Why ISC2’s New CEO Says Cybersecurity’s AI Challenge Is A People Challenge

Scott Beale explains why midmarket IT leaders should not regard AI as a substitute for professional development.

(Scott Beale, CEO, ISC2)

As AI becomes more deeply embedded into security stacks, organizations are placing a priority on leveraging AI’s ability to speed up threat detection, vulnerability management, and hasten remediation after an attack.

However, humans are still in the loop — which is why midmarket IT leaders should also fully assess whether they have enough trained professionals on staff who know when to trust AI, when to challenge it, and how to explain its risks to senior leadership.

[RELATED: Midmarket IT Faces Enterprise-Scale Threats On A Smaller Budget. Here’s How Leaders Are Rethinking Zero Trust.]

AI Is Changing Cybersecurity Work—Not Eliminating It

That is the message from Scott Beale, the new CEO of ISC2, who told MES Computing in an interview that cybersecurity leaders, particularly those with tight budgets, should not regard AI as a substitute for professional development.

Beale, who became CEO of ISC2 in January, delved into new research from ISC2 on how AI is not necessarily replacing cybersecurity professionals, but is reshaping the cybersecurity profession.

ISC2’s report, Rethinking AI’s Impact On Cyber Roles, includes findings from a survey of 856 cybersecurity professionals who use AI in their work.

• 65 percent said they spent more time deciding when to trust or act on AI-generated recommendations
• 63 percent spent more time reviewing or validating AI output
• 89 percent said that they had experienced AI recommendations that led to incorrect outcomes at their organizations
• 50 percent said human decision-makers are ultimately accountable for AI recommendations leading to incorrect outcomes

ISC2 Bets Training And Certification Will Close The AI Skills Gap

Beale said the findings demonstrate that AI is shifting cybersecurity work toward validation, oversight and governance rather than eliminating the need for human expertise.

[RELATED: 5 Rules To Getting Started With AI Governance]

Skillsets that include discernment, accountability, and governance will become critical as AI pilots continue to move into production.

A 2025 ISC2 workforce study found that 59 percent of cybersecurity workers report their teams lack critical or significant skills. AI was cited as the most pressing skill needed.

To address these training needs, Beale said ISC2 is providing training on AI security governance and has embedded AI-related questions into all nine of its vendor-neutral certifications.

ISC2 also announced Wednesday that it is developing a new AI security certification intended to help establish a trusted, vendor-neutral AI security standard for cybersecurity professionals.