For the CISO
The board just asked: are we OK on AI?
Track 2 · Your skills path is one click away. The story below is depth; the path names what to learn.
Score your mastery →Every function you own is adopting AI — most didn’t ask first.
The copilots landed in identity, in the SOC, in the pipeline, each on its own terms.
Now the board wants one answer, and your tools give you forty.
4 in 10
AI decision-makers name security and risk as their top AI concern — ahead of readiness, ahead of cost, ahead of the technology itself.
Forrester · State of AI Survey, 2025 · base 1,528 AI decision-makers
You are not behind, and you are not being replaced. Nobody has the textbook yet; these are emerging problems, and the frameworks are still being written.
What exists today is a way to see the whole estate on one grid, and an honest line between what’s governed and what merely got adopted, so you own the board answer.
“Can I show, function by function, that AI hasn’t outrun our controls?”
Yes. Two axes per function, one gate, one page.
Three things make that sentence true. Each one is next, in the order you’d present them.
The scorecard
Every function, one glance.
Each of your functions plots at two coordinates: how far AI has been adopted, and how well that adoption is governed. Above the diagonal, adoption sits inside what your controls can catch. Below it, something runs ahead of the controls that should catch it.
That diagonal is the whole argument, and the board reads it in a minute.
Identity Security: Autonomy 2.0 of 4 (AI-CMM, our model · calibrated to SAE J3016), governance 3.0 of 5 — adoption is inside what the controls can catch.
Your portfolio, live — the same instrument the board page opens with.
The gate
Autonomy must never outrun governance.
Two ladders, one rule. Maturity grades how well each function’s AI is secured — the CSA AI Security Maturity Model, five levels. Autonomy grades how far the AI has been allowed to act — our own four-rung ladder, calibrated to SAE J3016.
The gate joins them: a function may only climb the autonomy ladder as far as its governance floor supports. No exceptions, no vibes — a rule your auditors can read.
The top risks
Three lines you can read aloud.
The scorecard ends in sentences, not heat maps — the kind you can say to a board without a backup slide.
“Security Operations adopted fastest — and is the one function where autonomy has outrun governance.”
derived from the portfolio, function by function
“Identity and Data are within the gate; their next autonomy step is already governed.”
the gate reading, per function
“Nothing here is a vendor score. Every number traces to a question your teams answered.”
self-assessed · every reading labeled
Your reskilling list
11 controls have your name on them.
Not a course catalogue. These are the controls your program answers for, grouped the way you would delegate them.
10 to build · 1 to verify, not build. Nobody reskills for what the provider already owns.
Govern the AI program
4 controls
Set the appetite and the gates
3 controls
Own oversight and the ethics of use
3 controls
Build the AI-ready workforce
1 control
This is the same spine the assessment reads. Score your mastery on four concrete rungs per prompt, or run the function diagnostic — every gap lands on this list: the named skill, the group it belongs to, and who learns it.
Browse skills personalities →Run the diagnostic. Your gaps land on this list →
8 functions. Two readings each. One page.
Self-assessed where a run exists, illustrative where it doesn’t — always labeled which.
Not your role?
Each role has its own way in. Here is where the others start.