Editor's note — September 12, 2026: Corrected the unsupported 84% union and removed unverified turnover and near-zero attack-cost claims.
The take
The Gartner C-level Communities 2026 survey draws on more than 1,600 CISOs in its communities. In the risk-management section, 45% reported competing priorities and 39% reported lack of resources. These categories may overlap; they cannot be added to claim that 84% of respondents faced either problem.
The report also places enabling and protecting AI first among the listed functional priorities. That is a ranking in this survey, not proof that AI is the top threat for every organization.
Questions for the executive team
- Which material risks lack an owner or funded response?
- Which delivery commitments conflict with agreed risk limits?
- What decisions need escalation to the CEO or board?
My recommendation is to make prioritization and accepted residual risk explicit. A CISO should not be left to absorb unresolved business tradeoffs through an unbounded work queue.
Source and further reading: Primary reference. Framework guidance is not a statement that a particular law applies to every organization.