In Part 1 of this two-part series, I argued that the moat is dry. When NotPetya hit Merck in 2017, it didn’t climb a wall. It came in through trusted vendor software, the routine traffic every perimeter is built to admit, and Merck put the damage at more than $1.4 billion. Its insurers then tried not to pay, and after that fight, underwriters started asking much harder questions.

AI has since made attacks like that cheaper and faster. In IBM’s 2026 Cost of a Data Breach report, one in four malicious breaches was AI-enabled, and breaches that took more than 200 days to find and contain cost about $1.3 million more than those that didn’t. Deepfaked executives, software that can be talked into things and AI agents holding credentials are attacks on trust first and technology second.

Yet the people we hold responsible are set up to lose. Some 64% of CISOs still report into IT leadership, only 10% influence financial decisions, and only a quarter say board discussions of cyber risk run longer than 30 minutes. They are accountable for the breach without budget authority, and they check the work of the people they report to.

The organizations that feel safest about the next two years are not the ones with the most tools. They are the ones where leadership understands AI risk, someone clearly owns it, and the security team has the authority to act. That is a governance problem, and it has a governance fix.

A roadmap for reconstruction

1. Take security out of IT, and do it before the breach

No company lets the finance department audit its own books. That is why internal audit reports to the board’s audit committee rather than to the CFO. Security deserves the same independence for the same reason: the people who build and run the systems should not vouch for them. The CISO’s job is not to run technology. It is to govern how people, partners and machines behave around the things the organization cannot afford to lose, and to tell leadership the truth about that risk.

That does not make the job less technical. A CISO who can’t read an architecture diagram, question an engineer or spot a vendor’s overstatement will be steamrolled in the first meeting. The role needs an engineer’s depth. It is just bigger than engineering, the way a general counsel needs to know the law but is hired for judgment.

In practice, that means a direct line to the CEO and a board committee. Equifax did this after its 2017 breach. Its new CISO, Jamil Farshchi, called the direct line to the CEO and board the key to the turnaround, and noted that it costs nothing. Vertex Pharmaceuticals took a different route: its CISO reports to the Chief Scientific Officer, which puts security next to what the company actually protects, its research. Choose a model deliberately. Most organizations never choose; they inherit one.

2. Hand the CISO the AI governance pen

Only 19% of organizations report coordination between their AI governance and security teams. Every AI tool the business adopts is a security design decision, and it needs one accountable owner. Otherwise, you have a committee that approves tools and a security team that finds out later. But accountable doesn’t mean alone, which brings us to the most important step.

3. Give everyone a voice

A CISO knows security. A CISO does not know research, or claims processing, or the manufacturing line. Elevating the CISO works only if decisions get made with the people who live with them: research leaders, business owners, legal, finance and the CIO. Build a standing risk council where those voices shape controls before they’re imposed, and where a scientist can say “this will break my work” and be taken seriously. The point of elevating the CISO isn’t to put one person in charge of everyone else’s work. It’s to make sure the person who owns the risk is in the room, and that everyone affected by the decision is in the room too.

Security decisions made in isolation get worked around. Decisions made together get followed.

4. Define “ready,” then hire and develop to it

New York’s cybersecurity regulation for financial firms calls the CISO “a qualified individual” but never says what qualified means. Here’s a working definition, in the form of two tests a board can give. The first is technical, and it is not optional:

• Can you tell us what we own, who can reach it, and how fast we can recover, and when did we last test that?
• Have you personally used the AI tools our employees use? Can you explain prompt injection and agent permissions to us in plain English?
• Where does your threat knowledge come from besides vendors: peer networks, industry information-sharing groups, red-team results?

The second test is about judgment and behavior. It is the one most security leaders are never given:

• What do our people actually do when a request seems urgent and comes from someone senior?
• Which risks have you advised us to accept, and why? A CISO who never recommends accepting a risk is a gatekeeper, not a risk officer.
• Can you translate a risk into dollars and days of downtime?
• Which research and business leaders do you consult before a control changes how they work?

And one question for the board itself: Have we given this person authority that matches their accountability?

