Navigating the AI Cybersecurity Dilemma: What Enterprise CISOs Must Know Before Buying
The rapid commercialization of artificial intelligence has fundamentally disrupted the enterprise cybersecurity landscape, leaving Chief Information Security Officers (CISOs) trapped in a difficult paradox. On one side, executive boards and business leaders apply relentless pressure to adopt AI-powered security tools, driven by the fear of falling behind competitors or missing out on automated efficiencies. On the other side, vendors saturate the market with marketing claims, promising revolutionary threat detection and mitigation capabilities that are frequently difficult to verify. This environment has created a high-stakes guessing game for security executives: determining which AI investments will genuinely reduce organizational risk and which will merely add to capital expenditures without delivering tangible security outcomes.
This dilemma is compounded by a sobering reality: deploying advanced artificial intelligence on top of foundational operational weaknesses—such as fractured access controls, unclassified data repositories, and limited network visibility—does not patch those vulnerabilities. Instead, it exacerbates them, providing automated systems with a broader canvas to propagate errors or amplify existing misconfigurations.
Understanding the Macro-Level Vulnerability Landscape
Recent empirical research from global oversight bodies highlights the widening gap between AI adoption velocity and institutional readiness. According to findings published by the World Economic Forum (WEF) regarding 2026 cyberthreat projections, approximately one-third of organizations currently operate without any formal process to evaluate the security posture of AI tools prior to deployment. This oversight persists despite 87% of enterprise leaders acknowledging AI-related vulnerabilities as the fastest-growing category of cyber risk facing modern corporations.
Further compounding these concerns, the National Institute of Standards and Technology (NIST) has issued guidance emphasizing that third-party generative AI tools inherently introduce complex privacy and information-security risks. These risks are dictated primarily by the breadth of data and internal systems to which the tools are granted access. A parallel study released by the Cloud Security Alliance (CSA) revealed that 53% of organizations have experienced incidents where AI agents exceeded their intended operational permissions, while 47% reported suffering a direct security breach or incident involving an AI agent over the preceding twelve-year period.
The operational friction is further illustrated by data from ISACA, which reported that 56% of digital trust professionals do not possess a clear understanding of how quickly their organizations could manually or automatically halt an AI system during an active security incident. Together, these metrics suggest that enterprise security teams are accelerating AI adoption far faster than they can evaluate vendor claims, audit system permissions, or maintain operational control over autonomous workflows.
Bridging Theory and Practice: Insights from the AI in Business Podcast
To unpack these systemic challenges, Emerj’s Yolandi de Weerdt recently hosted Mark Alvarado, Executive Director of IT Security and Compliance (CISO) at Academy Sports + Outdoors, on the AI in Business podcast. Their discussion focused on a critical roadmap for security leaders: how to methodically separate genuine AI value from marketing hype, and how unmitigated AI integration compounds vulnerabilities across identity management, data governance, network architecture, and employee technology habits.
Alvarado brings more than two decades of dedicated experience across cybersecurity, IT compliance, and enterprise risk management, with previous leadership roles at major entities such as Ovintiv and Norton Rose Fulbright. At Academy Sports + Outdoors, Alvarado established a comprehensive incident response framework that successfully reduced recovery time by 90%, materially advancing the organization’s resilience. He holds a Master of Legal Studies in Cyber Law from the Texas A&M University School of Law alongside an M.S. in Cybersecurity and Information Assurance from Western Governors University.
Through his extensive practitioner lens, Alvarado emphasizes that the rush toward AI must be countered with rigorous, problem-led evaluations and disciplined architectural foundations.
Problem-Led Evaluation to Prevent Unnecessary AI Exposure
When evaluating enterprise software, a vendor will frequently market its product as leveraging advanced AI algorithms to identify threats faster or automate remediation. However, Alvarado asserts that external vendors inherently lack deep visibility into a specific company’s unique internal systems, data flows, and operating procedures. Consequently, the burden of proof rests entirely on the buyer to understand internal requirements and interrogate vendor claims.
Alvarado traces this procurement discipline back to his foundational background in business analysis. Historically, when an internal department requested a new technological solution, the standard procedure required documenting the existing workflow, defining the target future state, and establishing strict technical requirements before conducting vendor research or securing stakeholder buy-in.
Alvarado applies this exact sequential methodology to modern cybersecurity investments. Security leaders should begin every purchasing initiative with a clearly written problem statement, identify potential alternative solutions, calculate the true total cost of ownership, and formulate a comprehensive project charter. Whether artificial intelligence is ultimately incorporated into the solution or not, Alvarado maintains that this rigorous preliminary analysis either validates the investment or exposes its redundancy long before any budget requests are submitted to executive leadership.
Furthermore, Alvarado recommends establishing a standardized, shared definition of "artificial intelligence" during early vendor discussions. Because buyers and sellers frequently use the term as a catch-all buzzword to describe vastly different software functions, both parties must explicitly confirm what they mean by AI before conversations progress into technical, financial, or legal phases.
