![How security org design changes with company size: 58% of $10B+, 31% of $1B–$10B, and 19% of under-$1B organizations have a deputy CISO, and 65%, 42%, and 44% have a head of AI security](https://www.ians.com/_astro/how-security-organizations-are-evolving-5-key-findings-for-cisos.B30rZwWo_1kg4iH.webp)

# How Security Organizations Are Evolving: 5 Key Findings for CISOs

Explore five findings from the 2026 IANS and Artico Search report on security staffing, leadership roles, AI security, and outsourcing, by company size.

5 min read October 19, 2026

How big should your security team be? Which leadership roles does your organization need? When should you hire specialists instead of relying on internal staff or external providers?

CISOs face these decisions as they manage security operations (SecOps), allocate resources, and respond to new responsibilities tied to AI and other emerging technologies. The [2026 Security Organizational Design Benchmark Report](https://www.ians.com/lp/security-organizational-design-benchmark-report#security-org-design-report) from IANS and Artico Search examines how security organizations are structured across companies of different sizes. Based on research involving more than 1,400 CISOs and cybersecurity staff members, the report identifies three organizational designs based on company revenue.

Here are five findings that can help CISOs assess their staffing, leadership structures, and security operating models.

## 1. Security team size follows three patterns

The size and structure of security organizations vary significantly by company revenue, according to the report. The three organizational designs each have different staffing levels, budgets, and leadership structures.

![Table of security team size in full-time employees by company revenue: $10B+ organizations range from 30 to 275 with an average of 172, $1B–$10B from 8 to 34 with an average of 33, and under $1B from 3 to 10 with an average of 9, where the range is the 25th to 75th percentile](https://www.ians.com/_astro/how-security-organizations-are-evolving-5-key-findings-for-cisos-figure-1.DoXnYZ1O_1mD0gX.webp)

Source: [2026 Security Organizational Design Benchmark Report](https://www.ians.com/lp/security-organizational-design-benchmark-report#security-org-design-report), Figure 1, p. 6

At organizations with more than $10 billion in annual revenue, security teams average 172 full-time employees (FTEs). These organizations typically have multiple functional departments, specialized leadership positions, and several management layers.

Organizations generating $1 billion to $10 billion in annual revenue average 33 security professionals. Their teams generally include dedicated leaders for core functions, such as security operations and governance, risk, and compliance (GRC), while other responsibilities may be combined. At organizations with less than $1 billion in annual revenue, security teams average nine employees. These smaller teams typically operate with fewer management layers, and individual employees often cover multiple security functions.

Some organizations maintain larger security teams than is typical for their revenue, while others operate with smaller teams. CISOs can use this data to see how their team size and structure compare with organizations of similar size.

## 2. Leadership structures become more specialized as companies grow

Larger security teams are more likely to have dedicated leaders for individual functions.

At $10B+ organizations:

- 82% have a dedicated head of SecOps.
- 80% have a dedicated head of GRC.
- 71% have a dedicated head of identity and access management (IAM).
- 69% have a dedicated head of architecture and engineering.

The deputy CISO role also becomes more common as company size increases.

At $10B+ organizations, 58% have a deputy CISO, either in a dedicated position or as part of another role. That compares with 31% at $1B–$10B organizations and 19% at companies under $1B. Deputy CISOs support the CISO by managing operational responsibilities, overseeing functional leaders, and providing leadership continuity during absences or transitions.

Having a deputy CISO doesn’t necessarily mean that person will ultimately become the CISO. When CISOs leave, organizations often conduct external searches and evaluate internal candidates against experienced CISOs from other companies, according to the report.

## 3. AI security is a leadership responsibility

AI is introducing new responsibilities within security organizations, including the need to establish leadership accountability for securing AI systems and applications.

At $10B+ enterprises, 65% have a head of AI security, either as a dedicated position or as part of an existing role:

- 18% have a dedicated head of AI security.
- 47% assign AI security leadership to an existing position.

At smaller organizations, dedicated AI security leadership remains less common. Approximately 42% of $1B–$10B organizations and 44% of under-$1B organizations have assigned head of AI security responsibilities, predominantly through combined roles.

At $10B+ organizations, the CISO holds primary accountability for enterprise AI governance in 7% of cases. That figure rises to 11% at $1B–$10B organizations and 26% at companies under $1B. In larger organizations, AI governance responsibilities are more frequently assigned to other technology executives, including CIOs and CTOs.

## 4. MSSPs are an established part of security organizational design

Managed security service providers (MSSPs) are widely used across organizations of all sizes, according to the benchmark report. MSSP adoption rates are:

- 86% at $1B–$10B organizations.
- 78% at under-$1B organizations.
- 75% at $10B+ organizations.

At $1B–$10B organizations, 72% use MSSPs for 24/7 security monitoring or coverage. These organizations often rely on external providers to extend security operations without building equivalent internal staffing capabilities.

At $10B+ organizations, 55% use MSSPs to supplement internal teams with capabilities for specific security functions. Larger enterprises maintain more extensive internal security operations while using external providers for additional expertise or coverage. Common functions supported by MSSPs include threat detection and response, network security monitoring, and endpoint protection.

These findings give CISOs a way to compare their use of MSSPs with that of similarly sized organizations and assess which security functions they manage internally.

## 5. Security staffing remains concentrated in operational functions

The report shows that security staffing is concentrated in reactive operations rather than proactive capabilities, such as threat intelligence, resilience testing, and red teaming.

At $1B–$10B organizations, threat intelligence accounts for approximately 4% of security staffing, compared with 8% for incident response and 17% for SecOps. At smaller organizations, IAM responsibilities are frequently distributed among employees who manage multiple security functions.

As AI, low-code, and no-code tools accelerate software development, security organizations face additional challenges in maintaining visibility into applications and integrating security controls throughout development. The report recommends several organizational design priorities:

- Rebalance security resources toward proactive capabilities.
- Establish clear leadership and accountability for IAM.
- Integrate application security earlier in the software development lifecycle.
- Define AI security leadership responsibilities and enterprise AI governance ownership.

## Use peer benchmarks to inform security organizational design

Security organizational design involves more than headcount. CISOs also need to consider leadership responsibilities, functional staffing, and the use of external providers. Use these findings to help build a security organization that fits your business, informed by how your peers are staffing, structuring, and leading their teams.

[Explore the 2026 Security Organizational Design Benchmark Report](https://www.ians.com/lp/security-organizational-design-benchmark-report#security-org-design-report) to compare your security organization’s staffing, leadership structure, and operating model with peer organizations.

Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our News & blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.

Share this article

## Further Reading

[Browse all articles](https://www.ians.com/blog)

[AI Is Reshaping the Security Org Chart New benchmark data shows how security teams are structured and how AI is changing leadership roles and accountability. Findings are split by company revenue. Oct 19, 20261 min read Read more](https://www.ians.com/blog/ai-is-reshaping-the-security-org-chart) [Tips to Build an AI Governance Team How to build a cross-disciplinary AI governance team, the roles to include, and best practices for governing AI safely and responsibly. Apr 28, 20254 min read Lee Kim Apr 28, 20254 min read Read more](https://www.ians.com/blog/tips-to-build-an-ai-governance-team) [Managing AI Risk Today Won't Fully Prepare You for Tomorrow AI security controls aren't enough. New CISO data shows what separates organizations managing today's risks from those ready for what comes next. Sep 10, 20264 min read Read more](https://www.ians.com/blog/managing-ai-risk-today-wont-fully-prepare-you-for-tomorrow)