Cybersecurity Governance Was Everywhere at InfoSec World

InfoSec World 2026 just ended—and it was awesome.

The conference offered a great mix of serious cybersecurity conversations, new technology, networking and genuinely fun events. But one topic kept appearing in conversations with security leaders, speakers, marketers and sales teams: governance.

The Serious: Governance Is Having a Moment

Before the conference, general feedback from a client survey suggested that governance would be a major topic. That proved true almost immediately.

From cybersecurity strategy to PR and marketing, people were ready to discuss what effective governance means—especially as organisations evaluate AI, emerging risks and changing stakeholder expectations.

Here are several comments I heard from experts during the conference:

• "How can governance help us do better than what we already do? It's not that new, but it is more critical."
• "Our success depends on governance. How do we take it to the next level?"
• "It brings more focus to communications and stakeholder engagement than ever before."
• "Governance equals AI hygiene. Enough said."
• "What are the triggers? What are the risks? Governance allows us to have conversations directly about business risks."
• "It's having a renaissance within every organisation right now."
• "It lets me make smart decisions. Before I engage, I need to understand how I can create an outcome that works for everyone."

What stood out was that governance was not being discussed simply as a compliance exercise. People connected it directly to business risk, decision-making, communication and trust.

Questions Worth Researching

These conversations also raised important questions for future cybersecurity market research:

• How do organisations define effective cybersecurity and AI governance?
• Who owns governance decisions?
• What events trigger governance reviews?
• Does governance help teams make faster, more confident decisions?
• How well are security risks communicated to business stakeholders?
• Where do executives, security teams and employees see governance differently?

These are exactly the kinds of questions that independent research can help answer. The findings can support strategy while also giving PR, marketing and communications teams credible evidence for reports, campaigns and industry conversations.

If your team is exploring any of these questions, discuss a cybersecurity research study with CITE Research.

Now the Fun

The learning extended well beyond the conference sessions.

ESET hosted an extremely fun cybersecurity trivia night. The networking was excellent, the food was delicious and I met talented CISOs, conference speakers, marketers and sales leaders.

The Torq team once again proved that it knows its material—and always arrives prepared. I enjoyed catching up with the team and learning about its latest developments.

Trinity Cyber also kept me completely engaged while explaining its offering. Special thanks to Heather Porter and Nicholas DiPace for taking the time to walk me through it.

That combination of thoughtful conversations, practical learning and informal networking is why industry conferences remain so valuable. They reveal the questions people are really asking—and often provide the starting point for meaningful B2B market research.

I'm already looking forward to seeing everyone again.

---

Andrew Edwards is the founder and CEO of CITE Research. Drawing on experience in survey research at Nielsen and public relations at Edelman, he helps organisations develop credible quantitative and qualitative research for strategy, PR, marketing, sales and thought leadership.