As AI becomes increasingly bought, built and embedded across the enterprise landscape, organizations must confront familiar human-factor challenges alongside newer concerns around accuracy, security, compliance, unintended actions and governance, as Kristopher Persad, CISSP, CGRC, CC explains.
Disclaimer: The views and opinions expressed in this article belong solely to the author and do not necessarily reflect those of ISC2.
It’s quite staggering to see AI having arrived at the scaling phase. The reality of AI’s rapid advancement to scaling is well reflected in Ray Kurzweil’s Law of Accelerating Returns, which describes how technological progress benefits from the compounding effect of building on prior advancements.
This not only applies to the qualities and capabilities of AI, but also to the adoption of AI. McKinsey’s State of AI Report showed that nearly nine in 10 respondents reported regular use of AI in at least one business function, while 44% of organizations have moved toward scaling AI across their organizations. This supports much of what I’ve seen meeting with organizations to discuss their technology priorities throughout the year.
AI tooling is abundantly available. Microsoft 365 and Google Workspace, which both dominate the global enterprise productivity ecosystem, provide deeply integrated AI capabilities. AI is built into various enterprise tools, with examples ranging from SIEMs, ERP systems, CRMs, to analytics platforms.
The Good: The Road to 10x Productivity
AI has proven itself to be the “great optimizer”. The low-hanging fruit of AI is its ability to turn internal and external sources of unstructured data into meaningful outcomes. My ability to find specific answers without needing to become an expert across every technology area has improved at least five-fold. Many organizations have built fully agentic workflows that reduce friction across various business processes and further support the modern distributed workforce.
Productivity gains are provable. Anthropic reported that its engineers were merging ~8x as much code per engineer per day in Q2 2026 compared with 2024, with Claude authoring more than 80% of the merged code. McKinsey and Company’s State of AI report suggested ~80% of respondents considered AI to be directly improving their productivity.
The Bad: Risks Are Real, Outcomes Can Be Significant
Business email compromise remains one of the most significant risks to organizations. Microsoft found that 28% of breaches were initiated through phishing/social engineering, with business email compromise appearing as an outcome in 21% of successful attacks. These numbers continue to appear despite the growing maturity in both email security and employee awareness training. We’re trained to validate actors (senders/receivers), scrutinize directives (actions/asks) and be cautious with the contents we send (sensitive data). AI presents all the same human-factor risks, while automation bias can increase the likelihood that users trust AI-generated outputs without sufficient scrutiny.
The stakes are high for organizations with a growing list of concerns centered around accuracy, cybersecurity, unintended actions, intellectual property infringement and compliance. Failure in any one of these areas, or across multiple, can have significant consequences. Take a few recent examples that have appeared in the news:
- Workday: Workday is facing an ongoing U.S. class-action lawsuit alleging its AI-powered hiring tools discriminated against applicants based on characteristics including race, age and disability; Workday denies the allegations.
- Deloitte Australia: Deloitte agreed to partially refund the Australian government after a report which cost A$440,000 contained fabricated citations and a non-existent court quotation linked to generative-AI-assisted work.
- Air Canada: A British Columbia tribunal held Air Canada responsible after its chatbot gave a customer incorrect bereavement-fare advice, finding the airline had failed to ensure the chatbot’s information was accurate.
The Ugly: AI Governance on Paper
In my conversations with organizations, they tend to fall into two broad categories: those without a defined policy position to govern the use of AI and those with a policy but a limited ability to enforce it. The latter often rely on built-in provider controls or commercial agreements to manage risk. This is especially important where AI is performing tasks on behalf of the user, while accessing tools throughout the organization to deliver the outcome. Visibility, attribution and authorization through the request’s entire lifecycle are critical to effective management of AI.
This often leads to companies taking opposing positions: either denying the use of AI or allowing it with the expectation of users doing the right thing. The momentum of AI is a tidal wave companies can’t simply ignore. The risks are also significant enough that organizations need to move beyond defining a policy and toward the ability to enforce it. This is where the tension between enablement and control meets reality. Organizations must navigate the right level of control to retain and grow the benefits of AI while managing the risks.
Kristopher Persad, CISSP, CGRC, CC, is a senior solutions engineer at Cloudflare and founder of KrisperTech. He has nearly 20 years of experience helping organizations modernize security architectures across internet-facing applications, enterprise networks and zero trust environments. His work focuses on the intersection of AI security, application security and trust models for public-facing digital services.
