🔒 How AI is Transforming the CISO Role — And What Really Matters

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

Artificial Intelligence (AI) is reshaping how we think about cybersecurity. Whether you’re exploring “AI for Security” (using AI-driven tools to bolster defenses) or grappling with “Security for AI” (safeguarding emerging AI systems), today’s CISOs stand at a fast-evolving crossroad. From generative AI to compliance expansions, the modern CISO’s scope is broader than ever. But there’s one message worth emphasizing: Although attackers may benefit from Large Language Models (LLMs), the real game-changer isn’t an onslaught of unstoppable AI-driven breaches—it’s how CISOs strategically adapt to the new landscape.

Below, we’ll unpack why AI is shaking up the CISO’s world, where the real challenges lie, and how you can stay ahead.

🤖 1. “AI for Security”: Leveraging Generative AI Defensively

Many CISOs view AI as an accelerator for threat detection and response. According to the latest Foundry/CSO Security Priorities Study 2024, 98% of organizations using AI-enhanced security see significant benefits—everything from faster remediation to reduced analyst workloads. In practical terms, generative AI can:

• Automate routine tasks. AI can sift through network logs, correlate threat data, and flag anomalies at speed and scale no human team could match.
• Optimize threat intelligence. AI-driven solutions can surface patterns of attack and map suspicious behaviors to known adversarial campaigns.
• Augment vulnerability management. By scanning code for common flaws or automating patch priority lists, AI helps teams remediate faster.

As John Ang (Group CTO at EtonHouse) notes, “adequate protection isn’t just about staff training—it starts at the top.” That also means board-level understanding of why AI tools deserve investment.

Yet, even as we celebrate AI’s defensive benefits, generative AI alone won’t solve every security woe. Skilled people are still essential to interpret alerts, handle nuanced decisions, and shape the broader security strategy.

🛡️ 2. “Security for AI”: Safeguarding Emerging Systems

As organizations deploy AI at scale—machine learning pipelines, agentic AI workflows, LLM-based chatbots—these become new targets. Where do the threats loom?

• Data poisoning: Attackers manipulate training datasets to produce flawed AI outputs.
• Model theft: Proprietary models can be exfiltrated, cloned, or repurposed by malicious actors.
• Prompt injection: Especially relevant in generative AI, malicious prompts can make an AI system behave unpredictably or leak confidential data.

CISOs must integrate AI governance, data protection, and compliance into their overall cyber program. Carol Lee (Deputy GM, Cyber Security & Risk Management at Hang Lung Group) foresees broader AI governance responsibilities coupled with data privacy demands—skills that will be at a premium in any CISO’s toolkit.

⚖️ 3. Expanding Risk & Compliance: “Generative AI” as a Force Multiplier

Even if LLM-driven attacks haven’t become the doomsday scenario some feared, the adoption of generative AI has expanded the risk surface in other ways. For instance:

• Regulatory scrutiny is intensifying. The EU AI Act is one example, with more likely to follow in APAC and beyond.
• Policy & ethics: AI’s capacity for large-scale data processing raises ethical considerations around privacy, bias, and overall governance.
• Supply chain security: As organizations integrate third-party AI solutions, new dependencies (and vulnerabilities) arise.

As Cezary Piekarski (Standard Chartered Bank) predicts, 2025 and beyond will expose gaps in how quickly businesses adopt AI enhancements and the ability of security teams to keep up. That means carefully balancing your enthusiasm for new AI solutions with robust risk assessments and compliance checks.

🚀 4. Don’t Overestimate the ‘LLM Advantage’ for Attackers

Despite sensational headlines, we haven’t yet seen an onslaught of major intrusions purely powered by generative AI. Sure, LLMs can help attackers craft more fluent phishing emails or automate part of their reconnaissance. But serious threat actors still rely on tried-and-true techniques (phishing, ransomware, supply chain compromises) that have knownsuccess rates and known ROI.

