Accelerating Cybersecurity at the Speed of AI: The Evolving Role of the CISO

Post Views: 18

The CISO Role in the Age of Agentic AI: A New Reality

The role of the Chief Information Security Officer (CISO) has undergone significant changes over the past decade, but the most disruptive shift is the accountability driven by agentic AI.

Designing and Governing Hybrid Workforces

According to John White, EMEA Field CISO at Torq, security leaders must now design and govern hybrid workforces where humans and AI agents operate together, making decisions and acting at scale.

The traditional org chart, with its tree-like structure and specialist silos, is no longer sufficient. Today, CISOs must recruit talent that can work alongside AI agents, deciding which decisions can be safely automated and which require human judgment.

AI agents are moving beyond simple task execution and are now delivering real-time insights and responses. However, CISOs remain accountable for the outcomes, including those resulting from inaction when organizations fail to adopt and govern machine-speed security capabilities.

A New Era of Accountability

White notes that the biggest shift in the CISO role is not in tooling, but in accountability. When an AI agent acts at scale, the CISO is still responsible for the outcome.

This governance and operating model did not exist a decade ago. CISOs now carry accountability for inaction, and failing to adopt AI-driven capabilities can increase exposure and leave the organization structurally behind.

Real-World Challenges

In the retail sector, White faced situations where development velocity outpaced the maturity of emerging security controls. He had to compromise on security controls to avoid impacting revenue during peak trading periods.

However, this compromise was not about ignoring security, but about making informed, conscious decisions that enabled the business to move forward safely.

Evaluating Security Products

White also notes that the most common board question about cybersecurity is “Can you quantify all of our cyber risks?” However, this is a backward-looking question in a world where risk is increasingly non-linear and fast-moving.

Seeking precision based on historical data can create a false sense of confidence and anchors discussion in technical debt and past trends, rather than aligning leadership around emerging risks and sponsoring innovation.

When evaluating security products, White looks for those that can operate safely, transparently, and governably at machine speed while delivering business outcomes.

He assesses whether a product is intuitive to operate, capable of acting autonomously within clearly defined constraints, and providing real-time observability and assurance.

The strongest platforms can measure and report on their own effectiveness and value, turning security from a reactive function into a continuously optimizing system.

Reframing the Discussion

White also emphasizes the importance of reframing the discussion around “vendor convenience” as an existential risk.

He notes that convenience often comes from consolidating capability into familiar platforms, but these platforms may not be designed to operate autonomously at machine speed.

When a large incumbent experiences an outage, breach, or regulatory intervention, the business can fail hard, and the illusion of safety disappears quickly.

Conclusion

In conclusion, the CISO role has evolved significantly, and security leaders must now design and govern hybrid workforces where humans and AI agents operate together.

Accountability driven by agentic AI is the new reality, and CISOs must adopt a fresh mindset and skills to meet this challenge.

By reframing the discussion around vendor convenience and security products, CISOs can help their organizations stay ahead of the risk curve and maintain operational resilience in the face of machine-speed threats.