Jarrod Kinchington
Vice president Australia and New Zealand at Smartsheet
I see two key trends ahead for ANZ businesses in 2026. First, an opportunity to improve productivity with AI. And second, increasing pressure for project visibility and data governance. This is most acute in sectors like healthcare, aged care, and construction, where operational consistency and compliance are non-negotiable. Clear strategies and tools that unify people, data, and AI are becoming essential, enabling leaders to maintain control while driving meaningful outcomes.
When it comes to AI, choosing which tools to deploy is often the easy part. The true challenge lies in change management: getting employees to adopt new technology and fundamentally change their work practices. People are demonstrating high curiosity and a willingness to use AI, but achieving integrated, organisation-wide adoption is the next frontier. One of the most effective ways to achieve this is to embed AI directly into existing workflows so employees don’t have to learn how to use a new tool. For example, Smartsheet’s AI features fit easily into existing workflows, so they don’t disrupt the way teams already work.
We’re also seeing an increasing need for risk mitigation. Without structured processes and oversight, risks around inefficiency, miscommunication, and biased outcomes remain high. This is compounded by the critical need for robust data governance. With data breaches becoming increasingly common, the ability to guarantee data residency, traceability, and auditability is now non-negotiable for Australian businesses assessing new technology vendors.
John Kindervag
Chief evangelist at Illumio
In 2026, executive accountability for cyber incidents will finally land where it belongs: in the boardroom. For too long, CISOs have taken the fall for breaches they could not prevent because they lacked authority, resources, or budget. They get blamed while the people who make the real financial decisions walk away untouched. That era is ending. The CISO role is actually one of an advisor. Most security leaders cannot sign checks, set strategic priorities, or force compliance. They can only warn executives of the risks, and too often, those warnings go unheeded until after the damage occurs. CEOs, on the other hand, own the business risk. They approve budgets, set incentives, and decide whether to invest in prevention or accept exposure. If a company gets breached because leadership underfunded security or ignored zero-trust principles, that is not the CISO’s fault. It is a leadership failure.
We will see performance contracts and compensation structures that tie executive pay to measurable cyber security outcomes. That accountability will push CEOs to issue ‘executive orders’ within their organisations, making it clear that cyber security is not optional, that zero trust is the standard, and that prevention without containment is not enough. Only when the people at the top start feeling the consequences will cyber security mature from a cost centre into what it truly is: the structural engineering of modern business.
Jan Bee
CISO of TeamViewer
While compliance frameworks continue to mandate complex password policies, forward-thinking organisations will abandon passwords entirely in favour of platform authentication and biometric systems. The password requirements that made sense a decade ago are now actively holding back security progress. In 2026, we’ll see a clear divide between organisations clinging to outdated password mandates and those embracing passkeys, platform authentication on managed devices, and biometric verification as their standard.
CISOs should begin planning the complete elimination of passwords from their authentication workflows. Focus on platform authentication that verifies managed, compliant company devices, combined with biometric authentication. This isn’t just more secure – it’s dramatically more user-friendly, eliminating the frustration and security risks of password management. Yes, some compliance frameworks still emphasise passwords, but these requirements are outdated by the current threat landscape. Security teams should work with their compliance teams to demonstrate how modern authentication methods exceed the security intent of password requirements, even if they don’t follow the letter of older regulations. The organisations that make this transition in 2026 will be significantly ahead of their peers in both security posture and user experience.
Daniel Broad
Head of managed security operations at Fujitsu
A compromise targeting hospital systems may no longer simply expose patient data; it could disrupt the equipment that supports critical care. A breach in a port or logistics network could halt cranes, sensors, or autonomous vehicles.
These physical systems are now vulnerable to the same identity-based attacks and supply chain intrusions used to break into corporate networks.
In this environment, public trust hinges on a unified security strategy. This means having a single, real-time view of threats across your entire environment, from the cloud and corporate network right down to the factory controllers and medical devices on the ground. This integration is essential not only for compliance with tightened security legislation but for demonstrating that the organisation can protect both data and the physical safety of the communities it serves.
In 2026, IT/OT convergence will be a core expectation of resilient, modern organisations.
Alex Coates
CEO of Interactive
Hybrid isn’t a compromise; it’s a strategy. Organisations are moving away from cloud-first dogma and making intentional choices about where workloads live based on performance, cost, and sovereignty. Intelligent orchestration will be the differentiator.
Data is the gatekeeper for AI success. If your data isn’t structured, governed, and secure, your AI ambitions will stall. Less than a quarter of enterprises are truly data-ready; this is the Achilles’ heel of transformation.
Jay Jenkins
Chief technology officer, cloud computing, at Akamai Technologies
The EU’s 2025 push to reduce hyperscaler dependency has sparked a parallel movement across the Asia-Pacific [region], including Australia. Organisations now view cloud portability not just as a cost-optimisation tactic, but as essential risk mitigation against geopolitical uncertainty and vendor considerations. India is leading this transformation, with Australia close behind through large-scale proofs of concept.
Australian businesses and government agencies are focused on avoiding being locked into a single provider’s platform or geography. Several organisations are starting proofs of concept around multi-cloud and distributed infrastructure to reduce the risk of lock-in. According to Akamai’s Asia-Pacific Digital Natives Report, nearly nine in 10 digital-native businesses in Australia and New Zealand say efficiency and productivity are top priorities, tied to accelerated cloud adoption.
True digital sovereignty requires infrastructure independence, the ability to move workloads across providers, geographies, and architectures without technical or financial penalty. This flexibility, initially pursued for risk reasons, is also essential for next-generation AI applications that demand computational portability.
Jayant Dave
Field CISO, APAC, Check Point Evangelist, at Check Point Software Technologies
2026 will confirm that no enterprise operates alone. Every vendor, API, and integration adds new risk. Adversaries exploit these dependencies to compromise thousands of organisations simultaneously, turning the weakest supplier into an entry point for mass exploitation.
At the same time, global supply chains are transforming under the pressure of automation. Agentic AI will enable autonomous risk management: self-learning systems that map dependencies, monitor third-party compliance, and predict disruptions. Yet hyper-connectivity also magnifies exposure: compromised code libraries, API tokens, and cloud credentials can ripple through ecosystems faster than incidents can be traced.
Chris Millington
Senior Global Technical Lead for Cyber Resilience, Modern Data Protection and Compliance, at Hitachi Vantara
The lack of cyber security skills remains a challenge, and many companies are ratcheting up salaries to snag this limited talent. But more and more people, often from legal teams or with traditional data protection backgrounds, are now calling themselves cyber specialists. While they may know cybersecurity terminology or how to position or sell their companies’ products, most lack the strategic-level understanding needed to build a resiliency framework.
Labelling a wider range of roles as ‘cyber’ is diluting the talent pool, which could drive more companies to adopt cyber resilience-as-a-service models in the year ahead.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.