The CISO’s role now covers business resilience, enterprise risk and AI governance, yet authority and resources have struggled to keep pace.
Proofpoint’s 2026 survey found that 78% of CISOs expect to manage AI risks without additional resources, while 77% report excessive expectations. This leaves security leaders accountable for risks they may have limited power to address.
Recent incidents show the business consequences. Boston Scientific’s August 2026 cyber incident disrupted manufacturing and shipping, threatening financial guidance, while Jaguar Land Rover reported £64 million in cyber-related costs following its 2025 attack.
With AI adoption adding new oversight demands, the gap between cybersecurity responsibility and executive authority is becoming a pressing governance concern.
Why It Matters: CISOs are responsible for managing risks that often require funding or operational decisions outside their authority. This can delay remediation and leave known vulnerabilities unresolved, exposing gaps in how organizations assign accountability and manage cybersecurity risk.
- Cyber Resilience Has Become a Business Performance Issue: Cyber incidents at Boston Scientific and Jaguar Land Rover disrupted operations and affected financial results. These incidents show how recovery priorities depend on critical business systems and acceptable downtime, making coordination between cybersecurity and operational leadership an important part of incident planning.
- CISO Accountability Often Exceeds Decision-Making Authority: Security leaders may identify vulnerabilities that require funding or operational changes controlled by other executives. This division of responsibility can complicate remediation and risk acceptance. Defined decision rights and documented approval processes can clarify ownership of unresolved exposures.
- AI Deployment Is Challenging Existing Governance Processes: Splunk found that 96% of CISOs oversee enterprise AI governance and risk, while Gravitee reported that only 14% of respondents said all their AI agents received full security and IT approval before production. The findings show how AI deployment can occur outside established security oversight, even when CISOs remain accountable for managing the associated risks.
- Automation Is Changing Cybersecurity Workforce Development: Routine investigations and control testing have traditionally helped junior analysts develop expertise. Automating these responsibilities may reduce opportunities to gain experience, potentially affecting the future supply of senior cybersecurity professionals. Supervised investigations and reviews of automated findings can help maintain opportunities for developing technical judgment.
- Incident Readiness Extends to Executive Decision-Making: Major cyber incidents can require decisions about operational shutdowns and customer commitments before complete information is available. Cross-functional exercises can help organizations evaluate decision-making authority, coordination between departments and response continuity when key leaders are unavailable.
Go Deeper -> Does Your CISO Have the Authority the Job Now Requires? – Security Magazine
