CISO Strategy

NATIONAL HARBOR, Md. — One of the most important jobs for CISOs in the AI era is to stay calm and carefully assess their organizations’ risk exposure, experts said at the annual Gartner Security & Risk Management Summit here.

“Don’t panic,” Katell Thielemann, a VP analyst at Gartner, said during a talk about AI’s impact on the security of cyber-physical systems such as industrial control equipment.

“Yes, things are changing fast,” Thielemann said, “but there are some low-hanging fruit” that CISOs can tackle, such as disconnecting critical devices from the internet and monitoring remote access to the remaining infrastructure.

The debuts of Anthropic’s Claude Mythos and OpenAI’s Daybreak, two powerful AI models that can find software vulnerabilities much more quickly than previous tools, have rattled cybersecurity leaders, who have sought help countering the resulting risks. Technology vendors and consultants have rushed to meet that demand for help, in some cases with unnecessary or counterproductive advice and products. At Gartner’s conference, experts urged CISOs and other security executives to focus on the basics rather than the hype.

“What does Mythos or Daybreak change? Velocity and volume,” Dennis Xu, a VP analyst at Gartner, said during a session. Attackers are “coming at us much faster, and in the next 12 months [they will attack at] a much higher volume.”

Still, Xu said, CISOs should remember two things: “Don’t panic” and “communicate.”

“You need to communicate … to the executive team [and] to the board that we are fighting a different game now,” he said, adding that security executives shouldn’t be afraid to use the new threat environment as an opportunity to demand larger budgets.

But despite the increased velocity and volume, Xu said, businesses’ defensive priorities should remain largely the same, with a focus on managing asset exposure and prioritizing patch deployment to the most important systems.

At one point, Xu asked audience members how many of them had defined their businesses’ “minimum viable operations,” the core systems and processes without which they couldn’t function. When few hands went up, Xu said companies should focus on that task.

“I don’t want you to spend six months doing it, but that’s a thing I would have,” he said, “if for no other reason than it serves as a common language [where] we can all agree and understand what’s important, and then stakeholders can begin to prioritize cybersecurity resilience decisions in the important places.”

AI hype meets reality

Business leaders must be cognizant of how effectively they’re using AI, as well as what effects the technology is and isn’t yet having, Gartner analysts said during talks throughout the conference.

OpenAI, Anthropic and other AI firms are pushing businesses to buy expensive subscriptions for tools that they promise will revolutionize companies’ complex, time-consuming practices. But that rhetoric has often failed to match the reality, as companies discover that AI tools burn through tokens without producing significant results.

Security leaders “feel underrepresented and under-resourced,” said Bart Willemsen, a Gartner VP analyst, “because our money is actually going away to, dare I say, [generative] AI platforms that used to be somewhat almost free, then they started paying per user per month … [and] then it was per token.”

“Are we draining our budgets on things we can do better [with humans]?” Willemsen asked. “I do firmly believe we are.”

Companies should be wary of replacing experienced workers with AI models, he added, because if the AI tools prove deficient, recruiting those workers back or finding new people to replace them won’t be easy.

“For those of you who are thinking, ‘Well, AI will make it so that I can do whatever I want with less people,’ let me tell you, the moment you get rid of them, you are not getting them back,” he said.

Emphasizing human skills

Another session also featured a warning about the follies of neglecting workforce development in the AI era.

“We are facing crushing pressure from the C-suite and the board to showcase the value in AI investments,” said Alex Michaels, a director analyst at Gartner. “Years of hype further accelerate this urgency. Yet AI ambitions are met by a talent bench that is not prepared for widespread rapid AI adoption.”

Michaels was speaking in the context of the security operations center (SOC), a domain that business leaders have been keen to automate with AI but one that Michaels said required continual investment in human skill sets. Yet as AI takes on more SOC tasks, Michaels warned, there will be less imperative to keep human workers trained on important skills, potentially jeopardizing institutional knowledge.

“Even if we’re successful in implementing AI automation at scale,” Michaels said, “we risk eroding the potential of our future generation of SOC talent.”

Reality check on AI and industrial control systems

Thielemann, whose session focused on cyber-physical systems, said critical infrastructure operators should focus on cyber hygiene basics such as network segmentation and access control rather than stressing out about a crippling AI-powered cyberattack that might not arrive for years.

“We know AI is knocking at the door,” she said. “Time will tell, but we haven't seen sort of this nightmare scenario happening yet.”

