Redefining Security Roadmaps: Moving to Shorter Planning Cycles

Today's security environment requires chief information security officers (CISOs) to adapt swiftly as emerging AI technologies outpace traditional security measures. John Dickson, of Insight Global, embodies this challenge as employees adopt AI tools quicker than his security team can monitor. This situation pushes him to fast-track the development of visibility into non-human identities (NHIs) such as service accounts and AI agents. His proactive approach highlights a significant shift in security strategies, where waiting for planned reviews is no longer viable.

Incorporating a fresh take on traditional security roadmaps, Dickson's team implements an innovative strategy: a quarterly reassessment of their security approach against the evolving threat landscape. By stretching their planning horizon regularly, they avoid the pitfalls of making decisions based on outdated assumptions. As Dickson succinctly puts it, "An annual review means you’re making decisions on assumptions that may be a year old."

Agility in Security Planning

CISOs are increasingly recognizing the limitations of rigid yearly roadmaps. A recent Gartner survey of over 1,000 CISOs paints a clear picture of the need for agility in security planning. Agility is now defined as the ability to swiftly reprioritize strategies in response to shifting business risks. Hence, many leaders, including Dickson, have started to separate long-term strategies from the day-to-day tactical adjustments needed to respond to immediate threats.

Instead of clinging to a linear, multi-year planning model, security leaders are bifurcating their approaches. While high-level principles and compliance commitments still warrant multi-year plans, the tools and tactics necessary for daily operations are revisited on a much shorter timeline. Some teams are even adopting approaches that allow adjustments in real-time as new threats emerge. Chris Cochran, an experienced field CISO, emphasizes that in an unpredictable landscape, intellectual flexibility becomes a critical advantage.

Adapting to Accelerated Change

For Joe McManus, CISO of Grafana Labs, the fluidity of the threat landscape became painfully evident when AI agents he deployed began revealing significant misconfigurations that went unnoticed. His responsiveness to these findings illustrates the urgency behind adopting a more dynamic roadmap approach. He shifted priorities to include control audits and system segmentation after those AI insights, illustrating that planning cannot be a static exercise.

McManus notes that he finds planning beyond a year largely futile, especially in an era where new, affordable AI tools are readily accessible. While Grafana maintains a goal map that spans two years, they continuously adapt it to align with the current threat landscape. The realization that security isn’t a one-time setup but a perpetual state is reshaping the expectations from CISOs. Every quarter—and even every week—security leaders are expected to provide updates and adjustments.

Long-Term Commitments versus Immediate Priorities

Despite the push for short-term dynamism, many security leaders still recognize the importance of long-term planning. As per KPMG's 2026 Cybersecurity and Technology Risk Survey, a focus on long-term threats, including the implications of quantum computing, remains prevalent. Yet, it’s clear that while long-range plans are essential, they must be adaptable to changes in technology and business priorities.

Organizations like Insight Global prioritize commitments to data governance and platform modernization while remaining flexible in their timelines. Dickson describes these as essential elements that still align with overarching business commitments without being shackled to outdated strategies.

Categorizing Work for Effective Implementation

Determining the necessary timeframe for various initiatives is crucial. Jacob Berry at Fable Security advocates for a discerning approach when categorizing workloads. Each piece of work is evaluated based on the level of coordination required and its direct ties to strategic commitments. Those initiatives needing broad cooperation and that align closely with existing business commitments deserve longer planning horizons.

Conversely, tasks that are narrower in scope can be integrated into the continuous cycle of shorter-term reviews and iterations. This pragmatism ensures that security remains flexible and responsive without compromising the integrity of long-term strategies.

Governance as Communication

Governance in security planning has also evolved. CISOs are transitioning from the static compliance mindset more akin to earlier models towards a nuanced approach that focuses on communication. According to Cochran, effective governance today is about engaging the board and ensuring that teams are informed and aligned with shifting plans. The demands of boards have shifted; they now seek concrete evidence of how security measures align with business objectives and manage associated risks.

The challenge for many security leaders lies in clearly demonstrating return on investment in cybersecurity, as highlighted in the KPMG survey, where over 40% of CISOs reported difficulties in this area. This emerging landscape underscores why the traditional static security roadmap may not be viable anymore; constancy is contingent upon an ever-changing technological landscape.

Despite this shift, leaders such as Chris from AIVONS argue that the essence of a long-term cybersecurity roadmap remains valid, albeit in a more dynamic format. Dickson echoes this sentiment, asserting that an adaptable roadmap continues to hold value as long as it evolves with the threat environment.