The Evolving CISO Role: Managing Increased Responsibilities and Expectations
The Evolving Role of the CISO: Expanding Responsibilities and Pressures
The role of the Chief Information Security Officer (CISO) continues to grow in complexity, with personal liability becoming an increasingly significant concern.
Personal Liability and Risk Management
According to Splunk’s 2026 CISO Report, 78% of CISOs are worried about being held personally accountable for security incidents, a jump from 56% the previous year.
Expanded Responsibilities and Pressures
CISOs are now responsible for overseeing AI governance and risk management, in addition to their traditional duties in detection, response, compliance, and reporting.
Many are also tasked with establishing internal guidelines for the use of AI tools, including data access and output review.
This expanded mandate has brought an exceptional level of pressure and personal accountability, with CISOs managing not only technology but also risk, talent, and digital resilience.
Threat Environment and Security Landscape
The threat environment is also becoming increasingly demanding, with most CISOs citing attacker sophistication as a significant challenge.
To address this, security leaders are prioritizing visibility across cloud and on-premises systems, disciplined investigation cycles, and coordination among security, IT, and engineering teams.
Detection and response functions remain central to strategy, with programs focusing on broad monitoring coverage, structured investigation workflows, and automation.
Adoption of AI and Governance Frameworks
The adoption of AI is also changing the security landscape, with 40% of CISOs already using generative AI within their security functions.
However, this has introduced new concerns, including data leakage and unsanctioned use of AI tools.
Security teams are developing governance frameworks to address these risks, including policies for internal experimentation and third-party AI services.
Operational Pressures and Executive Expectations
Despite these challenges, CISOs are also facing operational pressures, including staffing shortages and high alert volumes.
45% of CISOs reported moderate burnout among their employees, with sustained alert volumes, investigation demands, and ongoing architectural change contributing to workload intensity.
Automation initiatives are being implemented to support analysts and improve signal quality.
Executive expectations are also adding complexity, with 85% of CISOs citing low cybersecurity fluency among non-technical executives as an obstacle to collaboration.
Security leaders are working to translate technical findings into business language to inform funding decisions, remediation timelines, and risk acceptance discussions.
However, measuring return on investment remains constrained, with 41% of CISOs unable to correlate ROI directly to risk mitigation and remediation activities.
Conclusion
These dynamics are shaping prioritization, budgeting, and communication across departments, with security teams reporting pressure around vulnerability remediation timelines and projections tied to potential revenue impact from an attack.
As the role of the CISO continues to evolve, it is clear that the pressures and responsibilities will only continue to grow.
About Author
English