{"id":9358,"date":"2026-09-09T08:25:00","date_gmt":"2026-09-09T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9358"},"modified":"2026-09-09T08:25:00","modified_gmt":"2026-09-09T08:25:00","slug":"50-of-cisos-see-mythos-as-a-sign-to-exit-the-profession","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9358","title":{"rendered":"50% of CISOs see Mythos as a sign to exit the profession"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

CISOs already have it tough, but the straw that breaks the back of many IT security executives may be the rapidly advancing capabilities of frontier AI models, enterprise insistence on rapid and widespread AI experimentation, and the compounding risk responsibilities and personal liabilities surrounding all that.<\/p>\n

\u201cThere are days where it feels exhausting,\u201d says one CISO at a large enterprise in the software industry, who did not want to be quoted by name. \u201cThere are days when it feels like this is a lot.\u201d<\/p>\n

This executive is not alone.<\/p>\n

In a recent survey of 1,001 CISOs in the US and UK<\/a>, 50% agreed that the introduction of Anthropic Mythos<\/a> and similar cyber-capable models<\/a> and tools has caused them to consider leaving the profession. Only 25% disagreed with that statement.<\/p>\n

And 60% said pressure from the board and executive leadership to adopt AI was outpacing their organization\u2019s ability to govern and secure its use.<\/p>\n

Christine Gadsby, chief security advisor at BlackBerry, who spent years in cyber leadership positions and was the company\u2019s CISO until switching to her new role last September, doesn\u2019t miss being the CISO.<\/p>\n

\u201cIt\u2019s madness! Madness!\u201d she says. \u201cI wouldn\u2019t say that I would never do a CISO role again, but it\u2019s a tough time right now to be a CISO.\u201d<\/p>\n

CISOs have historically had shorter tenures than other executive positions, she notes. \u201cBefore, it was burnout. They had so much responsibility and so many things to do. And now, with AI, some of these challenges are just mindboggling,\u201d she says.<\/p>\n

The personal responsibility aspect of the job<\/a> is also tough, she adds. \u201cOne thousand percent. As an industry, we built the CISO role to take all of that liability and now we act surprised when people want out.\u201d<\/p>\n

According to a survey released earlier this year, 78% of CISOs are concerned<\/a> about their own liability for security incidents \u2014 up from 56% a year ago. And 89% of CISOs say the breakneck pace of technology advancement is a challenge.<\/p>\n

\u201cAs fast as AI evolves, the benefit is with the attacker right now,\u201d says Gadsby. \u201cAttackers are weaponizing vulnerabilities as fast as they can find them, sometimes even sooner than the fix is published.\u201d<\/p>\n

A compounding problem<\/h2>\n

As a result of these and other factors, experienced CISOs are retiring, moving to less stressful security-related positions, switching to consulting or sales support jobs, or leaving the profession entirely<\/a>. That leaves companies having to hire less-experienced people, who are even more vulnerable to burnout.<\/p>\n

\u201cIf you feel not ready for the role, or don\u2019t feel empowered \u2014 especially right now \u2014 that\u2019s when you\u2019re like, \u2018I\u2019m out. I\u2019m going to go do something else,\u2019\u201c Gadsby says.<\/p>\n

Plus, because every enterprise IT environment is different, it takes time for a new CISO to get up to speed, creating more security risks given today\u2019s pace of change and attack \u2014 and thus putting even more stress on the CISO.<\/p>\n

\u201cYou have to be a special person to want to do that job,\u201d Gadsby says, likening the role to being a firefighter.<\/p>\n

\u201cEvery once in a while, I\u2019ll read something in the news and think, \u2018Oh my gosh, all my friends are not sleeping tonight.\u2019 I\u2019m glad I\u2019m not up at 2 a.m. trying to solve this. But sometimes I do miss being helpful, being a firefighter,\u201d she says. \u201cThe heart of the role is wanting to protect people.\u201d<\/p>\n

Addressing liability concerns<\/h2>\n

So is there a path forward for the profession?<\/p>\n

\u201cThere\u2019s not an easy way out for the CISO,\u201d says IDC analyst Chris Kissel. The average CISO tenure is now 18 months, he notes, and issues like personal liability for cybersecurity incidents and the new AI models aren\u2019t helping. \u201cThe new world for CISOs is very scary.\u201d<\/p>\n

