Enterprise AI leadership starts with who owns the decision
AI adoption is not a security decision dressed up as a technology project. It is a business choice, with security consequences—and that distinction matters when an initiative goes wrong.
At the ISC2 Strategic Congress 2026 in Denver, Nvidia’s Mark Weatherford described a CISO role changing alongside AI. As Dark Reading reported, he warned that organizations can move quickly because of fear of missing out, without doing enough business due diligence or understanding the value they expect from an AI investment. Sometimes the case for spending is strong. Sometimes it isn’t. The point is to know which is which before momentum becomes the strategy.
That is a useful definition of enterprise AI leadership: the ability to connect a proposed use of AI to business purpose, risk, and accountable decision-making. It isn’t a synonym for putting the security team in charge of every model or tool. The CISO brings risk into view; the executives pursuing a deployment must remain engaged with the consequences of that choice.
Weatherford’s central point, as reported by Dark Reading, is that the CISO should make sure the board understands the risks and knows who owns each one, especially when a deployment is created by another executive. He put the principle plainly: “the people taking the risk are responsible for the risk.” That is stronger than treating security as a final approval gate. It also means the CISO should not quietly inherit accountability for a business decision simply because security was consulted.
What enterprise leadership means for AI
Enterprise leadership is the work of setting direction across an organization and ensuring that decisions serve its objectives. In AI, that means resisting two easy but unhelpful defaults: approving a tool because competitors are using it, or rejecting it because any risk exists.
Weatherford described both pressures. He pointed to FOMO driving some organizations to deploy without sufficient business diligence. He also observed that CISOs can default to “no” when even a small element of risk is present. His alternative draws on the Navy idea of “command by negation”: subordinates act autonomously toward an overall goal unless a superior tells them to stop. Weatherford argued that cybersecurity leaders should be willing to accept more risk themselves, calibrated to the company’s risk tolerance.
That is not a license for security teams to wave through deployments. It is a call for judgment. A CISO who treats every uncertainty as a veto can block useful work without helping the business understand the trade-off. A business leader who treats speed as proof of value can expose the organization without understanding what it is gaining. Leadership means making the tension explicit, then keeping authority and accountability aligned.
The distinction is especially important as AI projects cross departmental boundaries. A business executive may sponsor a use case; technical teams may implement it; security may identify exposure. Those roles can overlap, but they are not interchangeable. Advising on a risk does not make the adviser its owner. The executive who decides to proceed should understand the exposure associated with that decision.
The CISO’s job is candor, not silent ownership
Risk conversations can be uncomfortable. Dark Reading reported Weatherford’s acknowledgment that frankness can sometimes be career-limiting. Yet CISOs can end up blamed for decisions that were not theirs, he said, and need to push back. That is not an argument for distancing security from outcomes. It is an argument for honest boundaries: explain the risk, make sure leadership understands it, and don’t let consultation be mistaken for ownership.
Boards need a clear account of the choices before them. Not a performance of certainty, and not a blanket warning that AI is dangerous. The useful discussion is about the proposed business value and the risks that accompany it. Weatherford’s reported emphasis is that the board should understand risks and know who owns them. The analysis follows: if those two things remain vague, the organization may discover only after an incident that everyone thought someone else had made the call.
This is also why a CISO’s influence depends on business fluency. Security advice lands better when it addresses what the organization is trying to accomplish, rather than treating risk as detached from the reason for adoption. Weatherford urged CISOs to stay curious, step outside their comfort zones, and keep thinking about how AI could transform both business and security. He also cautioned against relying on past reputation and work to carry them into the future.
Avoid both AI FOMO and reflexive rejection
The practical question for enterprise AI leaders is not simply “Is this safe?” No meaningful deployment is free of risk. Nor is “Are others doing it?” evidence that a particular investment makes sense for this organization. The better question is whether the business opportunity is understood well enough to weigh against the exposure—and whether the people making that choice recognize their responsibility.
Weatherford’s remarks leave room for different answers. Some AI spending may be justified; other cases may be less clear. That nuance matters. A security function that insists on zero risk can become a brake on useful experimentation. A leadership team that treats AI adoption as inevitable can mistake urgency for strategy. Neither posture is serious governance.
For Indian enterprises, as for organizations elsewhere, this principle is not about importing a particular governance chart or copying another company’s process. It is about making sure local business leaders and security leaders can have the same candid conversation: what value are we pursuing, what risks come with the deployment, and who is accountable for taking them? The source does not prescribe a country-specific formula. The underlying leadership challenge is universal: an executive cannot outsource the business judgment to security and still claim the decision as a business one.
CISOs, in turn, should be willing to make risk judgments within their organization’s tolerance rather than reflexively saying no. Weatherford’s “command by negation” analogy signals room for initiative, not absence of controls. The job is to be curious enough to understand what AI might make possible and clear-eyed enough to say when the business case or risk picture is not convincing.
Curiosity is part of the leadership role
Weatherford also emphasized learning. He encouraged CISOs to be curious, creative, and willing to learn and relearn; one suggestion he gave was to pick up a new topic every week. That is his advice, not a universal timetable or an implementation mandate. Its value is straightforward: AI will keep changing the questions security leaders are asked, and familiarity with yesterday’s work is no guarantee of readiness for the next decision.
He also discussed talent. Weatherford favors paid internships that bring AI-native young people into companies and teach them the business. One interview idea he described is giving a candidate a business problem and letting them use AI to solve it live, with no single right answer, as a way to test flexibility. He said CISOs should also support career paths and upward mobility; simply paying people more while leaving them in the same roles is not, in his view, a sufficient retention strategy.
Those observations connect back to enterprise AI leadership. Organizations need security leaders who can learn the technology and understand the business, but they also need business executives who stay accountable for deployment choices. AI governance fails when expertise is confused with ownership. The CISO may explain what can go wrong; the business owner must engage with whether the opportunity is worth that risk.
The most useful change is not another layer of process invented for its own sake. It is a sharper conversation about value, risk, and responsibility before a deployment proceeds. Weatherford’s message, as reported by Dark Reading, is direct: CISOs should help leaders see the risks, while those taking the risk should own it. That is what enterprise AI leadership looks like when the stakes are real.