Cybersecurity Governance and Leadership in the Age of AI

Cybersecurity Leadership in the Age of AI: Redefining Enterprise Security Strategy

Cybersecurity has evolved far beyond a purely technical function. In 2026, it is a strategic business capability shaping operational resilience, regulatory compliance and enterprise risk management.

As AI adoption accelerates and threat actors become more sophisticated, organizations are strengthening leadership structures, investing in security talent, stabilizing cybersecurity budgets and adopting cyber insurance to improve resilience. Insights from Optiv’s Cybersecurity Peer Index reveal how organizations are strengthening security by elevating cybersecurity leadership, making targeted budget investments, building informed workforces and adopting strategic cyber insurance to tackle evolving AI-driven threats.

Cybersecurity Ownership: A Strategic Leadership Shift 

Cybersecurity is no longer confined to IT operations. As organizations face rising cyberthreats, regulatory scrutiny and rapid adoption of technologies, the question of who owns cybersecurity within the organization has become a critical governance decision shaping enterprise resilience and risk management.

Per Optiv’s Cybersecurity Peer Index for 2025, across industries, 34% of the security teams report directly to the Chief Information Security Officer (CISO) – the most common reporting structure for security leadership. 

Image

The growing share of CISO-led reporting structures signals a shift from IT-driven security to business-risk-driven cybersecurity governance. The rise of agentic AI and autonomous systems accelerates the need for independent cybersecurity leadership and stronger governance models. Organizations that elevate cybersecurity leadership to board-level visibility through a CISO role tend to have stronger governance, clearer accountability and better alignment with enterprise risk management frameworks.

Cybersecurity Talent Distribution: Industry-Level Insights

Cybersecurity teams remain relatively small compared to IT organizations, despite the expanding threat landscape. This imbalance suggests that many organizations rely on external service providers for their security operations and maintenance, rather than on dedicated internal staff for cybersecurity management. 

Data from Optiv’s Cybersecurity Peer Index indicates that 21% of the IT workforce is dedicated to security functions in the Financial Services industry, as these institutions remain one of the most targeted sectors for cybercrime, including ransomware, fraud and phishing attacks. The rise of AI-driven financial fraud and digital banking platforms is pushing banks to significantly expand their security teams.

Image

Critical infrastructure sectors like Energy and Utilities now allocate over 10% of their IT staff to security in response to rising nation-state cyberthreats and attacks on operational technology (OT) systems. In December 2025, over 30 wind, solar and power facilities in Poland were hit by coordinated cyberattacks linked to specifically targeted operational infrastructure (OT systems), and a Romanian water infrastructure attack took 1,000 systems offline across water management authorities, which impacted critical digital operations (email, GIS, databases). These attacks reinforce the need for increased security staffing in sectors with critical infrastructure.

With the rise of agentic AI, cloud adoption and sophisticated cyberattacks, organizations across industries are increasingly prioritizing cybersecurity talent, automation and AI-enabled security operations to enhance resilience in an evolving threat landscape. 

Cybersecurity Budget Allocation: Strengthen Security Against Evolving Threats

Despite escalating cyber risks, organizations have not increased their cybersecurity spending levels owing to budget pressures and competing technological investments. Across industries, cybersecurity spending averages 8-11% of IT budgets, according to Optiv’s Cybersecurity Peer Index, reflecting a balanced approach in which organizations must manage rising cyber risks while controlling overall IT expenditure. 

Image

As organizations accelerate AI and cloud adoption, cybersecurity spending is increasingly embedded within digital transformation and platform engineering initiatives. Organizations in Consumers industry are spending around 10% of their IT budgets on cybersecurity, driven by digital adoption and rising risks of fraud. Also, the Energy and Utilities and Healthcare sectors allocate more than 10% of their IT budgets to cybersecurity, reflecting a significantly higher security priority relative to overall IT spending. This elevated investment underscores the critical nature of these industries, where the protection of essential services, sensitive data and operational continuity is paramount.

Globally, organizations are accelerating investments in AI, with spending projected to exceed $2.5 trillion by 2026. This rapid expansion of the digital ecosystem is amplifying regulatory scrutiny, making robust cybersecurity and governance not just standalone functions, but critical enablers of business resilience and stakeholder trust.

Cybersecurity Insurance Policies: Safety Net for Modern Cyberthreats

Cybercrime remains one of the top global business risks, forcing organizations to strengthen both cybersecurity controls and financial risk protection mechanisms. The rapid emergence of Generative and Agentic AI is transforming the cyberthreat landscape, enabling attackers to launch more sophisticated phishing campaigns, automate exploitation of vulnerabilities and scale cyberattacks. 

With cyber risks becoming more complex and unpredictable, organizations are reassessing their cyber risk transfer strategies, leading to increased interest in cyber insurance policies. Meanwhile, rising ransomware attacks, data breaches and operational disruptions are pushing organizations into integrating cyber insurance into broader enterprise risk management strategies to mitigate potential financial losses.

Insights from Optiv’s Cybersecurity Peer Index indicate more than 75% of organizations within the Energy and Utilities and Financial industries have cyber insurance policies in place. The Industrials sector shows a significant increase in cyber insurance adoption, rising from 60% in 2024 to 67% in 2025. These sectors continue to prioritize cyber insurance as these industries face significant exposure to infrastructure disruption and nation-state cyberthreats.

Image

In contrast, the Technology and Healthcare sectors show a decline in cyber insurance adoption in 2025, reflecting a shift toward greater cyber resilience and more selective, value-driven use of insurance, as organizations navigate evolving threats, coverage limitations and increasingly stringent underwriting requirements. Specifically, healthcare organizations face constrained cyber insurance coverage as escalating ransomware incidents and third-party ecosystem dependencies outpace insurers’ ability to model and absorb losses.

Future State: Looking Ahead to the Cybersecurity Landscape of 2026

As organizations move toward 2026, cybersecurity will undergo a fundamental shift driven by evolving governance models, workforce transformation, strategic investments and the changing role of cyber insurance. Together, these forces will redefine how enterprises manage cyber risk – transitioning from reactive security approaches to proactive, resilience-led governance frameworks

• Cyber resilience replacing traditional risk metrics: Organizations will move beyond assessing the likelihood of breaches to focus on impact tolerance and recovery capability. Metrics such as recovery time objective (RTO), recovery point objective (RPO) and operational continuity will become central to board-level decision-making and risk capital allocation.
• Expansion of governance beyond enterprise boundaries: As digital ecosystems grow, governance will extend to include continuous oversight of vendors, partners and supply chains. Third-party risk management will evolve into a critical boardroom priority, shaping enterprise-wide accountability.
• AI redefining governance structures: Artificial intelligence, including generative and agentic AI, will introduce new governance layers from model risk management to dedicated AI oversight functions while simultaneously influencing talent strategies and directing investments toward AI-driven security capabilities.
• Cyber risk embedded in financial governance: Cybersecurity will increasingly be quantified in financial terms, enabling organizations to evaluate risk through loss expectancy and risk-adjusted returns. This shift will position cyber risk alongside core financial risks, driving deeper involvement from CFOs and boards.

Cyber risk is now a core business and financial priority. Addressing it requires more than tools – it demands clarity, governance and leadership alignment. Optiv works alongside security and business leaders to strengthen resilience, guide investment decisions and embed cybersecurity into enterprise strategy. Get in touch to learn how we can support your journey.