Half of CISOs say AI advances are pushing them toward the exit

Key points

• 50% of 1,001 CISOs surveyed in the US and UK said advanced AI models have made them consider leaving the profession.
• 60% said board pressure to adopt AI is outpacing their organisation's ability to keep that AI safe.
• 78% of CISOs are concerned about personal legal liability for security incidents, up from 56% a year ago.
• The average CISO tenure now sits at 18 months, according to IDC analyst Chris Kissel.

Who are CISOs and why does their burnout matter?

A chief information security officer, or CISO, is the executive responsible for keeping a company's data and systems safe from attack. When they burn out and leave, companies scramble to replace them with less experienced people, and the gap in between is a vulnerable window.

A survey of 1,001 CISOs in the United States and United Kingdom, reported by CSO Online, found exactly half agreed that Anthropic Mythos and comparable AI tools had caused them to consider quitting. Only a quarter disagreed. Six in ten said their boards were pushing AI adoption faster than the organisation could safely govern it. Personal liability concerns have spiked sharply too: 78% now worry about being held personally responsible for a breach, up from 56% a year ago.

We've tracked this deterioration across several stories this summer. Our 20 July report found similar pressure building in Splunk survey data; the numbers have only grown worse since.

What is it about AI that's making things worse?

AI is giving attackers a speed advantage. Criminals are finding and weaponising software flaws, weaknesses that can be exploited to break in, sometimes before the vendor has published a fix.

"As fast as AI evolves, the benefit is with the attacker right now," said Christine Gadsby, chief security advisor at BlackBerry and the company's former CISO. "Attackers are weaponizing vulnerabilities as fast as they can find them, sometimes even sooner than the fix is published."

Boards, meanwhile, want rapid AI experimentation. That pressure lands on the CISO, who's expected to secure tools their organisation is still learning to use.

What does this mean for ordinary people?

Experienced security leaders leaving means greener replacements, and the handover period is dangerous. Every enterprise IT environment is different, so a new CISO needs months to understand an organisation before they can defend it well.

For anyone whose data a company holds, a depleted security leadership bench raises the real risk that a breach goes undetected longer or is handled less smoothly.

Oliver Legg, a recruiter at executive search firm Aspiron Search, said candidate priorities have shifted sharply. Two years ago, prospective CISOs asked about budget and headcount. Now their first questions are about indemnification and directors and officers insurance, a policy that shields business leaders from personal financial loss when they face lawsuits over workplace decisions.

Is there a way through this?

Structural change is what's needed, not just individual resilience. IDC analyst Chris Kissel argues that a governing body setting minimum standards for responsible security practice, and formally protecting CISOs who meet those standards from personal legal exposure, could ease the crisis.

Omar Khawaja, who teaches at Carnegie Mellon University and serves as global field CISO at Databricks, says AI can help CISOs do more with less, provided organisations start carefully. Using AI to spot unusual activity or triage existing alerts is manageable. Automating attack responses from day one isn't.

Mike Privette, founder of Return on Security and a former CISO, adds that the Mythos effect is overstated: these models have put a spotlight on problems that were already there. Many security leaders remain energised. "For many people, this is one of the most exciting times to be operating in the field," he said. The deciding variable is whether the CISO has genuine executive support and budget to match the mission.

The pattern here is worth watching.