Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By: Eran Barak, CEO, MIND
The security landscape is shifting faster than policy can catch up. AI has changed everything, from how we work to how risk materializes. What once felt like a distant horizon is now a daily reality: GenAI in the hands of employees, autonomous agents navigating business systems and sensitive data flowing across fragmented cloud environments at machine speed.
In 2026, security leaders will be forced to reckon with a hard truth: identity and data security must become a source of collaborative strength instead of isolated security silos.
That means rethinking long-held boundaries between identity and data. These domains were historically managed by different teams, measured with different metrics and governed by different policies. But AI doesn’t respect those separations. It operates across them. And that creates a fundamental challenge for the way modern enterprises manage risk.
Looking ahead, three predictions stand out, each pointing to a single imperative: security must become more unified, more continuously adaptive and more context-aware.
Prediction 1: Identity and Data Will No Longer Be Managed Separately
For decades, security has treated identity and data as separate domains: one controls who gets access, the other governs what is being accessed and, together, they determine when and where access occurs. But the rise of AI collapses that distinction. Agents are now not only requesting access, they’re generating, analyzing and transmitting sensitive information, often in real time. And many times without a human in the loop.
This new reality makes perimeter-based controls insufficient. Identity systems can’t determine risk in real time without understanding the nature of the data being touched. And data governance platforms can’t enforce meaningful controls without knowing who or what is in motion, and why.
In 2026, forward-looking organizations will begin building unified security fabrics that treat identity and data as two sides of the same coin. Policies will be dynamic, risk-aware and a combination of identity and data signals, grounded in context, not just credentials or classifications/tagging.
Implication: CISOs will drive convergence between IAM and DSP (data security platform, including DLP and DSPM capabilities), using a single layer of logic to assess access, intent and data sensitivity together.
Prediction 2: AI Will Break Legacy Risk Models
Traditional security models assume predictable, rule-based behavior. AI doesn’t fit in that box. It learns, adapts and evolves. It introduces nonlinear, non-deterministic risk into the enterprise. That means yesterday’s policies, based on static groupings or Boolean logic, simply won’t keep pace with how risk actually manifests in AI-driven environments.
In practical terms, this means more blind spots, more false positives and more alert fatigue, unless something changes. In 2026, we’ll see organizations shift from rigid policies to adaptive risk signals: behavior-based indicators that factor in who is acting, what data is being accessed and the full situational context around that action in real time at machine speed.
It’s a move away from “if X, then block Y” and toward probabilistic, adaptive decisions powered by real-time telemetry. Instead of guessing what might be risky based on a pattern or lineage, security systems will understand content and context, and respond accordingly.
Implication: Risk modeling must become dynamic, AI-informed and behavior-aware. Controls will evolve from static enforcement to contextual decision-making, capable of adjusting in real time as situations change.
Prediction 3: CISOs Will Shift from Gatekeepers to Enablers of Trusted Autonomy
Perhaps the biggest shift in 2026 will be philosophical: the role of the CISO is changing. Security leaders have long been seen as gatekeepers who say “no” to risky behavior in the name of protection. But in the era of AI, the mission is different. It’s not about stopping everything, it’s about guiding AI systems and human workflows to act intelligently, safely and within guardrails.
This will require a new security posture, one that builds trust by design. It means embedding policy awareness into AI systems, so agents can act autonomously without breaching compliance or exposing sensitive data. It means designing for explainability, auditability and ethical alignment from day one.
The most effective CISOs won’t be those who block innovation; they’ll be the ones who enable it responsibly.
Implication: The CISO becomes a design partner in the age of intelligent business systems, creating policy frameworks that empower AI, not just restrict it, and ensuring that autonomy doesn’t come at the cost of control and greater risk.
The Bottom Line: Unification is the Future of Security
As we enter 2026, the lines between user and agent, structured and unstructured data, access and action, and among IT environments such as SaaS and GenAI apps, clouds, on-prem servers, endpoints and emails will continue to blur. What matters now isn’t just visibility or control in isolation, it’s understanding risk in context in real-time.
Identity and data are no longer separate problems. They’re part of the same challenge and must be part of the same solution.
Security teams that embrace convergence, invest in adaptive intelligence and enable autonomy with trust will not only reduce risk, they’ll unlock a new era of resilience, productivity and innovation.
The future of security isn’t more control. It’s smarter guidance.
##
ABOUT THE AUTHOR
Eran Barak is the Co-Founder and CEO of MIND, which puts data loss prevention (DLP) and insider risk management (IRM) programs on autopilot to autonomously find sensitive data, fix data risk issues and stop data leaks at machine speed. He had the same role at Hexadite, which developed the first agentless intelligent SOAR platform and was acquired by Microsoft where he led cyber initiatives and partnerships for seven years. His journey in cyber began in Israel Defense Forces’ Tech Intel Unit, where he commanded a team responsible for securing critical systems.