👉 Click here to download a sample CISO job description👈

5. Make sure AI agents are governed like employees

The CISO doesn’t provision these accounts; the CISO makes sure someone is accountable for every one of them. Every non-human identity needs an owner, the least privilege it needs, monitoring, and a kill switch. Among organizations that had an AI-related incident, 92% lacked proper AI access controls.

6. Hold everyone to the clock, not the checklist

Ask every part of the organization for time to detect, time to contain and time to recover, using tested numbers rather than estimates, and report them to the board. The 200-day line in IBM’s data is worth more than a million dollars per breach.

7. Make sure the boring things get done

Encryption, multi-factor authentication, asset inventory and network segmentation are not glamorous, but they are exactly what insurers began requiring after the Merck case. Doing this work belongs to the technology teams. The CISO’s job is to verify that it’s done and to tell the board plainly when it isn’t. If your underwriter is asking for these controls, your board should be too.

8. Give the board more than 30 minutes

Make cyber a budget conversation rather than a status update. If the CISO’s board time is spent on regulatory trends instead of business trade-offs, the board is being briefed, not governed.

A word to CIOs

I know how this reads to a CIO: someone telling you to give up a direct report. But a CISO who reports to the CIO is grading the boss’s homework. The CIO is measured on availability and speed of delivery. The CISO is measured on risk. That tension is healthy only between peers. Elevating the CISO doesn’t diminish the CIO; it frees the CIO to build without also serving as auditor of what they built. The two roles aren’t a senior and a junior version of the same job. One builds and runs the organization’s technology. The other is responsible for whether the organization, its people included, can be trusted.

A good CIO should lean on the CISO and also be a little afraid of the CISO, the way a good CFO relies on the auditor and is a little afraid of what the auditor will find. That fear is not hostility; it is the reason the books stay clean. Pair it with the partnership described above, and the CIO gets something no direct report can offer: someone with the standing to say “no, not like that” before the board has to hear it from an attacker.

The CIO’s seat at the table appeared when technology became the business. The CISO’s is appearing because trust has become the business, and AI has made that impossible to ignore. Some organizations are already moving. In IBM’s follow-on research, 85% said they plan to increase security spending after learning what frontier AI models can do to their systems, compared with 64% who planned to spend more after suffering a breach. Learning from the threat is far cheaper than learning from the post-mortem, and the organizations that get there first will be the ones where security, research and the business decide together.

The moat is dry. Stop dredging it, and give the person defending the castle a seat at the table.

In June 2017, a piece of malware called NotPetya got into Merck & Co. without climbing a single wall. It arrived through a backdoor in accounting software supplied by a Ukrainian vendor, the kind of trusted, routine traffic every perimeter is built to let through. It spread to some 40,000 of the drugmaker’s computers, and Merck put the damage at more than $1.4 billion.

Then several of Merck’s insurers argued they owed nothing, because the attack was attributed to Russian military intelligence and their policies excluded acts of war. The fight ended in a confidential settlement in January 2024.

Two lessons sit in that story. The moat didn’t matter, because the threat came in with the traffic the moat was designed to admit. And the people who price risk for a living were the first to notice and the first to send the bill.

That was 2017, when attackers still needed humans at the keyboard. Increasingly, they don’t.

Here is the argument of this two-part series in two sentences. Security stopped being a technology problem with business consequences; it is now a business risk with a technology component. Most organizations are still organized the other way around, and the person they hold responsible for that risk sits inside the IT department, reporting to the people whose work they are supposed to check.

What AI actually changed

IBM’s 2026 Cost of a Data Breach Report, based on 602 breached organizations, found that one in four malicious breaches was AI-enabled, a 56% jump in a single year. Those breaches averaged $6 million, about $1 million above the global average of $4.99 million. In the U.S., the average breach now costs $11.5 million.

You don’t need a computer science degree to understand what changed. Three things matter:

• The con got a better voice. Deepfake impersonation was the most common AI-driven attack in IBM’s data, at 45%. The oldest scam in business, the urgent wire transfer, now arrives in the CFO’s actual voice on a video call.
• Your software can be talked into things. “Prompt injection” means hiding instructions inside an email, document or web page that an AI assistant reads and then obeys. It is social engineering aimed at the software instead of the employee, and no amount of annual phishing training protects against it.
• You’ve hired employees with no background check. Every AI agent holding credentials is, in effect, a new hire with keys to your systems, no manager and no HR file.