Anthropic has been inviting selected equipment vendors and critical infrastructure operators into its Claude Mythos preview program, Project Glasswing, but so far, Thielemann noted, none of the companies that make industrial control systems have disclosed their participation.

“If CPS-specific vendors are part of Mythos, they’re not piping up,” she said. “We haven’t seen anything from the Siemens, from the Rockwells, and [from] the Honeywells.”

“Until we start seeing more information,” she added, “please don't fall for the ‘Mythos in manufacturing, we’re all going to blow up’ [rhetoric], which I see quite a bit.”

AI agents remain a major cybersecurity risk for businesses, with 81% of CISOs worrying that their AI systems aren’t properly governed, according to a report by Okta.

Only 47% of companies Okta surveyed said they knew all the AI agents on their networks, and only 46% reported controlling those agents’ access to corporate data. Okta’s findings highlight a complicated and dangerous environment in which companies aren’t properly balancing the risks and benefits of agentic AI.

Security leaders face immense challenges in governing their companies’ use of AI, and the Okta report catalogs several of those challenges and describes how widespread they are.

Shadow AI is one of the biggest challenges, as users rush to adopt helpful tools without getting permission or even alerting security teams. The resulting visibility gaps and increased risk exposure make it harder for CISOs and their staff to defend networks. In Okta’s survey, 68% of CISOs reported seeing at least some unauthorized AI use.

When it comes to authorized AI tools, companies aren’t doing a very good job of tightly controlling what those tools can do and what they can access. Roughly one-fifth of organizations reported letting AI agents access network resources with shared credentials or highly permissioned agent-specific accounts, both of which represent weak boundaries around agents’ behavior. A similar share of respondents said they allowed the teams that created AI agents to manage them on their own. Only one-quarter of respondents said they managed AI agents through a dedicated access framework.

Leadership alignment is another major challenge facing security leaders as they try to manage AI sprawl. Fewer than one-third of CISOs told Okta that they felt “fully aligned” with their leadership, including CEOs and boards of directors, when it came to the amount of risk they should be taking with AI. In the U.S., only 12% of CISOs said so.

AI security dilemma

Part of the problem is that many executives still see security controls on AI tools as an impediment to business growth, rather than a protector of corporate well-being. According to the survey, fewer than half of CISOs believe that their boards consider AI security a business enabler.

Even as they try to protect their own AI systems, CISOs remain deeply worried about how AI is helping adversaries conduct attacks. More than half (57%) of security leaders in the global survey said they were extremely or very worried about AI-driven breaches; the number was much higher (84%) in the U.S. AI-enhanced phishing attacks, malicious AI agents and authentication-bypassing deepfakes topped the list of security executives’ fears.

Okta’s report is based on a survey of 306 CISOs and other cybersecurity executives in the U.S., the U.K., Japan, Germany, Canada and France

Sponsored content

By Deepwatch

Nearly every cybersecurity vendor now has an AI story. Most sound compelling on the surface: faster triage, summaries, investigations, and response. But speed alone is not the standard security leaders should use to evaluate AI in the SOC; that’s because faster access to information — especially in cybersecurity —is not the same as better decisions, and more output is not the same as operational value.

That distinction matters because security teams are already operating under strain. Analysts are overloaded, tool sprawl is real and tolerance for added workflow friction is low. At the same time, CISOs are under pressure to modernize operations and show that AI investments can improve security outcomes.

So the better question is: Does AI help analysts make better decisions and run a more effective SOC?

Not all AI creates the same kind of value

Enterprise Management Associates offers a helpful way to think about AI in cybersecurity: Is it useful, autonomous or genuinely productive? Those distinctions matter, but the market often blurs them together.

Useful AI can enrich alerts, surface patterns, summarize findings and accelerate routine tasks. Those capabilities matter, but they do not always improve productivity. In some environments, AI creates more analysis that analysts must still interpret, adding another step rather than removing one.

Autonomous AI promises independence and speed. Yet in a live SOC, autonomy without transparency, guardrails and human validation can introduce operational risk. If an analyst cannot understand why a system reached a conclusion or recommended an action, the issue is not merely technical. It is an accountability problem.

Productive AI improves how work gets done. It reduces manual effort, strengthens prioritization, shortens time to triage and helps teams respond more consistently. Instead of creating another layer of interpretation, it fits into the workflow and helps move an investigation forward.

That is the bar security leaders should use.

Move beyond enrichment to decision support

A lot of what is marketed as advanced AI in the SOC still operates mainly at the enrichment layer. That does not make it unhelpful. Summarizing alerts, surfacing relevant data faster and translating technical findings into readable language can save analysts time. But they do not answer the hardest questions: What actually matters? How much risk does it pose? And what should happen next?

