Risks & Rewards: How AI Is Redefining the CISO’s Role

Nvidia security executive Mark Weatherford says CISOs must help business leaders weigh AI’s pros and cons, and ensure those deploying it own the risks.

ISC2 Strategic Congress 2026 — Denver — The CISO role is evolving around AI, with security leaders now expected to help the business gain a competitive edge with it while also using the technology to help manage cyber-risk.

Doing both jobs at once means keeping up with technology that changes by the month, Mark Weatherford, Nvidia’s head of cybersecurity policy and strategic engagement, said this week at the ISC2 Strategic Congress 2026.

The Need for Speed

“Speed is the biggest challenge right now,” Weatherford said in a conference session on the evolving CISO role in the AI era. “Technology is changing so fast it is really hard for us to keep pace.”

The shift shows up in routine practices too, he noted. Penetration testing four times a year for instance, once counted as adequate. Now, anyone not testing around the clock is probably not testing enough.

Weatherford served as deputy undersecretary for cybersecurity at DHS in the Obama administration and was previously chief information security officer for the state of Colorado and the state of California. His other career highlights include serving as chief security officer of the North American Electric Reliability Corporation (NERC) and as a security leader at Booking Holdings.

Weatherford pointed to a sense of FOMO — or a fear of missing out — as driving many organizations to deploy AI without always doing business due diligence or understanding what value they might be deriving from their investment. While there are many instances where the rush to spend might make sense, there are other cases where the case for AI may not be as clear cut.

Command by Negation

CISOs often, though, have the opposite tendency, which is defaulting to “no” when there is the slightest element risk involved. Weatherford pointed to the Navy concept of command by negation where subordinates take autonomous action to meet an overall goal unless the superior asks them to stop.

He opined that cybersecurity leaders should similarly be willing to accept more risk on their own, calibrated to their company’s risk tolerance. “You have to be curious. You have to be willing to step out of your comfort zone,” he said.

Weatherford encouraged CISOs to continuously think about how AI can help transform business and security and look for opportunities to make themselves better in their role. CISOs who expect their reputations and past work alone to carry them through the future are limiting their potential, he cautioned.

“Be curious, be creative, be willing to learn and relearn,” Weatherford said, adding that one way to get up to speed on AI is to pick up one new topic every week.

The worry about being too slow to tap AI comes amid growing concern about organizations moving too quickly to implement AI without considering appropriate controls or without a full appreciation of associated risks, Weatherford noted. It is the role of the CISO to make sure the board understands the risks and knows who owns each risk, especially when another executive’s deployment creates it.

Such frankness can potentially be career-limiting at times, Weatherford conceded. But CISOs often end up getting blamed for decisions that are not theirs, and they need to push back, he advised. “I would say we need to make sure that the people taking the risk are responsible for the risk.

For the talent pipeline, Weatherford favors paid internships that bring AI-native young people into the company and teaches them the business. One of his interview ideas is to hand a candidate a business problem and let them use AI to solve it live, with no single right answer, to test flexibility.

It’s also important for CISOs to ensure that people continue to have a career path and upward mobility within the organization, Weatherford said. It’s a mistake to assume that paying people more and keeping them in their same roles is a way to retain talent.