Just because scads of companies are deploying and investing in generative AI (GenAI) doesn’t mean they actually understand what the technology is—or, more importantly, how it could threaten revenues and brand reputation. With AI adoption accelerating on the promise of improved efficiency and cost-cutting, boards and C-suiters need expert guidance on the potential risks to the business.
Enter a new breed of IT professional: the chief information security officer (CISO) as AI risk adviser.
The numbers point to the need for this kind of guidance. A recent Wharton School study found 82% of business leaders use AI weekly, and nearly half rely on it daily. What’s more, three out of four executives are already seeing positive returns on their AI investments, and most expect to spend more in the near future, the study found. But they may not understand just how much the threat landscape is expanding.
Nearly 80% of ransomware is now AI-powered, according to a new MIT Sloan and Safe Security review, suggesting a significant uptick in attack speed, volume, and scale. Then there’s the in-house threat: More than half of employees are using shadow AI, unsanctioned AI tools that put companies at risk—this per a comprehensive survey of 6,000 workers in the U.S., UK, and Germany by the German software conglomerate Software AG in 2024. (It’s a good bet those numbers are even higher today.) And 13% of companies last year reported breaches tied to AI models or applications, reports IBM.
The CISO can be the one to more regularly and fully inform the decision-makers about these exponentially increasing risks to the business—and what new controls or expenditures may be necessary to minimize them.
Rethinking the CISO role in terms of AI risk
Think of AI risk advisers as individuals whose responsibilities, in addition to building and executing cybersecurity strategies, include guiding leadership on the safe, secure, compliant, and ethical use of AI to advance business goals and enhance customer trust.
“Even though AI is now one of the top three agenda items in nearly every board meeting I attend, most boards still don’t understand it.”David Gee, board risk adviser, former HSBC CISO, and author
In some ways, the role already exists. With cybersecurity issues like ransomware, data breaches, and supply-chain hacks costing U.S. businesses tens of billions of dollars, security has become a serious business concern. So many CISOs now present to board members a few times each year.
But that doesn’t mean CISOs are correctly articulating what board and C-suite executives really need to know about AI, or that business leaders are comprehending what they’re being told.
“Even though AI is now one of the top three agenda items in nearly every board meeting I attend, most boards still don’t understand it,” said David Gee, a Sydney-based board risk adviser, former CISO for HSBC, and author of the new book <em>A Day in the Life of a CISO.</em> “They’re hiring directors with accounting and legal backgrounds, not people with experience in cyber, data, or AI.”
[Read also: Agentic AI is headed for SecOps—know the pros, cons, and steps to scale]
Many CISOs may also be telling board members and executives that conventional cybersecurity tools and controls are adequate for addressing AI risk when, in fact, they are insufficient, said Jim Routh, a chief trust officer for Saviynt and former CISO who advises boards on cybersecurity.
“Today, about 40% of CISOs are saying, ‘The controls we have in place today are sufficient to deal with this technology change,’” Routh said. “I believe that’s irresponsible.”
Gee sees the same problem.
“Most organizations are still running on playbooks built before GenAI even existed,” he said. “Threat surfaces have doubled—from traditional systems to new AI entry points like application programming interfaces (APIs), retrieval augmented generation (RAG) pipelines, and access control models—and most CISOs don’t have those mapped yet.” APIs, RAG pipelines, and model access controls serve as the connective tissue linking AI models to data, applications, and users, and are increasingly seen as promising attack vectors.
AI risk and addressing the right threats
Routh said the AI threat landscape is expanding on three fronts, each of which must be addressed through the full scope of a CISO’s capabilities. They include:
- Foundation models—where employees risk exposing sensitive data through everyday prompts.
- SaaS applications—where language models are embedded with minimal oversight.
- Software development—where people with varying levels of experience are using AI to spit out potentially vulnerable code.
The practice of using AI models to create complete applications from plain-English prompts, an approach known as “vibe coding,” worries Routh the most because of how integral applications are to an organization's operations and its supply chain partners.
And it doesn’t stop with coding apps. The rising threat of shadow AI projects in general is troubling experts like Wyatt Mayham, lead AI consultant for Northwest AI Consulting. Employees across business units are spinning up unsanctioned AI pilots or buying third-party tools without security review, creating blind spots that CISOs can’t afford to ignore, he said.
“Every week we’re discovering new AI apps running in production that IT never signed off on,” Mayham said. “The problem isn’t just the AI tools themselves. It’s the executives who don’t even know the tools exist until something breaks.”
