Quick Summary
The role of the Chief Information Security Officer (CISO) has significantly evolved, particularly with the rise of agentic AI, which impacts accountability and operational models. John White, EMEA Field CISO at Torq, emphasizes that while AI agents take on more responsibilities, CISOs remain accountable for outcomes and must adapt to new governance models. This shift is critical as organizations that fail to adopt AI-driven security capabilities risk increasing their exposure to threats.
The Securityish Brief
The Chief Information Security Officer (CISO) role has transformed over the past decade, particularly due to the emergence of agentic AI, as explained by John White, EMEA Field CISO at Torq. This shift has led to a new Security Target Operating Model where humans and AI agents work together, making decisions and responding in real-time. Unlike ten years ago, when organizations relied on a traditional structure with specialized roles, today’s CISOs must design and govern a hybrid workforce that includes both human and AI agents.
White highlights that accountability is now a central concern for CISOs. They are responsible not only for the actions of AI agents but also for the consequences of inaction, especially if organizations do not adopt machine-speed security capabilities. This change in accountability reflects a broader trend where security leaders must ensure that AI-driven processes are effectively governed.
In the retail sector, White notes that the pressure to maintain revenue and customer experience can lead to compromises on security controls. For instance, during peak trading periods, the need for rapid development may outpace the maturity of security measures, forcing businesses to shift from preventative to detective controls while accepting short-term risks.
Another significant challenge is the common board question about quantifying cyber risks. White argues this question is outdated, as it focuses on historical data rather than the emerging risks that organizations face today. A forward-looking approach is essential for developing effective cybersecurity strategies.
When evaluating security products, White emphasizes that the focus has shifted from features and integration to the ability of products to operate autonomously and deliver business outcomes at machine speed. Tools that require constant human intervention can become bottlenecks, hindering effective response to threats.
Why This Matters for Your Security
The evolving role of the CISO and the integration of AI into security practices highlight the need for organizations to rethink their cybersecurity strategies. As AI agents become more prevalent, companies must ensure they have the right governance frameworks in place to manage these technologies effectively.
Organizations should also be aware of the risks associated with vendor dependency. Relying too heavily on large vendors can create vulnerabilities, especially if those vendors experience outages or breaches. Businesses need to assess their vendor relationships and ensure they have contingency plans in place.
Ultimately, the ability to adapt to these changes will determine an organization’s resilience against cyber threats. Companies that embrace AI and automate their security processes while maintaining accountability will be better positioned to respond to the fast-paced nature of modern cyber risks.
Key Takeaways
- Evaluate your current security governance model to ensure it accommodates AI-driven capabilities.
- Assess vendor relationships to identify potential risks associated with over-reliance on large incumbents.
- Implement a strategy for balancing security controls with business needs, especially during peak periods.
- Encourage board discussions to focus on emerging risks rather than solely quantifying past cyber risks.
- Invest in security products that can operate autonomously and provide real-time insights without constant human intervention.
Key Terms & Concepts
- Agentic AI: In this article, agentic AI refers to artificial intelligence systems that can make decisions and act autonomously within defined parameters.
- CISO: CISO stands for Chief Information Security Officer, a senior executive responsible for an organization’s information security strategy and implementation.
- Security Target Operating Model: This term describes the framework that organizations use to structure their security operations and governance.
Read the original article here: https://www.helpnetsecurity.com/2026/02/16/john-white-torq-agentic-ai-security/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
