Cybersecurity in 2027: Automate Response and Secure Every Identity

Cybersecurity teams are being pushed to change how they work: AI is speeding up attacks, while growing numbers of AI agents and automated workflows are becoming part of enterprise operations. For Equifax CISO Jeremy Koppen, the response is to build security into product development earlier, automate routine work and apply rigorous identity checks to machine activity. The wider shift is just as practical: teams need to prioritize risk in their own environments, patch faster and adapt policies as conditions change.

That’s a significant adjustment for organizations built around human users, scheduled maintenance and fixed procedures. Omar Khawaja, a CISO, Carnegie Mellon University CISO program faculty member, and board member at HITRUST and the FAIR Institute, says many security leaders recognize that their current approach isn’t working. The transformation will take years, he says, but security leaders already need to decide what to change for 2027.

Build security into development and operations

Koppen’s strategy starts earlier in the product lifecycle. Equifax aims to expand security checks that run automatically during design and development, while using AI in security operations to handle routine tasks. The intent is to give specialists more time for complex threats and strategic work. Koppen says security done well can help a product launch sooner, rather than becoming a late-stage obstacle.

AI is accelerating activity on both sides. Attackers can use it to operate at greater scale, Koppen says, while Equifax is using it to move faster in its own security work. Florida State University CISO Bill Hunkapiller describes the operational pressure more bluntly: teams can’t keep up with attacks and vulnerabilities through manual work alone. He is implementing autonomous agents for routine security operations and plans to expand their role in 2027.

Adoption is already growing. Sygnia’s State of Incident Response Readiness reports that 32% of organizations use AI extensively across most or all threat detection and incident response activities, up from 25% in 2025. The survey found that 63% expect extensive AI use in those activities by 2027. The figures suggest automation is shifting from experimentation toward a more established part of security operations.

Apply identity controls to machines

As agents and automated workflows take on more tasks, identity management has to account for them as carefully as it accounts for employees. Koppen calls identity controls central to his 2027 strategy. Many traditional controls were designed around human users, he says, even as more network activity now comes from bots, agents and automated systems. Equifax is applying verification to these identities with the same rigor it applies to people.

Insight CISO Jason Rader is taking a similar approach, managing agents like people by controlling their identities, permissions and access to systems and data. The goal is to ensure each entity can reach only what its role requires. That work also needs to cover the full lifecycle of a machine identity, along with appropriate governance. APIs and other nonhuman identities belong in the same operational picture, rather than being treated as a separate class of access that gets less scrutiny.

That principle also matters when AI tools interact with other enterprise systems. James Lyne, CEO of security training and certification organization SANS, argues that AI security and governance should be part of the organization’s existing security and governance programs. An AI application exposed to malicious inputs presents an application security problem; an agent with unauthorized access presents a privilege management and operational security problem. The technology may be new, but the underlying responsibilities are familiar.

Replace generic severity with business context

A vulnerability’s published severity score can’t tell a security team how much damage it could cause in a particular environment. Koppen says a vendor’s “critical” label doesn’t account for whether the affected system holds sensitive data, faces the public internet or sits behind other controls. Equifax uses its own quantitative risk engine to add that context and direct attention toward issues that pose real risk to the business.

Hunkapiller is also looking for ways to assess vulnerabilities against his organization’s specific systems and defenses. He is exploring services that create a digital twin of an environment and simulate how an attacker might exploit weaknesses there. The resulting near-real-time view could help Florida State University identify which vulnerabilities demand the fastest response. Hunkapiller describes the capability as “attack surface management on steroids.”

This approach changes the question from “Which vulnerabilities have the highest score?” to “Which weaknesses create the greatest exposure here?” The distinction matters when teams have more issues to investigate than they can address at once. Local context can help security leaders direct limited remediation capacity where it is most useful.

Shorten the time between vulnerability and fix

Scheduled patch cycles leave a window in which known weaknesses remain exposed. Verizon’s 2026 Data Breach Investigations Report puts the median time to remediate known exploited vulnerabilities at 43 days, compared with 32 days in 2025. For Hugh Thompson, program chair for the RSA Conference, the old pattern of testing patches at length and deploying them on a calendar is increasingly difficult to sustain as attackers find and exploit vulnerabilities faster.

Thompson argues that patching needs more automation. Rader’s program at Insight has already reduced patch windows to seven days for its most critical components, despite the scale of the company’s IT environment and the volume of patches it receives. His next goal is to increase patching speed across the environment, with continuous patching as a longer-term target.

Faster deployment still requires teams to manage the risk of a patch disrupting a system. The operational challenge is to make testing, prioritization and rollout move quickly enough to keep pace with active threats. A calendar-based cycle may provide predictability, but a long delay can leave known flaws available to attackers.

Make security procedures easier to adapt

Security policies and standards can’t be treated as finished documents. Prakash Venkata, a cyber, data and technology risk partner at PwC and leader of the firm’s security, risk and engineering practice, says some CISOs still take a set-and-forget approach. That was already a weak fit for changing systems and threats; the current pace of change makes adaptability a basic requirement for keeping security practices current.

Thompson also urges security leaders to prepare for problems they can’t anticipate. That flexibility depends on work beyond the security team. Procurement, for example, may need to move quickly when a new technology could reduce an emerging risk. If buying procedures take longer than the threat response, the organization’s ability to act is constrained before security teams can put a defense in place.

The same need for coordination applies to governance. Lyne warns that separate AI security programs can create silos and duplicated effort when AI risks are already connected to application security, access management and enterprise operations. A unified strategy should cover human users, software services, AI agents and automated workflows under a shared approach.

The security strategy taking shape for 2027 links these changes: automate routine response, treat machine identities as first-class identities, rank vulnerabilities in local context and reduce the time required to fix them. The organizations best positioned to respond will be those that can update both their technical controls and the processes around them as their systems—and the threats aimed at them—change.