Serving in the military requires a precise, tactical mindset, and that’s exactly what Barry Hensley espoused during his 24 years in the US Army, where he rose to the rank of colonel.

The military “is where you earn your stripes, showing your soldiers your willingness to jump into a foxhole and pick up a weapon,” says Hensley, CSO of Brown & Brown, an independent insurance brokerage firm.

As a security leader in an industry that is constantly evolving, Hensley has leaned on that in-the-trenches approach as a key part of his leadership ethos, even as the CSO role has grown increasingly strategic.

“A security leader needs to be close enough to the tactical fight to effectively guide the organization’s strategic direction, align with business goals, manage risk and investments, and influence culture,” he explains. Business units need to have confidence in a security leader’s level of expertise in a specific security domain so the leader can properly represent the risks and investments required. 

“Rolling your sleeves up in the middle of a security event is never a bad thing,” Hensley adds. “It shows your willingness to lead from the front and/or support in the most stressful situations.”

And increasingly stressful those situations have become, as the spotlight on CISOs has never shone more brightly. Now alongside increasing responsibilities that include data protection and privacy, third-party and supply chain risk, and regulatory compliance and reporting, CISOs must confront the rise of AI — both in the hands of bad actors and throughout the enterprise. And as the CISO role evolves and grows, many are rising to embrace the opportunity.

According to Foundry’s latest Security Priorities Survey, 95% of top security leaders regularly engage with the board of directors multiple times a month, up from 85% in 2023.

This is helping advance cybersecurity initiatives. The CISO’s elevated prominence is also leading to new reporting structures, the survey found, with 31% of respondents reporting that the top security leader reports directly into the board of directors. Only one in five respondents said their security chief reports into the corporate CIO, “another sign that cybersecurity commands its own infrastructure and leadership outside of IT.”

CSO spoke with Hensley and other 2026 CSO Hall of Fame inductees, about how they are governing as AI initiatives become firmly rooted in the enterprise.

Implementing an AI security framework

AI is a core component of Brown & Brown’s security strategy: enhancing SOC operations, streamlining vulnerability management, determining the risks/rewards of third- and fourth-party partnerships, and boosting security application development, Hensley says. 

“For 2026, publishing an AI security framework is our top priority to enable the business to move fast — safely,” he says. His staff is partnering with the firm’s AI engineering and enablement teams to perform AI risk assessments and ensure that AI is fit for purpose and used responsibly through the company’s AI Governance Working Group.

“AI is top of mind for our leaders and a prominent topic with the board of directors, serving as a key consideration and differentiator for our business,” Hensley says.

Companies need governance frameworks that require security reviews before any AI capability is deployed, agrees Shaun Khalfan, senior vice president and CISO of PayPal. This ensures use cases are evaluated against security requirements, data sensitivity, operational risk, and business impact.

“This is why I am a strategic business advisor for major AI business decisions at PayPal,” says Khalfan, whose team is applying advanced risk detection technology and oversight, including machine learning models running in real-time that evaluate over a billion transactions per month. 

The work includes maintaining tight risk and business alignment, incorporating new products into existing compliance and risk frameworks, and adapting them to the unique characteristics of each product, he says. 

Move fast, keep risk at bay

Like Hensley, Jeff Trudeau, CSO of Chime, says the role is fundamentally shifting from a control function to a strategic partner in how the business adopts AI responsibly. At Chime, that means being embedded early in how AI is built and deployed, not reviewing it after the fact, Trudeau says.

“We’re focused on three areas: securing AI systems themselves, governing how AI is used across the company, and helping leadership make clear risk/reward decisions as we scale,” he says.

Noting that AI increases both speed and surface area, Trudeau says his role is to ensure the firm can move fast without introducing unacceptable risk. “That requires tighter integration with engineering, product, and data teams, as well as more direct engagement with executive leadership and the board on how AI changes our risk posture.”

Khalfan also characterizes himself as a strategic CISO with a strong operational and engineering foundation. He strongly believes that a well-defined security strategy aligned to business goals is essential for the success of any cybersecurity organization.

“Security cannot operate as a separate function; it must be embedded in how the business grows, innovates, and continues to earn trust,” he says, adding that “strategy without execution is just theory. We operate in a threat landscape that changes daily, and there are moments when tactical action is critical to managing immediate risk.”

Rapid AI adoption is a perfect example, he says. Echoing Trudeau, Khalfan believes the CISO must help the organization move fast while still protecting customers, data, infrastructure, and reputation.

“The best CISOs know how to balance both, thinking long-term while acting decisively in the short term,” he says. 

All roads lead back to trust and strong governance, he notes. “Trust is the foundation of both technology and business. You must build trust in the system across customers, merchants, partners, and infrastructure to ensure AI and agent-driven transactions are reliable, secure, and verifiable.”

AI is creating the greatest security challenges

For Trudeau, the biggest challenge of the burgeoning AI era is the pace of change. AI is accelerating how software is built, how attacks are executed, and how quickly systems evolve. Traditional security models, periodic reviews, and static controls don’t keep up, he says.

“We’re addressing that by shifting to more continuous, embedded security practices. That includes integrating security into development workflows, investing in detection and response capabilities that adapt in real-time, and building stronger data governance around how sensitive information is accessed and used by AI systems,” Trudeau says.