That is where decision support goes further. It connects signals, adds context and helps guide action with the right level of confidence. Used effectively, AI can pull together evidence from identity, endpoint, cloud and other telemetry sources; build a coherent picture of an investigation; make first-level triage more consistent; and help analysts assess likely severity and determine the next best action.

Generative AI has an important role here, too—but it is only as reliable as the detections, enrichment and decision logic underneath it. It can help analysts make sense of findings, draft communications and move through repetitive work with less friction. It should not be treated as the source of truth.

This distinction matters most when it comes to response. AI can piece together the chain of activity behind a suspicious event and recommend what to do next. But the analyst still needs to validate intent, consider the potential business impact and decide whether the recommended action makes sense for that environment. Productive AI should strengthen human judgment, not replace it.

Five questions security leaders should ask

Instead of asking whether a platform “has AI,” security leaders should ask:

1. Does it reduce analyst burden, or simply repackage the work?
2. Does it improve prioritization and decision quality, or only accelerate access to information?
3. Does it fit into the way the SOC already operates?
4. Does it preserve accountability, transparency and human validation where they matter most?
5. Can the vendor demonstrate measurable operational outcomes in production?

These questions will outlast today’s labels because they expose whether the technology improves security operations in practice.

At Deepwatch, this is the principle behind NEXA, our collaborative AI ecosystem for MDR: connect context, improve prioritization and help analysts and customers work together more effectively. The goal is not autonomy for its own sake. It is a more resilient security operation—one that reduces manual work, makes better decisions and responds with greater confidence.

AI in the SOC should make human defenders more effective. If it only produces more output, it is making the SOC busier—not better.

More than three-quarters of cybersecurity leaders said their organizations have experienced a cyberattack in the past 12 months, a report from Sygnia showed. And 73% of the same respondents said they would not be adequately prepared to respond to a future incident. 

The report, based on a survey of 600 senior cybersecurity decision managers, highlights a readiness gap that has plagued organizations for years. The report shows that, despite 99% adoption rates of formal incident response plans, many organizations have continued gaps in execution. 

According to the report, there are three major issues that limit incident response capabilities: 

• Organizations have difficulties in coordinating key stakeholders in the case of an attack.
• There is limited involvement of top executives or board members in incident response readiness and decision-making.
• Legal and communications matters often delay critical decisions. 

In certain industries, such as healthcare, regulatory considerations frequently get in the way of a well-rehearsed incident response playbook. 

The report also showed that incident response is often impacted by visibility gaps, such as the use of public cloud or software as a service. 

A series of reports demonstrated major evolutions in how threat groups target and undertake cyberattacks. 

They have used AI and sophisticated planning to execute ransomware and other attacks faster than ever. Threat groups have also exploited weaknesses in SaaS platforms to launch attacks against supply chains of customers. 

Nearly 30% of cybersecurity executives say privacy and security issues related to artificial intelligence represent their top concern, surpassing ransomware and other forms of malware, according to a 2025 report from Arctic Wolf.

The report, based on a survey of more than 1,200 leaders in 15 countries, highlighted trends such as ransomware negotiators reducing payouts, the widespread nature of breaches and attitudes about companies’ perceived returns on their cyber investments.

Another interesting data point: Nearly 85% of security leaders said they used next-generation endpoint security software, but only 40% said the tools gave them full visibility into their networks.

Arctic Wolf’s report captures the opinions of the security profession at a pivotal moment, as threat actors adapt to changes in the capabilities of AI and the profitability of different kinds of attacks. Companies are eager to use AI in some form, with 86%of them having established AI use policies, according to the report. But AI-driven security solutions still aren’t generating a significant return on investment — those technologies topped the list of devices creating “the least value” in corporate security programs, with 18% of respondents citing them. 

“While AI devices are great during demonstrations,” Arctic Wolf’s report observed, “they tend to underperform in the real world. This discrepancy is at least somewhat due to impractically high false positive rates. … [I]t will likely be a long time before the accuracy improves enough to put more trust in these devices.”

At the same time, AI is a major driver of companies’ cybersecurity planning. 

“Data transformation and secure AI adoption” topped the list of factors driving respondents’ strategic decision-making, earning a mention from 45% of respondents. Privacy and data protection came in second, followed by risk management. Arctic Wolf bemoaned this mismatch between strategic motivators and real-world threats, noting that AI-generated attacks pale in comparison to breaches that rely on common weaknesses. 

