CISO role evolution is accelerating as cyber resilience becomes a defining benchmark of security success. As AI reshapes the threat landscape, enterprises are focusing not only on defending against attacks, but also on how quickly they can recover from them. The stakes are steep: New research found the average cost of one hour of endpoint downtime across 1,000 CISOs surveyed was $19 million, underscoring why recovery, not just prevention, has become a board-level concern.

As theCUBE wrapped up two days of coverage from the show floor at Black Hat USA, the shift toward resilience benchmarks was one of four defining themes to emerge from dozens of conversations across the security stack, according to Krista Case (pictured), principal analyst and practice lead for cyber resilience and security at theCUBE Research.

“It is, practically speaking, inevitable … that any even mature security organization might experience some disruption at some point in time,” Case said. “The conversation is becoming, ‘Do we understand what our minimal viable operations look like? Do we have confidence that we’re able to recover them quickly and confidently to that trusted state?'”

Case delivered the wrap-up analysis as part of theCUBE’s coverage of Black Hat USA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. She addressed the shifting responsibilities of security leaders, the rise of resilience as a measurable outcome and how AI is driving convergence across identity, observability and governance. (* Disclosure below.)

CISO role evolution drives convergence across identity and governance

The evolving CISO role is expanding the mandate well beyond managing risk, according to Case. Security leaders are now expected to help the business safely roll out enterprise AI, shaping governance and operational guardrails as adoption accelerates.

“That means the CISO is working closely with a broad range of roles,” she said. “They’re working with engineering, legal, compliance and business leaders far more than ever before. Security is becoming embedded as a business function.”

CISO role evolution is unfolding alongside a security stack that is converging under AI pressure, as identity, observability and governance grow more interdependent. Attackers are also moving faster than defenders can respond, intensifying the case for identity-first controls, Case noted.

“AI agents are going to require not only access to data, but they’re also going to need to take action with that data and potentially access enterprise systems,” Case said. “They’re going to need that kind of visibility and governance as a critical piece of that stack.”

That operational shift is forcing security teams to prioritize execution and collaboration over chasing new point tools, according to Case.

“They need to really make sure that they’re collaborating across the business and with these different stakeholders,” she said. “As they consider how their roles are evolving and the tools and processes that they need to be able to do their jobs moving forward, they are able to have those healthy conversations with their vendors around … ‘How do we tie that back to doing my job, and where my job is going to head in this agentic AI era?'”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA 2026:

(* Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE’s event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE