KPMG Cybersecurity considerations 2026: eight priorities for CISOs, from AI agents to PQC

In two minutes

• The paper lists eight considerations: autonomous security workforce, geopolitics and compliance, safeguarding AI, non-human identities, IT/OT hyperconnectivity, post-quantum cryptography (PQC), supply chain detection and response, and a wider CISO role (p. 5).
• KPMG says supply chain risk, geopolitics and non-human identity management are rising to the top, and maps each sector's priorities in a chart (p. 6).
• On AI agents, it says CISOs struggle to find and catalog 'shadow agents'. It recommends a central identity store, policy-based access controls, zero trust and AI red-teaming (pp. 9, 21).
• For AI safety, it gives a six-question agent checklist (where agents run, their identities, access, permissions, fit with approved use, how to shut them down) and suggests a CISO-led AI governance committee (pp. 16, 18).
• On PQC, it says migration will happen globally and is multi-year. It advises risk assessments, cryptographic inventories, and procurement rules that require vendors to be quantum-ready (pp. 29-31).
• On supply chains, it says point-in-time, paper-based third party risk reviews cannot keep pace. It recommends continuous, risk-based monitoring of high-risk, low-maturity suppliers (pp. 33-35).
• In IT/OT, it says static models such as the Purdue Model are increasingly unsuited. It proposes a dynamic zero trust 'mesh' and cites CISA guidance that AI should not make OT safety decisions (pp. 25-26).
• Each consideration ends with suggested actions, and page 40 groups them under people, process, technology and regulations.

Key numbers

• 92%: of technology executives say managing AI agents will become an essential skill within five years (p. 9).
• 79% / 69% / 57%: CEOs naming cybercrime, regulatory demands and geopolitical conflicts as major threats to future prosperity (p. 12).
• 54%: of respondents in a study of almost 50,000 people in 47 countries say they are wary about trusting AI (p. 17).
• 61%: of US companies not yet comfortable with autonomous agents, who will require human-in-the-loop oversight (p. 21).
• 59%: of companies had a data breach caused by a third party in the past 12 months (SailPoint) (p. 21).
• 41%: of organizations concerned they are falling behind on quantum-driven threats and PQC transition (p. 29).
• US$7.1 billion: projected US federal PQC migration cost, 2025 to 2035, for prioritized systems only (p. 29).
• 45%: of organizations say regulatory and compliance risk has grown in importance (third-party risk survey) (p. 33).

What to do with it

• Build a central identity store that tags and tracks AI agents, and bring non-human identities into enterprise identity governance (pp. 21, 23).
• Use the six-question AI agent checklist to review where agents run, what they can access and how to shut them down (p. 16).
• Set up an AI and agent red-team function and a cross-department AI governance committee (pp. 10, 19).
• Start PQC work now: run quantum risk assessments, build cryptographic inventories and update procurement standards (p. 31).
• Extend third party risk management to distributors, partners and retailers, and move high-risk, low-maturity suppliers to continuous monitoring (p. 35).
• Merge IT and OT monitoring and secure top-down sponsorship for IT/OT change (pp. 25-27).

Read the full document if

• you need a checklist of 2026 CISO agenda items tied to suggested actions.
• you run identity, AI security or PQC programs and want the paper's specific recommendations.
• you work in government, financial services, defense, energy, telecoms or healthcare and want the sector priorities on p. 6.

What it relies on

The paper draws on insights from more than 20 KPMG cyber experts and senior leaders from alliance partners Google, Microsoft, Palo Alto Networks and ServiceNow (p. 4). It also cites KPMG surveys (2025 CEO Outlook, Global tech report 2026, AI Quarterly Pulse, Third-Party Risk Management Survey), plus outside sources such as CISA, NIST, OWASP and SailPoint. It gives no sample sizes or methods for the KPMG surveys. A closing note says the views are those of the interviewees (p. 44). KPMG sells cyber services and tools of the kind the paper recommends, including Cyber Managed Services and a risk quantification platform (pp. 13, 41).

Our read

A broad agenda-setting paper. It is most useful as a structured list of topics and suggested actions to check against your own program. The statistics are few and come from other surveys with no method given here. Expect advisory framing, with quotes from KPMG and alliance partners.