Only 7% of CISOs at Large Firms Own AI Governance, New Report Finds

New research published in 2026 indicates that chief information security officers at large enterprises rarely hold direct responsibility for artificial intelligence governance. According to a benchmark report released by IANS Research and Artico Search, only 7% of CISOs at companies generating $10 billion or more in annual revenue have ownership over AI governance structures. This finding highlights a significant gap between the rapid adoption of AI technologies and the establishment of clear security accountability within executive leadership teams.

The 2026 Security Organizational Design Benchmark Report draws data from 1,400 CISOs and cybersecurity professionals to analyze how organizations structure their security operations. The study reveals that assigning responsibility for AI security remains an unsolved challenge for many enterprises. While the technology introduces new operational risks, companies are struggling to determine where accountability belongs and whether the scope of work warrants dedicated leadership or integration into existing functions.

Shifting Organizational Structures

Despite the low rate of CISO ownership, large organizations are creating specific roles to manage AI security risks. Approximately 65% of large firms have designated a head of AI security role, as Threat Times reported on October 20, 2026. Of these organizations, 18% have established the position as a dedicated role, while 47% have combined it with another leadership responsibility. This suggests that many companies are building new functions by leveraging existing disciplines rather than creating entirely separate departments from scratch.

Nick Kakolowski, Senior Research Director at IANS, noted that underlying security disciplines already exist across application security, data governance, identity, risk, and compliance. The primary challenge for CISOs is determining how these capabilities converge around AI initiatives. Organizations must decide if the volume of work has become significant enough to require a standalone leader or if it can be managed through expanded scopes within current teams.

Impact on Smaller Organizations

The trend toward dedicated AI security leadership is far less common in smaller enterprises. Organizations with revenues between $1 billion and $10 billion report that only 9% have a dedicated AI security head. Companies with under $1 billion in revenue report an even lower figure of 6%. At these smaller organizations, AI responsibility is typically layered onto pre-existing leadership roles within governance, risk, and compliance, security operations, or architecture teams.

Steve Martano, an IANS Faculty member and Partner in Artico Search’s cyber practice, stated that the growth of AI creates a premium for leaders who can bridge technical security, risk, and compliance. He emphasized that organizations moving quickly on AI must revamp their structures and review the scope of security team members. Companies need to assess whether they can develop this expertise internally before entering a competitive external market for talent.

What should you do?

Security leaders should evaluate whether current team structures can adequately address AI-specific risks or if a dedicated role is necessary. Organizations must map existing capabilities in application security and data governance to identify gaps in AI oversight. Leaders should also assess internal talent pools to determine if expertise can be developed before seeking external hires.

What to do and how to stay safe: AI security

• Audit current security roles to identify who holds implicit responsibility for AI governance and document any gaps in accountability.
• Review existing application security and data governance processes to determine how they can be extended to cover AI workloads.
• Assess internal staff capabilities to decide if AI security expertise can be developed in-house rather than hiring externally.
• Define clear boundaries for AI security responsibilities to prevent overlap or neglect between traditional security teams and AI development groups.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What percentage of CISOs at large companies own AI governance?

Only 7% of CISOs at companies with $10 billion or more in revenue have ownership over AI governance, according to the 2026 benchmark report.

How many large firms have created a head of AI security role?

Approximately 65% of large organizations have designated a head of AI security role, with 18% making it a dedicated position.

Do smaller companies have dedicated AI security leaders?

No, smaller organizations rarely create dedicated roles; only 9% of $1B–$10B firms and 6% of under-$1B firms have dedicated AI security heads.