That lack of visibility is more than a technical gap, he said. It represents a governance gap, leaving companies exposed to regulatory fines, stalled operations, and brand-damaging headlines. Which is why experts said CISOs need to shift from being defenders in the background to risk whisperers at the decision-making table.
Speaking the right language
Many CISOs are still learning how to talk about AI risk in business terms.
“The problem isn’t just the AI tools themselves. It’s the executives who don’t even know the tools exist until something breaks.”Wyatt Mayham, lead AI consultant, Northwest AI Consulting
Timothy Youngblood, former CISO at McDonald’s and T-Mobile and now CISO in residence at Astrix Security, said too many security leaders struggle to move from talking technology to showing how strong security supports business growth.
“A lot of CISOs are such technologists that sometimes they forget the reason they are there is because the company’s trying to drive revenues,” he said. “The job is to help keep that revenue going and talk about risk in a language everybody in the room understands.”
That language starts with the board. Executives don’t need detailed lectures on model poisoning, prompt injection, or patching. They want to understand how security activities protect revenue, customers, and reputation.
That broader framing becomes even more important as governance questions rise to the surface.
[Read also: Racing to deploy GenAI? Security starts with good governance]
Boards are increasingly asking CISOs to differentiate between AI security (that is, defending systems from attack) and AI safety (ensuring that AI behaves as intended), said Kara Sprague, CEO of HackerOne, a bug bounty and vulnerability disclosure company. She warned that focusing on one category or the other could blind enterprises to the bigger picture. CISOs need to own the whole discussion, she said.
“Our research shows that about 84% of CISOs are considered the accountable party when it comes to AI risk related to security and safety,” Sprague said. “So, there’s an expectation of the CISO, regardless of whether they want or have the capability to own that mantle.”
C-suite challenge—facing the ugly truth about AI risk
Meeting that expectation might mean adjusting budgets. Legacy defenses cannot simply be retrofitted for AI. Instead, experts such as Routh said money must flow toward data governance, model monitoring, and real-time safeguards.
“Don’t be that Debbie Downer…. As an AI risk adviser, you want to be the person bringing solutions that enable the organization to say ‘yes’ safely.”Kara Sprague, CEO, HackerOne
A challenge, Routh and Youngblood both stressed, is that doing so requires storytelling, presenting, and analytical soft skills as much as technical expertise. Risk advisers must know how to persuade in ways that highlight opportunity alongside risk, they said.
Gee, whose book outlines the evolving role of security leaders in the AI era, frames the journey around three imperatives: Own it, train for it, and engage stakeholders.
“AI is not a passing fad; it’s a tsunami,” he said. “You either position yourself to ride it or get wiped out by it.”
5 moves to become an AI risk adviser
So how can CISOs do all of that? Here are some tips from experts for becoming an AI risk adviser:
- Know what you have—CISOs need to inventory how and where AI is being used across the business, including unsanctioned “shadow AI” projects. “You really can’t govern what you don’t know exists,” Mayham said. That means fingerprinting AI systems, tracking data flows, and surfacing blind spots before they turn into liabilities, he said.
- Define responsible use—Once visibility is established, CISOs should lead a consensus on what “responsible use” of AI means. It will vary by industry and regulatory requirements, but responsible use should serve as the North Star for all other efforts, Routh said.
- Build governance into the business—Next, Routh and Youngblood said CISOs should be able to articulate how they’re embedding governance—AI policies, oversight, accountability, and regulatory compliance—into everyday operations to make both cybersecurity and safety core business responsibilities rather than afterthoughts.
- Prioritize efforts—It’s also important to avoid trying to boil the ocean. Sprague said CISOs should be able to look at the threat landscape, identify where AI poses the greatest risk to business priorities, and explain how they plan to close specific gaps in risk coverage. “It’s an optimization question,” she said, “because we all know cybersecurity budgets aren’t growing at the same rate as the attack surface area.”
- Educate, educate, educate—Finally, CISOs must keep boards and employees updated and aligned on the evolving threat landscape, the company’s mitigation efforts, and how they map to business priorities, Youngblood and Sprague said. Those conversations need to be accurate and give board members and executives a clear, complete understanding of what’s happening and why. “If CISOs aren’t leading the charge with education and are instead telling them we’re good all the time, they are doing a disservice,” added Routh.
[Read also: It starts with good governance—how to create a whole-of-state cybersecurity strategy]
Above all, every board or executive-level conversation should underscore how a CISO’s plan enables innovation as opposed to locking down activities or saying “no,” Sprague said.
“Don’t be that Debbie Downer who is always saying, ‘No, we can't do that,’” she warned. “As an AI risk adviser, you want to be the person bringing solutions that enable the organization to say ‘yes’ safely.”