{"id":9310,"date":"2026-09-07T08:25:00","date_gmt":"2026-09-07T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9310"},"modified":"2026-09-07T08:25:00","modified_gmt":"2026-09-07T08:25:00","slug":"what-do-cisos-need-to-rest-easy-about-future-ai-risks","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9310","title":{"rendered":"What do CISOs need to rest easy about future AI risks?"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Security leaders\u2019 confidence in their ability to navigate the security risks AI will pose over the next two years rests on several clear factors, according to IANS analysis of its AI Security Survey, fielded earlier this year.<\/p>\n

Of the 113 CISOs IANS surveyed in April and May, 41% expressed optimism about their organization\u2019s ability to manage AI security risks over the next 24 months, versus 38% who were pessimistic.<\/p>\n

Delving deeper, IANS identified six strong organizational signals that differentiate CISOs who feel confident about their ability to address rapidly evolving AI risks and those CISOs who dread what\u2019s to come. And they have less to do with current controls and capacities and more to do with the CISO\u2019s standing and sway within the organization.<\/p>\n

\u201cThe findings reveal a distinction between present-day risk perceptions and optimism about the manageability of AI risk in the future. Perceptions of present-day risk are associated most strongly with AI security maturity \u2014 an organization\u2019s operational capacity and security controls to manage its AI environment,\u201d the report said. \u201cOptimism about the future is associated more strongly with organizational readiness factors.\u201d<\/p>\n

Those factors include:<\/p>\n

Leadership\u2019s understanding of AI risk<\/p>\n

Clearly defined AI governance ownership<\/p>\n

The security team\u2019s effectiveness with AI tools<\/p>\n

CISO ownership over the AI-security budget<\/p>\n

Sustainable security team workloads<\/p>\n

Sufficient security staffing<\/p>\n

Above any present-day measure of AI security maturity or budgetary increases, CISO optimism about the hard road ahead appears to rest largely on whether organizational leadership listens to, empowers, and adequately resources them \u2014 at least according to IANS\u2019 poll.<\/p>\n

A question of confidence<\/h2>\n

Cybersecurity consultants and analysts largely agree those elements will play a critical role in a company\u2019s AI cybersecurity effectiveness going forward, but with nuance and caveats.<\/p>\n

Pearl Almeida<\/a>, a research director at Info-Tech Research Group, underscores misalignment and leadership misunderstanding of AI risks as key factors that undercut a CISOs\u2019 ability to mitigate those risks.\u00a0<\/p>\n

\u201cThe risk-averse CISOs who resisted agent adoption have mostly been overruled by the business, and they [business executives] are moving forward whether or not they feel ready,\u201d Almeida says. \u201cOnly a handful of organizations I work with have strong controls in place. The rest are starting with fundamentals because deferring is no longer an option.\u201d<\/p>\n

Moreover, many CISOs are contending with what Almeida described as \u201corganizational blind spots.\u201d<\/p>\n

\u201cIn my conversations with CISOs, I have found that most leaders, security ones included, cannot explain how an agent works. They know that they need to use it, but don\u2019t understand the mechanics: where the agent gets its information, how it calls on tools, how it makes decisions, how human-in-the-loop actually works,\u201d Almeida says. \u201cWhen you can\u2019t describe the mechanism, you can\u2019t right-size the exposure.\u201d<\/p>\n

As for AI governance, Almeida cautions that clear ownership isn\u2019t enough on its own; the real issue is security culture.<\/p>\n

\u201cAssigning a named business owner only works if security is already embedded in how the business operates rather than bolted on at approval,\u201d she explains. \u201cOwners who won\u2019t take accountability should understand the trade plainly: They are handing security the authority to shut their workflow down during an incident without consulting them.\u201d<\/p>\n

Rock Lambros<\/a>, director of AI standards and governance at agentic security vendor Zenity, cautions that optimism can be misleading.<\/p>\n

\u201cEvery number in the report is one person\u2019s self-assessment measured against that same person\u2019s self-assessment,\u201d Lambros notes. \u201cA CISO who just told you their program is \u2018efficient\u2019 on a five-point scale isn\u2019t going to turn around two questions later and rate their risk a nine. People stay consistent with themselves.\u201d<\/p>\n

