Cyber Risks Drive CISOs to Surf AI Hype Wave

Organizations have yet to draw business value from investments in artificial intelligence with many feeling AI is overhyped. Encouraging intelligent risk-taking and investing in cybersecurity can improve an organization’s resilience, giving businesses more confidence to embrace cutting-edge technologies like AI.

See Also: Capturing the cybersecurity dividend

At the Gartner Security and Risk Management Summit in Mumbai, Deepti Gopal, director analyst at Gartner, and Dennis Xu, vice president analyst at Gartner, discussed how CISOs can lead the adoption and impact of AI in their organization. This year the keynote centered on hype – the hype cycle and AI in particular. Gartner analysts said hype is not necessarily bad, especially if an organization knows how to make its infrastructure resilient to cyberattacks.

“Hype can drive organizations to overinvest in unproven technologies or cause cyber and risk teams to slow down excessively, risking missed market opportunities. However, hype often contains a kernel of truth and signals change that cannot be ignored,” Xu said.

AI has become the focus for almost every organization and IT solutions vendor in the past two years. But AI – especially generative AI – is deemed “hype.” Gartner’s 2024 Hype Cycle for Artificial Intelligence report says AI has surpassed the peak of inflated expectations on the Hype Cycle, a visual framework it created to represent the life cycle of new technologies and innovations.

The Hype Cycle showcases the phases of adoption and understanding which emerging technologies progress through over time, highlighting the enthusiasm and associated challenges. The analysts said cybersecurity risk is the main factor holding back organizations from adopting AI and other cutting-edge technologies.

“That’s why tech leaders are increasing their cybersecurity funding. Sixty-nine percent say managing cybersecurity and other technology-related risks will be their top focus in the next 12 months,” Xu said.

Worldwide spending on information security is projected to increase in security segments in 2025 (See Table 1.)

Source: Gartner

While prudence has increased security spending, leaders are also investing in AI. Gartner said 74% of CEOs believe that AI is the technology that will profoundly affect their industry over the next three years. This has spurred 84% of tech leaders to increase AI investment this year.

Embrace Cyber Resilience to Surf the Hype Wave

Gopal, one of the keynote presenters, told Information Security Media Group that CISOs should “ride the hype” to supercharge cybersecurity leadership, while ensuring it empowers businesses rather than driving decisions.

“Cybersecurity should act as an enabler, reducing business friction while focusing on the organization’s mission. It’s critical to articulate challenges clearly and transition from merely protective measures to a resilience-focused approach that encompasses responding and recovering from threats,”

– Deepti Gopal, director analyst, Gartner

Resilience, once viewed as an abstract concept, has gained practical significance under frameworks like DORA, which links people, processes and technology to tangible business outcomes.

“Cybersecurity must align with the organization’s goals, emphasizing its indispensable role in ensuring overall business success. While CISOs recognize cybersecurity’s importance, many businesses still see it as a single line item in enterprise risk, overlooking its widespread implications,” Gopal said.

She said cybersecurity leaders must demonstrate to the business how cybersecurity affects areas such as financial risk, brand reputation and operational continuity. This requires CISOs to shift their focus from traditional protective measures to strategies that prioritize rapid response and recovery. This shift, evident in evolving frameworks, underscores the importance of adaptability in cybersecurity strategies.

Intelligent Risk-Taking

Gartner analysts said CISOs play a crucial role in balancing innovation’s rewards and risks by guiding intelligent risk-taking. They must foster a culture of intelligent risk-taking by enabling people to make intelligent decisions.

“Transformation and resilience themes dominate cybersecurity trends, with a focus on empowering people to make intelligent risk decisions and enabling businesses to address challenges effectively. However, CISOs often face external constraints, such as regulatory changes and budgetary pressures. Adopting a zen-like mindset, prioritizing critical actions to enable business continuity, is vital for long-term success,” Gopal said.

Gopal outlined four key roles for CISOs: managing controls, ensuring compliance, mitigating risk and driving business value .

“While CISOs may need to temporarily handle risks or focus on compliance, their primary goal should be to become facilitators of risk management and value creators,” she said. “By advising on emerging trends, such as AI governance and maintaining a presence in strategic discussions, cybersecurity leaders can position themselves as essential partners in business transformation. This proactive, advisory role is key to enabling resilience and driving the mission forward.”

The concept of assessing cyber risk exposure isn’t new; techniques such as risk appetite statements and risk quantification have existed with mixed success.

Outcome-Driven Metrics

The analysts said outcome-driven metrics, or ODMs, facilitate communication and agreement on protection levels with the business, enabling CISOs to harness hype and deliver mission-driven outcomes.

Gopal said ODMs are a “groundbreaking way” to measure and enhance cyber protection. ODMs evaluate one’s current cyber protection level or exposure, serving as “two sides of the same coin.” They empower businesses to align on protection standards while driving mission-focused outcomes effectively.

“ODMs are a way to enable business, explain cybersecurity to leadership, and it’s a very condensed way of delivering the value of cybersecurity tying it back to the investment – because that is always a challenge for us. Where do we invest? What is the outcome? We don’t always talk about that. ODMs provide us that guidance,” Gopal said.

Beginner’s Mindset for AI Literacy

Gartner says awareness and training at the beginner level, with a deep understanding of what AI can do for the business, can help address the confusion around AI, especially among senior business leaders who expect it to be a silver bullet.

“To harness the hype around AI, build AI literacy with a beginner’s mind, foster critical thinking, and develop AI champions to spearhead AI initiatives,” Gartner analysts said.

They also addressed the perennial industry problems of cybersecurity talent shortage and burnout among cybersecurity practitioners.

“In cybersecurity, skills shortage and burnout create a vicious cycle, exacerbated by the constant influx of hype that overwhelms teams with change and disruption. Change management and learning agility can help harness this hype, ensuring team resilience,” the analysts said.