Notice what those three have in common. Each one is an attack on trust, on whom we believe, what we obey and whom we let in, and only then on technology. That distinction matters for everything that follows.

Meanwhile, employees aren’t waiting for permission. Shadow AI, meaning tools staff use without sanction, showed up in 43% of breached organizations this year, up from 20% the year before. Breaches involving AI systems themselves rose to 21% of all incidents, and the most common way in wasn’t the model at all. It was the plumbing around it: compromised APIs and plug-ins, and misconfigured cloud workloads.

Why the moat is dry

Moat security is easy to recognize. There’s a perimeter, a couple of expensive appliances, an annual training module, and a binder of procedures nobody reads until the auditor visits. It assumes the enemy is outside.

Today, much of the risk has been invited in the assistant reading the email, the agent holding the credentials, the vendor pushing the update. When Johnson Controls was hit by ransomware in 2023, the attackers first got into the company’s Asia offices and spread from there across the network. The company confirmed data theft and more than $27 million in costs, net of insurance. One breach in a distant office, and the moat was irrelevant.

Moat organizations measure activity. Attackers measure time. IBM found the average time to identify and contain a breach rose to 247 days, the first increase in five years. Breaches contained in under 200 days cost $4.32 million; those that ran longer cost $5.65 million. And 53% of breached organizations hadn’t encrypted sensitive data at rest and in transit. The basics still aren’t done.

My email signature reads “Process is the evil twin of progress.” Moat security is process mistaken for protection.

Prepared versus old school: the numbers

In fairness, IBM sells security tools, and I’m aware of the irony of citing a vendor in a piece that warns against learning from vendors. The fieldwork is done by the Ponemon Institute, though, and the pattern matches what independent CISO surveys show. The gap between prepared and unprepared organizations is not subtle:

Sources: IBM/Ponemon, Cost of a Data Breach 2026; IANS/Artico Search, CISO Perspectives on AI Risk 2026.

The most revealing finding comes from the IANS survey of 113 CISOs. Mature AI security programs explained why some security chiefs feel safer today. But confidence about the next two years tracked something else: whether leadership understood AI risk, whether someone clearly owned AI governance, and whether the security team had budget authority and enough staff. In other words, the factor that matters most is governance, not technology.

The CISO problem: under-trained and under-armed

Under-trained. Many of today’s security leaders learned the job defending against people, not software that behaves like people, and much of what they know about AI came from the companies selling the cure. When IANS released its research this year, one of its partners pointed out that most AI risk data comes from vendors and so reflects the supply side. If your threat briefings, your training and your tools all come from the same sales channel, you’ll end up with a well-funded blind spot. Only 53% of CISOs in a LevelBlue survey said they felt prepared to defend against AI-enabled adversaries.

This is not about age. A veteran who keeps learning beats a newly certified buyer of AI-branded appliances every time. What matters is whether someone is still learning now, not when they first learned.

Under-armed. The IANS 2026 board engagement study found that 95% of CISOs brief their boards regularly, but only 10% influence financial decisions. Only a quarter say board discussions of cyber risk run longer than 30 minutes. And 64% of CISOs still report into IT leadership. That leaves the CISO accountable for the breach without authority over the budget.

The lab is not the accounting department

Everything above gets harder in a research organization. Research runs on unpredictable workflows, tools adopted the week they appear, enormous data transfers and outside collaborators. A control that slows a scientist doesn’t stop the work. It moves the work somewhere security can’t see.

The stakes are rising at the same time. Google’s threat intelligence group reported that in the second quarter of this year it investigated extortion cases involving stolen AI research, including one in which a healthcare organization lost drug research and an AI model. It also tracked a China-linked group targeting academic, medical and military research institutions in North America.