“Training staff to recognize phishing lures, MFA bombs, and other common — and unfortunately effective — techniques is a cost-effective way to improve an organization’s resilience,” the report said. “However, ‘building a culture of security awareness’ was only selected by 31% of respondents [as a strategic driver].”

Rich Campagna, senior vice president of product management at Palo Alto Networks, said it's understandable that companies want to focus so much on AI threats, given that the AI space is complicated and rapidly changing. But, he added, “Overemphasizing on future threats like AI can lead to gaps in defending against the more routine, yet still highly effective, attack vectors that adversaries continue to exploit daily.”

While ransomware receives significant public attention, business-email compromise scams remain equally potent. Twenty-three percent of respondents reported suffering a ransomware or data-exfiltration attack in 2024, but 35% said they had experienced a BEC attack. Another 35% said they experienced a “significant malware infection.” Seventy percent of respondents said their companies experienced at least one significant cyberattack, and 64% of those attacks led to at least three months’ worth of lost productivity.

 

Medium-sized businesses accounted for roughly three-quarters (73%) of ransomware incidents between 2023 and the first half of 2026, according to the risk management firm Black Kite.

Manufacturing was the most targeted industry (accounting for more than 25% of those victims), and nearly 30% of mid-market organizations had at least one known exploited vulnerability, the firm said in a report.

The findings add to the challenges facing mid-market firms, which include large customers demanding accountability and a vast array of suppliers that the mid-market firms lack the personnel to hold accountable.

Mid-market firms, defined as those with annual revenue between $10 million and $1 billion, receive comparatively less attention in cybersecurity discussions than either small businesses, whose struggles and weaknesses are well understood, or large companies, whose industry importance leads to widespread media coverage when they suffer hacks. Black Kite’s report, based on an analysis of 13,336 ransomware incidents between January 2023 and June 2026, examines the unique position that mid-market firms find themselves in, a dynamic that affects their ability to protect their systems.

Companies’ twin roles as suppliers and customers “are usually treated as separate problems, handled by separate teams under separate budgets,” the report said. “In a mid-market company they are rarely handled by anyone at all, and they are the same problem seen from two directions.”

The supply chain equation

The most victimized sectors — manufacturing, professional services, construction and wholesale — are full of companies that supply other companies, meaning that the damage from a cyberattack can quickly cascade downward and outward. “When one of these companies is attacked,” Black Kite said, “the incident is recorded against its own name, but the damage does not stop there.”

These supply-chain risks explain why large companies with medium-sized suppliers ask those mid-market firms to answer so many security questions, according to the report, which listed examples of regulations in the U.S. and Europe that codify suppliers’ cybersecurity responsibilities.

But mid-market firms often struggle to meet these oversight demands.

“Industry surveys of vendor-risk programs find teams of two or fewer people responsible for portfolios that run well past three hundred suppliers,” Black Kite researchers wrote, “a ratio that makes continuous oversight impossible by hand.”

Ransomware attacks during Black Kite’s research period were not evenly distributed across the mid-market. The smallest slice of those companies — those with annual revenue between $10 million and $50 million — accounted for roughly half of all incidents, followed closely by the “core mid-market” ($50 million to $500 million), with 40% to 45% of incidents. Very few “upper mid-market” firms ($500 million to $1 billion) experienced ransomware incidents; Black Kite noted that the number fell from 126 in 2023 to 45 in 2025, a 64% decline.

Black Kite’s report is based on data collected from the networks of some 120,128 mid-market businesses in North America and Europe, but the company found that North America heavily dominated the data set. Seventy-two percent of mid-market attacks during the research period targeted North American companies, and the number of North American victims grew from 2023 to 2026, even as the number of European victims effectively remained flat.

LAS VEGAS — The global system that catalogs technology vulnerabilities is resilient enough to survive the current onslaught of AI-generated bug reports that has alarmed cybersecurity experts, key leaders of that system said during panels at two security conferences here.

The Common Vulnerabilities and Exposures (CVE) Program — whose unique vulnerability identifiers are the bedrock of the entire cybersecurity industry — “will find a way to scale,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at the Cybersecurity and Infrastructure Security Agency (CISA), said at the Black Hat USA conference. “CVE is going to continue to flourish and improve, and I feel very positively about it.”

At the same time, program leaders acknowledged the monumental problems they now face. “These [vulnerabilities] are coming out at an AI pace,” Elizabeth Eigner, a senior manager for cybersecurity policy at Microsoft, said at DEF CON, “but we’re still creating and processing them at a human scale.”