It will take acts of leadership to improve the situation, he says, such as a governing body that mandates minimal requirements for responsible behavior.<\/p>\n

\u201cAnd if you take these steps, that takes the CISO out of the legal indemnity,\u201d he says. \u201cThere has to be a way to put the CISO in the clear.\u201d<\/p>\n

Oliver Legg, co-founder and cybersecurity recruiter at Aspiron Search, an executive search company focusing on cybersecurity, says he\u2019s seeing the liability concerns when talking to prospective CISOs.<\/p>\n

\u201cTwo years ago, we had CISO candidates ask about budget and headcount,\u201d he says. \u201cNow, the first questions are about indemnification and D&O coverage.\u201d<\/p>\n

D&O \u2014 or directors and officers<\/a> \u2014 is liability insurance that protects business leaders from personal financial loss.<\/p>\n

Countering AI anxiety<\/h2>\n

And dealing with the growing AI threats?<\/p>\n

That can be managed as well. AI itself can be used to improve security operations<\/a>, as long as it\u2019s handled responsibly.<\/p>\n

\u201cMythos doesn\u2019t really change what we need to do,\u201d says Omar Khawaja, who teaches at Carnegie Mellon University\u2019s CISO and CAIO programs and serves as the global field CISO at Databricks. \u201cIt changes how well, and how fast, and how much of it we need to do. And we need to change the approach and frameworks that we use so we can achieve a scale that\u2019s 2X, 3X, 10X bigger than in the past.\u201d<\/p>\n

That means that security programs will have to become much more agentically driven, he says, with the proper precautions in place.<\/p>\n

And fears of a company\u2019s own AI going rogue<\/a> are a bit overblown, he adds.<\/p>\n

\u201cAlmost every single one of those cases is where they\u2019ve been experimenting with models that have not been released and the companies say that they\u2019re not going to be released,\u201d he says. \u201cSo if you move to an agentic environment in production, don\u2019t use experimental AI. If you use one of the well-known AIs, it\u2019s very doable to manage those securely.\u201d<\/p>\n

And organizations that are new to AI and don\u2019t have all the experience and the guardrails yet should start with less risky use cases, learn to mitigate those risks, and then build from that.<\/p>\n

\u201cIn the security space, I would use the AI for anomalies and to triage existing investigations,\u201d he says. \u201cI probably wouldn\u2019t start out with using AI to automate my response. But if I work my way up, I can get there.\u201d<\/p>\n

A new opportunity<\/h2>\n

The Mythos effect is overstated, confirms Mike Privette, former CISO and founder and cybersecurity economist at Return on Security. These frontier models have just turned a public spotlight on problems that were already there.<\/p>\n

\u201cOn the flip side, while frontier models are changing the speed and complexity of the threat landscape, many CISOs are more excited than ever to be in the seat,\u201d he says. \u201cFor many people, this is one of the most exciting times to be operating in the field.\u201d<\/p>\n

That\u2019s especially the case when the CISO is working at a company that\u2019s embracing AI, and where they\u2019re given executive support, the right budget, and the leeway to experiment, he says.<\/p>\n

\u201cI\u2019ve had the opportunity to be in other roles in the middle of my CISO tenure,\u201d says the executive at the large software company who did not want to be quoted by name. \u201cAnd those other roles are so much easier. You can be at 90% and still get a pat on the back. But when you\u2019re a CISO, and you\u2019re at 99%, and there\u2019s one server that allowed the bad guys to break in, nobody cares that you patched the other 99. Less than perfect is never good enough.\u201d<\/p>\n

Still, there are days when it feels exhilarating, the executive adds. \u201cThough it\u2019s a very fine line between the two.\u201d<\/p>\n

And keeping a company and its customers secure is an awesome challenge.<\/p>\n

\u201cOur platform is used by thousands of enterprises,\u201d the executive says. \u201cI keep reminding myself and my team that that\u2019s the focus. We\u2019re not doing it just for us. The more I can think about what an awesome challenge this is, the more the mission and objective feel very awesome.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

CISOs already have it tough, but the straw that breaks the back of many IT security executives may be the rapidly advancing capabilities of frontier AI models, enterprise insistence on rapid and widespread AI experimentation, and the compounding risk responsibilities and personal liabilities surrounding all that. \u201cThere are days where it feels exhausting,\u201d says one […]<\/p>\n","protected":false},"author":0,"featured_media":9359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9358","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9358"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9358"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9358\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9359"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}