CSOs are becoming enterprise integrators as risk priorities shift

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Ontic's report: Corporate security leaders are redefining the CSO role around enterprise integration while geopolitical risk and AI spending reshape program priorities.

Why it matters: This matters because security leaders increasingly need to coordinate risk, resilience, investigations, and business operations across human identity, physical security, and digital controls.

By the numbers:

• The 2026 Annual CSO Survey draws on research with 118 CSOs.

Context

Corporate security is moving beyond a narrow protection function. When leaders are asked to manage enterprise risk, investigations, business continuity, and executive visibility at the same time, the operating model has to change with it.

Ontic's survey is a snapshot of that shift rather than a product story. The useful question is not whether security has a bigger remit, but which capabilities now belong inside the CSO organisation and which need tighter coordination with adjacent teams.

Key questions

Q: How should corporate security leaders integrate physical and cyber risk?

A: Corporate security leaders should integrate physical and cyber risk through one risk register, shared incident response, and converged controls over sites, people, devices, and access. That means linking badge management, visitor controls, CCTV, endpoint protection, network segmentation, and privileged access monitoring so a physical breach can be analysed as a cyber exposure and vice versa.

Q: Why does geopolitical risk change the CSO operating model?

A: Geopolitical risk changes the CSO operating model by forcing security to account for sanctions, civil unrest, cross-border supply chain disruption, and hostile state activity. The CSO needs threat intelligence, regional crisis playbooks, travel controls, site hardening, and coordination with legal, HR, and business continuity teams, rather than a purely technical security function.

Q: How should security teams govern AI in cybersecurity operations?

A: Security teams should govern AI in cybersecurity operations as a workflow control, not just a detection feature. Define where AI may summarise, prioritise, or route work, then keep approval authority, access changes, and exception handling under explicit human or policy control. This prevents convenience from quietly becoming delegated authority across the security programme.

Q: What role should the CSO play in enterprise resilience?

A: The CSO should translate security risk into resilience requirements, covering crisis management, continuity planning, protective security, and recovery of critical sites and services. That includes exercising incident response, setting minimum operating standards, and aligning security controls with business impact tolerances so the organisation can sustain operations during disruption.

Technical breakdown

Why the CSO role is expanding into enterprise integration

The CSO role expands when security becomes responsible for joining together physical protection, threat intelligence, incident response, and business-facing risk decisions. In that model, the CSO is no longer just a control owner but a coordinator of people, process, and executive judgement. That shift matters because the function has to translate risk signals into decisions that leaders across the enterprise can act on, not simply produce alerts or reports.

Practical implication: Treat the CSO function as an operating hub and define which decisions it owns, which it informs, and which it escalates.

Why geopolitical risk changes security prioritisation

Geopolitical risk forces security programmes to look beyond traditional site protection and insider concerns. It changes the mix of scenarios that matter, including travel exposure, supply disruption, regional instability, protests, and threats that cross physical and digital boundaries. For corporate security, that means intelligence, resilience planning, and incident coordination become more tightly linked, because the same event can affect people, facilities, operations, and reputation at once.

Practical implication: Align threat intelligence, crisis planning, and executive protection around the same risk taxonomy so priorities do not fragment.

How AI investment affects security operating models

AI investment changes security work because it increases both the volume of data leaders must interpret and the speed at which operational decisions are expected. In corporate security, that often means faster screening, broader detection coverage, and more automation in investigations and monitoring. The governance question is whether those capabilities improve decision quality or simply add another layer of tooling without clarifying accountability.

Practical implication: Define where AI supports analysts, where it automates triage, and where human review must remain mandatory.

Threat narrative

Attacker objective: The objective is to exploit organisational uncertainty and fragmented response so that disruption has a wider operational and reputational effect.

