Cybersecurity

CISOs Struggle to Own AI Governance

Analyst 207||Source: SecurityMag
CISO sits alone at a conference table with papers and laptop, lost in thought near a window overlooking a corporate office…
“AI is introducing responsibilities that security organizations have to account for, but that doesn’t mean every company needs to build a new function from scratch,” says Nick Kakolowski, Senior Research Director at IANS.

CISOs at $10 billion-plus companies: a small slice owns AI governance

New data from the 2026 Security Organizational Design Benchmark Report — produced by IANS Research in collaboration with Artico Search — shows a clear mismatch between AI’s rapid rise and who is held accountable for it inside large firms. The report, which draws on responses from 1,400 CISOs and cybersecurity professionals, found that only 7% of Chief Information Security Officers (CISOs) at organizations with $10 billion or more in revenue possess ownership of AI governance.

That single figure encapsulates a broader pattern: while AI responsibilities are being assigned, they are rarely parked squarely with the security chief at the biggest companies. The report frames this as an unresolved question of where accountability should sit as new AI risks intersect with existing security, privacy and compliance work.

Who has a head of AI security — and how that role is built

The same study finds that about two-thirds (65%) of large organizations have designated a head of AI security role. But those roles are split: only 18% of the $10 billion-plus organizations have established head-of-AI-security as a dedicated position, while 47% have combined it with another leadership role. In smaller organizations the share of dedicated AI leadership drops: 9% in companies with $1 billion–$10 billion in revenue and 6% in companies under $1 billion.

The pattern is telling. Where dedicated leaders exist, organizations have accepted that AI warrants focused oversight. Where responsibilities are combined, firms appear to be trying to fold AI into pre-existing governance, risk and compliance (GRC), SecOps or architecture functions rather than building a separate reporting line.

Why some organizations layer AI onto GRC, SecOps or architecture

For many companies, the practical answer to AI’s security and governance demands has been to redistribute responsibilities across disciplines that already exist. The report notes that AI governance frequently rides on the back of application security, data governance, identity, risk and compliance teams. That approach reflects a recognition — voiced by IANS researchers and search partners — that underlying capabilities often already live inside the security organization.

Still, combining AI oversight with other functions creates trade-offs: scope can blur, accountability may be diffuse, and the person carrying the added responsibility must span technical security, risk and compliance while understanding how the business wants to use AI.

Talent competition and structural trade-offs, in the words of practitioners

Steve Martano, IANS Faculty and Partner in Artico Search’s cyber practice, summarized the talent and organizational pressure plainly: “The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance while still understanding how the business wants to use the technology.” He added that organizations moving fastest on AI are being forced to revamp structure and review the scope of security team members, and must decide whether to develop expertise internally before competing in an “increasingly competitive external market.”

These pressures help explain why some firms create dedicated roles and why many stitch AI duties onto existing leaders: creating a separate function is costly and requires finding or training people with an unusual mix of skills.

What this means for CISOs, heads of AI security, and GRC/SecOps leaders

  • CISOs at $10B+ companies: Face a decision point between owning AI governance directly (the path a small minority have chosen) or delegating it to combined roles; either choice demands clarity about accountability and scope.
  • Heads of AI security (dedicated or combined): Will need to act as integrators — coordinating application security, data governance, identity, risk and compliance — and to demonstrate business-aligned thinking in addition to technical oversight.
  • GRC, SecOps and architecture leaders in smaller firms: Are likely to absorb AI responsibilities and therefore must be prepared to expand their remit and communicate resource needs, training gaps and escalation paths to senior leadership.

A narrow fact that widens the strategic question

The headline — 7% of CISOs at very large firms own AI governance — is a specific, measurable snapshot. Behind it lies a more consequential question posed directly by the study’s authors: when AI responsibilities are spread across existing disciplines, how do organizations ensure the capabilities come together, and who is accountable if they do not? The choices companies make now — create a dedicated leader, combine responsibilities, or leave AI dispersed — will shape how effectively they manage AI risk as the technology continues to scale.

Original story: https://www.securitymagazine.com/articles/102674-only-7-of-cisos-at-large-companies-own-ai-governance

Ai GovernanceArtificial IntelligenceEmerging ThreatsCISOGovernance Risk And ComplianceSecurity Organizational DesignIANS Research
Related Intelligence

Continue Reading

Cluttered workspace with papers, laptops, and books, conveying a sense of being overwhelmed.

Curl Moves to Public Disclosure for Low-Severity Flaws Amid Vulnerability Surge

The curl project is shifting to public disclosure for low-severity flaws due to an overwhelming surge in vulnerability reports that's left maintainers strained and overloaded. To cope, they're opening up their process, starting October 26, to ensure they can focus on their core work.

Analyst 207
Modern office workstation with laptop and development tools, displays blurred.

OpenCode Patched RCE Flaw Silently, Researchers Warn

A critical remote code execution flaw in OpenCode went unnoticed, leaving developers and security teams vulnerable to potential breaches, and experts are now sounding the alarm. The high-severity vulnerability, rated 9.8, could allow attackers to execute arbitrary code on a developer's machine.

Analyst 207
Modern conference room with sleek table, high-backed chairs, and laptop on a table near a large window with natural light.

Large Firms Bolster AI Security with New Leadership Roles

As AI continues to grow, companies are scrambling to find leaders who can balance technical security, risk, and compliance with business goals - and the big players are leading the charge, with 65% of large organizations having already established a head of AI security role. This emerging position is rapidly becoming a key priority, with 18% of major firms creating a dedicated role and 47% combining it with an existing leadership position.

Analyst 207
Technicians in a server room remove equipment, disconnect cables from computer racks.

DHS Disrupts DeepSeek AI Use Across US Federal Agencies

The Department of Homeland Security has issued a directive for federal agencies to immediately halt the use of DeepSeek AI products and remove them from their IT systems. Agencies must act fast, with exceptions only granted if requested within 60 days with a clear justification and risk mitigation plan.

Analyst 207