Share with your CISO
Two-thirds of companies with revenue above $10 billion have appointed a head of AI security, according to new benchmark research from IANS and Artico Search covering more than 1,400 cybersecurity leaders. Eighteen percent created a standalone role; 47% folded responsibility into an existing one. Below $1 billion in revenue, only 6% have done anything at all. Board oversight tells a starker story: just 21% of large enterprises have a dedicated AI ethics committee, and nearly half report no plans to build one.
What this means for your business
The data reveals a pattern worth naming: operational AI security is racing ahead while accountability at the top stays frozen. At companies above $10 billion, a head of AI security now exists in most cases, yet only 7% of CISOs hold primary accountability for enterprise AI governance, with the duty drifting toward Chief AI Officers where those roles exist. Between 14% and 19% of organizations at every revenue tier report no single executive accountable for AI governance at all. If you’re a CISO at a large enterprise, the structure around you is being built without you at the center of it.
The compensation data carries a signal that often gets missed in org-design conversations. Experience in information security outweighs company size, geography, and reporting structure as a pay driver. Deputy CISOs at the largest firms average $350,000 in cash with top earners clearing $500,000, and mid-market peers earn 16% to 26% less. The gap reflects genuine scarcity of seasoned AI security talent, not just title inflation. That scarcity is why 65% of large enterprises filled the head of AI security role by repurposing an existing leader rather than recruiting a net-new one: the external market doesn’t have enough supply to move faster.
The board oversight gap is the real exposure here. An AI security leader without board-level backing is essentially a compliance function dressed as a strategic one. When 43% to 48% of companies report no plans to establish a board AI committee, the CISO’s internal AI risk work sits on an organizational island. I’d revise this concern if board adoption accelerates meaningfully over the next 12 months, but the current trajectory suggests the gap between operational structure and governance authority will widen before it closes, leaving the CISO holding risk that the board hasn’t formally agreed to own.
Based on reporting from Large Enterprises Appoint AI Security Leaders as Board Oversight Lags — Security Today, originally published 2026-10-21 18:39:00.
