Risks & Rewards: How AI Is Redefining the CISO's Role

At the ISC2 Strategic Congress 2026 in Denver, Nvidia's head of cybersecurity policy and strategic engagement, Mark Weatherford, stressed that the CISO role is undergoing a significant transformation due to AI.

Security leaders are now expected to assist the business in gaining a competitive edge through AI while simultaneously using the technology to manage cyber-risk. Weatherford noted that managing both functions requires keeping up with technology that changes monthly.

He highlighted that the pace of change presents a major hurdle, stating, "Speed is the biggest challenge right now," and adding, "Technology is changing so fast it is really hard for us to keep pace." This rapid evolution affects basic security routines; for example, testing four times annually was once considered sufficient, but now, anyone not testing constantly is likely insufficient.

Weatherford observed that a "fear of missing out" drives many organizations to deploy AI without conducting proper business due diligence or fully grasping the value they seek. While some rushes to spend are justified, other AI cases lack clear justification.

Conversely, CISOs often tend toward a "no" response when any hint of risk appears. Weatherford suggested cybersecurity leaders should embrace more risk, calibrated to their company's tolerance, drawing a parallel to the Navy's concept of command by negation. He advised, "You have to be curious. You have to be willing to step out of your comfort zone."

The CISO's duty, Weatherford asserted, is to ensure the board understands the risks and knows who is accountable for each one, especially when another executive's deployment creates the danger. Although he conceded this candor can sometimes impede a career, he urged CISOs to push back when they are unfairly blamed for others' decisions, saying, "I would say we need to make sure that the people taking the risk are responsible for the risk."

To advance, Weatherford encouraged CISOs to constantly explore how AI can improve both security and business, cautioning that relying solely on past achievements limits potential. He recommended, "Be curious, be creative, be willing to learn and relearn," suggesting one way to gain AI knowledge is to study one new topic each week.

Regarding talent, Weatherford favors paid internships that introduce AI-native young professionals to the company and its business. He mentioned an interview technique involving giving a candidate a business problem and having them solve it live using AI, without a single correct answer, to assess flexibility. He also stressed that retaining talent requires more than simply increasing pay while keeping roles static.