R&D doesn’t need an exemption. It needs a different deal: wide freedom in how the work gets done, in exchange for a short list of fixed rules around the assets that matter most. In practice, that means protecting around the lab rather than inside it:

• Make the safe path the fast path. Offer pre-approved sandboxes, compute environments and AI tools that are quicker to use than the workarounds. Researchers don’t resist security; they resist friction.
• Watch instead of block. Monitor what leaves the lab and how, rather than putting a checkpoint in front of every action. Unusual data movement and odd access patterns are how theft gets caught without slowing discovery.
• Classify by value, not by department. Open science, pre-publication results and proprietary or controlled work need different protection. Lock down the crown jewels, not the whole lab.
• Borrow from the research networks. The research and education networking community solved a version of this years ago with the Science DMZ, a design that moves high-performance research traffic outside the enterprise firewall and secures it with targeted controls and monitoring instead.

Some rules don’t bend: federal research-security requirements, defense contracting standards, export controls. But that list should be short, explicit and explained, not a binder of procedures nobody in the lab can name.

We regulate security by tax status, not consequence

Public companies must describe board oversight of cyber risk to the SEC, though the final rule dropped a proposal to disclose whether they even have a CISO. New York’s financial regulator requires the CISO to report to the board in writing every year, and the board must understand and fund the program, public or private. Hospitals still operate under a HIPAA Security Rule written in 2003; its overhaul has slipped to July 2027. A privately held research firm can fail as badly as any public company, and the rules barely notice. Don’t wait for a regulator to tell you what your risk already has.

That is the diagnosis. In Part 2, the prescription: an eight-step roadmap for rebuilding, starting with the reporting line that most organizations never chose and simply inherited.

“Are we exposed?” CIOs and CTOs heard that question all last week. On Tuesday, PHP shipped emergency fixes for two pre-authentication remote code execution flaws that date back to 2004. By Wednesday, Palo Alto Networks said every supported version of PAN-OS and Panorama was vulnerable and no fix was available. Cisco was reviewing 18 products and 13 cloud services, and Fortinet was reviewing eleven. NSA, NCSC and CERT-EU told operators to take unpatched systems offline, and Cloudflare’s CEO watched exploit attempts jump from thousands to millions within hours. People are calling it Black October.

An AI model found most of these bugs. The lesson for boards, though, isn’t about AI. Patching is no longer the bottleneck. Knowing where to patch is.

“Please go to your boards and ask for help right now. Not for AI, for the basics.” (Jason Clinton, Deputy CISO, Anthropic, Oct. 22.) Marc Benioff replied: “Jason is 100% right. Code red.”

Answering “are we affected?” should take minutes. That takes one real-time, authoritative record of every device, version, site, owner and exposure, plus automation that patches from that record and confirms the fix. Organizations without that record are still searching while attackers move. With vulnerability volume climbing this fast, the gap will only grow.

The number of vulnerabilities has more than doubled in the last year – and it is just getting started

From January 1 to October 13, 79,680 CVEs were published, 2.15 times the same period in 2025. Microsoft alone published 1,408 on October 13. That’s more than it disclosed in all of 2025, and its fourth record month in a row.

AI is behind the surge. Between April and July, Anthropic’s Project Glasswing partners verified more than 129,000 vulnerabilities, over 33,000 of them critical or high, and Anthropic estimates the real total is at least five times higher. Google’s threat intelligence group says monthly disclosures doubled from January to August, and that AI-found bugs are twice as likely to be remote code execution. OpenAI, whose model found the PHP flaws, expects such findings to “increase sharply in the coming months.”

Exploitation is speeding up just as fast. Mandiant’s mean time-to-exploit for 2025 was negative seven days, and Microsoft puts median discovery-to-weaponization under 24 hours. Amazon CISO CJ Moses saw PHP2Shell probing four days before a patch existed. His warning: the disclosure date isn’t the earliest date of exploitation. Reuters reported that one operator used AI agents to breach more than 100 companies for about $5,000 in tokens. That works out to roughly $50 a breach.

Attackers can’t be allowed to have a better asset inventory than you do

Enterprises simply aren’t keeping up:

• Verizon’s 2026 DBIR found just 26 percent of known-exploited vulnerabilities fully remediated, down from 38 percent, with a median of 43 days.
• Moody’s puts the median at 87 days for exploited bugs.
• Tenable found Citrix environments take a median of 461 days to patch.

