A widening gap between AI adoption, security visibility and executive understanding is placing greater pressure on CISOs, according to new research from Gigamon.
The company’s CISO Empowerment in the Age of AI Risk report found seven in 10 CISOs are concerned that a lack of boardroom understanding of security best practices could allow AI adoption to outpace security readiness.
Improving board understanding of AI risks and benefits is now among the top security priorities for 41 per cent of CISOs over the next 12 months. AI corporate governance itself ranks as a top priority for 43 per cent.
The findings come as organisations adopt a mix of AI models, applications and infrastructure, creating more connections through which information can move.
Gigamon calls this approach “Hybrid AI”, with organisations combining frontier, open-weight, specialised and privately hosted models to balance performance, governance, sovereignty, security and cost.
For security teams, the challenge extends beyond determining whether an AI application is approved. It also involves understanding the systems it connects to, the data it accesses and the traffic it generates.
“CISOs need to understand which AI systems are in use, how they interact with applications and data, and what is happening across those connections,” said Grant Yacomeni, CISO at Gigamon.
“You cannot govern what you cannot see.”
Globally, 80 per cent of CISOs identify inadequate governance of unsanctioned AI use as their top challenge in securing data. Limited visibility into AI-driven traffic is a major barrier to securing adoption for 76 per cent.
Among organisations that experienced a breach over the past year, 83 per cent reported AI-related security incidents, with 30 per cent reporting internal leaks into AI systems and 30 per cent reporting unsanctioned AI use.
Australian respondents are placing particular emphasis on preventative controls and response capabilities. Implementing AI and large language model security guardrails and monitoring controls is a priority for 56 per cent, compared with 41 per cent of global CISOs.
Strengthening detection and response for AI-related threats is a priority for 54 per cent of Australian respondents, against 40 per cent of CISOs globally.
The survey also reveals markedly different assessments of incident response capability. Only 27 per cent of CISOs believe their organisation can identify root cause and restore normal operations within 72 hours, compared with 48 per cent of other C-level executives.
Lateral, or east-west, traffic is identified by 36 per cent of CISOs as an area of greatest breach risk. Such traffic becomes increasingly relevant as AI models, agents, applications and data communicate across distributed environments.
The accountability implications are also evident: more than one in four CISOs are concerned about losing their job following a serious cyber incident.
Gigamon says network-derived telemetry can provide additional context about data moving between systems. Some 87 per cent of CISOs regard deep observability as foundational to securing AI deployments.
The report draws on 307 CISOs within a broader survey of more than 1,000 security and IT leaders across six countries, including Australia.
