Metadata is key to CISO strategies in 2026

Source: Report landing page. Gigamon's respondents in various countries have seen an increase in attacks targeting their AI and large language model (LLM) deployments. Australia registered the largest increase at 56%.

Gigamon, a deep observability provider, has released research revealing how global CISOs are reshaping 2026 cybersecurity strategies as they seek to effectively secure and manage hybrid cloud infrastructure in the AI era.

More than 200 global CISOs surveyed across Australia, France, Germany, Singapore, the UK, and the US are shifting how they manage data, secure AI applications, and evolve their SecOps teams.

The CISO Insights: Recalibrating Risk in the Age of AI report reveals that as networks become more complex and AI accelerates digital transformation and intensifies cyberattacks, data visibility and quality have become mission critical to defending hybrid cloud infrastructure. Nearly six in 10 (58%) have seen more AI-powered attacks, and half said their large language models (LLMs) have been targeted.

To keep pace, CISOs now need to gain a deeper level of insight.

Packet-level data paired with metadata was cited by 86% of CISOs as essential in strengthening security posture today, and the key to gaining complete visibility, with metadata offering a scalable way to surface critical signals from rapidly-expanding data flows.

CISOs reported their top priority to optimise defense-in-depth strategies is real-time threat monitoring and visibility into all data in motion. In 2025, 64% will prioritise real-time monitoring, while 80% say network-derived telemetry is critical for securing AI and hybrid cloud with deep observability.

Yet nearly all (97%) of the CISOs surveyed admitted that they are making compromises in the areas of visibility gaps, tool integration, and data quality, all of which hinder their ability to effectively secure and manage hybrid cloud environments.

“Looking ahead to 2026, AI remains both one of the biggest challenges and most exciting opportunities for CISOs,” said Chaim Mazal, Chief AI and Security Officer at Gigamon.

“The rise in AI-driven ransomware, social engineering, and the unchecked spread of shadow AI is placing security leaders on the defence, which is why our survey shows visibility has become their top priority. At the same time, AI offers a powerful way to augment security teams, restore visibility and control, and reshape how organisations structure and resource their defenses, ultimately paving the way for stronger security.”

According to the survey, AI data volumes have nearly doubled, rapidly expanding the threat surface and impacting the way CISOs manage and store data across virtual, cloud, and container environments. As a result:

- Three quarters of CISOs believe that public cloud is a greater security risk than any other environment, causing many organisations to rethink their data storage strategy. Nearly half still lack visibility into lateral (east-west) traffic, leaving them vulnerable to advanced threats like AI-powered ransomware. 

- Almost three quarters (73%) of CISOs report they are considering repatriating public cloud data to private cloud due to security concerns, a significant change since the migration to public cloud started early two decades ago. 

- Just over half (52%) report they are reluctant to use AI in the public cloud due to issues around intellectual property, highlighting the compliance, control, and shadow AI challenges they face due to limited visibility. 

- Seven in 10 see public cloud as the riskiest environment, and half are considering moving workloads back on-prem.

These data challenges have extended beyond a technical imperative, now moving to a strategic business imperative, as seven in 10 report that public cloud security is now a board level priority.

Nearly one in five CISOs are not confident they have the right tools to manage the rising volumes of network data generated from AI, highlighting a critical gap, as existing log-based tools aren’t designed to defend against AI-powered attacks. To better manage data volumes fuelled by AI:

- Just over half (52%) of CISOs say a top priority for the next 12 months is leveraging network and application metadata to make existing tools more effective.

- Forty-six percent are ensuring visibility across all data-in-motion.

- A third are implementing guardrails around LLMs to mitigate exposure to emerging risks.

Data breaches are on the rise, with a 17% year-over-year increase in breaches, and 55% of organisations hit in the past 12 months. Nearly half said their tools failed to detect the breach. CISOs are feeling the pressure, with nearly half (45%) citing they are the primary person held accountable when a security breach occurs.

Another top concern cited by CISOs is the increased level of stress and burnout within their teams. As a result, CISOs are embracing AI:

- Forty-five percent of CISOs leveraging AI tools to enhance their internal security team's capabilities and productivity.  

- Faced with a global shortage of skilled professionals and reduced budgets, 73% of CISOs are also considering AI to compensate for decreasing headcount. 

With new AI technologies becoming available, teams will also be able to leverage AI to equip junior analysts to perform at the level of seasoned experts while helping teams reduce training costs, accelerate root cause analysis, and strengthen overall threat visibility.

Explore

Read CISO Insights: Recalibrating Risk in the Age of AI at https://www.gigamon.com/campaigns/hybrid-cloud-security-survey.html