CISO Role Faces Identity Crisis Amid Expanding Responsibilities

• •79% of CISOs report increased complexity in their roles.
• •Two-thirds of CISOs still report to IT, indicating structural disconnect.
• •96% of CISOs now manage AI risk without a redesign of their roles.

The Chief Information Security Officer (CISO) role is undergoing a significant transformation as organizations increasingly require leaders who can manage complex cybersecurity challenges. According to the 2026 State of the CISO report, 79% of CISOs report that their responsibilities have become more complex, encompassing data privacy, regulatory compliance, third-party cyber risk, and AI governance. Despite this, two-thirds of CISOs still report directly to IT, indicating a disconnect in organizational structure. Todd Fitzgerald, an ex-CISO, notes that many organizations have yet to recognize the strategic importance of the CISO role. The report also highlights that 96% of CISOs are now responsible for AI risk management without a corresponding redesign of their authority or resources. This evolution reflects the growing need for CISOs to act as business leaders while still managing technical and operational responsibilities.