CISO Perspectives
for 2026

Absolutely. 97% of CISOs believe NAC is a critical part of zero trust architecture, and NAC budgets are increasing across 87% of organizations—showing renewed investment in access control at the network layer.

Yes. It details where CISOs are increasing spending, helping readers benchmark their own roadmaps against industry peers.

Network Access Control (NAC) is a foundational component of a zero trust strategy. While zero trust is a strategic framework that requires every user — internal or external — to be authenticated, authorized, and continuously validated before gaining access, NAC provides the mechanisms to enforce those access decisions at the network level.

NAC ensures that only compliant and trusted devices can connect to the network, aligning directly with zero trust’s principle of “never trust, always verify.” By enforcing security policies based on context — such as user identity, device posture, and location — NAC helps organizations move away from perimeter-based assumptions and toward dynamic, policy-driven access control.

Together, NAC and zero trust create a simpler, more resilient security architecture that strengthens defenses and enhances user experience by ensuring access is always appropriate, verified, and secure.

CISOs have more clarity about what their policies cover, with notable improvements in clarity around supply-chain attacks, insider threats, and regulatory penalties.

This research is built for CISOs, security architects, zero trust strategists, and IT leaders who want to validate their 2026 roadmap against industry data and uncover blind spots around identity, access, and risk.