Addressing the Human Element and Employee Governance
Technology controls alone cannot protect an enterprise if the human element is ignored. Employee behavior represents a critical readiness test for any AI deployment. Alvarado advocates for the creation of a robust AI governance framework that provides personnel with unambiguous guidance regarding authorized and unauthorized use cases, alongside a structured checklist of questions employees must ask before engaging with generative or autonomous tools.
Without active employee buy-in and clear training, workers inevitably seek out unauthorized workarounds to satisfy productivity demands—a phenomenon often referred to in the industry as shadow AI. Alvarado illustrates this vulnerability with a stark analogy:
"You can have the most robust locks on your house. But if someone in your house just flat out leaves it open, or bypasses or jimmies the lock, it doesn’t matter how expensive that lock is. Someone’s gonna get in."
Identity, Data, and Network Visibility as Deployment Foundations
From Alvarado’s perspective, if a corporate security program was not fundamentally sound and well-managed prior to the introduction of AI, the deployment of artificial intelligence will only amplify those structural deficiencies exponentially. His operational philosophy begins with mapping out the enterprise infrastructure: understanding how the network is laid out, identifying precisely where critical assets and sensitive data reside, and defining the true perimeter of the organization before working backward to implement automated defenses.
Alvarado outlines three foundational pillars that organizations must prioritize and button up before deploying autonomous or AI-driven systems. While these programs do not need to achieve absolute perfection, bringing them to a high state of maturity is essential:
- Identity and Access Management (IAM): Knowing precisely who has access to what, enforcing the principle of least privilege, and continuously monitoring authentication behaviors.
- Data Governance and Classification: Knowing where sensitive intellectual property and customer data live, how it is labeled, and how it flows through internal and external systems.
- Network and Edge Visibility: Maintaining comprehensive logging and monitoring capabilities across network traffic to distinguish normal business operations from anomalous anomalies.
While Alvarado acknowledges that other domains of cybersecurity remain vital, he views these three specific areas as the bedrock upon which successful AI security tools must operate. As cloud migration accelerates and the volume and sophistication of cyberattacks continue to scale, mastering these foundations is the only way organizations can effectively "fight AI with AI."
Response Thresholds Tied to Material Business Risk
Once visibility across identity, data, and network activity is established, Alvarado recognizes immense value in deploying AI tools to analyze massive volumes of telemetry data, searching for deviations from established operational baselines. He utilizes a practical analogy to explain this mechanism: comparing the corporate network to a road network, endpoints to automobiles, digital identities to drivers, and cryptographic credentials to ignition keys.
An unexpected anomaly in a travel route, destination device, user identity, or accessed dataset often serves as an early indicator that an unauthorized actor has compromised an account. Because human beings are fundamentally creatures of habit, AI systems can accurately benchmark normal behavioral baselines for every digital identity and flag deviations for security review. However, Alvarado stresses that a baseline deviation is not, by itself, definitive proof of malicious activity, as legitimate business needs frequently shift.
This realization forces CISOs to carefully balance remediation actions. Alvarado distinguishes between simply prompting a user to confirm an unusual activity versus pulling the digital "keys"—such as instantly disabling a compromised identity or terminating an active network session. When a behavioral deviation is so extreme, or an action so egregious, that the organization cannot afford to miscalculate, security teams must act first and investigate second.
Alvarado frames this decision-making process around the core responsibilities of modern enterprise leadership:
"Fundamentally, at a CISO level, your job is not to stop every little thing that happens. You can, that’s great. There’s a cost associated with it. Your job is to keep the event from being material. The material threshold is different for every company, and each company should determine what that material threshold is. That’s how you make sure that you’re making good use of funds, because your program’s gonna cost."
The concept of materiality is central to this philosophy. Because every enterprise operates with unique risk tolerances, financial exposures, and regulatory requirements, the threshold for what constitutes a material breach differs vastly from one organization to the next. Establishing this internal threshold ensures that capital is deployed efficiently rather than wasted on chasing every minor alert.
While taking automated preventative action carries the inherent cost of false positives—which can temporarily interrupt legitimate business workflows—Alvarado notes that these occurrences are rare and easily resolved. In his experience, returning a locked-out user to the road after verifying their identity is a minor friction point, and stakeholders rarely object to an organization erring on the side of caution. While AI-based security tools command a premium price tag, that financial investment becomes fully justified once the fundamental pillars of identity, data, and network governance are firmly established.
Ultimately, Alvarado’s framework offers a pragmatic path forward for enterprise CISOs navigating the AI hype cycle. By anchoring technology investments in well-defined business problems and securing foundational controls, security leaders can transform raw, AI-generated signals into defensible, high-confidence decisions that protect the enterprise from escalating digital threats.