As for the factors identified, Lambros noted two clear groupings.<\/p>\n

\u201cLeadership understanding, clear governance ownership, and CISO budget control all rise and fall together because they\u2019re all downstream of a single decision somebody made in the C-suite or the boardroom,\u201d Lambros says, adding that workload and staffing are closely aligned, \u201cmeasuring whether the team has room to breathe.\u201d<\/p>\n

The practicalities of preparedness<\/h2>\n

Sanchit Vir Gogia<\/a>, chief analyst at Greyhound Research, notes that, while the factors IANS identified may be indicators of organizational readiness, \u201creadiness is not the same measure as security.\u201d<\/p>\n

\u201cThey show whether the CISO has leadership understanding, budget control, and capacity to act, not whether the AI estate is under control,\u201d Gogia says.<\/p>\n

Aman Mahapatra<\/a>, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, echoes Gogia\u2019s concerns.<\/p>\n

\u201cA CISO with an informed board, clean governance ownership, budget control, and a fully staffed team will feel optimistic whether or not a single agent in production has bounded authorization,\u201d Mahapatra says. \u201cThat is a useful map of how CISOs currently think. It is not a security roadmap, and the risk is that it gets read as one.\u201d<\/p>\n

How a security team uses AI internally, however, provides practical indication of preparedness, Mahapatra suggests, because it \u201cbuilds durable capability rather than favorable conditions.\u201d<\/p>\n

And it\u2019s something CISOs should emphasize, as it \u201chas to be earned over quarters, which is exactly why it compounds,\u201d he says. \u201cTeams running AI in their own triage and detection tuning learn experientially where prompt injection bites and how agents fail under adversarial input, and that knowledge transfers directly to securing AI everywhere else.\u201d<\/p>\n

Cybersecurity consultant Brian Levine<\/a>, executive director of FormerGov, advises CISOs to ensure that AI governance ownership includes a focus on third-party risk.\u00a0<\/p>\n

\u201cGovernance is useless if you don\u2019t actually know which models are being pulled into your environment and the risks associated with those models,\u201d Levine says. \u201cFor a CISO, the risk isn\u2019t just the AI you build. It\u2019s the AI you inherit via vendors and unauthorized use.\u201d<\/p>\n

Justin Greis<\/a>, CEO of consulting firm Acceligence, says future AI risk preparedness hinges on gaining as much intelligence about AI system data and app interactions as possible.<\/p>\n

\u201cThe CISO needs to know what identity that agent is operating under, what systems it can reach, what information it can retrieve, what transactions it can initiate, what other agents or tools it can invoke, whether every material action is observable and whether the organization can immediately terminate its authority,\u201d Greis says. \u201cThat starts looking much closer to managing a digital workforce than securing another software application.\u201d<\/p>\n

Greis also was skeptical \u2014 along with various analysts and consultants \u2014 about whether a 41% optimism rate truly reflects what most enterprise CISOs are experiencing.<\/p>\n

\u201cAlmost half of the CISOs are optimistic about the AI security future? Who the heck are these people?\u201d Greis asks. \u201cThe enterprise CISOs I talk with are white-knuckling their way through the fastest-moving security challenge of their careers.\u201d<\/p>\n

And that begs the question of timing: Asked in April and May about their level of confidence, would those CISOs answer the same way given what they\u2019ve seen since?<\/p>\n

It\u2019s possible that the further advancement of Mythos-class models and high-profile rogue acts by agents may be shaking that optimism. But it\u2019s also true that AI amplifies foundational security shortcomings, with organizational dysfunction chief among them.\u00a0<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Security leaders\u2019 confidence in their ability to navigate the security risks AI will pose over the next two years rests on several clear factors, according to IANS analysis of its AI Security Survey, fielded earlier this year. Of the 113 CISOs IANS surveyed in April and May, 41% expressed optimism about their organization\u2019s ability to […]<\/p>\n","protected":false},"author":0,"featured_media":9311,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9310","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9310"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9310"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9310\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9311"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}