Can Cyber Security Operating Models Keep Pace with Converging Risk?

Many cyber security operating models are struggling with converging risk because expertise, business context and decision-making authority remain divided across functions designed to manage separate domains. CISOs do not need to centralise every decision, but they do need to ensure accountability remains clear when risk crosses identity, applications, operational technology and AI.

Security teams have developed deep capabilities across these areas, yet incidents rarely respect the same organisational boundaries. A compromised identity may expose an application weakness. A software dependency can affect operational continuity. An AI agent may introduce access, data and governance concerns simultaneously.

Each control may have an owner. The combined business consequence may not.

Specialisation has created an accountability problem

Identity, application security, operational technology and incident response require distinct expertise. Combining them into one generalist function would weaken the depth organisations need.

The challenge lies in the handovers. Each team may understand its own exposure yet no single team has the context or authority to resolve the combined business risk.

Consider an identity compromise used to exploit an application supporting a critical operational process. One team manages access, another owns the application and a third is responsible for operational continuity. Each function may respond correctly within its remit while no one has clear authority over the overall consequence.

Risk committees and escalation processes provide oversight, but they can also slow action if decision rights have not been established in advance.

Senior cyber leaders need to know who takes ownership when risks intersect, who can resolve competing priorities and when a specialist decision becomes an enterprise decision.

The CISO should orchestrate risk, not absorb it

The CISO’s remit has expanded as cyber security has become more closely connected to business resilience, digital transformation, third-party exposure and regulatory scrutiny. AI adds questions around autonomous agents, machine identities, data access and human oversight.

This does not mean every related risk should transfer to the CISO.

Business owners remain accountable for the services and outcomes under their control. Technology and operational teams retain responsibilities within their environments. The CISO’s role is to ensure these parties can make informed decisions within a consistent enterprise-wide approach to managing cyber risk.

That requires a deliberate balance between central direction and distributed authority.

Enterprise guardrails should define non-negotiable expectations. Teams close to the technology should be empowered to resolve issues within those boundaries. Exposure exceeding agreed tolerances should move through explicit escalation routes.

Without those distinctions, centralisation can make security a bottleneck, while excessive delegation can leave material exposure caught between functions.

Four tests for the operating model

Senior leaders can examine whether their operating model is fit for converging risk through four tests.

1. Context

Can a technical issue be connected quickly to the business service, critical dependency and operational consequence it may affect?

Alerts and vulnerability scores offer limited decision value without this context. Leaders need to understand what is exposed, why it matters and what disruption could follow.

2. Accountability

Is there a named owner when an issue crosses identity, application, OT, cloud or third-party boundaries?

Control ownership is not the same as ownership of the business outcome. The operating model should make that distinction visible.

3. Authority

Can the person closest to the risk act within defined limits?

Teams should not need executive approval for every response, but the thresholds for escalation must be clear when commercial, safety, customer or regulatory consequences are involved.

4. Action

Have teams practised making coordinated decisions under realistic pressure?

A documented process cannot demonstrate whether competing priorities will be resolved quickly during an incident. Exercises should test the points at which information, responsibility and authority move between functions.

Assurance must test consequences

Boards often receive control maturity scores, vulnerability trends, compliance results and programme updates. These indicators can show activity and progress, but they do not necessarily demonstrate whether the organisation can withstand disruption.

A control may be present without being effective. It may operate correctly in isolation but fail within a wider attack path. A critical service may appear protected until an overlooked supplier, application or identity dependency is affected.

Assurance needs to test whether controls work together to protect critical business services, including when one failure exposes weaknesses elsewhere. This means assessing not only whether controls exist, but whether the organisation can detect disruption, make timely decisions and maintain essential operations when several protections fail at once.

The CISO Sydney 2027 program reflects this challenge through four themes: the confidence gap, the attention economy of risk, moving beyond the illusion of control and operating at machine speed.

Together, these themes raise a more useful executive question than whether the security programme is busy: does the organisation have credible evidence that it can make effective decisions when normal conditions no longer apply?

AI is testing the speed of governance

AI is accelerating development, automation and decision-making. It is also introducing systems that may act across data, applications and identities without fitting neatly into existing ownership models.

Traditional governance mechanisms were not designed for this pace. Establishing another committee or approval stage may improve oversight, but it can also create delay without resolving accountability.

Leaders instead need predetermined boundaries for automated action. They must decide where human approval remains essential, what behaviour should trigger intervention and who can suspend an AI-enabled process when its impact crosses multiple functions.

The real test is whether organisations can define who or what is authorised to act, and when human intervention is required, before an AI-enabled process creates consequences that existing escalation mechanisms cannot contain.

One challenge viewed through four disciplines

The launch of CISO Sydney 2027 alongside OT Security Sydney, AppSec & DevSecOps Sydney and Identity & Access Management Sydney reflects the interdependence of modern cyber risk.

The programs bring together four distinct perspectives: enterprise security leadership, operational consequence, secure software delivery and identity governance. Their disciplines remain specialised, but the decisions made within them increasingly affect one another.

More than 100 speakers and over 1,100 attendees are expected across the co-located events on 9 and 10 February 2027 at Royal Randwick Racecourse.

Operating models will be better prepared for converging risk when decision rights are clear, accountability extends beyond individual controls, and teams can act before gaps between functions become business exposure.

Explore how senior cyber leaders are rethinking accountability, assurance and decision-making across CISO Sydney 2027 alongside dedicated programs covering operational technology, secure software delivery and identity governance.

By Kye Ling Gan 

Join us in 2027

• CISO Sydney 2027, 9-10 February   
• OT Security Sydney 2027, 9 February
• AppSec & DevSecOps Sydney 2027, 10 February
• Identity & Access Management Sydney 2027, 10 February