A new benchmark from IANS and Artico Search shows that most very large companies now have a named lead for AI security, but board oversight and executive accountability for AI are well behind. The research comes from US firms and is banded in dollars, but UK security leaders are already recruiting for the same skills.
What happened
On 20 October 2026, IANS and the executive search firm Artico Search published their 2026 benchmark on how security teams are organised. It draws on surveys run between April and September, plus some 2025 staff responses, covering more than 1,400 CISOs and security practitioners.
The headline finding is that the head of AI security has become an established role at the top end of the market. Among organisations with annual revenue above $10bn, 65% have given someone that title or responsibility. For 18% it is a standalone job. For the other 47% it is combined with an existing leadership role. Further down the market dedicated posts are much rarer: 9% of firms turning over between $1bn and $10bn have one, and 6% of those under $1bn. In those smaller firms the work usually goes to whoever already leads governance, risk and compliance, security operations or architecture.
The detail
The governance picture is unsettled. CISOs own AI governance at 26% of organisations under $1bn, 11% of mid-sized firms and 7% of the largest. At $10bn+ companies the job most often sits with a chief AI officer, at 22%. In every size band, between 14% and 19% of respondents said no single executive is accountable for AI governance at all.
Boards are further behind. Only 21% of $10bn+ companies have fully set up a board committee for AI ethics or responsible AI. Below that revenue level the figure is 9%. Between 43% and 48% of organisations in each band have no plans for such a committee.
The report also covers the wider leadership bench. 58% of the largest firms now have a deputy CISO, compared with 31% of mid-sized firms and 19% of the smallest. The researchers note that when a CISO leaves, companies usually run an external search rather than promote the deputy. Pay follows experience more than any other factor: at $10bn+ firms, practitioners with eight to 15 years in the field earn roughly $35,000 more than those with under eight, with the gap rising to about $50,000 for the longest-serving staff. Full-time deputy CISOs at those firms average around $350,000 in cash compensation, and BISOs are close behind at about $342,000, according to Infosecurity Magazine.
Nick Kakolowski, senior research director at IANS, warned against treating AI security as a function that has to be built from nothing, noting that much of the required discipline already exists in application security, identity, data governance and compliance. Steve Martano of Artico Search said demand for leaders who can connect “technical security, risk and compliance” is pushing up their market value.
Why it matters for UK organisations
This is US research banded by dollar revenue, with no UK breakdown, so its percentages should not be applied directly to a FTSE 250 firm or an NHS supplier. The trend, however, matches the UK government’s own labour market data.
DSIT’s Cyber Security Skills in the UK Labour Market 2026 report, published on 29 September, found 70% of UK cyber security businesses now report staff using AI day to day, against 53% previously. AI skills were requested in 9% of core cyber job adverts in 2025, more than double the 4% the year before. Of the cyber firms that recruited, 24% had hired someone with AI skills into a security role, and 73% expect their need for those skills to grow over the next year. Citing DSIT’s sectoral analysis, it adds that staff numbers at UK firms offering AI security grew by 51%, to 14,718 across 111 firms.
Both studies point the same way: demand for AI-literate security people is rising faster than organisations are settling accountability. DSIT’s qualitative work found security teams were usually involved through policy and training, for example restricting staff to an approved assistant, with little sign of clear ownership of AI risk, echoing the IANS findings at board level.
For British boards there is also a supply problem. The DSIT report notes that entry-level cyber recruitment is weak and that cyber security apprenticeship starts fell by 15% in 2024/25. If the largest employers keep creating senior AI security posts and paying a premium for them, mid-market organisations will find it harder to hire. They will need to grow the capability internally.
Expert view
In my experience, a new job title is the easiest part of AI governance and the least important. When we test environments where AI assistants and agents have been rolled out, the problems are rarely exotic. Service accounts have too many permissions, nobody knows which data sources a tool can read, prompts and outputs are not logged, and no one person can approve or stop a deployment. Those are ownership failures.
Kakolowski’s point that the building blocks already exist is the right one for most UK organisations below FTSE 100 scale. No standalone head of AI security is needed to answer the basics: what AI is in use, what it can reach, who signed it off and how you would turn it off. You do need someone whose job it is to answer them. The 14% to 19% of firms where no executive is accountable worry me far more than the firms that have combined the role with another one.
The pay figures are in dollars and come from very large firms, but with UK demand rising and a thin junior pipeline, anyone who can explain model risk to a board and also review an integration’s permissions will be hard to keep.
What to do now
- Name an accountable executive for AI risk. Give them authority to approve, restrict or switch off AI tools, and record the decision.
- Build an inventory. List every AI assistant, agent and AI-enabled SaaS feature in use, the data it can access and the identities it runs under. This extends the asset management that Cyber Essentials already expects.
- Apply least privilege to AI identities. Treat agent and integration accounts like any other privileged account: limit their scope, review them regularly and remove what is unused. This maps to the Cyber Essentials user access control requirement.
- Turn on logging before you scale. Make sure prompts, tool calls and outputs from business-critical AI use can be investigated after an incident.
- Brief the board. Give directors a regular AI risk report covering usage, incidents, near-misses and open actions.
- Develop talent internally. Give existing application security, identity and GRC staff AI training and stretch assignments rather than relying on an overheated external market. Write a succession plan so your deputy is a credible candidate for the top job.
Bottom line
The largest companies have decided AI security needs a named leader. Most have not yet decided who answers for AI governance or how the board will oversee it. UK organisations do not need to copy American job titles. They do need a clear owner, a current inventory and a plan for building skills that are getting more expensive to hire.
Sources
- IANS: New IANS and Artico Search report finds head of AI security taking hold at large enterprises as board-level AI oversight lags
- Infosecurity Magazine: Head of AI Security Roles Surge in Large Organizations
- Security Magazine: Only 7% of CISOs at Large Companies Own AI Governance
- GOV.UK (DSIT): Cyber security skills in the UK labour market 2026
