"If you’re not doing pentesting 24/7, 365, you’re probably behind the curve," Mark Weatherford told an ISC2 audience on October 26, 2026, underscoring a new urgency for security leaders as AI reshapes enterprise risk.
Mark Weatherford at ISC2 Security Congress 2026
Speaking in Denver, Colorado, Nvidia’s head of cybersecurity policy, Mark Weatherford laid out a practical brief for modern CISOs. Weatherford framed the issue simply: broad adoption of AI in the workplace — including inside security teams — has shifted the CISO role. That shift, he said, requires translating AI-related risks into business terms and making sure executives understand who is responsible for accepting those risks.
From security gatekeeper to "business-risk translator"
Weatherford argued that AI adoption has moved CISOs away from a pure gatekeeping posture toward acting as interpreters of business risk. He described a boardroom exchange where a CISO, unable to explain how security related to the company’s business model, was challenged by the board — a moment that Weatherford said hurt the CISO’s credibility and perceived ability to protect the business. The lesson, he said, is that CISOs must understand how their organizations generate revenue, not only how to protect assets.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTwo technical axes: "security for AI" and "AI for security"
Weatherford identified two core technical challenges CISOs now face. First is the accelerating "pace of technological change," which complicates traditional security practices. Second, CISOs must address both "security for AI and AI for security" — protecting deployed AI systems while also evaluating how AI can augment security operations. Together, he warned, these pressures mean "traditional cybersecurity approaches may no longer be sufficient."
Vendor evaluation and supply-chain single points of failure
On procurement, Weatherford urged judgment over hype. He said he looks for "AI-native products that address security problems, rather than older products with AI added on." He also flagged supply-chain dependencies: multiple vendors can depend on the same suppliers, producing single points of failure that affect more than one product or service, and those dependencies may exist several tiers down the supply chain beyond the vendors an organization directly contracts with.
What this means for boards, CISOs, and procurement leaders
- Boards: Expect pressure to weigh competitive advantage against control. Weatherford noted boards may fear that moving too slowly will cost them edge in the market, while moving too quickly risks deploying tools without appropriate controls or understanding of the risks.
- CISOs: Must interpret business risk and make clear who owns it. Weatherford emphasized that CISOs "rarely own the business risk from deploying things like AI," yet they must translate that risk into decisions the board and executives can accept or reject.
- Procurement leaders: Should demand business due diligence before heavy AI spending. Weatherford counseled against investments driven by "fear of missing out" and recommended that CISOs prepare concise plans outlining proposed work and required resources to reduce risk.
Practical steps Weatherford recommends for CISOs
Weatherford offered several concrete habits and structures. He recommended keeping pace by staying curious and "learn[ing] one new thing every week," focusing on topics such as model context protocol (MCP), prompt injections or sandboxing. He advised CISOs to prepare short proposals that describe proposed AI work and the resources needed, rather than relying on vague assurances. He also encouraged joining and creating peer communities — he said he created a CISO Exchange Network that invited CISOs from Nvidia’s major partners, customers and suppliers to share experiences, concerns and tips.
Weatherford’s remarks tie together three practical threads: translate risk into business language, test and protect systems continuously, and coordinate across vendor ecosystems and peer networks. The central question he posed in different ways — who will accept the business risk of AI deployments, and do executives understand the tradeoffs — remains the practical hinge for decisions organizations must now make.
Original story: https://www.infosecurity-magazine.com/news/ai-is-turning-cisos-into/
