The New Security Mandate: How the CISO Role Is Expanding Well Beyond Traditional Cybersecurity

In this age of heightened geopolitical instability and rapid technological advancement, the repercussions to organizational security have been massive. Once largely focused on protecting systems, security now involves safeguarding the entire enterprise, including data, people, and assets. New types of threats are constantly emerging and quicky changing how organizations view risk and who is responsible for managing it. 

These factors have greatly affected the mandates of Chief Information Security Officers (CISO). Previously, much of the focus of a CISO was on more narrowly defined cybersecurity, but now it is so much more: cyber+physical security+ the emerging implications of cutting edge technology, from AI to quantum computing.  

In particular, we see three major forces that are fundamentally reshaping the security landscape. 

As AI integration expands across organizations, security leadership for AI can no longer sit solely with a Chief AI Officer or data function. CISOs are increasingly responsible for ensuring that AI systems are built and operated on secure foundations, protecting training data, safeguarding models and algorithms, and governing how AI is deployed across the enterprise. 

Increasingly, “bad actors” are leveraging automation and AI to scale phishing campaigns, exploit vulnerabilities, and move at machine speed. In response, defense mechanisms are also becoming more automated and AI-enabled. CISOs must now operate in an AI arms race, balancing secure enablement of AI innovation with staying ahead of increasingly sophisticated, automated threats. 

For many organizations, this also raises structural questions. Security responsibilities related to AI often sit across multiple functions, including data, engineering, and risk, requiring CISOs to also operate as orchestrators and ensure technical expertise isn’t siloed.  

A second emerging trend is the convergence of cyber and physical security. Historically, these domains have often been managed separately. CISOs oversaw the digital side of things and Chief Security Officers handled the physical ones, such as facility protection, executive security, and plant security.  

But those lines are blurring more than ever before. As cyber threats spill into operational technology, critical infrastructure, and connected environments, organizations are recognizing security as a single, integrated discipline. While this model is still evolving, we increasingly see CISOs asked to oversee broader security mandates, particularly in asset‑intensive industries. The CISO is gradually becoming the enterprise-wide security leader, accountable for protecting systems, data, people, and physical assets under one coherent strategy.  

Looking ahead, quantum computing will redefine cybersecurity. Once sufficiently powerful quantum computers become available, many of today’s cryptographic standards will no longer be secure. Therefore, data that is considered protected today may be vulnerable in the future. 

This creates a new expectation for CISOs: the ability to plan far beyond current threat horizons. Forward-looking security leaders are already incorporating post‑quantum considerations into their long-term roadmaps, assessing cryptographic dependencies, and preparing their organizations for an inevitable transition. Quantum computing will not only change how attacks work; it will also reshape defensive capabilities, requiring sustained strategic leadership. 

Overall, there is significant uncertainty on the timeline for quantum breakthroughs. Organizations that begin preparing early will be better positioned to navigate this transition. 

Demand for security leadership has never been higher, particularly for individuals who can operate at the intersection of technology, risk, and enterprise strategy. But that talent pool is relatively small, and even smaller for those with relevant quantum experience. We have seen a growing interest in leaders with profiles such as: 

• Senior military leaders transitioning into the private sector 
• Executives with experience in both physical and information security 
• Leaders who combine technical credibility with crisis leadership and stakeholder management 

However, it’s also important to be realistic. Not all organizations need, or are able to hire, a security leader who oversees every aspect of security. The priority should be aligning the role with the organization’s specific risk profile, industry context, and existing leadership capabilities.

Taken together, these trends underscore how much the CISO role has evolved. Technical depth remains essential, but it is now table stakes. The modern CISO must be a strategic leader, comfortable engaging with boards, fluent in AI and emerging technologies, and generally focused on enterprise resilience over the long term. 

Since the expectations placed on CISOs today are fundamentally different from those of even a few years ago, there are a few steps organizations can take now to keep pace with the evolving landscape: 

1. Clarify the security operating model: Assess whether a converged (physical, cyber, and other security domains are managed together under one leader) or integrated (domains that work closely but may remain separate, collaborating across functions) approach best fits your organization. 
2. Elevate security leadership to the executive and board level: At this point it should go without saying that CISOs need access to executive leadership across the enterprise and to the board to effectively do their job, but it is not always the case, so organizations should assess this to ensure they do. 
3. Invest in cross-functional collaboration: Break down silos between cyber, physical security, and risk functions. I 
4. Focus on timely, concise communication: Effective cybersecurity depends on a constant, disciplined exchange between business leaders, technical teams and the directors of the board. Concise, timely communication ensures that business priorities, operational realities, and emerging threats are understood on both sides, enabling faster decisions and more effective risk mitigation. 
5. Prepare for emerging disruptions: Begin incorporating AI and quantum considerations into long-term planning. 
6. Broaden the talent lens: Look beyond traditional career paths to identify leaders with the right combination of experience and capabilities. 

Rapid change and the instability it creates demand increased vigilance. As long as the world is in a state of such broad transformation, there will be pressure on CISOs to advance security measures across their organizations. In short, we only expect this pressure to keep increasing and the mandate for responsive CISO leaders to keep growing and becoming more imperative. Security is as evolutionary as the circumstances that require its enforcement.  

As organizations navigate ongoing uncertainty and emerging risks, the role of the CISO will continue to transform and play an increasingly central role. CISOs will need to marry technical expertise with adaptability, leadership, and the ability to foster collaboration across functions. A CISO is not in place to hold back innovation or transformation. These leaders help steer a strong governance system that allows the organization to seize opportunities and be aware of risks earlier.