The CVE Program, managed by the nonprofit research organization MITRE and overseen by CISA, is facing the biggest challenge in its 27-year history, as security researchers flood the program with bug reports generated by advanced AI models. Commercial and open-source software developers alike have struggled to keep up with the deluge of vulnerability reports, some of which are completely inaccurate. And the CVE Program itself is still recovering from a crisis in early 2025 that left some cybersecurity experts questioning its future.

The issues have threatened to cripple a vulnerability database that is widely considered one of the world’s most important cybersecurity resources.

During panels at both conferences, speakers described a tidal wave of vulnerability reports that exceeded anything they had ever seen before. GitHub, one of the more than 530 CVE Numbering Authorities (CNAs) authorized to issue identifiers to new vulnerabilities, has published more than 7,000 of those identifiers so far in 2026, a figure that GitHub’s Madison Ficorilli said she believed to be an annual record for a CNA. “This is not a competition,” she said at DEF CON. “It is an alarming metric.”

CISA, too, has felt the squeeze. The agency’s vulnerability response team is dealing with between 360 and 400 cases at a time, Cerkovnik said. “It’s very clearly a difference from what we were seeing a year ago and prior to that,” she said at DEF CON. “What’s being reported to us is increasing.”

Even the world’s biggest tech companies are struggling.

“People ask me whether this is the new normal, and I say yeah, it is, for now anyway,” said Lisa Olson, a principal security program manager at Microsoft, a major CNA.

AI solutions to AI problems

The first four months of 2026 were full of “AI slop,” Ficorilli said at DEF CON, pointing to an endless stream of inaccurate AI-generated bug reports that flooded software maintainers. Since then, she said, the models have improved and begun generating mostly valid reports. But those improvements have also made flawed bug reports harder to identify. Ficorilli said the reports “can be so convincing and, therefore, then consume so much of your time that many times, it may be easier to just say, ‘OK, this looks valid enough. I'm just going to fix it.’”

While AI is fueling the crush of reports, it could also help vulnerability responders sift through the noise. AI models are sometimes better than humans at finding flaws, although their non-deterministic nature means they won’t always find the same flaws from the same source data.

CISA is looking closely at how to automate aspects of the vulnerability triage process as it tries to avoid overtaxing its limited staff.

“With such an increase in scale, where can I use those resources the best and the most efficiently?” Cerkovnik said at DEF CON. “How do I take a job that’s already really difficult and make sure that they are able to focus on the things that really matter?”

The CVE Program is also looking for ways to bring frontier AI labs deeper into the fold. The organization recently granted OpenAI and Anthropic temporary CNA status, letting them assign CVEs to vulnerabilities that their models discover in certain software. “That’s a really big change,” Cerkovnik said. “We are piloting it in order to learn as much as we possibly can.”

Know your biggest cyber risks

Amid the vulnerability avalanche, CISA is deeply concerned that organizations aren’t carefully prioritizing vulnerabilities and are getting overwhelmed — and as a result, inadvertently leaving major security gaps.

“I am concerned about the industry’s ability to scale via prioritization,” Cerkovnik said at Black Hat. “We cannot treat every vulnerability the same way.”

Security leaders, she added, “need to be thinking about how you're going to convince the person above you that not patching something, ever, is an option.”

CISA has urged private organizations to follow the guidance in its recent binding operational directive to federal agencies on vulnerability prioritization.

“Not all vulnerabilities matter, and even vulnerabilities that matter don’t all matter at the same level for you and your organization,” Cerkovnik said at DEF CON. “That’s not a popular thing to say, but it’s true.”

Don’t call it a “vulnpocalypse” (maybe)

People who work in vulnerability analysis are split over how daunting the challenge is. Those divisions were on display during a listening session that the CVE Program hosted to discuss AI’s impact on the landscape.

One person who presented at the event said, “Let’s kill the word ‘vulnpocalypse,’ because it’s just not accurate,” Cerkovnik recalled at Black Hat. She said she understood the objection. “Language matters. … It’s harder to take action on a serious threat when you give it a non-serious name and you talk about it in a way that makes it sound like it’s unsolvable.”

On the other hand, she said, people who run product security teams spoke at the listening session about how they were being "inundated” with reports of varying quality levels.

Global coordination

The CVE Program remains the cornerstone of the global vulnerability ecosystem, but it is no longer alone. In recent years, foreign governments have launched companion programs, including the EU Vulnerability Database (EUVD). Some cybersecurity experts have questioned whether the new programs will lead to fragmentation.

