This year, 80% of surveyed organizations plan to increase their AI investment, according to a Deloitte report, as many enterprises seek to accelerate AI adoption and reap the benefits of the cognitive revolution. The rapid expansion of AI has caught many CISOs off guard as they scramble to adapt existing security solutions to the new risks created by AI-powered applications.

CISOs face a multidimensional challenge: they must quickly implement security guardrails to support AI adoption while transforming their organizations into modern, AI-powered security enterprises. Rapidly evolving technology choices, including automation from non-traditional vendors, complicate decisions around which solutions may be sustainable. This transformation will encompass significant changes to technology, talent models/workforce, governance, and the operating model.

Despite these challenges, there is enormous opportunity for CISOs and enterprises to utilize new tools to design, build, and operate a new AI-enabled cybersecurity function that can help reposition cybersecurity as a strategic engine for business growth and competitive edge. To fully realize these benefits, CISOs should develop a blueprint that aligns AI adoption with overall cybersecurity objectives, business strategy, and cost-containment goals – enabling them to do more than defend and instead harness AI to propel the business forward.

Technology advantage: right place, right time to value

As AI continues to advance rapidly, cybersecurity transformation is becoming even more complex and many security solutions can become obsolete quickly. While a powerful tool for business, AI is also a powerful tool for threat actors – and enterprises need to move to protect at the pace of change. At the same time, there is an opportunity for organizations to leverage this tipping point to reimagine cybersecurity as a driver of business outcomes.

When evaluating AI technologies, CISOs should prioritize solutions that are durable and align with a long-term adoption roadmap. Key considerations include workforce readiness – since many solutions require extensive AI training that may take years to deliver economic benefits – support for business strategy and measurable outcomes, and scalability. It’s also important to focus on solutions that drive efficiency rather than adopting new technologies for their own sake. Ultimately, each approach should be durable and directly support the organization’s strategic goals.

Scale geometrically

It's easy to get sidetracked by every opportunity for AI automation. The promise of getting more done can often inspire fear of missing out, especially as organizations seek to incorporate AI into their businesses for maximum benefits. AI is particularly valuable in areas where it can scale variable workloads and reduce security fatigue. For example, security operations centers (SOCs) can experience drastic fluctuations in incident volume. During peak periods, the limited number of analysts can result in backlogs, as each incident typically requires 20 minutes to resolve. When incidents number in the thousands per day, delays increase the risk of undetected breaches.

Implementing AI SOC analysts can reduce ticket resolution times, allowing digital analysts to scale seamlessly with rising workloads. Even during substantial surges in ticket volume, minimal human oversight is needed, enabling geometric scalability. This approach not only enhances efficiency and reduces fatigue but also empowers the cyber function through AI-driven capabilities while freeing up analysts to focus on security incidents.

Cognitive synergy

As enterprises adopt AI, they are working with foundation models that are evolving rapidly. Advances in domain-specific language models that can reason compliance controls and security risks can help accelerate adoption. These models offer the opportunity to consolidate processes that were previously divided. Much of security was designed around the experience and skills of the human talent model. In an AI-powered cybersecurity organization, AI applications and agents are not limited by specific skills but rather can be trained on multiple tasks.

For example, many organizations separate the automation of security controls from the audit process. However, in an AI-driven model, the agent that performs the security process will also understand audit controls and be able to interact with internal and external auditors to provide compliance evidence. AI solutions that can be trained to handle multiple challenges are more versatile and create synergy benefits.

Innovate new cybersecurity capabilities

AI is a valuable productivity tool for businesses, but it can also be a powerful tool for attackers, potentially straining current cybersecurity defenses. This situation creates a rapid innovation cycle where CISOs will have to develop capabilities to not only preempt these advanced AI threats but also harness their existing data, simulating attacks and training AI agents and applications to apply countermeasures. AI digital assistants not only help reduce workload, alleviate fatigue, and enable security workers to do more, but can also enhance security outcomes and provide CISOs with greater visibility into risk exposure in near real-time.

While much of today’s AI security guidance centers on establishing guardrails for adoption, CISOs should also develop a clear roadmap to enable AI across the entire cybersecurity function. The rapidly evolving technology landscape and prevalence of "AI washing" make it challenging to prioritize adoption and navigate disruption. To cut through the noise, CISOs should focus on solutions that enhance autonomy and augment human reasoning, not just automation. The objective is to keep humans on the loop, supporting continuous feedback and maturity. Ultimately, success depends not only on training, but on building security functions that self-learn and adapt over time.

Conclusion

As AI continues to disrupt business and rewrite the rules of how enterprises operate and the workforce manages day-to-day tasks, cybersecurity leaders should look to cut through the noise and complexity to lead in an AI-powered future. Those that seize this change as an opportunity may be better prepared to unlock new value by evolving their people, processes, data, and technology to help transform the cybersecurity function and create the enterprise of the future.