If AI Is A Growth Strategy, AI Security Needs An Owner

Rob Sloan is VP of Cybersecurity Advocacy at Zscaler, where he helps organizations navigate cybersecurity risk and business resilience.

​California’s recent decision to require each state agency to designate an AI cybersecurity officer isn’t just about adding another government title. To me, the bigger message is this: AI risk now needs a clear owner.​

As companies push AI into revenue, operations and product development, a security failure could mean data exposure, legal trouble or a direct hit to customer trust. Not every company will need a permanent new C-suite title, but a Chief AI Cybersecurity Officer, or a clearly empowered equivalent, could be a smart move at this stage of AI adoption.​

Isn’t This Already The CISO’s Job?​

Most budget-conscious CEOs will ask the obvious question: why can’t the chief information security officer own this? Maybe the CISO should own it. The problem is that most CISOs are already overloaded. They own cloud security, identity, resilience, ransomware preparedness, third-party risk, incident response and board reporting, frequently all at once.​

AI security is different from the cyber problems most companies already know how to manage, and adoption is moving faster than internal controls can keep up.​

At many companies, AI is no longer experimental; it’s a central part of the growth plan. It’s showing up in products, support, software development and internal decision-making. Add AI agents to the mix, and the risk picture gets even harder to track. AI security simply cannot be treated as a side job divided between legal, IT, security and engineering.​

Why This Isn’t Just Another Security Problem​

Attackers are moving faster as well. Attackers are already using AI to scale up their operations, and better models will only widen that advantage. Companies are deploying AI quickly while the threat environment is shifting just as fast. That alone is a strong argument for putting someone in charge who actually understands the technical risks.​