Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Ashley Rose, CEO and Co-Founder, Living Security
As security teams head into 2026, the old playbook is breaking down. Checkbox compliance, annual training, and reactive controls are no longer keeping pace with how work and risk actually happens. AI is accelerating this shift from policing behavior to predicting risk, from awareness to action, and from blaming humans to designing systems that work with them. The result is a reset in how security leaders think about identity, access, behavior, and the role of both people and AI agents in reducing real-world risk.
“Human Error” Won’t Be the Villain Anymore
We’re finally going to stop blaming employees for every security incident. With AI tools showing us why people make mistakes (confusing workflows, overly complex approvals, poor UX) companies will realize most “human error” isn’t a result of people not caring about security. It’s that the system around them is reactive, not predictive. Leaders will start redesigning processes and reducing friction instead of handing out more training. Teams that make this shift will see fewer missteps, fewer identity-based incidents, and happier employees.
Security Training Will Go Personal, and Compliance Will Shrink to a Checkbox
Security training for compliance isn’t going away, but it will be acknowledged for what it is: an audit checkbox. The real shift will be everything beyond compliance becoming risk based. I’m predicting the death of the one-size-fits-all annual security training. Instead, organizations will adopt tools that understand each employee’s behavior, reduce time spent in required training for people who don’t need it, and meet people where they are to actually improve their security hygiene. Behavioral risk intelligence will replace generic awareness programs, giving security teams a clear picture of who needs support before an incident happens.
AI Will Find Identity Weak Spots Faster Than IT Can Patch Them
This is the year AI starts discovering identity flaws at a speed no human team can keep up with. Attackers will use AI to map weak authentication, stale permissions, and risky accounts in minutes. This will push companies into continuous identity hardening instead of quarterly cleanups. By the end of the year, identity hygiene will be a core board metric, not an IT chore.
Humans and AI Will Finally Be Managed as One Workforce
AI agents won’t feel like just “tools” anymore, they’ll act like coworkers. Companies will have to define expectations, access policies, and performance rules for both humans and AI agents. Organizations that try to manage the two separately will end up with gaps, blind spots, and some awkward surprises. The smart ones will merge them under one unified workforce risk model that makes oversight much clearer and effective.
Employees Will Trust AI More Because It’ll Help Them, Not Police Them
We’re moving past the era of security tools that feel like surveillance. In the coming months, AI will act more like a safety net than a watchdog by auto-suggesting safer actions, fixing mistakes quietly, and guiding users instead of punishing them. When AI becomes a co-pilot instead of a critic, teams will feel less pressure and make fewer mistakes.
AI Agents Will Force Companies to Rethink Access Control from the Ground Up
Companies will suddenly realize AI agents hold some of the most powerful access privileges in the business, and most of that access hasn’t been reviewed, governed, or audited. 2026 is going to be the year we start asking: Who approved this agent’s access? How do we revoke it? What’s its blast radius? Expect major changes in permissions, onboarding, and oversight.
CISOs Will Be Judged on Risk Reduction, Not Checkboxes
Boards are tired of hearing about training completion rates and phishing click metrics. Moving forward, CISOs will be measured on real outcomes: fewer risky users, better identity hygiene, tighter access, and faster response times. We’re going to see security leaders shift from “Did we train them?” to “Did we reduce the risk?” It’s a subtle shift, but it changes everything.
At Living Security, our focus over the next year is to help security teams operationalize this shift, from awareness metrics to behavioral and identity risk signals that can drive safer decisions in the moment. That means bringing human and AI-agent activity into one workforce-risk view, then pairing insights with lightweight, context-aware interventions that reduce risk without adding friction.
##
ABOUT THE AUTHOR
As the CEO of Living Security, Ashley is passionate about helping companies build a positive security culture within their organizations. An adaptable problem solver, Ashley is thoughtful and transparent in her approach to running the company and working with clients toward a singular goal: reduce risk by making people a security asset instead of a liability. Ashley has a Bachelors of Business Administration from the University of Michigan and is a serial entrepreneur with experience designing and managing product lines. After launching her career in the tech industry, she became intrigued by cybersecurity and its accelerating impact on organizations, individuals, families and communities. Ashley co-founded Living Security based on a philosophy that empowering people is the best approach to lasting security awareness and breach prevention.
