In a fireside chat at ISC2 Security Congress 2026, Mark Weatherford, Head of Cybersecurity Policy & Strategic Engagement at NVIDIA, talked about the impact of AI on skills and cybersecurity leadership roles, key elements of executive success and ways to move forward in the ever-changing cybersecurity profession.
Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
Debra Christofferson, CISSP, Information Security Consultant Principal at Sapphire-Security Services, treated the Security Congress audience to a live interview with Mark Weatherford, Head of Cybersecurity Policy & Strategic Engagement at NVIDIA and one of the most successful CISOs and cybersecurity executives in the field. Their discussion, Behind the Boardroom Door: Evolving the CISO Role in the Age of AI, focused on executive success and evolving leadership roles in a rapidly changing cybersecurity profession.
The discussion mapped out a blueprint for success for today’s CISO, offering pragmatic insights on aligning organization priorities with CEO goals, reshaping the security agenda for AI value, upskilling for an AI agentic workforce, adjusting service contracts and tools against changing requirements, and driving leadership success.
How Is AI Changing the CISO Role?
Speed. Weatherford said that since leading in the age of AI, “every month is a new month,” and what he knew a month ago may no longer hold. He framed the job two ways: “security for AI and AI for security.” Cybersecurity leaders need to think about both. The pace is also changing cybersecurity practice. Pentesting a few times a year once seemed sufficient, for instance. Now, anything short of continuous testing means falling behind. His advice: “buckle up,” because there is no turning back.
What Does the Board See as the Highest Risk Of AI?
Two opposite fears are at play. Boards worry about moving too slowly and missing AI's competitive advantages and revenue potential. Yet they also worry about moving too fast and deploying AI tools without the right controls or understanding of risk. It falls to the CISO to translate and balance that risk for leadership, including making clear who owns it. Ownership of AI deployment risk typically sits outside security, with a business unit, the CEO or the board, but the CISO needs to help understand and convey the risk.
What Is the Strategy for Building the Future Pipeline?
Many of today's early-career cybersecurity professionals are AI natives who have never known a world without these tools, but they often lack an understanding of the business. Weatherford suggested that organizations should build internships – ideally paid – and teach interns how the organization operates. One interview idea: hand a candidate a straightforward problem and watch how they use AI to work through it. The point isn't a correct answer. It's seeing who thinks creatively and adaptably. Governments will eventually need to do more to prepare the next generation, too.
AI Vendors Are Multiplying – What Are They Replacing, What Should Cybersecurity Professionals Look For?
Watch for legacy products that have simply been dressed up with AI features, as Weatherford cautioned. Overhyped offerings will always exist, so buyers need to “weed out the wheat from the chaff,” he said. Asking whether a tool is AI native and what security problem it solves that you aren't already solving is essential, Weatherford added. Automated red teaming that delivers a dashboard every morning is “solid gold.” Vendors should also do their homework, he noted. Opening a meeting with “what's your biggest security problem these days?” wastes a CISO's scarce time. Supply chain deserves attention as well. Vendors frequently rely on the same suppliers, creating shared points of failure, while deeper-tier suppliers can be as critical as the ones you have contracted.
What Blind Spots Do Leaders Have in This Rapid Evolution?
In short, according to Weatherford, “FOMO”: fear of missing out. Leaders rush in without grasping the complexities, spend heavily on AI compute and only then ask what value they're getting. The due diligence comes after the purchase instead of before. That's where the CISO comes in, weighing whether something is too risky or not risky enough.
What Talent Is Needed to Enable Growth in the AI Era?
“Curiosity.” Leaders must move beyond what's familiar and ask how AI can transform both the business and security. A CISO who still operates as if it were the client-server era is running out of time. Leaning on reputation alone for your next job is limiting and it may cost you a seat at the table within a few years.
As Organizations Flatten, How Do Managers Build Career Resiliency?
Leaders must still prepare the next generation. Some people are being promoted to CISO before they've “skinned their knees.” Today's environments are too complex for anyone to personally run every tool. Talent won't stay without a path upward and organizations need room in the middle to retain institutional knowledge. Candidly, Weatherford noted that not everyone will make the transition to the AI era, and he said that's an acceptable outcome.
Which CISO Skills Will Matter Most Over the Next One to Three Years?
Stay curious and inventive, and be ready to keep learning and unlearning, including letting go of expertise that has gone stale. Skills aren't only technical. Operations ultimately follow policy, Weatherford said. He once dismissed policy work before seeing how laws shape what security teams must do. In Europe recently, he found AI and cybersecurity discussed almost interchangeably, usually in terms of safety and security. He urged everyone to know their state and federal legislators. Staffers often welcome a call from a practitioner.
What Are the Biggest Opportunities for AI In Supporting the Business?
Understanding and managing risk is the best opportunity. AI can surface gaps in risk posture that would otherwise go unnoticed and it is already uncovering vulnerabilities that have sat in code for 10, 15 or 20 years. Even skilled human developers introduce errors and AI tends not to make the same kinds. Weatherford calls himself an “absolute AI optimist.” More vulnerability events are coming, but he expects the remedy for AI-found flaws to be more capable AI.
What One Thing Can CISOs Take Forward Today to Intersect with the CEO And Board?
Bring a plan. Draft a short business case, one or two pages, outlining how you would shrink a risk or close a vulnerability, including the resources required. AI can help draft it and you can tailor it to your environment. Weatherford also challenged CISOs to focus on one new topic each week, such as MCP, prompt injection or sandboxing, which adds up to 52 in a year. It isn't too late to catch up. With so much new emerging, newcomers can even benefit from not carrying outdated knowledge.
The point that was weaved through the entire conversation: AI is moving fast and the CISOs who thrive will be those who stay curious, understand the business and bring leadership clear, practical plans.
Whether it is building the next generation of talent, vetting vendors or weighing risk against opportunity, security leaders have a chance to help their organizations welcome the AI era with confidence.
Learn more about ISC2 Security Congress 2026 Sessions
VVirtual and in-person attendees to Congress can see an on-demand replay of the session this article is based on as part of their existing access. On-demand access packages for Congress sessions will be available at a later date.
