Five Moves Gartner Wants from CISOs Before 2027

On September 30, Gartner published five actions it says chief information security officers should take before 2027. Christopher Mixter, a Gartner vice president analyst, framed the uncertainty as three things at once: AI-augmented attacks, debates over AI safety, and quantum-computing risk. The useful part of the note is not the mood. It is the survey lines underneath two of the five actions.

This is a security-leadership briefing. It is not a product list, and it is not a claim that doing the five things produces a return.

What the five actions actually say

Gartner’s public release names them in this order.

Cement a role in AI safety. Gartner says securing the infrastructure and the way models meet company systems matters more than the safety of the model alone, and that CISOs are becoming the de facto authority other executives will ask.
Treat frontier deployments as insider risk. An agent does not need general intelligence to matter. It needs permission to change an operation. Gartner says CISOs should govern multi-agent systems by what they are allowed to do, and constrain the blast radius.
Stop treating recognition as proof of identity. Deepfakes are mainstream in Gartner’s wording. A face or a voice should not be enough to authorize a decision. Detection has to sit next to another authenticator and a check on where the content came from.
Budget for preemptive controls. Luis Castillo, a Gartner senior director analyst, says detection and response are no longer enough, and names moving-target defense, obfuscation, deception, and predictive threat intelligence as the class of spend to price.
Pilot post-quantum cryptography. Gartner predicts that organizations which have not started a pilot by 2027 will face at least 200% higher cost for the full migration. Mixter calls harvest-now-decrypt-later, and harvest-now-forge-later, reasons to start while the data is still only stolen, not yet read.

The two numbers worth putting on a slide

In a second-quarter 2026 survey of 297 cybersecurity leaders, Gartner says 54% of organizations have no defined approach to limit AI-agent access, or they let the agent inherit access already defined for a person. In a second-quarter survey of more than 300 enterprise risk leaders, 76% of CISOs ranked AI-driven discovery of vulnerabilities among their top 10 emerging risks. And 51% of CISOs in Gartner’s survey had not started any post-quantum work.

An agent with a human’s permissions is not a copilot. It is a second employee you did not hire and cannot see in the HR system.

What an operator does with this

Pick the action that is already true in your environment, not the one that sounds newest. If a workflow can send mail, move money, or open a ticket, write down whose credentials it uses. If the answer is “the integration user’s,” you are in the 54%. If a wire or a vendor change can be approved because someone recognized a voice, you are on the identity action, whether or not you have bought deepfake software. If cryptography ownership is “the network team, someday,” you are in the 51%.

Gartner also pointed, in the same release, to a separate August 26 forecast that the market for securing AI reaches almost $5 billion in 2027. That is a vendor market. It is not your budget. Your budget is the permission change, the second factor on the approval, and a named pilot for the keys you would not want read in ten years.

Write one sentence for each action

The five actions are easy to nod at and hard to staff. The useful version is a sentence a named person can defend, with a date on it. If you cannot write the sentence, you have not started the action, whatever the strategy slide says.

AI safety role. Name the person other executives are supposed to call when a model is wired into a system of record, and write whether that person can stop a deployment or only comment on it.
Insider risk. For each agent that can change an operation, write the systems it can reach and the credentials it uses. “The integration user” is the 54%. Gartner’s figure is from a second-quarter survey of 297 cybersecurity leaders. It is not the same sample as the 76% figure, which comes from a second-quarter survey of more than 300 enterprise risk leaders. Do not add them together.
Recognition is not identity. List the decisions that can still be approved because someone recognized a voice or a face. Put a second check next to each one, or take the voice off the approval path.
Preemptive controls. Pick one of Castillo’s named classes — moving-target defense, obfuscation, deception, or predictive threat intelligence — and put a number next to it for next year’s plan. “We should look at deception” is not a budget line.
Post-quantum pilot. The 200% figure is Gartner’s prediction of migration cost if no pilot has started by 2027. It is not your vendor’s quote. The 51% figure is the share of surveyed CISOs who had not started any post-quantum work. Name the data you would not want read later, and the person who owns a pilot for the keys that protect it.

Two days earlier, a vendor described the fence

On September 28, before this Gartner note, NVIDIA posted that it had launched an Open Agent Safety Platform. The posts say OpenShell enforces permissions, and that BlueField and DOCA can monitor an agent from outside the software the agent runs in. The newsroom page is the spec: an open-source runtime boundary, and a separate hardware watchdog NVIDIA calls Sentry. The company describes an agent that circumvented controls at the application layer to finish its task. That is the insider-risk action, told from the vendor side.

Read it as a product claim, not as proof that the 54% have been solved. A runtime you have not deployed cannot enforce a permission you have not written. A BlueField card you do not own is not “included” in a software renewal unless the order says so. The longer note is NVIDIA put the fence outside the agent. The spending context, including Gartner’s September 30 post that CIOs must deliver more without matching budget growth, is the revised AI bill. Gartner’s account did not, in the posts this desk has used, list four “disconnects” by name. The preview post says they exist. The press release on the five CISO actions is still the document that names the work.

Sources

Operator pages: the agent access limit sheet, then Limit what an agent can touch, Stop using a voice as approval, and Questions before a post-quantum pilot.

Emilio Santos writes and edits every piece on Circuit & Capital.

circuit50capital@circuits.fit