Notifications
Clear all
Topic starter
11/06/2026 12:02 am
TL;DR: CISOs in 2026 are dealing with intensifying compliance pressure, Zero Trust execution gaps, tool sprawl, and AI-era access risk, with one survey showing 70% feel at risk of a material cyber attack in the next 12 months, according to Cerbos. The core issue is that security programmes still treat authorization as an app detail instead of a central control plane, which leaves access decisions inconsistent and hard to audit.
NHIMG editorial — based on content published by Cerbos: 10 critical challenges CISOs shared with us in 2026
By the numbers:
- 70% of CISOs feel at risk of a material cyber attack in the next 12 months.
- 70% of cloud breaches stem from misconfigured access controls.
- An average of 76 security tools creates siloed data and overwhelms analysts with noise.
Questions worth separating out
Q: How should security teams centralize authorization across cloud applications?
A: Security teams should separate policy decisions from application code and evaluate access through a central service or policy layer.
Q: Why do hard-coded access rules create governance risk?
A: Hard-coded rules create governance risk because every application becomes its own access-control island.
Q: What breaks when Zero Trust stops at authentication?
A: Zero Trust breaks when teams stop at authentication because proving identity does not automatically define what that identity may do.
Practitioner guidance
- Externalize authorization from application code Move access decisions into a central policy service so permissions can be reviewed, versioned, and tested consistently across applications instead of being reimplemented in each codebase.
- Map Zero Trust to request-level decisions Tie every sensitive action to contextual authorization rather than assuming authentication or network location is enough to establish trust.
- Create one evidence trail for access decisions Log policy changes, authorization outcomes, and administrative actions in a form auditors and security teams can trace without searching individual applications.
What's in the full article
Cerbos' full article covers the operational detail this post intentionally leaves for the source:
- Implementation guidance for externalized authorization across distributed application stacks
- Detailed explanations of how Cerbos maps fine-grained access rules to compliance and audit needs
- Practical examples of shift-down security and how platform teams can standardize permission logic
- Additional discussion of the company’s own role in AuthZEN and the shift toward interoperable authorization
👉 Read Cerbos’ analysis of the 2026 CISO authorization and compliance challenges →
Authorization visibility gaps: what IAM teams need to fix now?
Explore further
12/06/2026 6:33 am
Authorization is now the control plane that determines whether modern identity programmes are governable at all. When access logic lives inside each application, the organisation loses a reliable way to answer the oldest IAM question: who can do what, under which conditions, and with what evidence. That problem spans human access, service accounts, and AI-driven workflows, which is why fragmented authorization is no longer a technical nuisance but a governance failure. Practitioners should treat centralized authorization as the baseline for any credible identity architecture.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to The 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: How do NHI and AI access controls differ from human access control?
A: NHI and AI access controls need stronger runtime enforcement because they can operate faster, more consistently, and sometimes without a human watching each action. Human access programmes rely more easily on sessions, prompts, and user behaviour, while machine identities and AI systems need policy boundaries that apply on every request and every delegated action.
👉 Read our full editorial: CISOs in 2026 face a deeper authorization control gap
