Cybersecurity in 2026: Is Zero Trust Enough to Defend Against AI-Powered Threats?

Taking the three I have a view on:

• Zero Trust (1). Many teams seem to have bought the products without changing the architecture. A quick test is whether a stolen password alone, from an unmanaged device, can still reach something important. If it can, the policies are there but the "verify explicitly" part is not. Conditional Access that requires a compliant device, and not just MFA, is where it starts to be real.
• Identity versus perimeter (4). Identity has to come first, but a device is part of identity decisions. A valid user on an unpatched, unmanaged laptop is a different risk from the same user on a compliant one, so device health and patch state should feed the access decision, not sit in a separate tool.
• How much authority for AI agents (5). I would tier it by how reversible the action is. Reversible, low blast radius actions (isolating one device, forcing a sign-out, revoking a session) can run automatically with an audit trail. Anything destructive or wide (disabling accounts, wiping, changing policy for a group) should wait for a human, with the evidence and the exact command shown. Start every new action in approval mode and only promote it to automatic after it has a clean track record.

On that last point, some endpoint tools already work this way: TFalke (disclosure: I work on it) has an AI agent that diagnoses a Windows device and proposes the fix as a command, which an operator approves, and each action lands in an audit log. For security operations at scale the same pattern applies, and the useful measure is not how much the agent can do on its own, but how quickly a person can review what it wants to do.