PwC: No Clear Owner for Agentic AI Security

PwC published its Digital Trust Insights 2027 report on Friday, and its central finding is an ownership gap: no single role has clear responsibility for managing agentic AI or securing it. The survey covered approximately 4,000 business and technology leaders across 71 countries, according to ZDNET.

Asked where accountability sits, 29% of CEOs and security and risk leaders pointed to the CIO, CTO or a similar technology role. Another 17% said responsibility lies with the CISO or cybersecurity teams, and 26% said it should stay with a dedicated AI leader or AI function. A further 11% said accountability is unclear or shared across multiple roles or functions.

Some governance structures are in place. Nine out of 10 business leaders said practices such as board oversight, executive accountability and enterprise risk integration are now established, and 47% said cybersecurity is a standing agenda item for boards. About 33% of organizations have hired for dedicated AI roles, including AI chief officers and AI board members.

Jim Taylor, Chief Product and Strategy Officer at RSA, told ZDNET that identity controls used for human users need to be applied to the management of agentic AI.

The report's numbers do not establish a single default owner. They show the responsibility split across technology leadership, security teams and newer AI-specific roles, with a smaller share of organizations describing the picture as ambiguous.

The CISO role has a longer history

Formal security leadership is a comparatively recent corporate function: in 1994, Citigroup hired Steve Katz as the first formal CISO, a role created to handle the aftermath of Russian cyberattacks.