Security that lasts until 2027: fewer passwords, more context

Cybersecurity is no longer designed with the next quarter in mind. The security leaders consulted by Computerworld agree that the threat landscape is changing at a speed that forces a rethink of the very foundations of strategy. Jeremy Koppen, CISO at Equifax, sums it up with a simple idea: artificial intelligence is altering the pace on both sides. Attackers use it to operate at greater scale and defenders use it to innovate faster. In the middle of that race, sticking to business as usual is starting to become a luxury that no organization can afford.

The consensus among experts is clear: transformation is not optional. Omar Khawaja, CISO and lecturer in the CISO program at Carnegie Mellon University, maintains that security leaders are aware that their current situation does not work and that they need a significant transformation to succeed in the coming years. The question is no longer whether to change, but which specific elements must be replaced and with what.

The end of static credentials

One of the most visible changes affects something as everyday as passwords. Koppen warns that, however strict the policy, passwords end up resembling the name of a favorite sports team or the current season with an exclamation mark at the end, which turns them into easy targets for brute-force attacks. At Equifax they have eliminated passwords for their 22,000 employees and collaborators and are now extending that passwordless standard to their B2B customers.

For an SME, the takeaway is not to copy the model of a large corporation, but to assume that the reused password remains one of the most profitable holes for an attacker. Deploying two-factor authentication, reviewing privileged access and moving toward more robust authentication methods is a realistic first step with immediate impact. If your staff shares credentials for the CRM or email, that is the place to start.

Automate the SOC or be left behind

Bill Hunkapiller, CISO at Florida State University, says it bluntly: we are no longer able to cope with attacks and vulnerabilities manually, and AI is making it impossible. His team has been implementing autonomous agents for months to replace routine security operations tasks, and their plans involve expanding the number of tasks managed by machines.

The data supports that trend. Sygnia's State of Incident Response Readiness report reveals that 32% of organizations make extensive use of AI in most or all threat detection and incident response activities, compared with 25% in 2025. In addition, 63% expect to have implemented widespread use of AI for those activities by 2027.

An SME does not need to set up its own operations center. But it is worth reviewing which repetitive tasks — alerts, classification of suspicious emails, backups, patch review — can be automated with the tools already in place. As we discussed in our guide on cybersecurity in SMEs, the goal is to move from the firewall as the only barrier to business risk management.

Identities that are not people

Koppen points to another front that many companies have not yet internalized: an increasing share of activity on enterprise networks comes from AI agents, bots and automated workflows, while most traditional security controls were designed with a human user in mind. That is why, in his organization, they apply the same rigorous verification to those identities as to people.

This has a practical translation for any IT team: inventory which service accounts, integrations and automations have access to sensitive systems. They are often accounts created years ago, with broad permissions and no review. If an automated agent can read the customer database, it must be subject to the same policies as an employee.

Risk is measured with context, not with a label

Another practice that experts consider exhausted is the generic severity score. Koppen argues that a vendor's critical rating does not take into account whether a system contains sensitive data, is exposed to the outside or is protected by other controls. Equifax has its own quantitative risk engine that incorporates that context so that its teams focus on the problems that pose a real risk to the company. Hunkapiller insists on the same idea: understanding how a specific vulnerability affects the particular organization.

For an SME, this means stopping patching out of panic and starting to prioritize by real exposure. A vulnerability on an internal server without critical data does not deserve the same urgency as a flaw in the portal where customers enter their data. This is where what we already proposed in data resilience fits well: it is not just about protecting, but about knowing what is protected and why.

Beyond AI: geopolitics and quantum

The security leaders consulted do not stop at AI. Geopolitics, the expected arrival of quantum computing and increasingly interconnected systems are expanding the attack surface and should drive equally profound strategic changes. Pressure on CISOs is growing, and next year looks set to be, at the very least, as turbulent as the current one.

What we recommend at ForgeNEX

• Review identities, human and non-human. Make an inventory of accounts, permissions and automations. Eliminate what is not used and apply two-factor authentication where it is missing.
• Automate the repetitive. Start with backups, alerts and patch review. You do not need your own SOC to save time and reduce errors.
• Prioritize by context. Replace the generic criticality traffic light with an assessment that takes into account data, exposure and existing controls.
• Prepare the ground for what is coming. Quantum and geopolitics are not science fiction: it is worth reviewing cryptography and dependence on external providers in advance.

The security strategy that lasts beyond 2027 will not be the one that accumulates the most tools, but the one that understands what it protects, against whom and with what room for maneuver. For an SME, that starts with small decisions made in time.

Source: Computerworld. Analysis and adaptation: ForgeNEX.