The patch itself is rarely the obstacle. The obstacle is systems nobody knew about. As Armis’s threat intelligence lead put it this week, “the most common gap is not knowing an instance exists.” PHP is built into firewall consoles, NAS admin panels, printers, cameras and switches that never advertise it. Action1’s field CTO said it more bluntly: “The inventory is a guide, not a shield.” Most enterprises don’t even have the guide.

Two incidents this month show the stakes. On October 16, Palo Alto’s Unit 42 disclosed that attackers who compromised FortiManager instances got an inventory of more than 500 downstream FortiGate firewalls, including serial numbers and public IPs, and used it to gain root on those firewalls. In the Reuters case, when the target application had no flaw, the agents moved to adjacent infrastructure and found an exposed control panel nobody was watching.

AI now finds the bug, writes the exploit and maps your estate faster than your team can. The defender’s one lasting advantage is knowing the estate better than the attacker: every device, version, exposure and owner. That knowledge has to drive action in hours, not quarters.

Network and infrastructure is the front line

The hardest systems to see are the ones getting hit hardest. Google reports that edge and security appliances accounted for 14 percent of exploited vulnerabilities this year, and two-thirds of those were high or critical. Mandiant notes these devices usually lack standard EDR telemetry. In October, actively exploited flaws hit Ivanti Connect Secure, Cisco Secure Email Gateway, Palo Alto PAN-OS, Fortinet FortiMail and FortiOS, SonicWall SMA and Citrix NetScaler. Then PHP2Shell exposed the management plane of nearly every major network vendor at once.

You can’t put an agent on a router or scan what isn’t routable. That’s true across the campus, the branch and edge, the AI data center and the OT floor. The control that works there is an accurate, current record of what’s deployed, what it runs, where it sits, who owns it and whether it’s reachable from the internet, plus automation that acts on that record.

This is a board question now

Every board should ask its infrastructure leaders five questions this month:

1. Do we have a single, continuously updated inventory of every network device, server and appliance we operate — with software version, location, owner and internet exposure?
2. When the next PHP2Shell lands, how long does it take us to answer “which of our systems are affected”? Minutes, or weeks?
3. Is that inventory discovered from the live network, or is it a spreadsheet someone updates when they remember?
4. Can our automation patch directly from that inventory, or does every advisory start with a manual hunt?
5. After we patch, do we verify the fix took and the estate hasn’t drifted?

If the answers are no, weeks, spreadsheet, manual and no, the problem isn’t patching. It’s a gap in the fundamentals, and no patch-management budget will close it.

What to do this quarter, not next year

Treat this as a loop that runs continuously, not a project with an end date:

• Discover. Find everything on the network automatically, all the time. Unknown devices are the attacker’s favorite devices.
• Record. Put it in one system of record: the intended state of your infrastructure, not a scan export. Version, role, site, owner, exposure.
• Prioritize. Join that record against KEV and vendor advisories. Internet-reachable plus critical plus exploited goes first. The rest is a queue, not a panic.
• Patch from the record. Drive automation off the inventory so a new advisory becomes a targeted job, not a scavenger hunt.
• Verify and repeat. Confirm the live state matches the intended state, catch drift, and go again. Forever.

Automation helps teams keep pace, but without an authoritative inventory, it just misses things faster.

Attackers now discover at machine speed, while remediation still moves at the speed of someone opening a spreadsheet. Until that changes, attackers will know your infrastructure better than you do. Fix that first, and fix it this quarter.

Enterprises have historically built separate network and security architectures, but this separation is becoming increasingly difficult to maintain as frontier AI models mature and security architectures shift from perimeter-based defenses to identity- and context-aware enforcement.

Frontier AI does not change existing cybersecurity fundamentals; it narrows the time available to apply them. As attacks move from human speed to machine speed, enterprises need security controls that can detect, respond, and enforce at the same speed. The network is uniquely positioned to become that enforcement and containment fabric.

