 wasn’t a typical security event. This forum was a gathering of CISOs, analysts, and security leaders speaking candidly under Chatham House Rule about what’s actually breaking, what’s working, and where things are heading.

 that came through loud and clear. None of them were surprising. But together, they paint a pretty stark picture of where security and AI are right now.

1. It’s Not an Infrastructure Problem. It’s a Data Problem.

One theme anchored the entire discussion: 

we’re still framing the problem incorrectly.

Several CISOs pushed back on the idea that infrastructure is the core issue. The reality is more uncomfortable. Infrastructure might be where attacks land, but 

That shift matters. Because it reframes resilience entirely.

It’s no longer just about uptime or recovery. It’s about understanding what data is exposed, where it’s flowing, and whether you can prove control when something goes wrong, especially when that question comes from the board or the CFO.

2. We Need Automated Controls, Not Just Alerts.

There’s no shortage of security tooling in the enterprise. If anything, that’s part of the issue.

CISOs are questioning why, despite everything they’ve already invested in, problems still exist.

The real issue is that most tools were built for a different era. They detect. They log. They alert.

intervene in the moment the risk actually happens

This is the gap: not visibility, not detection — 

prevent things from going wrong in the first place

The tools that win won’t be the ones that generate better alerts. They’ll be the ones that:

In other words, any tools introduced need to have a 

 — one that sits inside the workflow, guides behaviour in real time, and closes the gap between policy and action.

There was no debate about whether AI is being used inside organisations. That question is settled.

The real issue is control, or more accurately, the lack of it.

That’s the reality most organisations are now dealing with. AI usage is happening across sanctioned and unsanctioned tools, and increasingly inside everyday SaaS products, where it’s even harder to detect.

What’s changing is the approach. Blocking is being quietly abandoned. Not because it’s a bad idea in theory, but because it doesn’t work in practice.

That shift is significant. It signals a move away from enforcement as the primary control, toward 

Because ultimately, AI adoption is being driven by the business, not security.

Almost every conversation about AI circled back to one starting point: 

Not high-level reporting. Not dashboards for the sake of it. Real visibility into how AI is actually being used.

Right now, most teams don’t have that. Or at least not at the level they need.

So decisions get made with incomplete information.

That’s the gap. And it’s only getting wider as AI becomes embedded across more systems and workflows.

One of the more interesting shifts in the conversation was how often people, not technology, came up as the limiting factor.

These aren’t side issues anymore. They’re directly tied to risk.

At the same time, expectations are increasing. More tools, more alerts, more pressure to respond faster, all while the threat landscape is accelerating.

There’s a growing recognition that security isn’t just a technical discipline. It’s behavioural.

That idea may be challenged in some circles, but it’s a practical reality in a world where a single prompt can expose sensitive data.

The closing question of the session was simple: 

They weren’t asking for more features or more innovation for the sake of it.

That’s not a failure. It’s the environment.

AI is accelerating everything: how people work, how data moves, how risk is created. And that pace isn’t slowing down. Which means the model has to change.

Security can’t rely on controls that sit outside the workflow, react after the fact, or depend on already stretched teams to interpret and act. 

Keeping up with this pace requires controls that operate 

at the same speed as the behaviour itself

, embedded into how people use AI, able to guide decisions in real time, and capable of reducing risk without slowing work down.

In practice, that means introducing technologies that don’t just detect or report on AI usage, but actively 

point_right

Learn more about CultureAI's AI Usage Control Platform.

Eskenzi's IT Analyst & CISO Forum wasn’t a typical vendor event. No polished decks. No rehearsed narratives. Just operators, CISOs, analysts, and security leaders, speaking candidly under Chatham House Rule about what’s actually breaking, what’s working, and where things are heading. A few themes came through loud and clear. None of them were surprising. But together, they paint a pretty stark picture of where security and AI are right now.

Inside the CISO Mindset:

Recommended for you

AI Myths Exposing the Governance Gap

How the Wrong Framing Creates New Risk

Why Legal AI Governance Must Operate at the Point of Use