For years, talking about cybersecurity inside a company meant talking about tools: which firewall we had, which antivirus we bought, which solution was up for renewal.I no longer think that conversation goes far enough. When I sit down with business leaders today, the questions are harder. If someone gets into our systems, how long before we notice? If an identity is compromised, how far can the attacker get? If operations go down, how long does it take to bring them back?I’d add one more: can we prove any of this, or are we simply assuming we’re ready?That is one of the biggest changes in our industry. For years, we measured maturity by the technology we had deployed. Now, we need to measure it by outcomes.In its Global Threat Landscape Report 2026, Fortinet reported 7,831 confirmed ransomware victims in 2025, up from roughly 1,600 in its previous report. Another figure strikes me as even more telling: in critical outbreaks, time to exploitation fell to 24–48 hours, compared with 4.76 days observed in earlier reports.We can keep counting tools. Attackers are counting something else: how much time they need to get there before we do.Speed Has Changed the ConversationArtificial intelligence is accelerating that race. This September, Google Threat Intelligence Group documented a case in which threat actors used agentic AI workflows to plan, build, and launch a large-scale credential theft campaign in under six hours.AI didn’t invent phishing, ransomware, or credential theft. What it is doing is compressing timelines, expanding scale, and reducing the effort required to carry out certain tasks.IBM’s Cost of a Data Breach 2026 found that 1 in 4 malicious incidents analyzed was AI-enabled. Those attacks cost close to US$6 million on average, compared with a global average of US4.99 million.So the question can no longer be just whether we use AI to defend ourselves. It also has to be whether we can use it as quickly as others are beginning to use it against us.When AI Stops Answering and Starts ActingAnother change goes even deeper.We’ve grown used to thinking of AI as a tool that takes a question and returns an answer. Agents do something different: they act. They query systems, use credentials, access applications, and carry out tasks.That changes what we need to protect.Okta found that 91% of organizations in its sample were already using AI agents, but only 10% had a well-developed strategy for managing them. I think that gap deserves close attention: we are granting autonomy faster than we are building the governance needed to manage it.For years, we protected people, devices, and applications. Now, we’ll also have to govern non-human identities capable of taking action.That changes how we think about identity. Knowing who logged in is no longer enough. We need to understand who or what has access, why they have it, what they can do with it, and how far they can go.Fewer Alerts, More ContextWe also need to change how we assess risk.Anyone who has spent years in security knows how easy it is to flood a console with alerts. The challenge isn’t producing more information. It’s understanding what that information means for the business.An alert that looks minor can mean something completely different depending on the user, the asset, the privileges involved, and the business process at stake. That’s why I believe the next phase of cybersecurity will be less about counting alerts and much more about understanding context.AI can help enormously here. The point isn’t to replace the analyst. It’s to enable analysts to correlate information and make better decisions, faster.The Quantum Clock Doesn’t Need an Exact DateSomething similar is happening with quantum computing.People often ask me when the so-called Q-Day will arrive. My answer is simple: We don’t need an exact date to start preparing.NIST has already finalized its first post-quantum cryptography standards, and its position is that the time to begin migrating is now. Its transition plan calls for deprecating or retiring certain vulnerable algorithms by 2035, while higher-risk systems may need to act sooner.But preparing doesn’t simply mean buying “post-quantum cryptography.”First, we need to know which algorithms we use, where they are deployed, what keys exist, what data they protect, and how long that data needs to remain secure. If we can’t answer those questions, we have a visibility problem before we even have a migration problem.This transition is an opportunity to go beyond a technology upgrade and make cryptographic governance part of an organization’s strategic objectives.The Difference Will Be What We Can ProveAfter nearly two decades in this