Qualys CISO: AI Cybersecurity Requires Human Accountability
As artificial intelligence accelerates vulnerability discovery and remediation, cybersecurity leaders must evolve governance practices, connect security decisions to business risk and maintain human accountability for automated actions, according to Nathan Smolenski, chief information security officer at Qualys.
Speaking with Steve Lasky, director of content for Endeavor Business Media Security Group, at the 2026 ROCon Conference in Austin, Texas, Smolenski discussed the challenges of autonomous remediation, enterprise risk and AI's evolving role in cybersecurity.
Security decisions must align with business risk
Smolenski said security vendors need to better understand how enterprise leaders make purchasing decisions and the business problems they need to solve. Rather than turning product capabilities into perceived needs, sales teams must understand customers' priorities and organizational challenges.
He emphasized that cybersecurity must be treated as a business risk, with security leaders able to explain how vulnerabilities and unaddressed threats could affect operations.
"Cyber is a business risk," Smolenski said, comparing cybersecurity with other risks organizations manage, including natural disasters.
AI requires stronger governance and oversight
As AI accelerates vulnerability discovery and exploitation, Smolenski said organizations must evolve governance, auditing and risk management alongside their technology.
"If we're not, then the paper policy is never going to match what the technology can ultimately do or what you don't want it to do," he said.
While autonomous agents can help organizations respond to threats, automated actions can also introduce risks. Smolenski cited the possibility of a hospital's automated security response disrupting life-saving systems.
"Accountability can't be outsourced," he said.
Organizations must establish controls around AI agents throughout their operational lifecycle and maintain the ability to reconstruct decisions, evaluate outcomes and respond when processes go wrong.
Business context can improve remediation
With vulnerability volumes increasing, Smolenski said AI can help security teams prioritize issues and reduce operational noise. However, effective automation requires a deeper understanding of organizational assets and their business functions.
Security teams need to know not only who owns an asset but also what it does and the consequences if it becomes unavailable. This context can help organizations assess operational and revenue impacts before automating remediation actions.
Smolenski said understanding these relationships can also reduce friction in traditional governance processes and help teams focus on the most critical risks.
Cyber insurance may increasingly use security data
Smolenski sees opportunities for cybersecurity telemetry to help insurers assess organizational risk, drawing comparisons with telematics in auto insurance and sensors used to detect water damage.
He said security data could help insurers improve risk models, but organizations must find ways to share useful information without exposing sensitive details about internal operations.
Humans will remain accountable
Despite AI's potential to automate cybersecurity tasks, Smolenski said human reasoning and accountability will remain essential as the technology advances.
"The agent can't be accountable," he said.
He expects people to continue translating business needs into instructions and context that AI systems can use effectively. He also said the technology creates an opportunity to rethink how organizations allocate labor to cybersecurity challenges.
While the CISO role will evolve as AI capabilities advance, Smolenski said human involvement will remain important for oversight, resilience and responsible adoption.