Does Your CISO Have the Authority the Job Now Requires?
Security Magazine, Tuesday, October 13th, 2026
Most organizations give CISOs a business-resilience and AI-governance mandate without the authority to carry it out.
The author argues that the modern CISO mandate spans business resilience, enterprise risk, AI governance, workforce readiness and board communication, but most organizations have not granted matching authority.
Proofpoint's survey of 1,600 CISOs found 78% expect to manage AI risk without more resources, and Gravitee found only 14% of AI agents went live with full security approval.
Incidents at Boston Scientific and Jaguar Land Rover show that cyber events now hit production and earnings guidance.
The piece proposes four shifts, including moving from control owner to risk advisor and running readiness exercises that test decisions, even with the CISO unavailable.