The landscape of IT governance, risk, and security is no longer merely evolving; it is accelerating at a velocity that threatens to outpace the professional frameworks designed to stabilize it. For decades, ISACA has served as the bedrock for global IT standards, offering certifications like the Certified Information Systems Auditor (CISA) and Certified Information Security Manager (CISM) that have guided generations of practitioners. However, as the industry gathers in the wake of the 2026 ISACA Europe Conference in Munich, a singular, unrelenting theme has emerged: the transformative, disruptive, and often chaotic arrival of artificial intelligence.
The conference, which served as a microcosm for the broader industry, made one thing clear—the era of the five-year professional roadmap is over. In its place is a reality of constant, iterative upskilling, where the shelf-life of technical expertise is shrinking by the month.
The Main Facts: A Paradigm Shift in Professional Governance
The core challenge facing the global security community is a fundamental shift in the speed of innovation. Where IT professionals once navigated predictable, multi-year cycles of technology adoption, they are now tasked with managing the immediate, systemic implications of AI integration.
At the Munich conference, this was reflected in an agenda dominated by AI-centric discourse. While traditional pillars of the ISACA mission—such as cross-border data privacy, operational technology (OT) security, and supply chain resilience—remained central, nearly half of all sessions were dedicated to the intersection of AI and risk.
To meet this challenge, ISACA is undergoing an internal transformation. The organization has proposed significant amendments to its bylaws, including shifting its legal headquarters to Washington, D.C., lowering the quorum requirements for member votes, and adopting a staggered three-year board term structure. These are not merely administrative adjustments; they are strategic maneuvers intended to provide the governance agility necessary to respond to a world where, as CEO Erik Prusch notes, "We are already behind."
Chronology: From Stability to Constant Adaptation
To understand the urgency, one must look at the trajectory of the profession over the last two years:
- 2024–2025: The Fear Phase. The industry was initially gripped by the existential threat of AI. Concerns were centered on job displacement, with widespread anxiety that AI-driven automation would render entry-level security and audit roles obsolete.
- Early 2026: The Integration Phase. As organizations began deploying AI in production environments, the focus shifted from "Will AI replace us?" to "How do we secure this?" Practitioners found themselves forced to integrate AI management into existing roles, often without formal training or structural support.
- Present Day: The Regulatory Scramble. As of late 2026, the focus has shifted toward compliance. With the EU’s AI Act, NIS2, and DORA now in effect, the challenge has evolved into a high-stakes struggle to bridge the gap between complex regulatory requirements and the practical, often under-resourced, realities of corporate implementation.
Supporting Data and the "Experience Paradox"
The data points to a growing tension in the workforce. According to ENISA, there are currently over 300,000 unfilled cybersecurity positions across the European Union. Yet, despite this massive talent gap, entry-level professionals are finding it increasingly difficult to enter the field.
Tara Wisniewski, senior vice president of advocacy at ISACA, highlighted a "mismatch" in hiring practices. As AI begins to automate routine tasks, junior roles are disappearing, yet employers continue to demand several years of experience for "entry-level" positions. This creates a dangerous feedback loop: if the next generation of security professionals cannot gain foundational experience, the long-term pipeline for senior leadership will effectively collapse.
Furthermore, the "cost of compliance" is becoming a significant economic barrier. For smaller organizations, the resources required to meet the rigorous standards of DORA and NIS2 are siphoning budgets away from training and professional development. This creates a secondary risk: as companies scramble to meet legal mandates, they may inadvertently weaken their long-term security posture by neglecting the very people tasked with maintaining it.
Official Responses: Navigating the "Governance Gap"
The leadership of ISACA has been vocal about the need for a fundamental reset in how the organization supports its members.
Massimo Migliuolo, ISACA Board Chair:
In his opening address in Munich, Migliuolo emphasized that the proposed changes to the organization’s bylaws are essential for global relevance. "These proposals give us the governance agility to respond faster to the needs of members wherever they are in the world," he stated. He acknowledged that while Europe is setting a high bar for regulation, the real-world application of these laws remains a hurdle that requires a more flexible, proactive professional body.
Erik Prusch, ISACA CEO:
Prusch noted that the career lifecycle of an IT professional has fundamentally changed. "Previously, you got certified, and maybe five years later, you might be getting your second certification as you’re escalating through an organization," he explained. "Now it’s much more current. Everybody’s having to stay not only trained and keep their current certifications up to date, but also bring in new technology."
Prusch’s message to the membership is clear: the era of static expertise is dead. ISACA is responding by launching dedicated AI credentials and embedding AI modules directly into the CISA and CISM curricula to ensure that current practitioners are not left behind as their roles evolve on an ad-hoc basis.
Monica Verma, Cybersecurity Advisor:
Offering a more critical perspective, Verma warned against the "apocalyptic" narrative surrounding AI. She argued that focusing on sci-fi scenarios of AI super-intelligence distracts from the immediate, tangible risks—such as data poisoning, model supply chain vulnerabilities, and the rapid expansion of the attack surface. "There is no time to waste," she cautioned, urging professionals to focus on the immediate, practical risks present today.
Implications: The Future of the Profession
The implications of this shift are profound, both for the individual practitioner and for the role of professional associations.
The Rise of De Facto Regulators
As government bodies struggle to keep pace with the technical nuances of AI, organizations like ISACA are increasingly stepping into the role of de facto regulators. By establishing industry-wide standards and professional codes of conduct, these associations are doing the heavy lifting that legislatures cannot. Wisniewski noted that ISACA is actively seeking a seat at the table in debates regarding whether cybersecurity should become a formal, licensed profession, similar to law or medicine.
The Looming Quantum Horizon
If AI represents the current crisis, quantum computing represents the next. ISACA’s leadership has already begun signaling that quantum readiness will be a primary theme for 2027. This suggests a future where the professional association acts as a "buffer" between rapid-fire technological disruption and the workforce, providing the training and standards necessary to prevent systemic collapse.
A Call for Speed
The final takeaway from the Munich gathering is a sobering one: the luxury of time is a relic of the past. Whether it is adapting to new AI regulations or preparing for the quantum shift, the consensus is that the pace of change will only accelerate. For the IT and security professional, this means that the "day job" is no longer just about maintaining systems; it is about constant learning, rapid adaptation, and, perhaps most importantly, advocating for a regulatory environment that recognizes the human element of security.
As Prusch concluded, the industry is no longer in the luxury phase of infrastructure development. With massive, critical regulations now active and AI-driven threats evolving in real-time, the mandate for the entire sector is simple: "We’ve got to do this faster."
About the Author
