Who Owns AI Transformation at Your Cybersecurity Company?

Welcome to this week’s edition of Cyber Motion, tailored for cybersecurity business leaders. In this newsletter, you’ll find practical strategies, cutting-edge insights, and fresh thinking designed to help your security-focused brand break through a crowded market. My goal is to equip you with the tools and ideas needed to thrive amid shifting threats, buyer skepticism, and evolving industry standards.

– Tobias

Not yet a subscriber? Sign up here.

Ask your leadership team one question this week: Who is accountable for AI transformation across the company, not just within a single department? If the answer is "no one" or "everyone," that's your signal. Assign it. Give it real authority. And start with a simple first step: audit every AI tool adopted in the last six months across every team. If the number surprises you, you've already found the problem.

Then ask a second question: Do we have a plan for AI literacy and workforce readiness, not just tool access but actual fluency, or are we leaving that to individual initiative? If the answer is the latter, that's your second signal. The companies pulling ahead aren't just adopting AI. They're investing in the people side of the transformation, including making room for early-career employees to build real capability, not just watch from the sidelines.

Before I dive into this week’s briefing, I owe a special thank you to Zoë W. who prompted me to go beyond the surface of the technical and also talk about the people side of the transformation.

Every cybersecurity company I talk to is fielding the same question from at least three directions: What are we doing with AI?

The board wants a strategy. The product team wants to ship features. Sales wants AI in the demo. Marketing already has six tools running. IT is trying to keep the lights on while someone in engineering just spun up a new copilot no one approved.

The pace of innovation makes it worse. It's been a little over three years since ChatGPT arrived, and it feels like a new model drops every other week. Every software vendor is suddenly an AI company. Some are genuinely building something new. Most are bolting on generative capabilities and calling it transformation. A few are doing neither but have slicker demos than ever before.

How do you parse the great from the good, the mediocre, or the truly bad? That question alone could consume a full-time role.

But the tooling layer is only the surface. AI transformation for cybersecurity companies goes much deeper: into people, process, and product. How big should a marketing department be today? Should you vibe code a marketing microsite? What about AI writing core pieces of the actual product? The answers will look different in six months than they do right now. And that uncertainty is precisely why someone has to own the thread.

In most cybersecurity companies under $100M, nobody formally owns AI transformation. IT handles procurement. Individual departments experiment on their own. The CEO talks about it in all-hands meetings. But no one is responsible for the connective tissue: the decisions about how AI changes the way the company operates, communicates, positions, and competes across every function.

The result is predictable. Tool proliferation without governance. Fragmented strategies that don't compound. Wasted budget on overlapping capabilities. Legal and compliance exposure that nobody scoped. And the most expensive cost of all: lost time. Every month without a coherent approach is a month your competitors use to pull ahead.

This isn't a technology problem. It's a leadership problem. And the longer no one owns it, the harder it gets to untangle.

Marketing was one of the first departments to get its hands on generative AI. From the moment ChatGPT launched, marketers were testing use cases, internally and customer-facing. We experiment earlier, with more freedom, and with a closer connection to the customer than almost anyone else in the org.

That early exposure matters. Not because marketing has all the answers, but because technically savvy CMOs bring a combined sense for how transformation looks both internally and externally. Not just what tools to adopt, but how they change the way we communicate, position, and compete. That dual vantage point is rare.

IT is a critical part of any AI transformation. No question. But the CMO who has been in the trenches with AI for three years, who understands the customer narrative and the operational architecture, is uniquely positioned to own the thread that ties it all together.

There's another dimension the CMO is built for: people readiness. Marketing leaders already think in terms of enablement: building the programs, playbooks, and training that help teams perform. Extending that instinct to AI fluency across the org is a natural move. Not just which tools to use, but how to think about AI as a working layer: what it changes about roles, workflows, and decision-making. The CMO who takes this on isn't just governing technology. They're building the organizational muscle that makes AI transformation stick.

That means going beyond marketing. Championing how the company builds its operational knowledge layer. How it thinks about, stores, and compartmentalizes information. Driving the creation of AI data governance policies. Overseeing rollouts of unified tools that serve multiple departments, not just one.

This isn't scope creep. It's what modern executive leadership demands. The companies that assign AI transformation to a senior operator who can see across the entire business are pulling ahead. The ones that leave it to emerge organically are bleeding coherence.

I've seen the pattern too many times. A Series B endpoint security company with six AI tools across four departments and no shared evaluation criteria. A mid-market IAM vendor where marketing, product, and engineering are each building their own AI workflows in isolation, duplicating effort and creating conflicting outputs. A CEO who announced an "AI-first" strategy in January and by March still has no one accountable for making it real.

The consequences compound:

Someone has to own this. Not as a side project. As a mandate.

And the people cost is just as real. When no one owns AI transformation, there's no one thinking about literacy. Not just "how to use the tools," but how to think critically about what AI should and shouldn't do inside the business. Workforce planning stalls. Early-career employees, the ones who will run these companies in five years, are left to figure it out on their own without the institutional context to do it well. The organizations that create structured space for that development now will compound the advantage. The ones that don't will wonder why their best junior talent left.

Stay sharp,
Tobias