In the AI era, cybersecurity leaders must explain how AI-related risks connects to business goals and help executives understand who is responsible for accepting those risks, according to Nvidia’s head of cybersecurity policy, Mark Weatherford.
Speaking at ISC2 Security Congress 2026, in Denver, Colorado, on October 26, Weatherford argued that the broad adoption of AI in the workplace, including in cybersecurity workflows, has transformed the CISO role from a security gatekeeper to a business-risk translator.
As organizations weigh AI adoption, CISOs must help executives understand the tradeoffs and clarify who owns the risk, he said.
Weatherford recalled a board meeting where a CISO struggled to explain the relationship between security and the business. Ultimately, the board challenged the CISO on their understanding of the company’s business model. This event, he said, had a negative impact on the perception the board had of the CISO’s credibility and ability to protect the business.
Weatherford said the exchange taught him that CISOs need to understand how their organizations generate revenue, not only how to protect them.
He added that business perspective is especially important as organizations weigh the potential benefits and risks of AI.
For instance, boards may worry that moving too slowly will cost them competitive advantage, Weatherford said, while moving too quickly can mean deploying tools without appropriate controls or an understanding of the risks.
While he argued that CISO rarely owns the business risk from deploying things like AI, he emphasized that modern CISOs must interpret that risk and make sure leaders understand who owns it.
Balancing AI Innovation With Cybersecurity Risks
Weatherford described two main challenges CISOs face with AI.
First and the “pace of technological change” makes their work more challenging.
Second, CISOs need to focus both on “security for AI and AI for security,” protecting the AI systems their organizations deploy while also considering how AI can support security operations.
Combined, these challenges mean traditional cybersecurity approaches may no longer be sufficient, he argued.
“If you’re not doing pentesting 24/7, 365, you’re probably behind the curve,” he said.
Weatherford also cautioned against investments driven by “fear of missing out.”
Leaders, he said, should do business due diligence before spending heavily on AI. CISOs can contribute by preparing concrete proposals for reducing risk. He recommended putting together a short plan that describes the proposed work and the resources it would require.
Vendor evaluation is another area where CISOs need to apply judgment. Weatherford said he looks for AI-native products that address security problems, rather than older products with AI added on.
He urged CISOs to consider supply-chain dependencies, too. Multiple vendors may depend on the same suppliers, creating single points of failure that can affect more than one product or service. Some dependencies may sit several tiers down the supply chain, beyond the suppliers an organization knows it relies on directly.
Weatherford’s advice for keeping pace with these changes was to stay curious and keep learning and even relearn things as technologies evolve.
For instance, he encouraged CISOs to “learn one new thing every week,” suggesting focusing on one AI topic at a time, such as model context protocol (MCP), prompt injections or sandboxing.
Finally, Weatherford recommended CISOs to join and create formal and informal peer communities. He mentioned that he created a CISO Exchange Network in which he invited CISOs from Nvidia’s major partners, customers and suppliers, where they share experience, concerns and tips.