CISO role evolution is accelerating as cyber resilience emerges as a defining benchmark of security success and AI forces enterprises to rethink not just how they defend against attacks, but how quickly they can recover from them. The stakes are steep: New research presented at this year’s show found the average cost of one hour of endpoint downtime across 1,000 CISOs surveyed was $19 million, underscoring why recovery, not just prevention, has become a board-level concern.

Wrapping up two days of coverage from the show floor, the shift toward resilience benchmarks was one of four defining themes to emerge from dozens of conversations across the security stack, according to Krista Case (pictured), principal analyst and practice lead for cyber resilience and security at theCUBE Research, the analyst-led division of SiliconANGLE Media Inc.

“It is more likely than not, it is practically speaking inevitable, unfortunately, that any even mature security organization might experience some disruption at some point in time,” Case said. “The conversation is becoming, do we understand what our minimal viable operations look like? And do we have confidence that we’re able to recover them quickly and confidently to that trusted state?”

Case delivered the wrap-up analysis as part of theCUBE’s coverage of Black Hat USA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. She discussed the shifting responsibilities of security leaders, the rise of resilience as a measurable outcome, and how AI is driving convergence across identity, observability and governance. (* Disclosure below.)

CISO role evolution drives convergence across identity and governance

The CISO’s role evolution is expanding the mandate well beyond managing risk, Case noted. Security leaders are now expected to help the business safely roll out enterprise AI, shaping governance and operational guardrails as adoption accelerates.

“That means the CISO is working closely with a broad range of roles,” Case said. “They’re working with engineering, legal, compliance and business leaders far more than ever before. Really, security is becoming embedded as a business function.”

That CISO role evolution is colliding with a security stack converging under AI pressure, as identity, observability and governance grow more interdependent. Attackers are also moving faster than defenders can respond, intensifying the case for identity-first controls, Case noted.

“AI agents are going to require not only access to data, but they’re also going to need to take action with that data and potentially access enterprise systems,” Case said. “They’re going to need that kind of visibility and governance as a critical piece of that stack.”

That operational shift is forcing security teams to prioritize execution and collaboration over chasing new point tools, Case said.

“They need to really make sure that they’re collaborating across the business and with these different stakeholders,” Case said. “As they consider how their roles are evolving and the tools and processes that they need to be able to do their jobs moving forward, they are able to have those healthy conversations with their vendors around … how do we tie that back to doing my job and where my job is going to head in this agentic AI era.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA 2026:

(* Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE’s event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE