What CSOs Say Matters Most in 2026, and What It Means for Your GSOC

Liferaft | October 16, 2026

GSOC analyst monitoring security threats and location-based intelligence on multiple screens in a security operations center

May 29, 2026

5 Months In: 2026 Threat Trends for Corporate Security

June 12, 2026

From Threat Monitoring to Decision Intelligence

December 22, 2025

Business Security Predictions for 2026 | Liferaft

Most security leaders know the feeling. Something breaks overnight, and by 8 a.m. an executive wants to know what it means for the company, the people, and the quarter. The Clarity Factory's 2026 Annual Chief Security Officer Survey, released in September, puts hard numbers behind that pressure.

Rachel Briggs OBE and her team surveyed CSOs in March and April 2026, and 118 responses from multinational companies with more than 3,000 employees made the final dataset. Most of the report speaks to the CSO's seat at the leadership table. This post looks one floor down, at the GSOC, because much of what the survey describes lands on the analysts and operators who watch the feeds, write the alerts, and make the first call.

The Risk Picture Got Crowded Fast

In 2025, four security risks were rated 'critical' or 'high' by more than half of CSOs. In 2026, that number rose to seven. Cyberattacks, geopolitical risk, data and IP theft, insider risk, and reputational risk sit at the top of the list, with cyber still in first place and about three quarters of CSOs rating it critical or high.

A few figures stand out for anyone running a watch floor. Geopolitical risk was rated critical by 28% of CSOs, up from 13% a year earlier, and 74% rated it critical or high. Armed conflict climbed to 41% critical or high from 31%. The share of CSOs placing ongoing conflicts in their top five geopolitical risks jumped from 37% to 67%, the largest increase anywhere in the dataset. Travel risk went from about a third of CSOs rating it critical or high to a majority.

The report notes that the survey opened just as the conflict with Iran began, which may have lifted some of those numbers. Even allowing for that timing, a GSOC now carries more risk categories that need standing monitoring, defined escalation thresholds, and a named owner on the business side.

Safe Passage: Best Practices for Corporate Travel Security in a Global Environment

Leadership Wants Analysis, And The GSOC Is Changing Shape

The survey tracks a steady change in how corporate security teams are built. Roles in intelligence, crisis and resilience, and what the report calls higher-value GSOC positions are growing. Guarding, site security, and operator-level GSOC roles are shrinking. Budgets follow the same pattern, with money moving toward GSOC modernization, fusion centers, and systems integration, and away from manual operations.

One CSO interviewed for the report summed it up: "GSOCs need to get away from being too tactical."

There is a catch though. More intelligence output hasn't translated into more influence. Only 25% of CSOs said their intelligence products frequently shaped business decisions over the past year, and about a third said they rarely did or didn't at all. The audience has grown, with more security teams now serving business leaders and cyber colleagues, yet reach and impact are separate measures. Since the GSOC produces much of a security team's daily reporting, it is a sensible place to start closing that gap.

What Intelligence-Led Looks Like On A Regular Shift

'Intelligence-led' can sound like a slogan until you put it into a shift schedule. In practice, it shows up in a handful of habits.

Work from requirements. The report describes one CSO who told his intelligence team to stop producing anything nobody had asked for and to give more tailored content to the people who used it most. Demand for their work went up, and other parts of the business started requesting their own briefings. A GSOC can apply the same logic by keeping a short list of standing requirements for each stakeholder, such as the executive protection lead, the travel manager, and regional operations heads. Every alert should map back to one of them.
Put the 'so what' in every alert. Say an unlawful protest is forming three blocks from the Chicago office. A useful alert tells the site manager which entrance to close, flags that an executive has a 2 p.m. meeting on site, and notes how confident the analyst is in the crowd estimate. Three extra lines in the alert template can do most of the work.
Get ahead of the morning question. Executives now have their own AI tools and expect near-instant answers. One CSO in the report has AI agents generate intelligence reports at 5:30 each morning so the team is ready before the C-suite starts asking. For a GSOC, that can be as simple as an overnight brief covering events near company sites and travelers, ready before leadership logs on.
Measure what leadership cares about. The report draws a clear line between metrics and KPIs, and counting GSOC responses falls on the metrics side. Its suggested measures for intelligence include request-to-delivery time, repeat demand, and the number of business decisions influenced. Those numbers tell a much better story in a budget meeting than alert volume.

Mapping The Top Risks To The Watch Floor

The five risks CSOs ranked highest each have a GSOC angle, and several of them overlap.

Cyberattacks are cross-departmental. The survey shows three quarters of CSOs now collaborate regularly with cyber security, up from 2025. A joint playbook that spells out when the SOC calls the GSOC, and the reverse, saves time during an incident.

Geopolitical risk and conflict call for asset and traveler mapping against areas of unrest, with clear triggers for when an analyst escalates. With travel risk now rated critical or high by most CSOs, the travel desk and the GSOC benefit from a shared view of where people are.

Data and IP theft and insider risk often surface outside the company first, through leaked credentials, documents posted to paste sites, or chatter on dark web forums. Half of CSOs rated insider risk critical or high. Monitoring for those signals, and a clean handoff to HR and legal, belongs in the GSOC's standing requirements.

Reputational risk is where online noise and physical security meet. In the past year, 62% of CSOs said their company faced civil unrest or activism, 44% saw negative social media sentiment, and 38% experienced reputational damage. One CSO in the report described the core task as judging when online criticism crosses into something security should act on. That judgment call is daily GSOC work, and it depends on knowing what normal looks like for your brand and your executives.

Where To Start This Quarter

None of this requires a bigger headcount for most. The report found that team size had no link to the number of areas a security function is responsible for, so most GSOC managers are working with what they have. A few practical moves can shift the floor toward intelligence-led work within a quarter:

Pull last month's alerts and count how many led to a decision, a change in plans, or a question back from a stakeholder.
Sit down with your five heaviest consumers of GSOC reporting and write down what they need to know, how fast, and in what format.
Add a 'so what' and a recommended action to the alert template, and make confidence levels a required field.
Start tracking request-to-delivery time and repeat requests alongside your usual volume counts.
Pilot one hybrid pairing the report highlights, such as GSOC analysts working alongside investigations, or GSOC and executive protection teams planning events together.

The full Clarity Factory report runs to roughly 90 pages and is free to download. The sections on intelligence and on corporate security teams are worth reading in full for anyone who manages a GSOC or the people in it.