IANS and Artico Search released the 2026 Security Organizational Design Benchmark Report, examining how cybersecurity teams are structured and evolve as organizations grow. This year’s research explores the impact of artificial intelligence on security leadership, identifying the emergence of a dedicated head of AI security role. The findings also highlight ongoing uncertainty over responsibility for enterprise AI governance, as organizations work to define leadership roles and accountability for AI-related security risks.
“AI is introducing responsibilities that security organizations have to account for, but that doesn’t mean every company needs to build a new function from scratch,” said Nick Kakolowski, Senior Research Director at IANS. “Many of the underlying disciplines already exist across application security, data governance, identity, risk and compliance. The challenge for CISOs is determining how those capabilities come together around AI, where accountability belongs and whether the scope of the work has become significant enough to require dedicated leadership.”
Key findings from the report include:
Head of AI security is becoming a standard part of the security leadership team at $10B+ organizations. Nearly two-thirds (65%) of $10B+ organizations have assigned a head of AI security role—18% as a dedicated position and 47% combined with another leadership role—making it one of the fastest-emerging functional roles in this year’s data.
Dedicated positions remain uncommon at $1B–$10B organizations (9%) and under-$1B organizations (6%), where the responsibility is typically layered onto an existing GRC, SecOps or architecture lead.
Accountability for enterprise AI governance is unsettled—and at $10B+ organizations it rarely sits with the CISO. CISOs hold primary accountability for enterprise AI governance at 26% of under-$1B organizations, compared with 11% of $1B–$10B organizations and just 7% of $10B+ enterprises, where it most often sits with the chief AI officer (22%).
Across all three tiers, 14% to 19% of organizations report that no single executive is accountable. Board-level oversight lags further behind: Only 21% of $10B+ companies—and 9% of organizations below $10B—have fully implemented a board committee dedicated to AI ethics or responsible AI, and 43% to 48% have no such committee planned.
$10B+ organizations build deeper leadership benches, but the deputy CISO usually isn’t the successor. $10B+ organizations often staff more than 100 security professionals, compared to more than 10 at $1B–$10B organizations and fewer than 10 nine at under-$1B organizations. More than half (58%) of $10B+ organizations now have a deputy CISO—47% as a full-time role and 11% combined with a functional department head—compared with 31% at $1B–$10B organizations and 19% at under-$1B organizations.
Yet, as the report notes, when a CISO departs, companies typically run a full external search rather than promote the deputy, leaving internal candidates to compete against board-facing CISOs who have done the job for years.
Infosec experience drives pay more than company size, but the large-enterprise premium is substantial. Years of infosec experience is the single biggest driver of compensation differences within the same role, outweighing company size, geographic location, tenure, and reporting level. At $10B+ organizations, individual contributors with eight to 15 years of experience earn about $35,000 more than those with fewer than eight years, and the gap grows to about $50,000 for the most experienced staff.
Full-time deputy CISOs at $10B+ enterprises average approximately $350,000 in annual cash compensation, with the top 10% exceeding $500,000. Security leaders and staff at $1B–$10B enterprises earn roughly 16% to 26% less than their $10B+ counterparts, and $1B–$10B enterprises in turn pay about 15% more than under-$1B firms.
“The growth of AI is creating a premium for leaders who can bridge technical security, risk and compliance while still understanding how the business wants to use the technology,” said Steve Martano, IANS Faculty and Partner in Artico Search’s cyber practice. “The talent challenge is that the organizations moving fastest on AI are having to revamp the structure and review the scope of security team members. Companies need to strategically think about what they need from the function and whether they can develop that expertise internally before going to an increasingly competitive external market.”
