Cognizant: How the CISO Role Evolves in the Age of AI Agents

Critically, agents also expand the attack surface in ways legacy controls were never designed to handle. Models, prompts, data pipelines and tool integrations are now live attack surfaces inside every enterprise.

Attackers and defenders draw on the same AI, and the advantage goes to whoever moves first.

If an AI agent can make decisions and take action autonomously, who should be held responsible for those actions? 

The people and organisations responsible for deploying and overseeing these systems must remain accountable for how they behave. Giving an AI agent greater autonomy should never mean giving up human responsibility for its actions.

That starts with anticipating what could go wrong when an agent acts autonomously, and defining where human intervention is required as a core part of cybersecurity controls. Clear ownership and escalation paths are essential, particularly where there is significant operational, financial or regulatory risk.

This is why the CISO's role is evolving. The CISO is the one executive with the mandate and operational mechanisms to manage AI trust continuously, not through periodic policy reviews but through governance backed by evidence: traceability, auditability and explainability.