CIO and CISO offices unify over AI

The rapid evolution and adoption of AI is going to force CIOs and CISOs to the same table — often.

The reason is simple: AI capabilities will always outpace slow-churning business and technology decisions. This places urgency on unified governance of these advanced technologies, a rapid understanding of how AI drives threats and raises risk levels, and answers to whether new AI-based tools can be deployed without expanding an already fragile attack surface.

This is especially pertinent in critical infrastructure sectors heavily invested in operational technology (OT) assets and internet of things (IoT) devices that are increasingly being connected to the internet. In these environments, operational resilience is establishing itself as the guiding principle for CIOs, who are experiencing a realignment of priorities that now focus on business continuity and collaborations across functions (primarily security and operations teams) to better address governance and procurement concerns.

CIOs responding to Claroty’s recent “Global State of Operational Security” report indicate the integration of AI will be fundamental to cybersecurity strategies moving forward, further cementing that the CIO office must be in lockstep with CISOs and security teams. For example, 82% of CIOs said that AI is a baseline requirement in cybersecurity procurement for operational environments, and close to 60% said they had removed or replaced a cybersecurity vendor in the last year because of insufficient AI capabilities. Robust security programs, no doubt, will feature AI as a core product and business capability.

Frontier models have immersed security in the AI world

Since the emergence earlier this year of frontier AI models such as Anthropic’s Claude Mythos and OpenAI’s GPT-5.6-Cyber, the cybersecurity world has become fully immersed in AI. Almost overnight, these models brought out irreversible changes in exposure and vulnerability management through their ability to carry out machine-speed code analysis, uncover software vulnerabilities, and develop exploits. Large technology vendors (i.e., Microsoft, Cisco, Adobe, and many others) with early access to these models have already flooded enterprises with thousands of new CVEs, reducing traditional vulnerability management programs to rubble. No company can contend with this volume of patches.

Claroty Team82, in response to the damaging cyberattacks against French supermarkets, used an AI agent paired with publicly available vulnerability information, accessible device firmware, and analytics tools, to reproduce previously discovered vulnerabilities in the commercial refrigeration assets that were attacked in France. What took months without AI took 28 minutes and cost $6 to reproduce. What this demonstrates is that vulnerabilities are highly accessible with relatively minimal knowledge of the target, and the impact can be significant.

Technology and security leaders must now understand which assets mean the most to core business capabilities and apply the proper controls to keep them secure. This includes not only patch management, but also compensating controls such as virtual network segmentation, and locking down remote access — especially for third parties such as integrators and suppliers that are so crucial in operational environments. Already in the Claroty survey, 58% of all respondents said they’d suffered an incident that impacted operations, with significant implications around downtime (an average of three days) and financial loss (an average loss of $1.1 million).

AI-powered security investments are procurement priorities

AI-powered attacks will only further pressure CIOs to invest in AI to defend operations in critical infrastructure; 86% of CIOs agree that their organizations are investing in AI-driven security to counter AI-fueled attacks and uncover vulnerabilities. Meanwhile, cyber threats, threat intelligence services, and operational risk are the biggest drivers of cybersecurity investment in operational environments, cited by 44% of CIOs.

For those organizations already investing in AI within operations and cyber-physical environments, there was a mixed bag of results. More than half (54%) of CIOs noted that AI has improved decision-making through automation and analytics, yet 50% acknowledged that AI has introduced new cybersecurity, compliance, or operational risks.

Once CIOs and CISOs unify strategically over AI, it will become the core defensive capability. Of the CIOs responding to the Claroty survey, 77% said their organizations are using AI in key cybersecurity tasks.

The value is enormous in terms of continuous threat detection: analyzing security telemetry, identifying anomalies, investigating incidents, and automating some response activities that allow for quicker recovery from breaches and compromises. Organizations can use AI to bring business and asset context to security information such as vulnerabilities, weak configurations, and legacy technology in the environment. Decision makers can use AI to make remediation recommendations, but it’s doubtful in operational environments that CIOs and CISOs will allow for many autonomous actions on the part of AI. CIOs will be front and center in the convergence of AI adoption and cybersecurity governance from a business impact perspective. Operational resilience — the need for key systems to withstand and recover quickly from attacks — will drive the need for faster risk assessments of operational environments. Speed and scale will drive much of operational security in the AI age, much like it does on the attackers’ side of the equation. Organizations must detect and respond faster, and AI is the only way forward.