FutureCISO

The AI governance gap is becoming increasingly difficult to ignore. Gartner warned that applying the same governance approach to every AI agent can itself lead to failure. "Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure," said Shiva Varma, senior director analyst at Gartner.

In early 2026, Check Point Research documented Operation TrueChaos, a zero-day exploitation campaign attributed to a Chinese-linked actor that compromised a single server and spread malware across dozens of connected government agencies simultaneously. This was not sophisticated individual targeting, but the exploitation of interconnected vulnerabilities. For Southeast Asian organisations, the challenge is uniquely asymmetric.

Recent cyberattacks on water systems across several US states have reignited concerns over the security of essential services that underpin daily life. Yet, contrary to popular belief, the onus of protecting critical infrastructure does not rest primarily with federal or state governments.

Southeast Asian enterprises are accelerating into the agentic era. According to IDC, 2026 marks the dawn of widespread agentic AI deployment across Asia-Pacific, with the region’s IT spending forecast to grow 7% to US$1.123 trillion as organisations move beyond experimentation to autonomous systems that act with intent and minimal human oversight. Yet this enthusiasm is exposing a critical governance deficit.

Australian enterprises are preparing for post‑quantum cryptography (PQC) but remain stuck in pilot mode, with deployment advancing just two percentage points over the past year, according to DigiCert’s second annual global survey**. ** The global, while marked as global, mainly focused on three countries: the UK, the USA and Australia which combined represent 5.37% of the global population.

For many business leaders, AI ethics and governance are often viewed as a necessary burden—a cost of doing business to avoid regulatory fines and reputational damage. However, new research from the IBM Institute for Business Value (IBM IBV) suggests this perspective is outdated and costly. Investing in AI ethics is not just about risk mitigation; it is strongly associated with business growth and superior financial performance.

Broadcom has announced new capabilities for VMware vDefend and VMware Avi Load Balancer, designed to strengthen security across private-cloud workloads while reducing deployment and operational complexity for stretched security teams. The updates extend VMware Cloud Foundation (VCF) with additional controls for lateral movement, malware, API attacks and vulnerable workloads.

Tenable has launched the CyberAgents Exchange, an open-source, vendor-agnostic registry intended to help security teams discover, share and build AI agents, skills, Model Context Protocol (MCP) servers and multi-agent playbooks.

Cloudflare has launched Identity-Aware AI Gateway, giving security and IT teams a way to link AI activity to individual employees and automated agents, monitor what is being sent to models and apply spending controls in real time. The launch addresses two growing concerns for CISOs: limited visibility into enterprise AI use and the risk that sensitive information could be sent to external model providers without proper oversight.

Generative AI is reshaping cloud operations - drafting Terraform, proposing remediations, and summarizing incidents. But speed alone is not success. Without trusted context and governance, agentic automation becomes unsafe fast. This paper introduces Agentic Lifecycle Management: an operating model that combines Infrastructure Lifecycle Management (ILM) and Security Lifecycle Management (SLM) to make autonomy auditable, repeatable, and safe.