The role of the information systems security officer (CISO) is no longer about protection alone; it is increasingly about prioritizing and arbitrating among projects, all deemed urgent.
That is the main takeaway CESIN draws from its “Instantanés” for the first half of 2026, based on 21 weekly mini-surveys conducted among its members.
AI governance still in its infancy
Generative artificial intelligence continues to embed itself in organizations, but the oversight framework struggles to keep pace. According to CESIN, 27% of respondents, largely from mid-sized organizations, have not defined any policy for the use of generative AI.
The finding is similar for AI-enhanced development environments: only 18% of organizations have a specific policy for developers, while 34% allow installation generally and 34% by exception.
Meeting transcription and summarization tools raise similar questions, focusing on data access, storage location, and retention.
Regarding AI applied to cyber defense, organizations are mostly at the pilot or testing stage, with three dominant concerns: reliability, confidentiality, and sovereignty.
The rise of generative AI is also accompanied by an increase in malicious uses.
54% of large enterprises report having already suffered a “deepfake” attack, compared with 19% of mid-sized firms and 5% of small businesses. Exposure clearly grows with organization size.
Post-quantum: a project barely underway
The migration toward post-quantum cryptography remains very slow.
According to the survey, 69% of respondents have not yet engaged with it, 20% are evaluating the impacts and needs, 3% have run pilots or tests, and only 1% have started an operational migration.
The CESIN notes that this project goes beyond a purely technical dimension. It requires identifying cryptographic usages and critical data, and embedding it within cross-functional governance.
Compliance, top priority for the smallest structures
Regulatory compliance tops the priority list for 2026, but the intensity varies by organization size.
It ranks among the top three initiatives for 46% of large enterprises, 61% of mid-sized firms, and 72% of small and medium-sized businesses. Large companies spread their efforts across multiple subjects (AI, third parties, governance), while smaller structures concentrate resources on compliance alone.
Vendors: a risk that spills beyond the IT perimeter
Technological dependencies weigh increasingly on CISOs’ concerns.
The European Cyber Resilience Act is one illustration: 52% of mid-sized firms report not being directly affected by the regulation, even though they are customers of suppliers who are.
Acquisitions in the cyber sector likewise have tangible effects on costs. Sixty-nine percent of large companies and 74% of mid-sized firms have seen costs soar following a supplier’s acquisition, compared with 38% of small and medium-sized enterprises. Additionally, 41% of respondents point to a phenomenon of vendor lock-in.
CISO careers under pressure
The survey also revisits CISO career prospects, two years after a first poll on the subject.
Among 162 respondents, only 24% believe that CISO job opportunities are as numerous as in the past, 17 points lower than in 2024. At the same time, 31% are considering moving into advisory or consulting roles, due to insufficient influence within their own organizations (up 16%).
Growing complexity, not a retreat in maturity
For CESIN, these results do not reflect a retreat in cyber maturity among organizations, but rather a growing complexity in the role.
“The CISO’s mission is in full upheaval. Benchmarks are shifting, priorities too, and yesterday’s answers do not always suffice. CISOs must now chart their own path to support this transformation,” sums up Fabrice Bru, president of CESIN.