1. Entry begins when geopolitical instability, armed conflict, or related disruption enters the security operating environment as a business risk rather than a single-site event.
2. Escalation occurs as the CSO function absorbs broader coordination duties across intelligence, investigations, protection, and continuity planning.
3. Impact follows when security decisions become enterprise-wide and the operating model determines whether the organisation can respond coherently to fast-moving risk.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Enterprise integration is now the central CSO competency: the survey shows that security leaders are being measured less as isolated risk owners and more as connectors across the business. That shift is structural, not cosmetic, because the function must now combine threat awareness, incident coordination, and executive decision support. The practical conclusion is that CSO operating models need clearer authority boundaries and better cross-functional governance.

Geopolitical pressure is broadening the security agenda: once geopolitical risk and armed conflict become board-level concerns, the security team has to think in terms of scenario management rather than single-vector protection. That broadens the remit of intelligence, travel, crisis response, and resilience work. It also means the security programme must be able to explain how external instability translates into internal exposure.

Risk orchestration: the most useful security organisations are becoming orchestration layers for human, physical, and operational risk. That concept is grounded in the survey's emphasis on changing roles and investment priorities. It matters because the leader who can connect signals across disciplines is better placed to reduce blind spots than a team that operates in functional silos. The practitioner conclusion is to build governance around shared risk decisions, not separate local optimisations.

AI spending will test governance maturity, not just budget appetite: as CSOs direct more investment toward AI, the real question is whether those funds improve detection, prioritisation, and decision quality. Automation without governance can amplify noise and reduce trust in security outputs. The practical conclusion is that AI should be evaluated as a control enabler inside a defined operating model, not as a standalone capability.

What this signals

Risk orchestration: security programmes that still separate threat intelligence, executive protection, and business continuity will struggle to respond coherently when external instability becomes a board-level issue. The better model is a shared risk cadence that lets leaders prioritise the same scenarios from the same evidence.

As AI becomes more embedded in security workflows, governance has to move from tool selection to decision control. The programme should specify which outputs can inform action, which must be reviewed, and where accountability sits when automation shapes security judgement.

For practitioners

• Define the CSO decision boundary Map which risks, incidents, and escalations the security function owns directly, which it coordinates, and which it only advises on.
• Align enterprise risk scenarios Use one scenario set for geopolitical disruption, executive protection, business continuity, and incident response so teams are not planning from different assumptions.
• Review the security operating model Check whether investigations, intelligence, protection, and resilience sit in a structure that can share priorities and act on the same information.
• Set governance for AI-supported security work Define where automation can triage, where analysts must decide, and where executive review is required before the organisation depends on AI output.

Key takeaways

• The survey points to a CSO role that is moving from narrow protection toward enterprise-wide coordination of risk and response.
• Geopolitical instability and armed conflict are changing which scenarios security leaders prioritise and how they organise their programmes.
• Security teams should respond by tightening governance, clarifying decision ownership, and aligning resilience, investigations, and intelligence under one operating model.

Related NHI Mgmt Group resources: Security Budget and Investment Planning Guide · Security Investment and ROSI Guide · Cyber Security Investment Executive Briefing · Cybersecurity Risk Manager Career Guide

Key terms

• Chief Security Officer: A Chief Security Officer is the senior executive responsible for an organisation’s security strategy, governance, and risk management across domains such as cyber, physical, and operational security. If the role lacks authority or visibility, security decisions fragment and risk ownership becomes unclear. Defenders should define reporting lines, decision rights, and accountability.
• Threat Intelligence: Threat intelligence is contextualised information about adversaries, techniques, and signals that helps teams decide what matters and what to do next. In practice, it becomes useful when it is tied to detection, identity scope, and response actions rather than remaining a feed of indicators.
• Executive Protection: Executive Protection is the coordinated safeguarding of senior leaders against physical, digital, and reputational threats. In security programs, it blends close protection, travel risk, threat intelligence, secure communications, identity verification, and access control to reduce targeting, impersonation, surveillance, and compromise across personal, corporate, and family environments.
• Crisis Response: Crisis response is the coordinated action taken to contain an active security or operational event, reduce harm, and restore safe business function. In identity security, it combines triage, containment, investigation, communication, credential and access control changes, and recovery steps across IAM, NHI, cloud, and incident response teams.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the wider security operating model their programme depends on.