The new danger for CISO’s…

What is an Anti-CISO?

A few years ago, I wrote about the concept of the “Anti-CISO,” a security leader who operates outside the traditional boundaries of a CISO role. I argued that a CISO’s often isolated position—focusing primarily on compliance, risk management, and a narrow view of security—created a disconnect between security and the business. The Anti-CISO, I suggested, would be a leader embedded within the business, working collaboratively with all teams, and aligning security strategies directly with organisational goals.

But since then, the landscape has shifted. The role of security has evolved. And, I’ve realised that while the Anti-CISO model still holds significant value, the landscape demands even more than just decentralisation and integration. It now requires an embracing of new technologies and a rethinking of how security can be truly scalable across the enterprise.

The CISO: Evolving or Stagnating?

For context, the traditional CISO was once seen as the protector of the company’s digital perimeter, often working in isolation, dealing with breaches, threats, and compliance at a high level. There’s nothing wrong with that, but in today’s world, that role isn’t just about securing data. It’s about shaping organisational resilience, aligning security with business strategy, and leading a culture where security is everyone’s responsibility.

Today, CISOs (or whatever title you prefer) are expected to be strategic leaders who work across departments, enabling business initiatives while ensuring risk is managed appropriately. That sounds great in theory, but often, this is easier said than done. In fact, many organisations still wrestle with integrating security into the fabric of business decision-making. That’s where decentralisation comes in.

Why Decentralisation Still Makes Sense

The evolution of cyber threats and the rapid pace of technological change don’t always lend themselves well to a single, centralised security figure. Sure, the CISO or security leader might be the one who is ultimately responsible, but real change comes when security is everyone’s responsibility.

Security is not just the CISO’s problem—it’s everyone’s problem, from the developers writing code to the marketing team handling customer data. To make this work, we need a decentralised approach where the security function supports the entire organisation but lets individual teams take ownership of their own risk areas.

That’s why I’m still a huge proponent of decentralisation in security. But it’s no longer just about human decision-makers at the centre of it all. With the rise of AI agents, decentralisation has gained new power. AI-driven tools, particularly in threat detection and response, enable security teams across the business to work autonomously while remaining aligned with the broader security strategy. AI makes decentralised security scalable, efficient, and much more responsive.

Enter AI: The Great Decentraliser

The introduction of AI into the security ecosystem is the game-changer. Gone are the days when security was about a handful of humans constantly monitoring systems, running reports, and responding to incidents. Now, AI agents are able to autonomously detect, assess, and respond to security threats in real-time, operating across multiple touchpoints within the organisation, without requiring human intervention at every step.

This shift does two things. First, it decentralises decision-making. AI can handle tasks that were once bottlenecks in the security process, enabling teams across the business to move faster and more effectively. Second, it scales security efforts without scaling the team. AI allows you to amplify your security footprint without increasing your workforce. That’s decentralisation taken to the next level.

Security leaders now need to think not just about how to manage people and processes, but how to leverage technology to empower those people in a decentralised environment. Security leaders—whether they are CISOs or Anti-CISOs—must act as enablers, equipping their teams with the tools, frameworks, and autonomy they need to manage security on a day-to-day basis. The traditional “top-down” approach is no longer sustainable in a world where threats evolve faster than teams can react.

The CISO’s AI Struggles: Scaling Challenges

But here’s where things get interesting—and a little messy. As AI continues to scale in the workplace, CISOs will soon face a fundamental challenge: they may find themselves overwhelmed by an AI-driven workforce they didn’t anticipate. The speed at which AI systems can now monitor, analyse, and respond to threats will likely outpace human capacity to manage these systems effectively.

As security increasingly relies on AI agents, CISOs may find it difficult to maintain control over a workforce that operates independently, learning and evolving without human oversight. Imagine a world where AI systems are continuously updating their strategies, adapting to new threats, and making decisions without direct human input. This scale will require a level of technical expertise and strategic oversight that most CISOs aren’t currently prepared for—leaving them struggling to maintain control.

In this new world, the traditional CISO role will likely need to be augmented with AI-driven tools. Enter the CISO agent.

The Rise of the CISO Agent: A Threat to the Traditional CISO

The concept of the CISO agent is an intriguing one. What if instead of relying on a single human CISO, organisations started leveraging AI to function as the CISO? These AI-powered agents would have the capacity to make autonomous security decisions, adapt strategies in real-time, and act on behalf of the organisation’s security leadership.

On the surface, this might sound like a dream come true—AI systems that can scale endlessly, react faster than any human, and maintain security in a constantly evolving threat landscape. But there’s a darker side to this. If AI systems take over the CISO role, they don’t just automate decision-making—they also centralise it in ways that could put a lot of power in the hands of machines, removing human judgement from key decisions.

The danger here is twofold: first, CISOs might find themselves relegated to being secondary players, overshadowed by their AI counterparts. Second, as AI takes over, organisations might lose the human insight and strategic vision that real, experienced CISOs bring to the table. Instead of guiding organisational strategy and aligning security with business objectives, the CISO agent might simply execute predefined security protocols, without considering the broader impact on business operations.

This doesn’t just endanger the CISO role—it endangers the future of security leadership, as we risk becoming overly reliant on algorithms that, no matter how advanced, still lack the nuance and adaptability that humans bring to complex, high-stakes decisions.

Conclusion

The Anti-CISO concept remains relevant today, but the role of security leadership is expanding beyond what I first envisioned. Decentralisation is still the key, but now it’s decentralisation enabled by AI. Security leaders who recognise this shift and embrace the decentralisation of responsibility, combined with AI’s capabilities, will be the ones driving the future of cybersecurity.

The path forward isn’t about consolidating security into one office or team. It’s about creating a decentralised ecosystem of empowered teams, each supported by cutting-edge tools that allow them to act autonomously, while still aligned with broader organisational security goals.

But as AI systems scale and potentially take over more decision-making roles, we must be mindful of the balance between technology and human leadership. It’s not about replacing the CISO with an AI agent—but about finding the right synergy where human expertise and AI can co-exist, each empowering the other to create a more resilient, secure organisation.

Let’s move beyond the traditional models and build something that truly scales, operates seamlessly, and empowers every team to contribute to our collective security—without losing sight of what makes human leadership in security so valuable.

#cyber #security #ciso