Adapting IT Security Roadmaps for a Rapidly Evolving Threat Landscape

Security leaders are facing unprecedented challenges as rapidly advancing AI technologies outpace traditional IT security roadmaps. For instance, John Dickson of Insight Global found his security team overwhelmed by the swift adoption of AI tools by employees, prompting his organization to quickly develop visibility into non-human identities (NHIs), like service accounts and AI agents. Instead of adhering to a year-long plan, his team opted for a proactive strategy that involves reassessing their security approach every quarter. “An annual review means you’re making decisions on assumptions that may be a year old,” he notes, advocating for an approach that keeps pace with the current threat landscape.

The security market’s dynamic nature is compelling leaders like Dickson to break away from static plans. Gartner’s recent survey revealed that an increasing number of CISOs are adopting a two-tier planning model: long-term commitment to principles and compliance, paired with flexible monthly or even weekly updates on tools and tactics. “The luxury of a fixed three-year plan you set and forget is gone,” insists Chris Cochran of the SANS Institute, emphasizing the need for agility in a climate rife with uncertainty.

When Static Plans Become Obsolete

The urgency for responsive strategies is further illustrated by cases like that of Grafana Labs, where CISO Joe McManus had to act quickly to address issues identified by AI agents developed by citizen developers. These agents highlighted critical misconfigurations and shortcomings in controls that had not been previously recognized. McManus’ immediate response included adding control audits to their roadmap, reflecting the gap between static planning and the fast-moving realities of cybersecurity.

McManus contends that planning beyond a year often feels futile, particularly with AI innovations making rapid advances in threat vectors. While Grafana maintains a two-year goal map, the second year acts more as a flexible framework, constantly adjusted based on current threats. Their shift to shorter, tactical sprints has transformed security audits from an extensive project into regular reviews, adapting alongside the evolving threat landscape.

The Shift Towards Agile Security

Fable Security's CISO Jacob Berry describes how traditional linear security reviews—designed to sequentially control processes—are becoming obsolete. The organization now collaborates closely with engineering to roll out features faster than before, aligning with the market's pace. The rigid sequential nature of security reviews is replaced by a more fluid, integrated approach that prioritizes equipping teams over controlling them.

According to Raja Chris, former CISO and founder of AI governance firm AIVONS, the best security tools today operate like living entities. They continuously adapt and respond to new exposure instead of relying on delayed reviews. This shift indicates a broader trend: CISOs must rethink their strategies and roadmaps to reflect a more responsive and real-time approach to security.

The Value of Long-Term Planning

Despite the push for agility, many security leaders still recognize the importance of long-term roadmaps, particularly when addressing enduring threats like quantum computing. As highlighted in KPMG’s 2026 Cybersecurity and Technology Risk Survey, security leaders continue to expect AI-driven attacks to lead the cyber threat landscape in the near future, underscoring the need for both immediate and extended planning.

For Dickson, maintaining a long-term vision is essential for guiding principles such as data governance and platform modernization. Meanwhile, Berry’s team at Fable Security regards their long-range view as more of a direction plan than a rigid technical roadmap. However, Cochran suggests that even these plans are susceptible to disruption, with major shifts in budgeting or executive support potentially derailing even the most carefully crafted strategies.

Categorizing Work in Security Roadmaps

Determining where initiatives belong within a security strategy isn’t arbitrary. Berry guides his team to ask two critical questions: How many resources are needed to accomplish this task? And how closely does it relate to a strategic business commitment? Projects that require extensive collaboration and align with larger business goals are assigned to longer timelines, while more isolated tasks fit within a continuous review framework.

Long-lasting outcomes, such as resilience and identity verification, should remain prominent, though the technologies that support these goals might not. AIVONS’ Chris posits a litmus test: if an initiative would stand firm even if all vendors were replaced, it can typically be considered part of a long-term plan. Conversely, if it’s just a choice of implementation framed as strategy, it belongs in quicker cycles to enhance credibility in the planning process.

Governance in an Agile Security Environment

Transitioning to a quarterly roadmap necessitates a different governance approach. Instead of relying on compliance checklists and singular sign-offs, CISOs must foster an environment of communication and collaboration across teams, argues Cochran. This shift is vital for ensuring that all stakeholders—from boards to individual team members—stay aligned with evolving plans.

Boards now expect comprehensive insights into how security measures keep pace with business developments, alongside the associated risks that come with rapid progress. Chris notes a shift in the questions they ask: they’re looking for transparency about security processes rather than simply confirming security’s presence. As illustrated by KPMG’s latest findings, a significant percentage of security leaders struggle to show a return on cybersecurity investments, highlighting a compelling reason for the evolution of roadmaps.

While the conventional static roadmap may be fading, there’s still merit in long-range planning. Dickson affirms the continuing value of a well-structured roadmap that is regularly updated. The challenge lies in balancing long-term strategies with the need for agility—an essential aspect of navigating today’s complex security landscape.