Mark Weatherford, a security executive at Nvidia, stated that Chief Information Security Officers (CISOs) must assist business executives in weighing the advantages and disadvantages of artificial intelligence.
Furthermore, these security leaders must ensure that those deploying AI assume accountability for the associated risks. This perspective was shared by Weatherford during the ISC2 Strategic Congress 2026 in Denver.
The CISO function is undergoing a transformation due to AI, requiring security leaders to simultaneously help the enterprise gain a competitive advantage while also using the technology to manage cyber-risk. Weatherford, who heads cybersecurity policy and strategic engagement at Nvidia, noted this week that keeping pace with technology changing monthly presents a significant challenge.
"Speed is the biggest challenge right now," Weatherford remarked during a conference session addressing the evolving CISO role in the AI era. He added, "Technology is changing so fast it is really hard for us to keep pace." This acceleration affects standard procedures; for example, what once seemed adequate was penetration testing four times per year, but currently, anyone not testing constantly is likely testing insufficiently.
Weatherford, who previously served as deputy undersecretary for cybersecurity at DHS under the Obama administration and held roles as chief information security officer for Colorado and California, also mentioned the fear of missing out (FOMO) driving organizations to adopt AI. This rush sometimes occurs without due diligence or a clear understanding of the return on investment.
He observed that while some rapid spending may be justifiable, other AI cases lack clear justification. CISOs, conversely, often default to a "no" stance when even a minor risk is present. Weatherford referenced the Navy's command by negation concept, suggesting cybersecurity leaders should similarly be prepared to accept calibrated risk based on organizational tolerance.
Weatherford advised that CISOs need to cultivate curiosity and be willing to move beyond their established comfort zones. He urged them to constantly examine how AI can improve both business processes and security functions, cautioning that relying solely on past achievements limits future potential.
The concern regarding moving too slowly to adopt AI surfaces amidst worries that organizations are implementing AI too quickly without adequate controls or a full grasp of the risks. The CISO's duty includes ensuring the board understands these risks and knows who owns each one, particularly when another executive's deployment creates it.
Weatherford conceded that such forthrightness can sometimes impede career advancement. However, he advised that CISOs must push back when unfairly blamed for decisions outside their purview, stating, "I would say we need to make sure that the people taking the risk are responsible for the risk." For talent development, Weatherford supports paid internships that integrate AI-native youth into the company to teach them business functions, suggesting a test where candidates use AI to solve a business problem live.
This evolution of security leadership reflects a broader industry trend where operational tempo and technological velocity are forcing platform and security roles to become more integrated with strategic business execution.