industry, I’ve learned one thing: The problem is rarely solved by buying one more technology.AI and quantum computing are forcing us to rethink concepts that seemed settled for years: identity, access, trust, cryptography, oversight, and response capabilities.In this landscape, the best-prepared organizations won’t necessarily be the ones with the most tools. They’ll be the ones that understand their exposure, detect threats earlier, respond quickly, restore operations, and know exactly what every identity is allowed to do, whether human or machine.There’s a deeper shift underway, too.We’re coming out of an era centered on searching for answers. With AI, we’re entering an era defined by the depth of our questions. The real value will lie in knowing what to ask, how to refine those questions, and what context to provide so the answers become more precise and relevant.In cybersecurity, that ability will be essential to understanding risk and making decisions aligned with each organization’s business profile and needs.We’ve spent a long time asking what technology we should buy.Maybe the question that matters now is a different one: If something goes wrong tomorrow, what can we prove we’re capable of doing?{“path”:{“baseUrl”:”\/”,”scriptPath”:null,”pathPrefix”:””,”currentPath”:”node\/65429″,”currentPathIsAdmin”:false,”isFront”:false,”currentLanguage”:”en”},”pluralDelimiter”:”\u0003″,”suppressDeprecationErrors”:true,”sharebardata”:{“buttons”:”\u003Cul class=\u0022social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 data-counter=\u0022top\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\r\n\u003Cdiv class=\u0022g-plusone\u0022 data-size=\u0022tall\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022\u003E\u003C\/div\u003E\r\n\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 data-count=\u0022vertical\u0022 data-via=\u0022The Next Cybersecurity Era Can\u0026#039;t Be Bought. It Has to Be Proven\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”buttons_small”:”\u003Cul class=\u0022mobile-social-sharebar\u0022\u003E\u003Cli\u003E\u003Cscript src=\u0022\/\/platform.linkedin.com\/in.js\u0022 type=\u0022text\/javascript\u0022\u003E\r\n lang: en_US\u003C\/script\u003E\u003Cscript type=\u0022IN\/Share\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 data-counter=\u0022right\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv class=\u0022g-plusone\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022\u003E\u003C\/div\u003E\u003Cscript type=\u0022text\/javascript\u0022\u003E(function() {var po = document.createElement(\u0027script\u0027); po.type = \u0027text\/javascript\u0027; po.async = true;po.src = \u0027https:\/\/apis.google.com\/js\/plusone.js\u0027;var s = document.getElementsByTagName(\u0027script\u0027)[0]; s.parentNode.insertBefore(po, s);})();\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022http:\/\/twitter.com\/share\u0022 class=\u0022twitter-share-button\u0022 data-url=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 data-count=\u0022horizontal\u0022 data-via=\u0022The Next Cybersecurity Era Can\u0026#039;t Be Bought. It Has to Be Proven\u0022\u003ETweet\u003C\/a\u003E\u003Cscript type=\u0022text\/javascript\u0022 src=\u0022http:\/\/platform.twitter.com\/widgets.js\u0022\u003E\u003C\/script\u003E\u003C\/li\u003E\u003Cli\u003E\u003Cdiv id=\u0022fb-root\u0022\u003E\u003C\/div\u003E \u003Cscript\u003E(function(d, s, id) { var js, fjs = d.getElementsByTagName(s)[0]; if (d.getElementById(id)) return; js = d.createElement(s); js.id = id; js.src = \u0022\/\/connect.facebook.net\/en_US\/all.js#xfbml=1\u0022; fjs.parentNode.insertBefore(js, fjs); }(document, \u0027script\u0027, \u0027facebook-jssdk\u0027));\u003C\/script\u003E \u003Chtml fb=\u0022http:\/\/ogp.me\/ns\/fb#\u0022\u003E\r\n\u003Cdiv class=\u0022fb-like\u0022 data-href=\u0022https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 data-layout=\u0022box_count\u0022 data-action=\u0022like\u0022 data-size=\u0022small\u0022 data-show-faces=\u0022true\u0022 data-share=\u0022true\u0022\u003E\u003C\/div\u003E\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022mailto:?subject=https:\/\/mexicobusiness.news\/cybersecurity\/news\/next-cybersecurity-era-cant-be-bought-it-has-be-proven\u0022 class=\u0022sharebar-button email\u0022\u003EEmail\u003C\/a\u003E\u003C\/li\u003E\u003C\/ul\u003E”,”width”:”85″,”position”:”left”,”top_offset”:”200″,”left_offset”:”5″,”right_offset”:”0″},”statistics”:{“data”:{“nid”:”65429″},”url”:”\/core\/modules\/statistics\/statistics.php”},”user”:{“uid”:0,”permissionsHash”:”d5cfe5151b3ffc53c5d130d9e05e2100e43cfffcac57d2afbf37c73af1c6771d”}}
Click Here For The Original Source.
——————————————————–
