The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most CISOs, keeping up with AI means expanding beyond traditional security leadership. The job increasingly includes governing AI use, managing risks in AI-enabled products and workflows, helping engineering teams build securely, and coordinating decisions across the business. The strongest response is a practical blend of AI literacy, security judgment, clear accountability, executive communication, and workforce development—not an expectation that the CISO personally owns every AI decision.
How AI is expanding the CISO’s remit
AI changes the CISO role in two related but distinct ways: security teams use AI to support their work, and organizations must secure and govern AI-enabled systems. The first can affect security operations, such as event review and data correlation. The second covers the products, internal workflows, vendors, and agents that use AI, including how they access information and take action.
In Cisco’s February 24, 2026 summary of Splunk’s annual CISO Report, 650 CISOs surveyed by Oxford Economics said their responsibilities increasingly included AI governance and risk management; more than four out of five also reported responsibility for secure software development. The survey was conducted in July and August 2025 among CISOs in nine countries and across nine industry groups. These findings describe those respondents, not every organization. Cisco’s summary and methodology provide the survey context.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Respondents also reported operational benefits: 92% said AI enabled their teams to review more security events, and 89% reported improved data correlation. These are reported perceptions, not controlled measurements of productivity. At the same time, 86% feared agentic AI would increase the sophistication of social engineering attacks. The implication for a CISO is not simply to adopt AI or block it, but to weigh operational value against the risks created by new capabilities and access.
#1 Best Overall
What the CISO should own—and what must be shared
AI governance is an enterprise coordination problem. Business leaders set objectives and decide what level of risk is acceptable for a use case. Product and technology teams design, build, and operate the system. Legal, privacy, compliance, procurement, finance, and security may each have responsibilities depending on the data, vendor, and business process involved.
Deloitte’s 2026 analysis recommends identifying a business owner, technical owner, and risk oversight owner for each significant AI use case. That is a useful accountability pattern, not a universal organization chart. A CISO can help establish decision rights, minimum controls, monitoring, and escalation routes without becoming the owner of every business outcome. Deloitte also reports that 49% of organizations in its survey had a CISO role in 2026, up from 31% in 2023; that finding comes from a separate survey and should not be combined with the Splunk/Oxford Economics results. Deloitte’s analysis of the changing role discusses this shared-responsibility approach.
Capabilities to strengthen for AI governance
AI and model literacy
A CISO does not need to become a machine-learning researcher, but should be able to ask how a system uses data, what permissions it receives, which tools or services it can reach, and where a person reviews its output or action. Those questions reveal whether a use case needs tighter access, human approval, additional monitoring, or a clear stop condition.
Risk governance and accountability
Build a usable inventory of AI use cases, including internal workflows and systems supplied by vendors. For each significant use case, identify accountable owners, the data and systems involved, required approvals, and conditions under which use should be paused or escalated. Ensure that relevant decisions and actions can be audited. A policy without named owners and operational follow-through will not give executives a reliable view of exposure.
Rank #3
Identity and access for people and agents
Apply identity and access thinking to both human users and AI agents. Ask whose authority an agent acts under, which information and tools it can access, whether that access is appropriate at that moment, and how it is revoked. An agent’s ability to take action can turn excessive permissions into a business risk, so scope access to the task and make the responsible identity traceable.
Secure-by-design partnership with engineering
Work with product and engineering leaders early enough to shape design choices rather than relying only on a late security review. Discuss data flows, dependencies, permissions, testing, deployment approvals, monitoring, and incident response as part of the development process. Cisco’s survey found that more than four out of five respondents oversaw secure software development, underscoring how closely AI governance and product security can intersect.
Executive communication tied to business outcomes
Translate technical controls into business consequences: what could be exposed, disrupted, or misused; how likely the organization is to detect it; and what response or recovery capability is available. A CISO should help leaders compare the value of a use case with its security, privacy, and operational risks, then make the remaining risk visible to the people authorized to accept it.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Workforce development and task redesign
Assess which security tasks AI can automate, which it can augment, and which still require human judgment. Build training around the skills employees need for their actual responsibilities, and adjust roles as workflows change. SANS Institute and GIAC Certifications’ 2026 workforce report, based on 947 global respondents, says 60% of organizations named the skills gap as their leading workforce challenge, compared with 40% citing headcount shortages. It also reports that 74% said AI was changing cybersecurity team size or role structures, while 16% cited workforce reduction. Those results indicate varied effects, not inevitable job losses. The report says 27% of organizations experienced a breach as a direct impact of workforce skills gaps; it does not establish that any particular training program prevents breaches. The SANS/GIAC report page provides its findings and sample context.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Controls to consider when agents can take action
For AI agents connected to tools or data, Deloitte’s analysis suggests monitoring for signs that behavior is straying from expected boundaries. These are suggested controls, not a binding standard; choose them according to the agent’s permissions and the consequences of its actions.
- Watch for anomalous tool use, unusual data access, privilege escalation, or unexpected interactions.
- Detect behavior that deviates from the agent’s intended goal or changes unexpectedly.
- Keep logs that allow relevant activity and decisions to be reviewed.
- Set thresholds for human intervention, pausing, or other rapid response when activity crosses an unacceptable boundary.
Define in advance who can intervene and how to stop the agent’s access or actions. Monitoring is most useful when an alert has an owner and a response path.
How to assess whether your organization is keeping up
Use a current AI use case—not an abstract policy debate—to test whether responsibilities and controls are clear. The following questions expose gaps without assuming every organization needs the same operating model.
- Accountability: Are the business, technical, and risk oversight owners identifiable for significant use cases?
- Approval and intervention: Is it clear which actions require human approval and what conditions trigger a pause or escalation?
- Coverage across the lifecycle: Do controls address prevention as well as detection, containment, and recovery?
- Skills strategy: Are you deciding deliberately between hiring, upskilling, and redesigning roles based on the tasks that need to be done?
- Risk and value: Are reported productivity gains weighed against threats, privacy concerns, and workforce effects for the organization’s actual use cases?
These are trade-offs to resolve in context, not choices with one universal winner. For example, more automated action may improve speed but demand stronger limits, monitoring, and intervention paths. Similarly, hiring can add expertise, while upskilling and role redesign may address needs in an existing team. Set the balance according to business objectives, risk tolerance, and the system’s actual permissions.
A practical development plan for a CISO
- Map the use cases. Ask business and technology leaders which AI systems and agents are in use or planned, what data and tools they touch, and which processes depend on them.
- Name decision owners. For each significant use case, identify who owns the business outcome, technical operation, and risk oversight. Confirm who can approve use and who can pause it.
- Test access and oversight. Review the permissions granted to people and agents, the actions that require human review, the logs available for investigation, and the response path for anomalous behavior.
- Connect controls to outcomes. Explain the exposure, safeguards, detection capability, and recovery plan in terms that help executives make and document risk decisions.
- Develop the workforce deliberately. Identify tasks that can be automated or augmented, the human judgment that remains essential, and the skills employees need as responsibilities shift.
Oxford Economics published The CISO Report 2026 on July 16, 2026. The Cisco release describes its survey as covering 650 CISOs in July and August 2025; keep that survey’s reported results distinct from Deloitte’s and SANS/GIAC’s separate findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
