Cyber governance is now firmly a board-level priority. While no doubt this presents challenges for CISOs, it is also an opportunity to shine a light on the true demands of both leaders and their teams. M&S Chair Archie Norman described the attack by Scattered Spider as an “out of body experience”. However, the landscape is shifting from human-led attacks to automated ones; the release of frontier AI models like Anthropic’s Mythos—capable of autonomously identifying and exploiting zero-day vulnerabilities—marks a new era of agentic AI threats. Compounded by this rapid AI diffusion and geopolitical unpredictability, the CISO’s role is set for a further evolution from technologist to a strategic guardian of resilience.
To support leaders through this shift, ISTARI and the University of Cambridge’s Judge Business School, led by Dr Simon Learmount, have launched a programme of research into how the CISO role is changing, and what boards and executives can do to set it up for success.
-
What responsibilities are creeping into the remit?
CISOs are now managing everything from AI ethics to building and retaining the teams that deliver it — all on top of the "architectural debt" of the pandemic era. -
How well prepared are CISOs to take on these expanded roles?
Many feel the role has become "unsustainable," acting as part-diplomat and part-shrink without sufficient "bench strength" or board buy-in. -
What enablers do CISOs, CEOs and boards need to ensure next-generation cyber resilience?
Compliance frameworks need to be more than a tickbox exercise; they must serve as a shared language that allows boards to govern autonomous systems they may not fully understand.
