CISO AI risk management is emerging as the defining test of the AI era, pushing security leaders beyond blocking attacks and into the middle of enterprise decisions about how much risk a business is willing to accept. That tension is playing out this week as thousands of practitioners converge on Las Vegas for Black Hat USA, where autonomous attacks and the urgent need to adopt defensive AI have pushed cybersecurity into a new phase.
The pressure is landing on the CISO, who is increasingly expected to act as connective tissue across legal, compliance, engineering and the business itself, according to Krista Case, principal analyst and practice lead for cyber resilience and security at theCUBE Research.
"I've also been thinking about this AI governance through the lens of the different roles that the CISO has to collaborate with within the enterprise - things like legal, compliance, engineering, IT," Case said. "They almost have to be sort of the connective tissue helping to facilitate these conversations. So they're really becoming a business enabler."
CISO role expands beyond security
Case was joined by Jon Oltsik, analyst in residence at theCUBE Research, for a keynote analysis of Black Hat USA. They discussed how the CISO role is evolving as AI moves from experimentation into production, alongside invite-only summits where senior cybersecurity executives participate in candid, confidential conversation that will help shape the next generation of cybersecurity strategy.
The shift means security leaders must understand how AI is deployed across the organization and where it creates exposure. That requires working with engineering teams on model governance, with legal on regulatory obligations, and with the business on which AI initiatives are worth the risk. For management professionals who work alongside security leadership, understanding how these decisions get made is increasingly part of the job. Executive education in AI for Executives & Strategy can help close that gap.
AI risk management splits leaders from laggards
That evolution remains far from universal. Only a narrow slice of security leaders have translated AI hype into a coherent strategy, according to Oltsik.
"About 20% of CISOs get it," he said. "They understand the implications, they understand what their organization's trying to do with AI. They're looking at security architecturally. The other 80% are in a state of ignorance, sometimes ignorance is bliss, or at least assumed bliss."
That gap is compounded by a disconnect between the tools flooding the show floor and the practitioners meant to evaluate them, Oltsik said. CISOs must build threat models tied to specific business initiatives, then hand executives a clear menu of choices - accept, mitigate or transfer the risk - rather than stand in the way of adoption.
"You can't get in the way, and no one should try to get in the way - you'll get run over," Oltsik said. "You'll lose your job if you try to get in the way."
Why this matters for management professionals
The CISO's move from gatekeeper to business enabler changes what executives need to know. When security leaders present a menu of risk choices - accept, mitigate, transfer - management must be equipped to evaluate those options against business goals instead of deferring entirely to the security team.
That's a leadership skill, not a technical one. Executives who understand how AI risk is framed at the leadership level can ask sharper questions and move faster. Practical training in AI for Management can help managers build that fluency.
Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE's event coverage do not have editorial control over content on theCUBE or SiliconANGLE.
Your membership also unlocks:
