Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
The Evolving Threat Landscape: AI, Cloud and Supply Chain
The landscape never stands still
Attack techniques, technology and the business all change constantly, so a risk assessment from last year may already be out of date. One CISM task is to monitor for internal and external factors that may require reassessment of risk. The 2026 outline keeps “emerging risk and threat landscape” as a named topic.
What’s emerging now
| Area | What’s changing |
|---|---|
| AI-enabled attacks | Fluent, personalised phishing at scale; cloned voices and deepfake video of executives; faster discovery of vulnerabilities |
| Risks to the organisation’s AI | Prompt injection, poisoned training data, models revealing sensitive data, insecure plug-ins and agents |
| Cloud and identity | Misconfiguration, stolen session tokens, over-privileged identities, attacks that bypass MFA |
| Supply chain | Compromised software updates, managed service providers and open-source libraries reaching many victims at once |
| Ransomware and extortion | Data stolen before encryption, leak sites, pressure on customers and regulators |
| OT, IoT and quantum | Connected industrial systems; future quantum computers breaking today’s public-key encryption (“harvest now, decrypt later”) |
AI, both ways
- Attackers using AI produce better phishing and impersonation.
- The organisation’s own AI brings new risks: prompt injection, data poisoning and leakage of sensitive data.
- Shadow AI: staff paste confidential data into public tools.
- The governance response: an AI use policy, approved tools, data classification rules for AI and AI risk assessments before deployment. Banning AI outright usually drives it underground.
Responding to something new
When something new appears, follow the normal risk process rather than reacting to headlines:
- Scan the horizon for changes.
- Assess relevance to the organisation’s assets, industry and technology.
- Reassess risk: update scenarios, likelihood and impact.
- Decide treatment against the appetite.
- Report what changed to risk owners and management.
Example. A finance clerk receives a video call from the “CFO” asking for an urgent transfer. It’s a deepfake. The security manager reassesses payment fraud risk, adds a rule that transfers above a limit need a call-back on a known number, and briefs finance staff, without buying any new technology.
Where to watch
- threat intelligence feeds and sector information sharing centres (ISACs)
- alerts from government agencies and regulators
- vendor advisories and known-exploited vulnerability lists
- peers, conferences and published incident reports
- the organisation’s own business plans: new technology, markets and suppliers
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step when a new threat emerges | Assess its relevance and reassess the risk |
| Best approach to staff using generative AI | Govern it: policy, approved tools, data rules |
| Main cloud security risk | Misconfiguration and identity weaknesses |
| Why ransomware risk remains with good backups | Data theft and extortion |
| When should risk be reassessed? | When internal or external factors change |
In short
- Emerging risk is a CISM topic in its own right: threats, technology and the business keep changing, so risk assessments must too.
- AI cuts both ways: attackers use it for convincing phishing and deepfakes; the organisation's own AI systems bring new risks such as prompt injection, data poisoning and leakage.
- Cloud risk is dominated by misconfiguration and identity: stolen tokens and over-privileged accounts.
- Supply chain attacks reach many victims through one trusted supplier or software update.
- Ransomware groups now steal data before encrypting it, adding extortion even when backups work.
- When a new threat appears, the first step is to assess its relevance and reassess risk, not to buy a product.
Exam traps
- Reacting to headlines without assessing relevance wastes resources.
- Banning new technology outright (such as generative AI) often drives shadow use; govern it instead.
- Good backups don't remove the risk of data-theft extortion.
- Emerging risks still go through the normal risk process: assess, treat within appetite, report.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What's emerging now
Responding to something new
ExampleA finance clerk receives a video call from the 'CFO' asking for an urgent transfer: a deepfake. The security manager reassesses payment fraud risk, adds a call-back rule on a known number for all transfers above a limit, and briefs finance staff, without buying new technology.
1 / 9