The 2026 Security Organisational Design Benchmark Report, published by cybersecurity research firm IANS and executive recruitment company Artico Search, found that 65% of organisations generating at least $10 billion in annual revenue have established a head of AI security role.
Only 18% of those businesses have created a dedicated position, while another 47% have added the responsibility to an existing leadership job. The findings indicate that larger companies are adapting their security management structures as AI systems become more widely embedded in business operations.
However, just 21% of companies in the highest revenue category have fully implemented a board committee dedicated to AI ethics or responsible AI. Among organisations with annual revenue below $10 billion, the corresponding figure is 9%.
The research also found that between 43% and 48% of organisations across the surveyed revenue categories have no plans for such a committee. The figures suggest that appointments within security departments are proceeding faster than the establishment of dedicated board oversight.
Responsibility for overall AI governance also differs sharply according to company size. Chief information security officers, or CISOs, are primarily accountable at only 7% of businesses with revenue exceeding $10 billion, compared with 11% of companies generating between $1 billion and $10 billion and 26% of smaller organisations.
At the largest businesses, chief AI officers are the most frequently identified executives responsible for enterprise AI governance, although they hold that responsibility at just 22% of organisations. Across the three revenue groups, between 14% and 19% reported having no single executive accountable for the function.
Nick Kakolowski, senior research director at IANS, said businesses did not necessarily need to establish entirely new departments to address AI security. Existing expertise in application security, data governance, identity management, risk and compliance could be brought together under clearer management arrangements.
He said the central challenge for CISOs was deciding how those capabilities should work together, where accountability should rest and whether the volume of work justified a dedicated leader.
The distinction between securing AI systems and governing their use is significant. Security specialists may oversee technical safeguards, access controls and vulnerability management, while wider governance decisions can involve legal, compliance, technology and business executives. The survey indicates that organisations have yet to settle on a consistent division of responsibilities.
Smaller companies are considerably less likely to employ a dedicated AI security leader. The researchers found the position established at 9% of businesses with revenue between $1 billion and $10 billion and 6% of those below $1 billion. Responsibilities at these companies are generally incorporated into existing security operations, architecture or governance, risk and compliance positions.
Steve Martano, a partner in Artico Search’s cyber practice and an IANS faculty member, said companies needed leaders able to combine technical security knowledge with an understanding of risk, compliance and business requirements. He said employers should assess whether they could develop the necessary expertise internally before seeking candidates in the external recruitment market.
The report also examined how security leadership teams expand as businesses grow. Among organisations generating at least $10 billion annually, 58% have a deputy CISO, including 47% with a full-time deputy and 11% combining the position with another departmental leadership role.
That compares with 31% of businesses in the middle revenue category and 19% among smaller companies. Nevertheless, the researchers found that organisations commonly undertake an external search when a CISO leaves rather than automatically promote the deputy.
Compensation data showed that full-time deputy CISOs at the largest enterprises receive average annual cash pay of approximately $350,000, with the highest-paid 10% earning more than $500,000. The researchers identified years of information security experience as the strongest factor influencing differences in pay within equivalent positions.
Among experienced individual contributors at the largest companies, those with eight to 15 years of security experience earn approximately $35,000 more annually than colleagues with fewer than eight years of experience, the survey found.
The findings draw on IANS and Artico Search surveys launched in April, with responses gathered through September, supplemented by responses from a 2025 staff survey. Together, the research covers more than 1,400 CISOs and cybersecurity employees and examines staffing, management structures, compensation and governance arrangements.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