AI-driven attacks can introduce unpredictable code behavior and complicate intrusion campaigns. Ironically, the more adversaries rely on LLMs for “creative tasks,” the higher their risk of automated missteps. In other words, the hype can overshadow reality. As a CISO, focusing on known vulnerabilities, user awareness, strong authentication, and proven technologies like Extended Detection & Response (XDR) or Zero Trust remains your best line of defense.

Sam Goh CISA, CISM, CDPSE, CISSP, CPISI, ISMS LA (CISO at DataX) calls this an emerging “AI divide”: some criminals may experiment, but established attackers still find “traditional” hacking more predictable and cost-effective.

🌐 5. How the CISO Role Is Evolving

With AI reshaping nearly every business function, CISOs increasingly find themselves wearing multiple hats. In fact, 72% of security decision-makers in the Foundry/CSO Security Priorities Study say their roles have expanded within the last year—taking on AI governance, broader risk management, and even digital transformation initiatives. Some organizations are rebranding the role into a “Chief Security and Resilience Officer” or “Chief Digital Security, Risk, and Resilience Officer.”

Key pillars of this expanded role include:

1. Holistic Strategy & Governance

Align AI deployments with cybersecurity best practices and corporate risk appetite.

2. Cross-Functional Collaboration

Team up with legal, compliance, data science, and executive leadership to develop governance frameworks for generative AI and beyond.

3. Continuous Education & Training

Just as your staff needs upskilling on new AI tools, they also need awareness of AI-driven threats. Many experts, including Dominic Grunden (CISO at Smile Technology), emphasize equipping teams with both technical acumen and a security-first culture.

4. Incident Response & Resilience

In healthcare, finance, or manufacturing, a prolonged outage can be catastrophic. AI can accelerate detection, but human oversight remains crucial for rapid remediation.

💡 Practical Next Steps: Balancing Vision and Real-World Context

1. Upgrade, Don’t Overhaul: Leverage AI to automate repetitive tasks—threat hunting, log triage, vulnerability scans. But keep seasoned analysts in the loop for advanced threat detection and incident handling.

2. Consolidate Controls: Evaluate how new AI solutions integrate with existing frameworks like Zero Trust or SASE. AI sprawl can create unintentional blind spots.

3. Define AI Governance: Work with legal and compliance teams to set policies around model training, data privacy, and usage guidelines. That ensures responsible AI deployment without stifling innovation.

4. Prepare for ‘AI 2.0’: Watch for evolving agentic or multimodal AI capabilities that might shift the threat landscape. Build agile processes now so you can respond quickly to future developments.

5. Stay Grounded in Reality: AI is an evolving tool—not a magic bullet for defenders, nor an invincible weapon for criminals. Risk-based, real-world assessments will yield better outcomes than knee-jerk fear.

🏆 Conclusion: A CISO’s Moment of Opportunity

Far from being an existential threat, generative AI is a catalyst challenging CISOs to refine their craft. Yes, AI can aid attackers, but it’s also one of the most potent tools defenders have ever had. The widespread adoption of AI across the enterprise is stretching the CISO remit in compliance, ethics, data governance, and beyond—yet offers an unparalleled opportunity to innovate and lead.

In short: Don’t let the headlines about “AI super-hackers” distract you from building a well-rounded security program. The future CISO will be the linchpin—enabling safe, ethical AI-driven growth while keeping a level head about the real risks and the real rewards that AI brings to cybersecurity.

Which aspect of AI is most pressing for your security strategy—“AI for Security,” or “Security for AI”? Feel free to share your thoughts or experiences in the comments!

Further Read

• 25 on 2025: APAC security thought leaders share their predictions and aspirations
• What is a CISO? Responsibilities and requirements for this vital role
• Security priorities emphasize CISO role on the rise
• CISOs should stop freaking out about attackers getting a boost from LLMs

Publication Note & Disclaimer
This article was originally published on LinkedIn on February 11, 2025 and may have been edited or updated for publication on this site.

It reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.