Companies want AI-native CISOs, but supply is tight

What do companies want? CISOs skilled in agentic AI. When do they want it? Now. Although actually finding one is proving difficult for many.

According to research from executive recruitment firm Christian & Timbers, the demand for AI-native CISOs and CSOs jumped 256% in the first seven months of the year compared to the same period last year. The findings are based on roughly 100 conversations between Christian & Timber partners and C-suite executives between January and July.

Where’s the supply? While more companies want CISOs with agentic expertise, supply has yet to match that demand, according to Christian & Timbers President JC Christian.

“For basically any AI-native role, supply is very scarce,” Christian said. “The very best is able to command a premium as a result.”

The imbalance in supply and demand for AI-native CISOs extends beyond Christian & Timbers. Martha Heller, CEO at Heller, an IT executive recruiting firm, said she has witnessed a sudden uptick in clients seeking agentic AI skill sets from CISO contenders, which she noted are few and far between at the moment.

“What’s so fascinating about it is…you cannot really say, ‘I want someone who has built and implemented a comprehensive agentic cyber program,’ because no one has. It is totally and completely new,” Heller said. “And that’s what’s so interesting about recruiting now is so much more often, you’re looking for ability than experience, because there just isn’t any.”

How to be an attractive CISO candidate. While not many CISOs have deep agentic experience, Christian and Heller said there are still ways to remain marketable in today’s job market. Christian suggested that security pros try to serve as “positive catalysts” of agentic initiatives within their current organization.

“You should be able to develop agentic frameworks for each of the surface areas for risk, both from, in some cases, offensive, but mostly defensive security and posture,” Christian said.

Heller added that security leaders should embrace AI inside and outside of the workplace.

“Become AI-focused. Take whatever certifications in AI you possibly can. Put AI all over your résumé, and say right in a top bullet that agentic AI and agentic cyber is a strong focus of yours,” Heller said. “Just deck yourself out in agentic AI.”

And finally, Heller reminds CISOs of the importance of context for AI, encouraging leaders to lean into familiar business processes when applying for agentic AI positions, because this technology is ultimately designed to make those processes more efficient.

“If you’ve never been in a hospital, you probably aren’t going to be as good at that as somebody who worked in that field,” Heller said. “I would say really understand yourself, cyber leader. Are you great with banking info? Are you great with HIPAA? What is your lane?”