Zscaler's Rob Sloan makes California's agency rule the case for a corporate AI security owner

The record here is one column, and where it was published matters. Sloan's piece ran on Forbes' Tech Council platform, which carries his employer in the byline note ^[16][3]. His account of the California requirement is a single sentence, with no bill number, no effective date, and no description of what the designated officers are obliged to do ^[17]. The rule he cites binds state agencies. The recommendation he draws from it is aimed at companies, and the extension is his own ^[18].

"Maybe the CISO should own it. The problem is that most CISOs are already overloaded," Sloan wrote ^[5]. The support he offers is a list of what security chiefs hold at once: cloud security, identity, resilience, ransomware preparedness, third-party risk, incident response and board reporting ^[6]. Sloan lists seven standing mandates in one job ^[21]. Sloan's claim is that AI security does not fit as the eighth.

Five exposures carry the technical half of the argument ^[20]: prompt injection, training data poisoning, model manipulation, agent permission abuse, and sensitive information leaking into unsanctioned tools ^[7]. "AI security simply cannot be treated as a side job divided between legal, IT, security and engineering," Sloan wrote ^[8]. He puts the work in execution terms, naming model hardening, guardrails and limits on what AI agents are allowed to do ^[15]. On the boundary with compliance he is direct: "This person shouldn't replace legal or compliance; their job is to make sure policy turns into actual controls, testing and guardrails" ^[10].

The trade-off a budget owner actually faces is hidden behind the title question. Extending the CISO's charter is a memo, and the next reorganisation can undo it. Standing up an officer with a reporting line and headcount is a commitment that has to be unwound in public later, and Sloan expects an unwinding: he writes that the role may not need to be permanent, and that over time the work may fold back into something broader ^[12].

On sequencing he is specific about who goes first, naming regulated companies, multinationals and firms putting AI into customer-facing products ^[11]. For everyone else his case rests on timing. When security is seen as slowing deployments, Sloan writes, business teams bring it in too late or not at all, which is how shadow AI grows and how pilots reach production before anyone has asked what data is exposed ^[13]. He also argues that attackers are already using AI to scale their operations and that better models will widen that advantage ^[14].

Sloan's five exposures can each be assigned to a named person on an existing org chart. That mapping tells a board whether it has an ownership gap or a capacity gap. Hiring only closes the second.