AI Is Changing the CISO Role: From Security Gatekeeper to Business-Risk Translator

Speaking at ISC2 Security Congress 2026 in Denver on October 26, Mark Weatherford, Nvidia's head of cybersecurity policy, argued that widespread AI use at work has changed the CISO role. In his view, the job has moved from security gatekeeper to business-risk translator. Security leaders must show how AI-related risks connect to business goals, and help executives understand who is responsible for accepting those risks.

Weatherford recalled a board meeting where a CISO struggled to explain how security relates to the business. The board questioned whether the CISO understood the company's business model, which damaged the CISO's credibility. His lesson was that security leaders need to understand how an organisation makes money, not only how to protect it. That matters with AI, he said, because boards may fear losing competitive advantage by moving slowly, while moving too fast can mean deploying tools without proper controls. He noted that a CISO rarely owns the business risk of deploying AI, but must make sure leaders know who does.

He described two main challenges: the pace of technological change, and the need to focus on both security for AI and AI for security. That means protecting the AI systems an organisation deploys while also considering how AI can support security work. Traditional approaches may no longer be enough, he argued, saying: "If you're not doing pentesting 24/7, 365, you're probably behind the curve." He also cautioned against investments driven by fear of missing out.