Nvidia’s Weatherford says AI is reshaping the CISO’s role

Nvidia head of cybersecurity policy Mark Weatherford said the wider use of AI is changing the CISO’s role from security gatekeeper to business-risk translator. Speaking at ISC2 Security Congress 2026 in Denver on 26 October, he said CISOs need to explain how AI risks relate to business goals and make clear who is responsible for accepting them.

He said a CISO’s credibility suffered after a board challenged their understanding of the company’s business model, prompting him to argue that security leaders must know how their organisations generate revenue.

Weatherford said boards must weigh the risk of losing competitive advantage by moving too slowly against the risk of adopting AI without suitable controls or a clear understanding of its dangers. Although CISOs rarely own the business risk of deploying AI, he said, they should help executives understand it. He identified the pace of technological change and the need to address both “security for AI” and “AI for security” as key challenges, and said traditional security approaches may no longer be sufficient.

He also warned against AI spending driven by fear of missing out, recommending business due diligence and short proposals setting out risk-reduction work and required resources.

For vendor assessments, Weatherford said he favours AI-native products designed to address security problems over older products with AI added later. He also urged CISOs to examine supply-chain dependencies, including suppliers several tiers removed, which could create shared points of failure. To keep up, he recommended continual learning, including studying one AI topic each week, and joining or forming peer networks to share experience.