1. Endpoints and Identity Need Threat Response Capabilities
Zero trust has always been a great network design and is now very mainstream. But zero trust shifts security responsibility to endpoints and identity systems, which means that these need to participate in both detection and response. This is one of the most significant changes that security teams need to internalize: Zero trust means a change in the way we handle endpoints and identity.
For endpoints, old-school anti-malware is definitely out, and its replacement has changed names several times, from endpoint detection and response (EDR) to today’s extended detection and response (XDR). What’s important is not the acronym but the security capabilities. Specifically, security managers should be looking for endpoint tools that include cross-domain telemetry (as opposed to host-only events), global and dynamic response to threats across the network (as opposed to on-host actions such as file quarantines) and global identity-based behavior anomaly detection (as opposed to host-specific behavior analysis).
This doesn’t mean that the endpoint doesn’t have security tools, detection and controls, but that the detection moves from what the particular endpoint is doing to what the identity is doing across the entire corporate network and application fabric.
Identity and access management (IAM) must undergo a similar metamorphosis. It’s often said now that threat actors “don't hack in, they log in.” Detecting that and responding to it is a 2026 requirement.
The additional capabilities for threat detection and response will be foreign to anyone who is accustomed to thinking of Active Directory as their entire IAM system. These more advanced capabilities can be either add-ons or new products, but security managers should be looking for tools that also include environmental scanning for shadow or inactive accounts with administrative rights, privilege escalation paths, and evidence of common attacks such as Kerberoasting or token hijacking. And, as with endpoint tools, IAM needs to be able to respond to threats or actual break-ins such as revoking tokens across network, cloud and Software as a Service environments, or updating endpoint or network access control lists.
LEARN MORE: Find out why detection and response are the new security baseline.
2. Logs Need Smarter Analysis
Security information and event management (SIEM) systems have become standard instrumentation at businesses of all sizes. Unfortunately, the problem of dealing with the massive flood of logs wasn’t solved then just by installing some software — and the problem today has worsened with the addition of more log volume, diverse sources and the need for correlation.
Threat detection has become performance- and cost-constrained. How many logs per second can we afford to accept? And what sources have a high signal-to-noise ratio that makes them worth paying to process? These types of questions expose fundamental failures in the SIEM landscape that security managers are going to have to work hard to overcome.
In 2026, SIEMs aren't just databases of events; they're becoming data lakes. And AI-driven agents are poring over everything, correlating one suspect printer driver on this host with an anomalous login here and a strange outbound network connection there. The goal is to create an attack narrative for an analyst to see, along with recommended remediations so it’s all just a click away from isolation.
Meanwhile, we know that today’s attackers are using AI-assisted malware, that they've developed “living off the land” techniques to move laterally through our networks, and that they're finding new vulnerability chains that no one could have imagined.
All this means that in 2026, threat detection requires speed and automation, which is delivered by security orchestration, automation and response (SOAR) solutions. Getting to a strong SIEM with SOAR capabilities may require a wholesale rethinking of that part of the threat detection and response team, but without someone — or something — analyzing events and orchestrating responses at machine speed, there’s no hope of keeping up.
3. Networks Need Better Visibility
Intrusion detection and prevention systems are commonplace, but they’ve lost their usefulness as tools to block malware or to identify attacks and data exfiltration in progress. The world has moved onto Transport Layer Security version 1.3 encryption for almost all traffic, which means that passive inspection of data is essentially impossible. Even active inspection is difficult: It won't work against most internet services, including SaaS; within the enterprise, it will work only with a complex and performance-crippling architecture.
The lack of visibility, though, doesn't reduce the need to know what is passing over the enterprise network. Visibility is key to performance management and application experience as well as threat detection.
Threat detection teams responding to this change in encryption technology in 2026 must split in two directions. First is better analysis of encrypted traffic at the perimeter of the network. Cryptographic metadata, network metadata (such as IP addresses), packet sizes and timing, and comparison to published indicators of compromise are all part of a modern edge intrusion detection capability. Command and control detection, data exfiltration and unusual patterns are all part of the job for modern IDS/IPS tools. You may occasionally get a stray unencrypted packet, but network edge threat detection tools need to look at flows and infer what is happening, or they're not effective.
The second part of this split involves looking more at internal lateral traffic. The movement of data between systems in data centers, servers, application programming interface gateways and VPN concentrators may or may not be encrypted, but this traffic can be analyzed for anomalies such as high-volume password guessing, unusual connection requests showing lateral movement, and systems talking to each other that have never done that before.
As with SIEM, wholesale rethinking of IDS/IPS placement and products can be hard, but it’s certain that five-year-old UTM firewalls with IPS signatures aren't doing much more than slowing down your traffic.
Click the banner below to read the recent CDW Cybersecurity Research Report.
