cyber.hendryadrian.com
Security Report · github.com/jacobdjwilson

KPMG’s 2026 Cybersecurity Report Highlights AI Identity Risks and Quantum Readiness

· Original Report (PDF) ↗

Summary

KPMG’s Cybersecurity Considerations 2026 outlines eight priorities, including AI agent governance, non-human identities, IT/OT security, post-quantum migration and continuous supply chain monitoring.

Key points

  • The report draws on more than 20 KPMG cyber experts, alliance leaders and global and regional surveys to outline eight cybersecurity priorities for 2026.
  • Citing KPMG’s Global tech report 2026, it says 92% of technology executives expect managing AI agents to become an essential skill within five years.
  • For proliferating non-human identities, KPMG recommends centralized inventories, clear ownership, policy-based access, least privilege and controls to stop individual agents acting outside their scope.
  • AI security recommendations include security-by-design, continuous red-teaming, runtime observability and human oversight, including for third-party AI products.
  • The report recommends integrated IT/OT monitoring and clear cross-functional ownership as connected industrial systems expand cyber-physical risks.
  • Post-quantum migration should become an active, multi-year program supported by cryptographic inventories, risk assessments, vendor engagement and updated procurement requirements.
  • KPMG advocates continuous supply chain detection and response over static compliance questionnaires, while highlighting geopolitical fragmentation and sovereignty requirements as growing resilience challenges.

Article Details

Publisher
KPMG International
Report Period
2026
Scope
Global, cross-sector cybersecurity priorities for CISOs and enterprise leaders, covering AI security, identity governance, resilience, IT/OT, supply chains, and post-quantum cryptography.
Sample Size
Insights from more than 20 KPMG cyber experts and cybersecurity alliance leaders, supplemented by global and regional surveys.
Key Statistics
  • KPMG Global tech report 2026: 92% of technology executives say managing AI agents will become an essential skill within the next five years.
  • KPMG Global tech report 2026: 41% of organizations say they are concerned about falling behind in preparing for quantum-driven security threats and the transition to post-quantum cryptography.
  • A KPMG and University of Melbourne study of almost 50,000 people across 47 countries found that 54% were wary about trusting AI.
  • KPMG AI Quarterly Pulse, Q3 2025: 61% of US companies were not yet comfortable with autonomous agents and would require human-in-the-loop oversight.
  • 2026 KPMG Global Third-Party Risk Management Survey: 45% of organizations say regulatory and compliance risk has grown in importance.
Recommendations
  • Establish cross-functional AI governance, embed security by design, continuously monitor and red-team AI systems, and retain human oversight.
  • Maintain a central identity store to discover, tag, and track AI agents; enforce zero trust, least privilege, policy-based access controls, and continuous monitoring.
  • Conduct quantum risk assessments, build cryptographic inventories, and update procurement requirements through early engagement with suppliers on quantum-safe migration.
  • Extend third-party risk management across the supplier ecosystem, continuously monitor higher-risk partners, and define contractual security and incident-response obligations.
  • Integrate IT/OT visibility and telemetry, strengthen asset inventories and continuity planning, and secure leadership sponsorship for architectural changes.

People

Ben de BontChief Information Security Officer at ServiceNow; contributes perspectives on supply-chain monitoring, IT/OT convergence, and continuous risk assessment.Chris CordeGoogle security operations product leader; discusses autonomous security, agentic workflows, and workforce skills.Dani MichauxReport author and Cybersecurity Leader, EMA; discusses geopolitical fragmentation, sovereignty, and increasing complexity for CISOs.Jim WilhelmReport author and Global Cybersecurity Investment Leader at KPMG International.Laurent GobbiReport author and Global Cybersecurity and Tech Risk Centre of Excellence Leader at KPMG International.Michael EganDirector, Quantum Technologies at KPMG Australia; contributes guidance on coordinating post-quantum cryptography migration with business partners.Motoki SawadaReport author and Cybersecurity Leader, ASPAC.Prasanna GovindankuttyReport author and Cybersecurity Leader, Americas.Saira MohammedChief Security Advisor at Microsoft; discusses AI governance, accountability, security by design, and human oversight.Sitaram IyerArea VP Emerging Technologies at Palo Alto Networks; emphasizes authentication, authorization, ownership, and human accountability for machine identities.

Vendors

Googleresilient, supporting business continuity, and managing regulatory changes. including Google, Microsoft, Palo Alto Networks, and ServiceNow. It is further informed byKPMGKPMG International kpmg.com/cyberconsiderationsMicrosoftresilient, supporting business continuity, and managing regulatory changes. including Google, Microsoft, Palo Alto Networks, and ServiceNow. It is further informed byPalo Alto Networksresilient, supporting business continuity, and managing regulatory changes. including Google, Microsoft, Palo Alto Networks, and ServiceNow. It is further informed byServiceNowresilient, supporting business continuity, and managing regulatory changes. including Google, Microsoft, Palo Alto Networks, and ServiceNow. It is further informed by

Industries

Defensecybersecurity professionals. On the one hand, those charged with defense, protection and response (sometimes rapid) decoupling of former trading partners. As organizations rethink where they operateFinancial ServicesGovernment and Public sector Financial Services Defense HealthcareGovernment and public sectorGovernment and Public sector Financial Services Defense HealthcareHealthcareGovernment and Public sector Financial Services Defense HealthcareManufacturing(OT) environment in sectors like Utilities, Oil and Gas, Natural Resources, Manufacturing, and it aims to contribute to the future direction of cybersecurity and highlights opportunities toTechnology, media, and telecommunicationsGovernment and Public Sector: Defense: Technology, Media and Telecommunications: