Over the last 12 months I've sat in on board prep calls, Part 500 readiness reviews, AI governance committee meetings, and SOC retros inside US mid-market SecOps organizations. Across all of them, one CISO title is doing the work of four people.
Technical security leadership, board-level risk translation, regulatory compliance ownership, and AI governance are now separate jobs in everything except the org chart. Most of the CISOs I work with are running one of those four mandates well and triaging the rest under a job description that hasn't been updated since 2018.
The four mandates joined the role at different points over the last several years. Detection and response have sat with the CISO since the title existed.
Board-level risk translation came in with the U.S. Securities and Exchange Commission's (SEC) 2023 disclosure rules, personal regulatory exposure for the CISO sharpened with NYDFS Part 500's 2023 Second Amendment and Federal Trade Commission (FTC) consent orders that have named executives personally, and AI governance arrived through 2024 and 2025 without a matching headcount adjustment at most organizations.
With four mandates competing for one calendar, the lowest-priority one drifts, and whoever sits below the CISO ends up covering it by default.
In brief:
- The CISO title in 2026 covers four distinct jobs: technical security leadership, board-level risk translation, regulatory compliance ownership with personal legal exposure, and AI governance. None of that is reflected in the job description.
- The four mandates joined the role at different points over the last several years, each bringing its own counterparties, vocabulary, and calendar pressure under the same title.
- Practitioner benchmark research frames the role as already split in practice, with organizations either elevating CISOs to executive scope or narrowing them to a tactical director function under the same title.
- With four mandates competing for one calendar, the lowest-priority one drifts, and whoever reports to that CISO ends up covering it by default.
What the CISO role covers in 2026
The textbook says the CISO owns security strategy, manages risk, and reports outcomes to the board. That's accurate, but a year of sitting next to the work convinced me the textbook describes one role that no longer exists as one role in practice. In any given week, the CISOs I work with are running four jobs in parallel:
- Technical security leadership: the original CISO job — detection, response, architecture, vulnerability management, the SOC.
- Enterprise risk translation: taking cyber risk and stating it in language a board and a CFO can act on.
- Regulatory compliance ownership: reshaped by post-2023 disclosure rules, state-level certification regimes, and personal-executive consent orders that put senior management on the hook for governance failures.
- AI governance: a new identity layer, attack surface, and audit obligation absorbed into the CISO portfolio at most organizations without new headcount.
The orthodoxy I'd push back on is the framing that the role is in "transition" or "evolving" toward some future stable shape. The role I'm watching isn't evolving; it's already fractured.
Practitioner benchmark research describes it as bifurcated, with organizations either elevating CISOs to executive scope or narrowing the role to a tactical director function under a title that most job descriptions on the market continue to describe as if the bifurcation hadn't happened. The CISO recruiters I talk to are recruiting for two completely different jobs under one title and pretending the candidate pool is the same.
Technical leadership is the mandate that gets crowded out first
Technical security leadership loses calendar to the other three because it's the only one with continuous incoming work. Detection and response fire on their own schedule.
A board meeting can be rescheduled, a regulatory filing can be drafted by counsel and reviewed later, and an AI policy can sit in a draft folder for three weeks, but the SOC keeps running regardless. The CISOs I've worked with who keep the SOC under direct authority are also the ones most likely to drift on the other three mandates, because the SOC is the only part of the job a CISO can't ignore for even a day.
In one engagement this year I watched a CISO interrupt an AI governance committee twice in 40 minutes to handle SOC escalations. By the end of the meeting the only mandate she had given real attention was the SOC, and the AI policy on the table had moved into the next quarter for the third time running.
That isn't a personal failing; it's what the calendar physically allows when one title carries four jobs. The line I hear most often from CISOs in this position is some version of "I don't have time to be strategic." If your CISO keeps getting pulled out of strategic conversations to handle SOC escalations, the cause is more often calendar design than the individual occupying the role.
Board-level risk translation is now a regulatory function
After the SEC's 2023 cybersecurity disclosure rules (Release No. 33-11216), public companies are required to describe management's role and expertise in assessing material cybersecurity risks in their annual 10-K filings. The CISO is now the named accountability point for translating cyber risk into board-level financial language.
The ability to do that translation has moved from an aptitude some CISOs happened to have into a job function written into the regulatory record.
The assumption I keep hearing in CISO Slack groups, peer dinners, and the calls I take with security leaders ahead of board prep is that the SEC rule already restructured where CISOs report. The numbers don't support that, and which numbers you trust depends on the sample.
Executive-search surveys focused on public-company CISOs show a sharp year-over-year shift toward direct CEO reporting. Broader practitioner samples covering a wider range of company sizes still show most CISOs reporting into IT leadership.
The two samples aren't measuring the same population, and for the mid-market CISOs I work with the broader practitioner picture sits closer to the situation on the ground. Either way, board-level risk translation is now the CISO's mandate whether they report to the CEO, the CIO, or the CFO.
Compliance ownership now carries personal legal exposure
The third mandate is the one I've watched most directly reshape compensation negotiations over the last 18 months. US regulators have been writing personal accountability for senior management into the law itself, through certification regimes, disclosure obligations, and consent orders that name individual executives.
Liability can attach to governance failures even when no breach has happened. Three US frameworks are pushing in that direction at the same time:
- NYDFS Part 500 (New York Department of Financial Services Cybersecurity Regulation): the November 2023 Second Amendment requires the CISO and the company's highest-ranking executive to co-sign an annual compliance certification, putting both signatures on the line for the program. The financial-services CISOs I work with spent most of 2024 building out the evidence trail the dual-signature certification now demands.
- CMMC 2.0 (Cybersecurity Maturity Model Certification): requires executives to personally certify the security posture of their supply chains for US defense contractors.
- FTC consent orders against named executives: the Federal Trade Commission's January 2023 final order against the Drizly CEO bound him personally to information-security obligations for ten years, applying at any business where he serves as a CEO, majority owner, or senior officer with security responsibilities. The order signaled that personal-executive accountability is part of the FTC's enforcement toolkit when companies fail to protect consumer data.
The SolarWinds matter is the case CISOs reference when negotiating Directors and Officers (D&O) coverage into their packages. Most of the SEC's claims were later dismissed, but the precedent stands as a reference point that comes up in nearly every offer conversation I've been peripheral to since late 2024.
D&O coverage has moved over those months from a benefit that surfaces somewhere in the offer letter footnotes into a hard line item that candidates raise before they get to base salary. When a CISO opens an offer conversation with D&O before they negotiate comp, they're acknowledging in practice that the job has outgrown the title.
AI governance arrived without headcount
The fourth mandate is where I see organizations get the framing wrong most often. Most of them write AI governance into the CISO's job description as a single new responsibility. The CISOs I work with at AI-active organizations are running four problems under that one label:
- A new identity layer to govern: every AI agent, automation script, and workflow now has an identity with access scopes and credential lifecycles that didn't exist 24 months ago.
- A new attack surface to defend: model inputs, training pipelines, and agent action loops introduce failure modes most SOC playbooks don't cover.
- An audit obligation under emerging frameworks: National Institute of Standards and Technology (NIST) AI Profile and International Organization for Standardization (ISO) standards in progress, each adding documentation, control evidence, and review cadence.
- A vendor-evaluation problem: the category is new, the differentiation is immature, and CISOs are signing three-year contracts before category norms have settled.
Most organizations absorbed all four into the CISO's portfolio without adding headcount.
The IBM Cost of a Data Breach Report 2025 found that 63% of organizations still lack AI governance policies and that 97% of AI-related breaches involved AI systems without proper access controls, which is roughly what you'd expect when organizations roll AI agents into production faster than they can build the access controls or audit evidence the new regulatory expectations require.
The cohort of CISOs I work with at organizations that have AI agents running in production isn't large yet, but every one of them raises the identity layer first when the conversation turns to AI. As those organizations move from limiting AI to operationalizing it, every agent and automation in production carries an identity that needs scoping and credentialing like any other.
