“AI is introducing responsibilities that security organizations have to account for, but that doesn’t mean every company needs to build a new function from scratch,” says Nick Kakolowski, Senior Research Director at IANS. “Many of the underlying disciplines already exist across application security, data governance, identity, risk and compliance. The challenge for CISOs is determining how those capabilities come together around AI, where accountability belongs and whether the scope of the work has become significant enough to require dedicated leadership.”

Approximately two-thirds (65%) of large organizations have designated a head of AI security role. 18% have established it as a dedicated position, and 47% have combined it with an additional leadership role. 

Dedicated AI leadership roles are less common in smaller organizations, with $1B–$10B organizations reporting 9%, and under-$1B organizations reporting 6%. At these organizations, AI responsibility is often layered with pre-existing GRC, SecOps or architecture leadership.

“The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance while still understanding how the business wants to use the technology,” adds Steve Martano, IANS Faculty and Partner in Artico Search’s cyber practice. “The talent challenge is that the organizations moving fastest on AI are having to revamp the structure and review the scope of security team members. Companies need to strategically think about what they need from the function and whether they can develop that expertise internally before going to an increasingly competitive external market.”