Speakers at the conferences said that was not the case. The EUVD is built around CVE IDs, and Nuno Rodrigues Carvalho, the top vulnerability management official at the European Union Agency for Cybersecurity (ENISA), said at Black Hat that “we don’t see it as a duplication of effort whatsoever.”

“We don’t want a system in which there are multiple platforms that are not in sync with each other,” Microsoft’s Eigner said at DEF CON, but “there’s not a risk there, as it stands now, of two different systems emerging.”

CISA reassures skeptics

After CISA’s contract with MITRE to run the CVE Program nearly expired in April 2025, cybersecurity experts began questioning whether the U.S. government was the right steward for such a critical resource.

CISA’s Cerkovnik sought to reassure those critics.

“We’re more committed than ever,” she said at Black Hat, adding that CISA wants to make the program nimbler and more responsive to researchers’ needs. CISA is focused on improving both the quality of vulnerability records and the ease of the reporting process, she said.

Cerkovnik said the CVE Program is now on sound financial footing, but she acknowledged that 2025’s near-fiasco had reminded both CISA and the broader cybersecurity community of the program’s value.

“With the current emergence of AI-enabled vulnerability research and discovery,” she added, “that importance of the program is becoming more evident every single day.”

ENISA’s Carvalho said the world seemed committed to the program. “I don't think that another model or another way of doing things will come,” he said at Black Hat.

Not everyone was as confident. “Most of the regulators around the world think that CVE is still the way to go and should remain the standard,” Microsoft’s Olson said at DEF CON. “But I think the program has to really rise to the moment in order for some other competitive system to not take its place.”

Others were even more critical.

“I don’t think the CVE Program was designed to be able to manage [this] influx of vulnerabilities,” Katie Noble, a program board member who leads product security incident response for Intel, said at DEF CON. “I don’t think it is capable of keeping up at this point.”

A letter from the CISOs of 45 powerful global companies could provide crucial backing for world governments looking to reduce cybersecurity regulations and their accompanying hassles for businesses.

The CISO letter, sent to members of the Group of Seven nations and the Organization for Economic Cooperation and Development, urges governments to use those high-level forums to “focus on greater alignment of cybersecurity regulations.”

The signatories — including tech giants, large banks, major hospital chains and influential health-care firms — want to see consistent implementation of existing rules, more collaboration on future rules, faster threat intelligence-sharing and more corporate engagement.

The broad list of the letter’s signatories reflects widespread frustration across industries about the international morass of conflicting and redundant cyber rules, as well as the private sector’s belief that the moment for harmonization has finally arrived.

“It is helpful that these CISOs in different industries are highlighting the universal problems they are seeing with compliance burden,” Ari Schwartz, managing director of cybersecurity services at Venable, told Cybersecurity Dive. “When companies have to do multiple assessments and audits to show alignment with the same controls, it is a waste of resources that could be going to actual security.”

The Biden administration launched an effort to tackle cyber regulatory harmonization through the Office of the National Cyber Director, and that effort is likely to continue under the Trump administration, which has vowed to cut regulations across the board. Lawmakers in the U.S. share the executive branch’s concerns about confusing and overlapping rules.

Other countries likely share the United States’ worries about the security impacts of regulatory compliance.

“I think there is sympathy with that point from most governments around the world,” Schwartz said.

CISOs from major companies

The letter’s signatories include major U.S. firms like Amazon Web Services, Honeywell, Marriott, Eli Lilly and Mastercard, but they also include foreign titans like Enbridge, Siemens, Swisscom and Danske Bank.

The companies urged governments to use the OECD as a forum for cooperation on regulatory harmonization, noting that current mechanisms for this cooperation “remain nascent.”

Ideally, they said, the OECD would “convene relevant stakeholders, including industry and other nongovernmental representatives, once or twice a year,” and develop an “action plan” to implement world leaders’ harmonization vows and provide them with “regular progress updates.”

The firms also suggested specific ways to harmonize rules, from reciprocity agreements to international standards to expanded authorizations for third-party audits.

“This letter adds some specificity on to what governments can do to maintain their sovereignty and address this issue,” Schwartz said, “which is the right approach to getting some action here.”

Confusion and wasted resources aren’t the only issues worrying the letter’s signatories. In its own blog post, Microsoft warned that regulatory divergence “also limits the ability of governments and private sector entities to share threat intelligence efficiently, weakening collective cyber resilience.”