AI in Cybersecurity: How CISOs Can Achieve Board Alignment 

This document provides guidance for CISOs and boards on governing AI in cybersecurity, distinguishing risk profiles across rule-based AI, machine learning, and generative AI, and emphasizing the dual-use nature of AI for defenders and adversaries. It highlights regulatory expectations from the EU AI Act and NIST AI RMF, and recommends immediate actions including assigning ownership of AI risk, integrating AI into enterprise risk management with quantification (e.g., FAIR), and enforcing rigorous vendor due diligence. The piece points to a seven-step AI governance program and offers a board briefing deck to support oversight, transparency, and disclosure readiness.