CISOs Can’t Agree Where the AI Express Is Headed But They’re All Onboard

by Nick McKenzie, Chief Information Officer and Chief Security Officer at Bugcrowd

AI is a disruptive technology in more ways than one. A survey of 209 CISOs and security leaders globally shows security professionals struggling to reach a consensus about what AI means for their organisations and their own roles.

Despite a range of divergent and sometimes contradictory views, the report Inside the Mind of a CISO leaves little doubt that AI is a powerful force for change. What’s less clear is whether change overall will be good or bad. And perhaps it’s too early to expect CISOs – or anyone – to be able to settle that question.

As for disruption, the survey points to a worryingly high level of burnout among security professionals, with as many as two-thirds of CISOs who believe that security practitioners experience a higher rate of burnout than other roles.   Aggravating factors for this include the hiring landscape: over half of CISOs say their teams are understaffed and 87% are currently hiring.

However, there is growing confidence that AI will make a positive difference at least in automating some of the less skilled roles. Nearly a quarter of respondents (23%) say that AI tools have already enabled them to reduce or repurpose headcount, while 71% expect to have made cuts over the next three to five years.

Gartner endorses this trend. They have gone on record to say that by 2028 AI will have closed the skills gap. However, and this is the critical point, the Gartner prediction refers to “entry-level skills”. That begs some big questions about the security workforce as a whole. What skills will be needed to address the next wave of AI-enabled threats? Will AI tools mitigate those too? Or will we just see the bar raised in future?

Not to leave those questions hanging, I believe the answers are “We don’t know yet”, “Not entirely” and “Yes”. While it would be reassuring to think that AI will close the skills gap, I think it’s more accurate to predict that it will change it. The bottom line for organisations of all kinds is that finding the right people to mount an effective defence will be challenging for the foreseeable future.

CISOs are realistic about the threats facing their organisations. Asked about their top priorities, only 18% had the goal of “avoiding breaches at all times”. Most of the responses were more pragmatic than optimistic, with 17% voting for “balancing risk against business objectives” and 20% for “building resilience”. In other words, few CISOs believe they’re in a war that will be over anytime soon. The majority are settling in for a long campaign.

The top priority for 31% of CISOs is “building a security brand”, reflecting their belief that effective cybersecurity is now a major factor in competitive advantage. This is a significant finding reflecting a shift in attitudes from a “do enough” compliance culture to a business environment in which being seen to “do more” has become a critical measure of business viability and being a business enablement powerhouse.

Few CISOs in the survey believe organisations are doing enough today, however. Most believe that the majority of organisations do not fully understand the risks of being breached and, as a result, are not as well defended as they could be.

While they also understand that many of the decisions organisations make will be a trade-off between business benefit and security risk, CISOs have serious concerns that some may start taking risks that will compromise their customers’ long-term privacy or security for the sake of short-term savings.

As for AI, while CISOs are currently split about its use, this is more a matter of timing than any deeply held conviction.

Nearly eight in ten (78%) are already using AI in their security teams and of the rest, only 3% say they will never use it. Does it outperform some of its security professionals in certain cyber processes? Yes, according to 44%, while most of the rest (47%) believe that it will eventually replace team members when the technology improves. This is not a view shared by ethical hackers, who believe that while AI adoption will increase, it will never replace human ingenuity.

The picture may be more nuanced. As we saw earlier, there’s no doubt that AI will replace low-level security roles with certain operational-type characteristics. What happens further up the skills hierarchy is less clear.

Even with the benefits of AI from a hiring perspective, the jury is still out on AI’s long-term potential. 58% of CISOs argue that the risks of AI outweigh the benefits. CISOs are scrambling to put defensive measures in place to prepare, with 95% of CISOs having already implemented AI-based defensive measures, including crowdsourcing and pen testing.

In a sense this part of the debate is academic. The AI train is rolling and like it or not most CISOs are already on board.