The AI era requires enterprises to treat the network as an active security control, not simply as infrastructure to be protected. By integrating identity, telemetry, segmentation, and automated enforcement, the network can reduce exposure, contain compromise, and accelerate recovery at machine speed.

A brief look at how security has evolved

Traditional firewalls established an enterprise perimeter, while demilitarized zones created controlled, externally facing segments that restricted access to internal resources. Network access control lists added another enforcement layer by limiting communication to or from IP addresses associated with unauthorized users and devices.

As threats evolved, enterprises needed controls more granular than zones and IP addresses. Architectures such as Cisco ACI and TrustSec enabled application traffic to be permitted or denied according to identity and context, rather than relying only on addressing or device type.

Next-generation firewalls extended this identity- and context-aware model to perimeter enforcement by distinguishing among applications, users, devices, content, and threats.

The migration of workloads, applications, and data to cloud environments expanded the security boundary beyond enterprise-controlled infrastructure and required controls designed for cloud configuration, workloads, applications, and access.

Software-defined WAN then helped establish the Secure Access Service Edge model, combining SD-WAN connectivity with Security Service Edge capabilities such as secure web gateways, cloud access security brokers, firewall as a service, and zero-trust network access.

The frontier AI era

Frontier models have crossed an important cybersecurity threshold: AI-based models can increasingly discover vulnerabilities, develop exploits, orchestrate attack chains, and operate with levels of autonomy that compress attack cycles from days or hours to machine speed.

Enterprises must therefore now design security architectures on the assumption that compromise will occur.

This change demands a security strategy that reduces exposure before an attack, contains damage during a breach, accelerates response, and restores operations quickly.

The key pillars of this security approach are:

• Attack surface management: Reducing exploitable opportunities and weaknesses.
• Blast radius reduction: Reducing the scope of damage when a breach occurs.
• AI-enhanced security operations: Accelerating detection and response so defenders can keep pace with machine-speed attacks.
• Enhanced resilience and recovery: Restoring critical services rapidly and reducing the overall impact on the enterprise.

Supporting measures will include stronger patch management, segmentation as a core cyber-resilience capability, and virtual shielding. Together, these controls minimize the attack surface and reduce the blast radius where vulnerabilities cannot be remediated immediately.

Identity governance must extend beyond human users to include non-human identities associated with agentic AI, automated systems, and the internet of things. Unlike traditional users, who typically interact with applications and systems one action at a time, AI agents can operate continuously, interact directly with APIs, and other agents, and execute actions at machine speed.

Zero trust is evolving from an access architecture into a continuous operating model in which every request to a protected resource is explicitly authenticated and authorized, regardless of whether it originates inside or outside the enterprise environment.

In a zero-trust environment, identity determines which resources a user, device, workload, or agent may access. The network then becomes a critical control point for limiting how far that authorized access can extend across the enterprise.

The network as the enforcement fabric

Enterprises should prioritize their most critical business services, automate security operations, and strengthen network resilience so that prevention, containment, response, and recovery function as one operating model. Within that model, the secure network must provide five core capabilities:

• Visibility: Provides visibility into traffic between users, devices, workloads, applications, APIs, agents, and data.
• Enforcement: Convert identity, posture, application, and threat intelligence into access decisions.
• Segmentation: Prevent a compromised identity, workload, or AI agent from becoming an enterprise-wide compromise.
• Telemetry: Use network behavior as a detection signal for increasingly rapid and autonomous attacks.
• Containment: Isolate workloads, revoke communication paths, and constrain east-west movement at machine speed.

In the frontier AI era, preventing every breach is no longer a realistic strategy. The objective is to make compromise difficult, lateral movement constrained, detection immediate, and recovery rapid. Achieving that objective requires identity, endpoint, cloud, and application security to operate as an integrated system, with the network providing the visibility, segmentation, and enforcement fabric that connects them.

The network is no longer simply infrastructure to be secured. It is becoming part of the security architecture itself.

Hear from the experts

How can enterprises turn the network into an active layer of security in the AI era? Watch this webinar to hear experts from NTT DATA, Cisco, and IDC discuss how organizations can evolve their network architectures to improve visibility, contain threats, and strengthen resilience.