Share with your CISO
A quarter of CISOs are seriously considering leaving the profession, and the cause isn’t burnout from security operations, it’s liability exposure from AI governance they didn’t choose to own. Splunk’s survey of 650 global security leaders finds 96% of CISOs now carry AI governance responsibility enterprise-wide, while 78% fear personal legal exposure for a breach tied to AI systems they may never have approved. The Splunk CISO Report frames this as an expanded mandate arriving faster than the authority to enforce it.
What this means for your business
The 26% exit-consideration figure is less a talent crisis headline and more a structural warning signal. CISOs who report genuine enthusiasm for AI in their own security operations, 92% say it helps teams review more events, 89% cite better data correlation, are still eyeing the door. That combination only makes sense if the pain isn’t the technology itself but the accountability architecture surrounding it. If your organization deploys AI without routing it through security first, your CISO is absorbing risk they didn’t underwrite.
The specific dynamic driving the liability fear is what you might call governance displacement: the speed at which business units ship AI tools, including applications built with “vibe coding” (fast, informal AI-assisted development with minimal documentation or review) and shadow AI wired directly into production, consistently outruns the security team’s visibility into those deployments. With 85% of business leaders lacking basic cybersecurity fluency, the executive formally accountable for AI risk has the least practical leverage over how fast that risk accumulates. The liability math is brutal. Regulators and boards hold the CISO answerable for systems they were never briefed on.
Splunk, now owned by Cisco and with a natural interest in positioning security tools as the governance layer, frames the solution as expanded CISO mandate. That framing isn’t wrong, but it understates where the actual fix lives. Mandate without enforcement mechanism is just a longer job description. The 78% personal liability figure, up from roughly half the year prior, should land on the CEO and general counsel’s desk as urgently as the CISO’s, because the risk doesn’t originate in the security team and can’t be contained there alone.
Boards still treating AI governance as a CISO configuration problem will discover it’s a corporate governance problem when the first regulatory action names an individual executive. The leading indicator to watch isn’t CISO turnover yet, it’s whether your organization has a process that requires security sign-off before an AI system reaches production. If that process doesn’t exist, the personal liability your CISO fears is the liability your board is quietly holding without knowing it.
Concept deep-dive: Shadow AI
Shadow AI refers to AI tools, agents, or model-connected applications deployed inside a company without formal IT or security review, the AI equivalent of employees using personal cloud storage to share sensitive files. It emerges when business teams move faster than procurement or approval cycles allow. The governance problem is acute because shadow AI can ingest sensitive data, make consequential decisions, or expose APIs to external models, all before the CISO knows the system exists.
Based on reporting from AI Governance Liability Has a Quarter of CISOs Eyeing the Exit, originally published 2026-07-28 20:54:00.
