My email signature reads “Process is the evil twin of progress.” Moat security is process mistaken for protection.
Prepared versus old school: the numbers
In fairness, IBM sells security tools, and I’m aware of the irony of citing a vendor in a piece that warns against learning from vendors. The fieldwork is done by the Ponemon Institute, though, and the pattern matches what independent CISO surveys show. The gap between prepared and unprepared organizations is not subtle:
| What separates them | Prepared | Old school |
| AI and automation in security operations | Breach costs nearly $2M lower | One in four still without |
| Breach found and contained | Under 200 days: $4.32M | Over 200 days: $5.65M |
| Employee use of unsanctioned AI | Low: $4.63M per breach | Widespread: $5.39M per breach |
| AI security maturity (CISO self-rated risk) | 3.7 out of 10 | 7.8 out of 10 |
| AI governance and security teams coordinated | 19% of organizations | Everyone else |
Sources: IBM/Ponemon, Cost of a Data Breach 2026; IANS/Artico Search, CISO Perspectives on AI Risk 2026.
The most revealing finding comes from the IANS survey of 113 CISOs. Mature AI security programs explained why some security chiefs feel safer today. But confidence about the next two years tracked something else: whether leadership understood AI risk, whether someone clearly owned AI governance, and whether the security team had budget authority and enough staff. In other words, the factor that matters most is governance, not technology.