private sector to match this level of ambition.

Most enterprises are not even close.

83 tools. 29 vendors.

According to the IBM Institute for Business Value, the average organization manages 83 security solutions across 29 vendors, while more than half of security teams say this fragmentation limits their ability to respond to threats. Many cyber defenses are a patchwork of static tools that were never designed to work together. That is not a security strategy. It is a structural vulnerability, and that is exactly what the national strategy is telling the private sector to fix.

The stakes have never been higher. The potential impact of a cyberattack now extends to geopolitical disruption, economic instability, and the safety of citizens. Artificial intelligence is fundamentally reshaping both how attacks are carried out and how defenses must evolve. That shift is happening faster than most enterprise security architectures were built to handle.

The agentic threat is already here.

At #RSAC26 this week, one theme dominating every keynote and hallway conversation: the rise of agentic AI. Adversaries are already experimenting with agentic AI systems, autonomous, self-directing, and operating without human intervention. When an AI-driven attack can achieve full domain dominance on a corporate network in under an hour, the question is no longer whether you have the right tools. It is whether those tools can act at machine speed.

As many as 1.3 billion AI agents could be in operation by 2028, each requiring governance and protection. This introduces an entirely new attack surface: non-human identities. AI agents acting on behalf of employees must be secured with the same vigilance applied to people with observability, least privilege, and zero trust principles extended to every autonomous system in your environment. “We cannot protect what we cannot see,” as one RSAC26 keynote speaker put it. In the agentic era, an observability control plane is no longer optional.

Focus is becoming the differentiator.

The enterprises pulling ahead are narrowing their focus, starting with data. They are identifying the information that would have the greatest impact if exposed or disrupted, planning for compromise, and prioritizing protection above everything else.

The U.S. National Cyber Strategy reflects this same discipline. By placing quantum-safe cryptography, zero trust, and critical infrastructure at the center of national priorities, it signals that not all risks can be treated equally. The conversation around post-quantum cryptography is shifting from “if” to “when,” with IT leaders urged to inventory cryptographic assets and develop migration strategies now.  State actors are harvesting encrypted data today, expecting to decrypt it within years using quantum computers. Crypto-agility is a multi-year migration and not a switch you flip. These are boardroom conversations, not just SOC conversations.

Leading organizations are also moving from periodic security assessments to Continuous Threat Exposure Management (CTEM), which is an always-on framework that provides ongoing visibility into vulnerabilities, attack paths, and business impact.  In a world of agentic threats, point-in-time testing is a liability.

Simplification is not efficiency. It is survival.

The practical question for CISOs is does AI reduce the time to detect, time to respond, and operational friction, without increasing risk. Where it simply adds another tool the team cannot integrate, govern, or measure, it should be avoided.

That means security designed into the architecture from the foundation, not bolted on. It means platforms that consolidate detection, response, and intelligence into a single operating model. It means quantum-safe encryption built in from the outset, not retrofitted after the threat arrives. And it means AI governance frameworks that keep humans in the loop as autonomous systems take on greater responsibility. When security is architectural, it scales. When it is fragmented, it fractures under pressure. This does not always mean starting over — but it is time to evolve.

It is time to act.

The U.S. government has moved from a defensive posture to a proactive one. Everything we have done in security over the past 20 years is going to change and it is going to change quickly.  This is no longer about compliance checklists or adding another vendor to the stack. It is about whether your security architecture can operate at the speed and scale this moment demands.

Security fragmentation is vulnerability. Focus is the strategy. The organizations that simplify their architecture, protect their most critical data, govern their AI agents, and build security into the foundation will not just survive this era. They will operate with confidence and a resilience that their competitors cannot match.

Curious to learn more? Talk to IBM’s cybersecurity experts: https://www.ibm.com/services/security