Key Takeaways
- One in four CISOs (26%) have seriously considered leaving their role, driven not by AI‑induced burnout but by growing personal liability fears.
- AI governance now falls squarely on the CISO: 96% own AI risk management and 78% worry about personal liability for a breach they must answer to regulators or boards.
- The rapid spread of “shadow AI”—unsanctioned AI built with vibe coding and deployed without security approval—expands the attack surface faster than security teams can govern it.
- Business leaders’ low cybersecurity fluency (≈85% lack basic knowledge) leaves CISOs with limited influence over how quickly AI risk proliferates.
- To regain authority, CISOs should (1) involve security early in AI development, (2) translate technical risk into business‑focused language for the board, and (3) build a durable governance program that survives leadership changes and external audits.
CISOs Considering Exit Amid Rising AI Governance Burden
Over the past year, a notable quarter of security chiefs have contemplated walking away from their positions. According to two internal surveys cited by Splunk field CISO Kirsty Paine, 26% of CISOs thought seriously about resignation. Contrary to popular speculation, the primary driver is not exhaustion from AI tools themselves but the escalating personal liability attached to AI governance. Security leaders feel increasingly exposed to regulatory and board‑level scrutiny for AI‑related incidents, prompting many to reevaluate the sustainability of the role in its current form.
AI Governance Now Falls Squarely on the CISO
The mandate for AI risk management has shifted dramatically onto the CISO’s desk. Splunk’s The CISO Report reveals that 96% of global security leaders now own AI governance and risk management across the enterprise. Simultaneously, the proportion of CISOs fearing personal liability for a data breach they must answer for to regulators or their board has risen to 78%, up from just over half six months earlier. This convergence of ownership and accountability means that the CISO is both the steward of AI enablement and the individual held responsible when things go wrong.
The Personal Liability Shift and Expanded Mandate
Michael Fanning, Splunk’s CISO, describes the role as operating “in the eye of the storm,” a characterization borne out by the survey data. While CISOs appreciate the operational benefits AI brings—enhanced event review, better data correlation, and improved SOC workload—the accompanying liability feels disproportionate to the authority they actually wield. The expanded mandate arrives faster than the authority needed to enforce it, leaving security leaders answerable for risks they may not have the power to fully control.
Shadow AI Expands the Attack Surface CISOs Must Manage
Despite the advantages AI offers, a parallel threat is growing unchecked: shadow AI. Teams frequently build applications using “vibe coding” practices and wire AI models into production without formal security approval, creating systems the CISO never sanctioned. In the same Splunk survey, 92% of CISOs said AI helps their teams review more security events, and 89% reported better data correlation, yet the very tools that boost efficiency also fuel uncontrolled risk. TJ Marlin, CEO of Guardrail Technologies, notes that this disconnect stems from business units moving faster than security can govern, expanding the attack surface that CISOs must answer for.
Business Leaders’ Low Cybersecurity Fluency Fuels Risk Growth
Compounding the shadow AI problem is a widespread lack of cybersecurity literacy among executives. Approximately 85% of business leaders lack basic cybersecurity fluency, which hampers effective risk communication and decision‑making. When non‑technical leaders champion AI initiatives without grasping the associated security implications, the CISO ends up owning risk they have little influence over. This fluency gap means that even well‑intentioned security recommendations can be overridden or ignored, accelerating the proliferation of uncontrolled AI deployments.
Three Strategic Moves to Reclaim Authority Before the Next AI Agent Ships
To counterbalance liability with leverage, security leaders can adopt a three‑step sequence: (1) get security into the decision before the AI ships, (2) translate the risk into language the board understands while they are listening, and (3) build a governance record that will survive scrutiny after the CISO’s tenure ends. Each step aims to reclaim a piece of the authority that liability already assumes, turning a reactive posture into a proactive, governance‑driven approach.
Move Security Upstream: Embedding Controls in AI Development
The first move calls for embedding security early in the AI lifecycle. Michael Fanning argues that security must be part of the rollout process, advocating for safe defaults and rigorous review before agents reach production. With 96% of CISOs already accountable for AI governance, waiting to assess risk after deployment means owning exposure they never saw. By shifting left—integrating threat modeling, data‑privacy checks, and model‑validation gates into development pipelines—security can influence design decisions, reduce shadow AI, and establish a clear audit trail that demonstrates due diligence.
Translate Risk into Board‑Friendly Language to Secure Budget and Credibility
The second move focuses on communication. Fanning ties the 85% cybersecurity‑fluency gap to the need for a shared vocabulary that frames technical risk in business terms. CISOs who can articulate AI risk as potential financial impact, regulatory penalties, or reputational damage are more likely to secure the budget and executive sponsorship needed for robust controls. Crafting a regulator‑ready compliance story on incident disclosure not only satisfies auditors but also provides a defensible narrative that reduces the time spent defending personal liability after a breach occurs.
Build a Program That Outlives the CISO Tenure for End‑of‑Tenure Audits
The final move stresses longevity. Justin Bajko, co‑founder and chief strategy officer at Expel, advises building a governance program that endures beyond any individual leader’s tenure. Such a program should be documented, repeatable, and aligned with industry standards so that it can withstand scrutiny from regulators, law‑enforcement agencies, or even prospective employers reviewing a former CISO’s résumé. For the 26% of security chiefs already eyeing the exit, a durable AI‑governance framework serves as both a professional safeguard and a signal to boards that accountability is institutionalized, not personality‑dependent. By investing in controls that outlive any single leader, organizations reduce the risk that a departure will leave a governance void, thereby addressing the very liability concerns prompting CISOs to consider leaving.