"The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance while still understanding how the business wants to use the technology," said Steve Martano, IANS Faculty and partner at Artico Search’s cyber practice.
Adoption: head of AI security roles in $10bn+ firms
New research from IANS and Artico Search, published on October 20, finds that a head of AI security role has been established in 65% of large organizations with annual revenue above $10 billion. Within that cohort, 18% of $10bn+ firms have made the head of AI security a dedicated position and another 47% have combined it with an existing leadership role — a pattern the researchers describe as making the position "one of the fastest emerging functional roles."
Accountability for enterprise AI governance
Despite the rapid spread of head of AI security titles at the largest companies, overall lines of accountability for enterprise AI governance remain unsettled. The IANS report shows that chief information security officers (CISOs) carry primary accountability in just 7% of large organizations, while chief AI officers are the most frequently accountable role in that tier at 22%.
Accountability patterns differ by size: CISOs hold primary accountability in 11% of medium firms and 26% of small businesses. Across all three revenue tiers, between 14% and 19% of organizations reported that no single executive is accountable for enterprise AI governance.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildBoard-level oversight: committees for AI ethics and responsible AI
Board structures have not yet caught up with the technology’s spread. The report found that between 43% and 48% of organizations across all three size tiers stated they have no board committee dedicated to AI ethics or responsible AI planned. That absence suggests a gap between title proliferation at the management level and formal governance structures at the board level.
Compensation: experience as the largest pay driver
The IANS–Artico Search analysis identifies experience level as the single biggest driver of compensation differences in the same security role — more significant than company size or geography. In $10bn+ businesses, security professionals with eight to 15 years’ experience earn about $35,000 more than those with fewer than eight years; the gap widens to around $50,000 between early-career staff and professionals with more than 16 years’ experience.
The report gives concrete mid- to senior-level benchmarks for large firms: average pay for Deputy CISOs was $350,000 per annum, while business information security officers (BISOs) earned an average of $342,000. The report notes that data around average compensation levels for CISOs was not included.
What this means for technologists, boardrooms, and recruiters
- Technologists and security teams: demand is rising for leaders who can "bridge technical security, risk and compliance" while aligning to business use — a skillset the report flags as creating a market premium.
- Boardrooms and governance committees: nearly half of organizations report having no committee planned for AI ethics or responsible AI, indicating boards will need to decide whether to formalize oversight as operational roles proliferate.
- Recruiters and talent leaders: the report warns of "an increasingly competitive external market" and urges organizations to "think about what they need from the function and whether they can develop that expertise internally before going" outside — a direct call to consider build-versus-buy for scarce experience.
Researchers and practitioners are now tracking a paradox: rapid title adoption at the enterprise level — especially in the largest companies — coexisting with unclear accountability and limited board-level structures. The IANS–Artico Search findings put the onus on organizations to pair role creation and compensation with a coherent governance model; as Steve Martano put it, companies must restructure security teams so their governance strategies keep pace with rapid AI adoption.
