CISOs Debate Human Role in AI-Powered Security

RSAC 2026 CONFERENCE IN SAN FRANCISCO: Do AI systems need a "human in the loop," or will people just slow things down This article explores security ai revolution. ? During a panel at the RSAC 2026 Conference, security leaders from Google Cloud, Vodafone, and PayPal talked about how AI is being used in new ways and how to safely use it in your own environment.

James Rundle of The Wall Street Journal asked Google Cloud's chief operating officer (COO) and president of security products in the panel "From Threat to Strategy: The CISO's Playbook for the AI Revolution." Francis deSouza, Emma Smith, Vodafone's global chief information security officer (CISO), and Shaun Khalfan, PayPal's senior vice president and CISO, talk about how security leaders can best adjust to the new AI landscape.

The three also talked about how people fit into AI-powered security. The "AI revolution" wants to fix a lot of problems, but the arrival of LLM-powered security products has made some of the problems in the security landscape worse. She also said that Vodafone has made a heat map that shows how sure people are about an AI's outcome and how risky it might be.

Vodafone probably wouldn't go after this kind of approach for use cases with a very high risk impact unless it would be good for business. "And then it would definitely have a human in the loop." ## Why Data Security and Working Together Are So Important Khalfan followed Smith by stressing how important it is to put everything you do in a data security wrapper.

PayPal supports the engineering and technological benefits of AI tooling, but he also said that "it's just as important to have a risk and compliance wrapper around it." "Data and security are two of our most important AI principles. He said, "It's privacy, it's openness, and it's being able to explain things."

"These principles help us stay grounded in all the work we're doing." For example, PayPal's AI model teams put them in tiers based on how sensitive the data is, how it will be used, and what controls need to be in place to keep any sensitive data safe.