A Quarter of Security Chiefs Thought About Quitting Last Year. AI is Why.

Key points

• 26% of senior security executives considered leaving their jobs in the past 12 months, according to Splunk's 2024 CISO Report.
• 96% of chief information security officers are now responsible for governing how their companies use AI.
• 78% of security chiefs fear personal legal liability if a cyberattack hits their organisation on their watch.
• 85% of security chiefs say their biggest obstacle is that other senior leaders don't understand cybersecurity.
• 87% of security professionals say AI is adding heavily to their team's workload.

The people whose job it is to protect companies from hackers are struggling. Not because attacks are slowing down. Because the opposite is true, and a wave of artificial intelligence tools is making everything harder and faster at once.

Splunk, a security software company, published findings from two surveys showing that one in four senior security executives seriously considered leaving the profession in the past year. The 2024 report, first covered by Dark Reading, paints a picture of an industry under genuine strain.

Why are security leaders thinking about walking away?

Two pressures sit at the top of the pile. The first is personal legal risk. Nearly eight in ten security chiefs (78%) worry they could face lawsuits or regulatory penalties if their company suffers a cyberattack, even if they followed every reasonable precaution. Regulators in the United States and elsewhere have started holding individual executives personally accountable for breaches, meaning a single bad incident can follow a person's career for years.

The second pressure is AI itself. Almost every security chief surveyed (96%) has been handed responsibility for something called AI governance, which means deciding which AI tools the company can use safely and which ones introduce unacceptable risk. That job barely existed two years ago.

Michael Fanning, Splunk's CISO, told Dark Reading that lower-skilled criminals now have AI tools that let them cause far more damage than before. At the same time, employees inside companies are adopting AI quickly, sometimes without telling anyone in the security team. That unsanctioned use is often called shadow AI, where staff quietly build or use AI tools outside official channels, creating hidden risks the security team can't see or manage. Our 17 July story "Your Boss Is the Biggest Shadow AI Risk in the Building" found it's senior executives driving that problem more than anyone else.

TJ Marlin, chief executive of AI security firm Guardrail Technologies, described the gap bluntly to Dark Reading. Organisations spent years worrying about criminals sneaking in through back doors. Now companies are opening the front door to AI without the tools or training to know what they're letting in.

The problem is made worse by a communication breakdown at the top. Splunk found that 85% of security chiefs identify the same core obstacle: other senior leaders don't understand cybersecurity well enough to make informed decisions about it. Business teams push to roll out AI as fast as possible. Security teams, who see the risks most clearly, get treated as a speed bump rather than a partner.

AI isn't all bad news for defenders. Splunk's data shows 92% of security chiefs say AI lets them review more potential threats than before, and 89% say it improves their ability to connect data across multiple sources. Nine in ten security operations analysts say AI has improved their working day.

Should you worry?

If you share personal information with AI-powered services, whether as an employee or a customer, the practical concern is real. Ask whether your organisation has a clear policy on approved AI tools. If you receive unexpected messages that seem to know unusual detail about you, treat them with more suspicion than before: AI is making targeted scams cheaper and faster to build.