As cybersecurity pressures converge, partners need to adapt their services report CRN.

Sydney, Australia | 18 February 2026

The rapid adoption of AI, regulatory uncertainty and an accelerating threat landscape will define cybersecurity in 2026, according to Gartner.

It has identified several major trends that could alter the cybersecurity landscape. This uncharted territory demands new approaches to managing cyber risk and resilience, the insights firm said.

For partners, it could force a rethink in how they deliver services as these pressures test the limits of cyber teams in an environment defined by constant change.

Agentic AI demands greater oversight

As employees and developers embrace agentic AI and more experimental tools like vibe coding, it raises the risks from unsecured code and potential regulatory compliance violations.

“Adoption of these tools has outpaced most cybersecurity teams’ detection and response capabilities,” warned Peter Soulsby, Brennan’s Director of Cybersecurity.

Sensitive information is being ingested into AI platforms without clear visibility into where it goes, how it is retained or who can access it — leading to a new shadow IT.

To address the risk, partners will need to work closely with customers on data management and security.

“If you know what data you have, where it is stored, who has access to it, and how it is being used, you can appropriately manage the risk that this represents,” he said.

AI is changing the role of SOCs

AI-enabled security operations centres (SOCs) are introducing new complexity, putting pressure on existing skills gaps and changing the cost equation for AI tools.

Partners need to lead customer conversations towards longer term value, rather than simply cutting costs.

Improved outcomes and efficiencies will come long before costs are lowered because AI-driven SOCs need significant upfront investment in technology and people, Soulsby explained.

“Only when those outcomes are at a point that they can be trusted will you be able to lower the costs of the SOC,” he said.

AI demands new approaches to cyber education

General cyber awareness training is no longer fit for purpose and needs to evolve into adaptive behavioural and training programs that include AI-specific tasks. This includes the risks of unapproved GenAI tools.

“Doing training on a screen is only going to get you so far. People need to be spoken to in person and in plain, non-technical talk about the risks these technologies pose.”

Peter Soulsby, Director of Cybersecurity, Brennan

AI agents need secure identity management

Traditional identity and access management (IAM) strategies are heightening access-related risks and demands new approaches to identity registration and governance, credential automation and policy-driven authorisation for machine actors.

“While too much access for humans is dangerous, too much access for machines that can work at machine speed, is a recipe for disaster and could be catastrophic to any organisation.”

Peter Soulsby, Director of Cybersecurity, Brennan

Partners need to help organisations adopt least-privilege, zero-trust approaches to identity, especially when it comes to autonomous or machine-based identities.

“You want to lock things down as much as possible, without impacting user experience in such a way that users find other ways of doing things,” he said.

“The same goes for data. You need to ensure you’re using the least amount of data possible to satisfy the use case,” he added.

Regulatory uncertainty is part of risk management

Global mandates have become critical business risks and require a higher bar for organisational resilience.

However, compliance is often difficult because the relevant legislation and frameworks can be hard to implement, expensive to maintain and often have adverse impacts on user experience, according to Soulsby.

“On top of this, maintaining real-time visibility of compliance is often extremely difficult,” he said.

Partners need to work with organisations to adopt a risk-based approach to compliance.

Soulsby said compliance should be the building block to a broader risk-based approach to cybersecurity, not a guarantee of reduced risk.

“Beware of the pitfalls of thinking that compliance equals security — it does not,” he added.

This article was originally published on CRN, 11 February 2026.