Top Risks 2027: Insights for information security teams

5 min read

2027 Executive Perspectives on Top Risks and Opportunities

For today's CISOs, protecting the enterprise is only part of the job. Business leaders also expect security teams to support transformation, enable growth and respond quickly when disruption hits. Protiviti's 2027 findings show that cyber threats, privacy obligations, AI, regulatory change and third-party exposure are interconnected, while confidence in the ability to protect enterprise value outpaces confidence in the ability to respond. CISOs are prioritizing AI governance and shifting limited budgets toward a more modern security foundation. Read the CISO brief to see how security leaders are strengthening resilience and guiding responsible AI adoption without taking on unacceptable risk.

Explore the 2027 insights for information security teams

Watch the 2027 webinar on-demand

Where information security leaders see the greatest growth opportunities over the next two to three years

CISOs remain focused on growth but are more cautious than a year ago, with optimism down across all three areas. The question is less whether to grow and more which opportunities the enterprise can pursue securely within its existing capacity.

51 %

see significant opportunities to grow revenue.

43 %

see significant opportunities to grow beyond their headquarters' domestic market.

51 %

see significant opportunities to expand strategic alliances and partnerships.

Explore featured solutions and industries

Explore services that help security leaders protect the enterprise, govern AI and respond to disruption.

Artificial Intelligence (AI)

Build AI you can trust by embedding governance, security and risk management across the AI lifecycle, with clear accountability, model testing and secure, responsible development.

Learn more

Cybersecurity

Protect data and critical assets across every layer of the organization, from cloud and identity to incident response, so the business can grow securely.

Learn more

Operational Resilience

Strengthen resilience across business, technology, cyber and third-parties, with scenario testing and crisis simulations to withstand disruption and recover.

Learn more

Technology

Modernize infrastructure and applications across cloud, ERP, data and cybersecurity, reducing complexity and connecting strategy to execution.

Learn more

Artificial Intelligence (AI)

Build AI you can trust by embedding governance, security and risk management across the AI lifecycle, with clear accountability, model testing and secure, responsible development.

Learn more

Cybersecurity

Protect data and critical assets across every layer of the organization, from cloud and identity to incident response, so the business can grow securely.

Learn more

Operational Resilience

Strengthen resilience across business, technology, cyber and third-parties, with scenario testing and crisis simulations to withstand disruption and recover.

Learn more

Technology

Modernize infrastructure and applications across cloud, ERP, data and cybersecurity, reducing complexity and connecting strategy to execution.

Learn more

Discover our full catalog of insight briefs for additional research findings and expert commentary related to the 2027 report on Top Risks and Opportunities.

Insights by industry
Insights by organizational role

Insights by industry

Aerospace & Defense

CPG & Retail

Energy & Utilities

Financial Services

Healthcare

Higher Education

Manufacturing & Distribution

Private Equity

Non Profit

Technology, Media & Telecommunications

Insights by organizational role

Finance Teams

Internal Audit Teams

Operations Teams

Technology & Data Teams

FAQs

+ EXPAND ALL

What are the top risks for CISOs in 2027?

Cyber threats lead at 3.54 on a five-point impact scale, up from 3.36, followed by privacy compliance (3.39, up from 2.81) and economic conditions (3.31, up from 2.59). Third-party risk, AI implementation, resilience and regulatory uncertainty are tied at 3.28. The common thread is convergence: a cyber incident can trigger privacy and regulatory consequences, and an AI deployment can widen data, identity and third-party exposure.

Why are CISOs less confident in their ability to respond to disruption?

41% are highly confident they can protect enterprise value, but only 29% say the same about responding, and 54% report only moderate confidence. Recovery depends on technology, business, legal, communications and third parties working together, much of it outside security's direct control. Testing may be part of the gap: many organizations run penetration tests, but fewer prove readiness through red-team and blue-team exercises.

What are CISOs' top priorities for AI?

Governance leads at 51%, followed by equipping the workforce (45%) and integrating AI with existing technologies and processes (32%). Only 13% chose deploying AI at a more competitive pace. For CISOs, governance defines who owns AI systems, which uses are permitted, what data they can access and who is accountable, questions that get harder as agentic AI and nonhuman identities enter the enterprise.

Where are CISOs investing in 2027?

Cybersecurity leads at 48%, down from 53%, with data privacy and infrastructure modernization tied at 33%. Infrastructure modernization rose from 21%, while data privacy fell from 54% even as privacy became the No. 2 near-term risk. Flat budgets are pushing CISOs toward a more modern, scalable security foundation, but cyber, privacy and compliance outcomes still need to stay fully funded.

Why is talent a rising long-term concern for CISOs?

Talent challenges rose to 38% as a top long-term risk, up from 30%, ranking second behind security and privacy (49%). CISOs need people who can secure emerging technologies, govern AI, modernize identity and access controls, manage third-party exposure and maintain legacy systems. AI deployments, meanwhile, fell to 35% from 46%, suggesting AI is shifting from a future concern to a current operating reality.