At the same time, the focus is on maintaining trust at scale. “As we introduce more AI-driven experiences, we have to be clear about how systems behave, how decisions are made, and where human oversight remains,” Trudeau says. “That’s as much a product and trust challenge as it is a technical one.”

AI is also impacting what Brown & Brown is seeing with phishing campaigns, notes Hensley. “AI is maturing in its ability to impersonate individuals, both voice and video, while quickly generating supporting documents to further convince teammates that a fraudulent request is genuine.”

A preview of Anthropic’s Mythos release shows that AI can now rapidly discover previously unknown vulnerabilities and automate their exploitation, Hensley says. “This changes the paradigm. Vulnerability management will likely become a higher priority for organizations as they cannot wait weeks to patch hosts based on a perceived risk tolerance of mitigating controls.”

Most organizations will have to empower their IT platform providers to deploy automation for near-real-time patching — while holding them accountable for the contracted service-level availability, he says.

Managing identity, data, and humans

AI is not the only challenge CISOs have to contend with. Khalfan says that identity, data security, and context are his most important challenges to solve for.

“Identity is becoming more complex, as humans, machines, APIs, and autonomous agents all interact with critical systems,” he says. “Knowing who — or what — is requesting access and ensuring the right level of trust and least privilege is fundamental.”

Context is the multiplier, Khalfan adds. “Security decisions without business context create unnecessary friction, and business decisions without security context create unnecessary risk. Security leaders must create systems that make both visible in real-time.”

To execute, his team focuses heavily on getting the fundamentals right: strong data governance, dynamic policy tuning, continuous validation of the control environment, frequent deployment of security improvements, and designing controls that are embedded into workflows rather than added afterward, Khalfan says.

“Security at scale is less about isolated controls and more about building resilient systems that continuously adapt,” he says.

As much as AI has added new trials, Hensley finds that the human element, along with the expanding attack surface, remain the greatest security challenges. This includes the arms race between attackers and defenders. “Sophisticated social engineering is at an all-time high, challenging our teammates to be not only vigilant but also often the first line of defense,” he says.

To stay ahead, “we are tackling from all angles, including security awareness training, enabling new advanced AI features in our security tools, and taking more proactive actions on behalf of our teammates based on risk/reward evaluations,” Hensley says.

Hall of Fame advice on meeting the current CISO moment

Meeting today’s cyber leadership challenges requires CISOs to lead from the front — something both Hensley and Khalfan practice. That means only adopting AI that is secure and trusted. “Security should not be the department of ‘no’; it should help business partners move faster with confidence, Khalfan says.

Leading from the front also means challenging the status quo, and viewing yourself as a business partner/risk advisor, Hensley says.

For Trudeau, it’s about being able to translate risk into business terms.

Stay close to the business. “If you do not understand how your company creates value, you cannot effectively protect it,” Khalfan says. “Security leaders need to speak the language of growth, customer trust, and operational resilience, not just technical risk.”

Trudeau agrees, saying that security leaders must align their work directly to business outcomes. “If security is seen as separate from growth, you’ll always be reacting instead of shaping decisions.”

Be the enabler. “The best CISOs help the business move faster and safer, not slower,” Khalfan says. “Your job is not to create friction everywhere; it is to create friction where the risk is highest and remove it where trust can be increased through better design.”

Engage early. “The earlier security is involved in product and AI development, the more leverage you have to influence outcomes without slowing teams down,” Trudeau notes.

Khalfan echoes that, saying that data security, identity, and observability are the foundations on which trusted AI systems are built. Business and cyber teams must work hand in hand to ensure those outcomes are achieved, he says. 

“Whether it is defending against AI-enabled threats, protecting AI infrastructure, or evaluating the risk and reward of AI innovation, security must be involved early, not after deployment,” he adds.

Stay proactively compliant. Khalfan says that PayPal’s security organization continually monitors and updates its governance and requirements based on the evolving regulatory frameworks.

Solve business problems. This is a sure-fire way to meet the today’s cyber challenges and raise your profile as CISO. “When security becomes a driver of trust, speed, and competitive advantage, your seat at the table becomes permanent,” Khalfan says.

For example, Khalfan drove company-wide bot protection initiatives, a collaborative, multi-team effort that enhanced fraud prevention. It greatly reduced fraudulent traffic at the top of the process, resulting in higher quality customer engagement, he says.

Talk the talk. If you want to understand how to secure AI, you need to actively use AI, Khalfan stresses. “Security leaders cannot govern what they do not understand. Hands-on experience creates credibility and better decision-making,” he says.

This often requires investing in fluency beyond security to understand how AI systems work, how your company builds products, and what leadership cares about, Trudeau says.

Build credibility through consistency. “As the scope of the role expands, especially with AI, leaders are looking for clear, pragmatic guidance, not theoretical risk models,” Trudeau says.

There’s no ‘I’ in team

A core part of raising to today’s challenges and elevating your CISO role requires security leaders to bring your teammates along. They will always be your greatest resource, Hensley says. 

“My military experience is part of my DNA and has shaped every part of my life, especially how I think of teammate development, building highly cohesive functioning teams, and prioritizing what is most important,” he says.

So many things in life will come and go, but your impact on others will impact generations, Hensley adds. They carry your values forward from culture, ethics, and standards.

“My legacy will be the teammates that I have served alongside through my career,” he says. “I encourage security leaders to focus on the impact you can make on your team every day — it will ultimately serve to elevate your profile and leave a lasting mark.”