For CISOs & Security

CISOs and Information Security

AI is reshaping both sides of the security equation — attack capability and defence capability scale in parallel. The CISO's mandate now includes governing AI systems they don't own.

For: Chief Information Security Officers, security architects, security operations

For CISOs, AI presents three converging challenges. First, AI capabilities are reshaping the threat landscape — phishing, social engineering, and vulnerability discovery are all being augmented by AI. Second, frontier AI systems are dual-use: the same capability that enables defence enables attack (Anthropic's Project Glasswing exists precisely because of this). Third, the security implications of AI adoption inside the enterprise — Microsoft Agent 365, ChatGPT Enterprise, Claude, custom agents — create attack surfaces that traditional controls don't cover. The Five Eyes agentic AI guidance (1 May 2026) and ASIC's 8 May 2026 cyber resilience letter are the most directly applicable references for this work.

What this role is accountable for

The substantive AI governance responsibilities that fall to this role under current Australian and global expectations.

1AI-specific threat modelling — prompt injection, indirect injection, data exfiltration via AI outputs
2Agentic AI security — controls for autonomous systems operating across enterprise applications
3AI vendor security assessment, including frontier model providers
4Data classification and DLP integration with AI tools (Microsoft Purview, equivalent platforms)
5AI incident response — detection, containment, and forensics for AI-related security events
6Workforce AI security awareness — shadow AI, data leakage, social engineering
7Engagement with national security guidance (ASD ACSC, CISA, NCSC) on AI-specific threats