NIST published its Cybersecurity Framework Profile for AI in late 2025, federal AI policy continues to shift through executive orders, and benchmark research in 2026 describes most AI governance committees as immature. Monitoring AI agents in production requires telemetry that SecOps wasn't already collecting, and most organizations are still figuring out the gap.
The org chart already knows the role has split
Microsoft is the cleanest public example of a company that responded to this problem by changing the org chart. Under Global CISO Igor Tsyganskiy, Microsoft built out a Deputy CISO (dCISO) layer covering product divisions and functional areas including identity, AI, gaming, and government systems.
The dCISOs sit on a Cybersecurity Governance Council reporting to Tsyganskiy and own cyber risk, defense, and compliance for the company as a whole, and several of them carry scope and scale that would have them called the CISO in any other organization. I read the structure as the cleanest public acknowledgment that one title was carrying multiple jobs, and the formal split was the response Microsoft chose.
Mid-market companies don't have the headcount to build a multi-deputy structure, and most haven't formally split the role. The split runs informally instead, through whichever mandates the CISO can't make time for. Those mandates land on a VP of Security or Head of Security Operations who is already running their own four-job calendar.
I don't expect the title to split formally at the mid-market in the next two years, but the people below the CISO are already absorbing whatever the CISO can't cover. If you're a SecOps leader reporting to a CISO, the practical question is which of the four mandates your CISO is actively holding given their calendar, reporting line, and board access, and which of the four are landing on your team without anyone naming it.
Of the SecOps leaders I've walked through this mapping in the last year, most found they were already covering at least two of the four mandates by default, and none of them had it written into their role description.
Frequently asked questions about CISOs
What does CISO mean in 2026?
In 2026 the CISO title covers four distinct mandates that no longer fit comfortably under one role: technical security leadership, board-level enterprise risk translation, regulatory compliance ownership with personal legal exposure, and AI governance.
Practitioner benchmark research describes the role as already bifurcated, with organizations either elevating CISOs to executive scope or narrowing the role to a tactical director function while keeping the title.
Why is the CISO role splitting?
Post-2023 regulation, including the SEC cybersecurity disclosure rules, NYDFS Part 500, CMMC 2.0, and the FTC's 2023 Drizly order holding the CEO personally accountable, pushed governance accountability onto named individuals at the senior management level.
Running a 24/7 SOC and coordinating SEC disclosure obligations with legal and finance are two different modes of work that compete for the same calendar slots. Microsoft built a Deputy CISO layer in response. Most mid-market organizations haven't split the role formally, so the split runs informally through whichever mandate gets less of the CISO's calendar.
What is CISO personal liability under NYDFS Part 500?
NYDFS Part 500 requires the CISO and the company's highest-ranking executive to co-sign an annual certification of material compliance with the regulation. The CISO's signature attaches personal exposure to that certification.
The November 2023 Second Amendment also expanded enforcement provisions covering material failures to comply, and NYDFS has used certification failures as a standalone violation when pursuing other Part 500 enforcement actions. The regulation covers banking, insurance, and financial services entities operating in New York, and the dual-signature certification first applied to the compliance year ending in 2023.
How does AI governance affect the CISO role?
AI governance became a CISO responsibility at most organizations through 2024 and 2025, and most of those organizations didn't add headcount to match. Every AI agent, automation script, and workflow now carries a non-human identity that needs scoping and credentialing.
NIST published its Cybersecurity Framework Profile for AI in late 2025, and federal AI policy continues to shift through executive orders and FTC enforcement. The IBM Cost of a Data Breach Report 2025 found that 63% of organizations still lack AI governance policies, which suggests most CISO programs haven't caught up to the regulatory expectations.
Should CISOs report to the CEO or CIO?
It depends on company size and which sample you trust. Executive-search surveys focused on public-company CISOs show a sharp year-over-year shift toward direct CEO reporting.
Broader practitioner samples covering a wider range of company sizes still show most CISOs reporting into IT leadership. For mid-market CISOs, the broader practitioner picture sits closer to the situation on the ground, while the executive-search number is a better read on where large public companies are moving.