Cybersecurity Strategy for 2027: Automate Response, Verify Every Identity
The security strategy taking shape for 2027 starts with a shift in operating tempo. AI is helping attackers scale their work, while defenders are using automation to sort alerts, handle routine tasks, and respond faster. For Equifax CISO Jeremy Koppen, that speed has a practical payoff: security built into product development can help teams ship sooner, as well as reduce risk.
That approach depends on more than adding AI tools. Security leaders are rethinking how they verify identities, prioritize vulnerabilities, patch systems, and update internal processes. Their common challenge is making protection adapt at the pace of a changing environment, where activity comes from people, software, and AI agents alike.
Build security into development and operations
Koppen says Equifax is continuing to embed security checks earlier in design and development, with more of those checks running automatically. The company is also expanding its use of AI in security operations to take on routine work. The goal is to reserve expert attention for threats and initiatives that need human judgment, while letting automated checks keep pace with product teams.
That work sits within a broader change in the CISO role. Omar Khawaja, a CISO and faculty member in Carnegie Mellon University’s CISO program, says security leaders recognize that their current approaches need substantial change over the next few years. He also describes transformation as ongoing: many executives are still working out which practices to change and how to make those changes stick.
The pressure comes from several directions. Alongside AI, security teams face geopolitical uncertainty, the prospect of quantum computing, and increasingly interconnected systems. Each can alter the organization’s exposure and make plans based on fixed assumptions less useful.
Replace passwords and apply human-grade controls to machines
Static credentials are one target for change. Koppen argues that even strict password rules cannot prevent predictable choices, such as a favorite sports team or current season followed by an exclamation point. Equifax has removed passwords for its 22,000 employees and contractors, and is extending its passwordless standard to business customers.
Identity management also has to account for a growing population of nonhuman users. AI agents, bots, automated workflows, systems, and APIs can access enterprise networks and data, but many traditional controls were designed around human employees.
Koppen says Equifax is applying rigorous verification to agent identities. Jason Rader, CISO for technology solutions and systems integrator Insight, says his team is managing agents like people: assigning identities, controlling permissions, and limiting access to what each role requires. He also stresses that machine identities need governance throughout their lifecycle. The practical test is whether every identity, human or machine, has only the access it needs and can be managed as its role changes.
Automate routine security work
Manual security operations can’t keep up with the volume and speed of attacks, according to Bill Hunkapiller, CISO at Florida State University. He has begun using autonomous agents for routine security operations and plans to expand the number of tasks handled by machines in 2027.
Adoption is rising across the industry. Sygnia’s State of Incident Response Readiness found that 32% of organizations had extensive AI use across most or all threat detection and incident response activities, up from 25% in 2025. The survey reported that 63% expect extensive AI use in those activities by 2027.
Those figures point to a change in how security teams spend their time. Automation can process routine signals and tasks at a scale that staff can’t match manually. But the operational value depends on directing that capacity toward meaningful risks, with people available to investigate and make decisions when judgment is required.
Prioritize vulnerabilities by business context
Generic severity scores offer a starting point, but they can’t tell a team how exposed a particular organization is. A vendor’s “critical” label doesn’t account for whether a system holds sensitive data, faces the public internet, or sits behind other controls, Koppen says.
Equifax uses a quantitative risk engine that weighs such context so teams can focus on vulnerabilities that pose real business risk. Hunkapiller is exploring services that build a digital twin of Florida State University’s environment and simulate how an attacker might exploit weaknesses. The aim is to get near-real-time insight into which vulnerabilities matter most to FSU and prioritize fixes accordingly. He compares the capability to “attack surface management on steroids.”
Contextual assessment matters more as the time available to respond shrinks. Verizon’s 2026 Data Breach Investigations Report puts the median time to remediate known exploited vulnerabilities at 43 days, compared with 32 days in 2025. Hugh Thompson, program chair for the RSA Conference, says methodical patch schedules that leave time for extensive testing may no longer match the speed at which AI-enabled attackers can exploit or discover vulnerabilities.
Move from scheduled patching toward continuous updates
Thompson argues that patching needs more automation. The older approach—test a fix, schedule its installation, and roll it out later—was designed to limit the chance that an update would break a system. In a faster threat cycle, lengthy delays can leave known weaknesses exposed.
Rader has reduced patch windows to seven days for Insight’s most critical components, a demanding target given the size of the IT environment and the volume of updates. He wants to accelerate patching across more of the environment in 2027, with continuous patching as a longer-term goal. Getting there will require teams to improve both the speed of deployment and their ability to understand the risk of applying each update.
Make security policy adaptable and connect AI governance
Fixed policies and procedures struggle when threats and technology change quickly. Prakash Venkata, a cyber, data, and technology risk partner at PwC, says CISOs need to build agility into their strategies so they can keep pace with changes to the threat environment and the organization’s attack surface. Thompson similarly urges security leaders to prepare for problems they can’t anticipate.
That agility has to extend beyond security. Thompson points to procurement as one example: when a new risk calls for a specific technology, purchasing processes need to move quickly enough for security teams to put it in place. Cross-functional coordination becomes part of the response capability.
James Lyne, CEO of SANS, sees another coordination problem in AI programs that operate apart from enterprise security and governance. AI applications exposed to malicious inputs still present an application security issue, he says; an agent with excessive access raises privilege management and operational security concerns. Those risks belong within the organization’s existing security disciplines.
For 2027, the strongest strategies will connect these pieces: identity controls that include machines, automated operations, contextual vulnerability decisions, faster patching, and policies that can adjust as conditions change. Security leaders are aiming to make that system work across people, software services, AI agents, and automated workflows—because attackers already operate across those same boundaries.
