2026 CISO Report Finds Gaps in AI Governance and Highlights Third-Party Risk
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Hitch Partners’ survey of more than 625 security executives reports that 73% lack mature AI governance, while third-party risk is the top security priority for 43% of respondents.
Key points
- The report is based on responses from more than 625 information security executives collected between Q4 2025 and Q1 2026.
- Third-party risk was the top priority for 43% of respondents; AI-enhanced attacks ranked second at 22%.
- The report says 73% of organizations lack mature AI governance, and only 6% of private and 13% of public companies have dedicated AI security leaders.
- Data exposure and privacy breaches were the leading AI risk concern, cited by 75% of CISOs.
- The report identifies incident response, cloud security, and SecOps as common CISO responsibilities, while AI ethics, post-quantum cryptography, and fraud are less widely assigned.
- About 74% of surveyed CISOs reportedly lack personal liability insurance; 36% of private-company CISOs lack executive liability or indemnification coverage.
Article Details
- Publisher
- Hitch Partners
- Report Period
- Q4 2025–Q1 2026
- Scope
- CISO and NextGen security leadership compensation, reporting structures, responsibilities, governance, and threat priorities in North America and selected international markets.
- Sample Size
- More than 625 information security executives.
- Key Statistics
- CISOs reporting third-party risk as their top priority: 43%.
- 73% of organizations lack mature AI governance: 52% are developing or inconsistent, and 21% are initial or ad hoc.
- Approximately 74% of CISOs lack personal liability insurance coverage.
- Security teams peak at an average of 243 personnel at organizations with 5,000–10,000 employees; beyond 10,000 employees, teams contract by 47%.
- International CISOs average $469K in total compensation, 32% below the North American average of $750K.
- Recommendations
- Close the public-private CISO compensation gap to address retention risk.
- Demonstrate security's technical enablement value in organizations where CISOs report to CTOs or engineering leaders.
- Mature AI governance frameworks.
- Secure executive liability protection for CISOs.
- Manage third-party risk and develop the NextGen security leadership pipeline.