CISO AI risk management is emerging as the defining test of the AI era, pushing security leaders beyond blocking attacks and into the middle of enterprise decisions about how much risk a business is willing to accept. As AI moves into production, those decisions are becoming increasingly intertwined with governance, compliance and business strategy.

Much of that pressure is now landing squarely on the CISO, who is increasingly expected to act as connective tissue across legal, compliance, engineering and the business itself, according to Krista Case (pictured, left), principal analyst and practice lead for cyber resilience and security at theCUBE Research.

“I’ve also been thinking about this AI governance through the lens of the different roles that the CISO has to collaborate with within the enterprise — things like legal, compliance, engineering, IT,” she said. “They almost have to be sort of the connective tissue helping to facilitate these conversations. They’re really becoming a business enabler.”

Case was joined by Jon Oltsik (right), analyst in residence at theCUBE Research, for a keynote analysis of Black Hat USA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how the CISO role is evolving as AI moves from experimentation into production. (* Disclosure below.)

CISO AI risk management splits the market into leaders and laggards

The shift in the CISO role remains far from universal. Only a minority of security leaders have translated AI hype into a coherent strategy, according to Oltsik.

“About 20% of CISOs get it,” he said. “They understand the implications, they understand what their organization’s trying to do with AI. They’re looking at security architecturally. The other 80% are in a state of ignorance; sometimes ignorance is bliss, or at least assumed bliss.”

That gap in AI risk management is compounded by a disconnect between the tools flooding the show floor and the practitioners meant to evaluate them, according to Oltsik. Instead, CISOs must build threat models tied to specific business initiatives, then hand executives a clear menu of choices — accept, mitigate or transfer the risk — rather than stand in the way of adoption.

“You can’t get in the way, and no one should try to get in the way — you’ll get run over,” Oltsik said. “You’ll lose your job if you try to get in the way. That’s really the way it is.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE’s event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE