COMMENTARY: Let's put the philosophical debates aside. As a CISO, the decisions about how and where to adopt AI in the business are clear as a bell. Companies have found remarkable ways to deploy AI at scale, to save time, reduce costs, and grow revenue. Applying AI well takes some hard work. Every valid use rests on a clear methodology and visible evidence.
Boards still spend most of their energy discussing product and growth opportunities, and the health of the business. But AI investment and governance have joined the agenda and we can no longer ignore them. Directors want to know how AI has been deployed inside the business, who’s accountable for it, and whether the company can defend its choices when a regulator or a customer asks.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]The board must continue to press on this. A lot of that adoption has come in through side doors. The 2026 Verizon Data Breach Investigations Report found that 45% of employees now use AI tools on their corporate devices, roughly triple the year before, and two-thirds of them do it through personal accounts. The data they most often paste into those tools is source code.Boards are not the only audience here. Customers and regulators want the same assurance, and earning trust from all three starts with four questions every CISO must now answer with evidence:
Start with the humans. Keep a human-in-the-loop on consequential decisions instead of handing judgment to a model and hoping it holds. AI opens attack paths that traditional controls were never designed to catch, like prompt injection or phishing convincing enough to fool a trained employee.The realities are less dramatic than the headlines suggest. For now, attackers are mostly using AI to run familiar plays faster rather than to invent new ones, which means fundamental security practices still matter. Security leaders must keep their own governance in step with how fast the business has adopted AI. Agents get deployed, permissions get granted, and no one can say with confidence what those systems can reach.
Stay ahead by testing controls continuously across the environment instead of sampling a small slice annually, so a failure surfaces while the team can still do something about it.
Demonstrating compliance and documenting it are two different things. New rules keep arriving. The EU AI Act has been phasing in, with requirements that map closely to ISO 42001 and the NIST AI Risk Management Framework. Those are the two standards most teams are aligning to first, alongside the sector rules and contractual commitments they already carry.It's a moving target in a way traditional compliance never was. The obligations the team maps to today will expand, deadlines are still being revised, and AI systems change behavior in ways a static control set was never built to capture. A yearly audit cannot keep up, because a control that passed review last quarter tells us nothing about whether it’s operating today.This weakness has always been underneath point-in-time compliance; AI simply makes it impossible to ignore. We need compliance we can demonstrate on any given day, with controls mapped to important frameworks and monitored continuously instead of reconstructed once a year for the auditor. Fix it for AI and we’ve fixed it everywhere, because the evidence a regulator or a customer wants remains the same whether the control governs a model or a database.
The numbers from the Verizon breach report made it clear: our most sensitive material moves into AI tools faster than any policy can track, and most of it’s not malicious. It’s our own people using AI because it works. The harder half of the picture comes from outside, where vendors add AI features to products the team has already cleared, each one a new path our data can travel that was never part of any review.Draw a clean distinction for the board between the AI risk the company creates directly, and the AI risk that arrives through our supply chain. Both belong in one governance program, not a separate AI initiative running beside the controls already in place. Data moving into AI tools represents a data-loss problem -- govern them as one. Vendor AI has become part of each vendor's risk profile and belongs inside the third-party review the company already runs. When we assess a vendor's security but not their AI practices, we are certifying a version of them that no longer exists.
There’s real pressure today to adopt AI everywhere, and real reason to question the actual returns so far. McKinsey's most recent State of AI found that it’s still rare to find meaningful enterprisewide impact on the bottom line. Only about 37% of organizations could attribute any measurable EBIT impact to AI, and just 6% moved the bottom line by 5% or more.Most leaders cannot yet show AI’s value. The CISO who can will stand out. The board needs proof that AI has lowered risk and cost and has not added manual work for a team that’s already stretched. That means holding any AI put into the security program to a standard: it should reason from a clear model of the company’s controls, show its evidence, and report the time and money it saves. Measure AI against the outcomes the business already reports on: time to market, resilience as the company grows, and the cost of proving compliance. Those are the numbers a CFO will accept.So what makes all four of these questions answerable?It’s fairly simple: Hold AI to a bar high enough to earn the security team’s trust before it gets extended out. Answer these four questions with evidence when the board asks. The number of AI tools purchased, and the investment in each, matter far less than that.By answering them it gives the board an evidence-based read on which AI tools belong in the business and which do not. I am optimistic about what this technology will let us do. Held to the right standard, it will earn the trust we place in it.Sravish Sridhar, founder and CEO, TrustCloudSC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Boards still spend most of their energy discussing product and growth opportunities, and the health of the business. But AI investment and governance have joined the agenda and we can no longer ignore them. Directors want to know how AI has been deployed inside the business, who’s accountable for it, and whether the company can defend its choices when a regulator or a customer asks.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]The board must continue to press on this. A lot of that adoption has come in through side doors. The 2026 Verizon Data Breach Investigations Report found that 45% of employees now use AI tools on their corporate devices, roughly triple the year before, and two-thirds of them do it through personal accounts. The data they most often paste into those tools is source code.Boards are not the only audience here. Customers and regulators want the same assurance, and earning trust from all three starts with four questions every CISO must now answer with evidence:
- Is the security team protecting the business from AI-driven threats?
Stay ahead by testing controls continuously across the environment instead of sampling a small slice annually, so a failure surfaces while the team can still do something about it.
- Can the team prove the company has been meeting its AI compliance obligations?
- Does the team know where its data and IP go once AI touches them?
- Has AI created real value, or just more risk and work?
