CISO Talks: When Business Leaders Want the Data But Not the Risk
Data ownership was the most emotionally charged topic of our nationwide CISO tour. Here’s what that frustration sounds like, what’s actually worked, and why AI agents are making it harder.
.webp)
Key Takeaways:
- Ownership is the second-biggest data security gap after visibility, because business teams want the value of data but not the risk.
- Incident response exercises and real breach stories can help convince business executives to take ownership.
- As AI agents and copied data multiply, organizations need visibility into who or what is using data before they can hold anyone accountable.
When we asked 159 security leaders across five cities what would most improve their data security posture, data ownership was the most common answer after data visibility.
A security leader at a city government agency put it more bluntly, and only half-jokingly: “A data breach.”
Her agency has always defaulted to disclosing everything, she said. Pulling back, even on data that clearly shouldn’t be public, has been close to impossible, because no one in the business will own the decision. She suggested only a breach would force anyone to act.
Andy Land, general manager of CISO Executive Network and the roundtable moderator, explained why so many security leaders could relate. Without a breach, he said, data protection rarely gets funded: “Nobody’s going to do anything because it’s been fine. Why do we need to spend money on it?”
.png)
Security Gets the Blame by Default
This sort of attitude leaves security teams in a vulnerable position, noted one VP of IT security. “Everybody thinks that IT and legal and security own data classification,” he said, “and we don’t.”
Land has heard that complaint enough times to have a theory about it. Business units, he said, want to own the upside of data: its value, usefulness, and the money it can help generate. “They don’t want to own the risk.” In his experience, people are quick to take credit for what data lets them do, and slow to take responsibility for what happens if it leaks.
What Actually Moves Executives
A newly retired CISO offered the closest thing to a working solution anyone described. Rather than a single mandate, what worked for him was a steady diet of incident response exercises, run for both technical staff and executives, plus what he called “ripped from the headlines” briefings: walking leadership through a real breach at a comparable organization and asking what would happen if it were them.
A government-sector CISO in the same room made the case in financial terms. Recovering from a breach, he argued, reliably costs more than preventing one. He pointed to a public after-action report from a past government breach as one of the most effective tools he’s used for making that case to the people who control budgets.
AI Agents Make Ownership Harder
If ownership were only a human accountability problem, better incentives might eventually fix it, or, as one attendee suggested, “a punishment for not hitting your mark.” But several CISOs argued the problem has shifted, because many of the things now touching sensitive data aren’t people at all.
An AI, data, and application security leader at a national insurance company framed it through an identity-first lens. Knowing who has access to a dataset is only the start. The real question is whether “that user or agent” should be able to take a specific action, right now, on specific data.
AI agents, she said, are reaching into systems and data stores that traditional access reviews were never designed to catch, because those reviews assumed a human was on the other end of the request.
An independent security consultant agreed, with one caveat that mattered. A person generally won’t misuse access at the same rate an AI agent might, because human intent doesn’t scale the way automated action does.
He also pushed back on the idea that organizations are failing at governance. They’re doing what’s realistic, he said, “biting off what you can deal with” at each new turning point, whether that’s cloud migration, a new privacy law, or now AI.
A CISO at a global insurance firm described how quickly ownership breaks down in practice. His developers routinely copy data into cloud storage buckets to build or test something new. They mean no harm, but that action strips away whatever access controls protected the original data, and the copy has no clear owner.
His instinct is to centralize, forcing every team and tool through a single point of control. But even he admitted his developers keep asking for their own separate databases, which is exactly how the duplication started.
Data is going to keep getting copied. The question is whether security can follow each copy and know who’s using it.
Protect your data the moment it moves.
Give us 30 minutes to show you how ORION identifies sensitive data, understands context, and prevents data loss with 95% fewer false positives.
Where There Is Heading
None of the CISOs we heard from thought a policy memo would solve ownership. The recurring view, across multiple cities, was that ownership has to be visible before it can be assigned. Right now, most organizations can’t show in real time who touched a piece of data, where it went, or whether anyone ever authorized an AI agent to access it.
That’s the near-term goal several CISOs described: enough automated visibility into how data moves that “who did this” becomes a question with an immediate answer instead of a forensic investigation after a breach. Once security teams can show who is actually using data, human or agent, ownership stops being an argument in a committee meeting. It becomes a fact the business has to deal with.
.webp)