IANS and Artico Search have released their 2026 Security Organizational Design Benchmark Report, highlighting how artificial intelligence is reshaping cybersecurity leadership, governance and workforce planning. Based on research involving more than 1,400 CISOs and cybersecurity professionals, the report finds that 65% of organizations with more than $10 billion in revenue have assigned a head of AI security role, either as a dedicated position or alongside another leadership responsibility. Yet accountability for enterprise AI governance remains fragmented, with few large organizations placing it under the CISO and relatively limited formal board oversight.
AI Security Creates New Leadership Demands for CISOs
Artificial intelligence is changing not only how enterprises defend their systems but also how they organize the teams responsible for security and risk. A new report from IANS and executive search firm Artico Search suggests that organizations are creating dedicated AI security leadership roles while continuing to debate who should be accountable for enterprise-wide AI governance.
The 2026 Security Organizational Design Benchmark Report examines cybersecurity team structures, executive responsibilities, staffing and compensation across organizations of different sizes. Its findings draw on IANS and Artico Search’s annual CISO Compensation and Budget Survey and Security Staff Compensation and Career Surveys, with more than 1,400 CISOs and cybersecurity professionals represented in the research.
The results point to an organizational challenge accompanying enterprise AI adoption: securing AI systems is not necessarily the same responsibility as governing how an organization uses AI. Security teams may oversee model vulnerabilities, data exposure, identity controls and application risks, while enterprise AI governance can also involve business policy, legal compliance, responsible use and operational accountability.
For chief information security officers (CISOs), defining the boundary between those responsibilities is becoming an important part of organizational design.
Large Enterprises Formalize AI Security Leadership
According to the report, 65% of organizations with more than $10 billion in revenue have assigned a head of AI security role. However, only 18% have established it as a dedicated position; the remaining 47% combine the responsibility with another leadership role.
Dedicated AI security positions are less common among smaller organizations. The report places the figure at 9% for organizations with $1 billion to $10 billion in revenue and 6% for those below $1 billion.
The pattern suggests that large enterprises are more likely to formalize AI security leadership, while smaller companies generally distribute the work among existing teams. Governance, risk and compliance (GRC), security operations and security architecture leaders may already possess capabilities relevant to AI security, including access management, vulnerability assessment, data protection and risk analysis.
This does not necessarily mean every organization needs a new executive position. The appropriate structure depends on the scale of AI deployment, the sensitivity of the information involved, regulatory obligations and how extensively AI systems are integrated into business operations.
As AI applications move from experimentation into production, however, unclear ownership can make it harder to coordinate model security reviews, incident response, third-party assessments and controls over sensitive data.
Enterprise AI Governance Still Lacks Clear Ownership
The report identifies a significant gap between AI security leadership and responsibility for enterprise AI governance.
CISOs are the primary accountable executives for enterprise AI governance at 26% of organizations with less than $1 billion in revenue. That figure falls to 11% among organizations with $1 billion to $10 billion in revenue and just 7% at enterprises above $10 billion.
At the largest organizations, the chief AI officer is the most frequently identified accountable executive, at 22%. Across all three revenue groups, between 14% and 19% of organizations report having no single executive accountable for enterprise AI governance.
The findings highlight why the distinction between security and governance matters. Security teams can assess whether an AI application exposes sensitive data or creates a new attack surface, but broader governance may require decisions about acceptable use, business accountability, legal obligations and oversight of AI-enabled processes.
Responsibility spread across several functions can bring relevant expertise into decision-making. Without an explicit executive owner, however, organizations risk leaving gaps between policy development, technical enforcement and business accountability.
Board oversight remains limited as well. Only 21% of organizations with more than $10 billion in revenue have fully implemented a board committee dedicated to AI ethics or responsible AI, compared with 9% of organizations below $10 billion. The report says 43% to 48% of organizations across the revenue tiers have no such committee planned.
These figures do not establish that a dedicated committee is the right governance model for every company. They do show that formal board structures for AI oversight have not kept pace uniformly with the emergence of AI-related responsibilities.
Security Teams and Succession Planning Reflect Scale
The report also finds substantial differences in security staffing and leadership structures by company size. Organizations above $10 billion in revenue often have more than 100 security professionals, while those between $1 billion and $10 billion typically have more than 10. Organizations below $1 billion generally have fewer than 10 security professionals, according to the report.
Deputy CISO roles are more common in large enterprises. Some 58% of organizations above $10 billion have a deputy CISO, including 47% with a full-time position and 11% where the responsibility is combined with leadership of a functional department. The comparable figures are 31% for mid-sized enterprises and 19% for smaller organizations.
Yet the deputy role does not automatically provide a path to the top security position. The report says companies typically conduct external searches when a CISO leaves, creating a succession-planning challenge for organizations that want to retain institutional knowledge and develop internal leadership.
Cybersecurity Compensation Rewards Experience
Compensation findings reinforce the importance of experience and organizational scale in cybersecurity hiring. IANS and Artico Search identify years of information security experience as the largest driver of pay differences within the same role.
At organizations above $10 billion in revenue, individual contributors with eight to 15 years of experience earn approximately $35,000 more than those with fewer than eight years. The gap reaches about $50,000 for the most experienced staff, according to the report.
Full-time deputy CISOs at the largest enterprises average approximately $350,000 in annual cash compensation, with the top 10% earning more than $500,000. Security professionals and leaders at organizations between $1 billion and $10 billion earn roughly 16% to 26% less than counterparts at the largest enterprises.
These figures underline the cost of developing and retaining experienced security talent as AI adds new demands to already complex roles.
Organizational Clarity Will Shape Enterprise AI Security
The report suggests that AI adoption is prompting enterprises to reconsider security responsibilities, leadership structures and workforce development. Organizations do not necessarily need to create new departments for every emerging risk, but they do need clear accountability for technical controls and enterprise-wide decisions.
For CISOs, the immediate task is to determine which existing capabilities can be extended to AI, where specialist expertise is needed and how security teams should coordinate with AI leadership, legal, compliance and business functions.
As AI becomes more deeply embedded in enterprise workflows, organizational design will be part of the security strategy—not simply an administrative question. Clear ownership, experienced staff and effective oversight may prove as important as the technical controls organizations deploy.
Market Landscape
Enterprise AI is expanding the cybersecurity remit beyond traditional infrastructure, application and identity protection. Security teams must increasingly address model-related vulnerabilities, sensitive data exposure, third-party AI services and the risks of AI-enabled business processes.
The IANS and Artico Search findings show that large enterprises are more likely to assign formal AI security leadership, but enterprise-wide AI governance remains distributed across executives and business functions. This creates demand for leaders who can connect technical security with risk, compliance and business strategy.
The report’s figures are survey findings rather than a universal blueprint for organizational design. Companies should evaluate leadership structures against their AI exposure, size, regulatory environment and existing security capabilities.
Top Insights
- AI security leadership is emerging: 65% of organizations above $10 billion in revenue have assigned a head of AI security, mostly alongside another role.
- Governance ownership remains fragmented: Only 7% of the largest enterprises identify the CISO as primarily accountable for enterprise AI governance.
- Board oversight is limited: Just 21% of organizations above $10 billion have fully implemented a dedicated board committee for AI ethics or responsible AI.
- Deputy CISOs are more common in large firms: 58% of the largest organizations have a deputy CISO, but internal succession remains a challenge.
- Experience commands a premium: The report links cybersecurity compensation differences most strongly to years of information security experience, alongside company size.
Power Tomorrow’s Intelligence — Build It with TechEdgeAI
