AI makes those questions harder. As companies automate security work, someone has to decide where human review belongs and who is accountable for the result.

That is the modern CISO mandate: business resilience, enterprise risk, AI governance, workforce readiness and board communication. Meeting it takes authority, capacity and continuity. Most organizations have given their CISO the mandate and not the authority. In Proofpoint’s 2026 survey of 1,600 CISOs, 78 percent expect to manage AI risk without a matching increase in resources, and 77 percent say the expectations placed on them are excessive.

Recent Incidents Show What Is at Stake

In a September 8, 2026 SEC filing, Boston Scientific reported that an August cybersecurity incident disrupted manufacturing, order processing and shipping, and said it was unlikely to meet previously issued sales and earnings guidance.

Jaguar Land Rover had already been through it. After its 2025 incident, production took until mid-November to recover, and the company disclosed 64 million pounds in cyber-related costs for the quarter ending December 2025.

In neither case did the problem end when the systems came back. Production, customer commitments and financial guidance all became part of the response. You can no longer judge cybersecurity leadership by prevention alone. The test is whether the organization can make fast, coordinated business decisions while the technology is down.

Authority Has Not Kept Up With the Job

In Splunk’s 2026 survey of 650 CISOs, 96 percent said they oversee enterprise AI governance and risk. Much of what they are accountable for never comes through security at all. In Gravitee’s 2026 State of AI Agent Security survey, only 14 percent of respondents said all of their AI agents went live with full security and IT approval. Builders are putting agents into production without going through security. This is the tension between innovation and governance, and the CISO sits in the middle of it.

Automation adds a second problem. Verifying what the machine concluded takes more seniority than producing the finding ever did, and fixing an exposure may depend on engineering capacity, production schedules, vendor decisions or business funding. A CISO who can’t influence those decisions can’t manage the risk. They can only describe it.

5 Ways the CISO Role Needs to Evolve

1. From technical protection to business resilience. Start with what generates revenue, fulfills customer obligations and keeps operations running, and build recovery priorities from those dependencies. For a software company that means customer access and service integrity. For a manufacturer it means production, order processing and distribution. The CISO should help business leaders define how much disruption is tolerable.

2. From control owner to enterprise risk advisor. A finding is only useful when leaders understand what it means for the business and what their choices are. The CISO explains the exposure, the options and the cost of waiting. Postponing remediation can be a legitimate decision. It needs a named owner, a written rationale, interim safeguards and a date to revisit it.

3. From incident responder to readiness leader. Readiness is built before the incident. Run exercises that include operations, finance, legal, communications and the executive team, and test the decisions as well as the procedures. Who can authorize shutting down a revenue-producing system? Which customer commitments come first? Who speaks when the facts are incomplete? Then run it again with the CISO unavailable. The plan has to work when people are missing.

4. From security function leader to AI governance and workforce design partner. AI did not invent a new control set. It exposed the companies that never finished implementing the old one. Tim Mather, a CISO I have worked with for years, says it this way: “Neither the controls nor their names have changed. What has changed is how to automate those controls for continuous monitoring, and who is writing and validating the correlations that automation depends on. The tools do not solve that. Experienced people do.”

The workforce side is just as real. Tier 1 and manual control-testing work were the apprenticeships that produced senior analysts. If you automate the entry rung without replacing that learning path, you are trading a cost reduction today for a talent shortage a few years from now. CISOs and CHROs should decide together how people gain experience (supervised investigations, review of automated findings, a seat at real risk decisions) and fund it.

5. From metrics reporter to translator of judgment. Directors need to know what the results mean for business priorities and remaining risk. Where a report leans on AI-generated analysis, the board should hear how the conclusions were validated.

Leadership Readiness Is Business Resilience

Cyber resilience depends on leadership design as much as technology. CEOs and boards should confirm three things: the CISO has the authority and executive access to coordinate decisions across the business; material risks and AI-generated recommendations get experienced human review; and coverage plans hold up when a key leader is out or in transition.

I have watched a lot of companies learn this the expensive way. Don’t wait for an incident to find out who has the authority to decide.