CISOs lag on AI governance as board oversight trails

IANS and Artico Search have released a report on security organisational design and AI governance, based on responses from more than 1,400 CISOs and cybersecurity professionals.

The study found that only 7% of CISOs at companies with revenue above USD $10 billion hold primary accountability for AI governance, even though nearly two-thirds of those organisations have assigned a Head of AI Security role. The split points to a distinction between operational AI security work and broader corporate oversight of AI use.

Among the largest companies, 65% have assigned a Head of AI Security role, with 18% creating a dedicated post and 47% combining the responsibility with another leadership job. Among companies with revenue between USD $1 billion and USD $10 billion, only 9% have a dedicated position, while the figure falls to 6% at companies below USD $1 billion.

The data suggests large enterprises are formalising AI-related security responsibilities within their security teams while leaving enterprise-wide governance elsewhere. At companies with revenue above USD $10 billion, the Chief AI Officer role is the most common home for primary accountability for enterprise AI governance, at 22%.

By contrast, CISOs are more likely to hold that accountability at smaller organisations. They have primary responsibility for enterprise AI governance at 26% of companies with revenue below USD $1 billion, compared with 11% at companies in the USD $1 billion to USD $10 billion bracket.

Across all three company size tiers, 14% to 19% of respondents said no single executive is accountable for enterprise AI governance. That suggests many organisations still lack a clear reporting line for decisions on AI risk, controls and oversight.

Board oversight

Board structures also appear to lag operational changes. Only 21% of companies with revenue above USD $10 billion have fully implemented a board committee dedicated to AI ethics or responsible AI, while the share drops to 9% at organisations below that revenue level.

Many companies have not moved towards that type of oversight at all. Across revenue groups, 43% to 48% of respondents said no such committee is planned.

Nick Kakolowski, Senior Research Director at IANS, said the issue for security leaders is not simply whether to create new teams. "AI is introducing responsibilities that security organizations have to account for, but that doesn't mean every company needs to build a new function from scratch."

"Many of the underlying disciplines already exist across application security, data governance, identity, risk and compliance. The challenge for CISOs is determining how those capabilities come together around AI, where accountability belongs, and whether the scope of the work has become significant enough to require dedicated leadership," Kakolowski said.

Leadership depth

The research also tracks how security teams change as companies grow. Organisations with revenue above USD $10 billion often employ more than 100 security professionals, compared with more than 10 at companies with revenue between USD $1 billion and USD $10 billion and fewer than 10 at businesses below USD $1 billion.

More than half, or 58%, of the largest organisations now have a Deputy CISO. That includes 47% where it is a full-time role and 11% where the job is combined with leadership of a functional department.

The equivalent figure is 31% at companies with revenue between USD $1 billion and USD $10 billion and 19% at those below USD $1 billion. Yet companies usually conduct a full external search when a CISO leaves rather than automatically promote the deputy.

That suggests the deputy role does not necessarily serve as a clear internal succession route, even at large organisations with broader security leadership benches. Instead, internal candidates often compete with experienced external CISOs for the top post.

Pay trends

According to the report, compensation in security roles is influenced more by years of infosec experience than by company size. Still, the premium at the largest companies remains significant.

At organisations with revenue above USD $10 billion, individual contributors with eight to 15 years of experience earn about USD $35,000 more than peers with fewer than eight years of experience. For the most experienced staff, the gap rises to about USD $50,000.

Full-time Deputy CISOs at the largest enterprises average around USD $350,000 in annual cash compensation, with the top 10% earning more than USD $500,000. Security leaders and staff at companies with revenue between USD $1 billion and USD $10 billion earn about 16% to 26% less than their counterparts at the largest enterprises, while that middle tier pays roughly 15% more than firms below USD $1 billion.

Steve Martano, IANS Faculty and Partner in Artico Search's cyber practice, said employers are looking for people who can connect technical security work with business and compliance demands. "The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance while still understanding how the business wants to use the technology."

"The talent challenge is that the organizations moving fastest on AI are having to revamp the structure and review the scope of security team members. Companies need to think strategically about what they need from the function and whether they can develop that expertise internally before going to an increasingly competitive external market," Martano said.