How AI failures actually happen.

Here are two findings that shouldn't both be true.

EY surveyed 975 C-suite leaders last year about AI-related risks. Sixty-four percent said their company had lost more than $1 million to them. Among those that experienced losses, the average was $4.4 million — and EY called that estimate conservative.

Yet ask a room of executives, "Who here has had an AI failure?" and you'll see maybe one hand, offered reluctantly.

Both of those things are real. I want to explain how, because the reconciliation is the single most useful thing I've learned about AI risk.

AI failures don't arrive labeled.

There is no line on your ledger called "AI failure." So when one happens, the loss gets filed under the nearest old category — and from that moment, it's invisible.

The recommendation model quietly degrades and customers drift away? That's booked as churn. Marketing gets budget to fix it.

An automated decision treats a customer or an employee badly enough that lawyers get involved? That's a settlement. Legal handles it, quietly, with a confidentiality clause.

A pricing or procurement algorithm does exactly what it was configured to do, in a situation nobody configured it for? That's an operational write-off. A "one-time" charge. Finance smooths it over.

A promising automation program gets shut down eighteen months in because nobody trusts its output? That's a strategic re-prioritization. It doesn't even make the loss column.

Every one of those is an AI failure. None of them will ever be counted as one. Which is how a company can lose millions to AI-related risk and honestly believe it hasn't started yet.

Why the mislabeling matters more than the loss.

A miscategorized loss doesn't just understate your exposure — it sends the repair money to the wrong department. If the loss is filed as churn, marketing buys retention campaigns. If it's filed as a legal matter, you get a better confidentiality clause. The system that actually generated the loss is never touched, because as far as the org chart is concerned, it was never involved.

So the failure repeats. And because these systems are wired into more decisions every quarter, it doesn't repeat at the same size.

I spent my career as a CISO inside large enterprises, and I've watched this movie before. Twenty years ago, breaches were booked as "IT outages" and "network issues." The losses were real; the category didn't exist yet. It took disclosure rules and a few spectacular headlines before boards saw the true number — and most wished they'd seen it sooner, when it was cheaper.

AI risk is at that same stage right now: material, recurring, and filed under other names.

Three questions for your next finance review.

You don't need new tooling to test this. You need one uncomfortable hour:

1. Pull the last four quarters of write-offs, settlements, "one-time" charges, and unexplained churn. For each: was there an automated decision anywhere upstream?

2. For any "yes" — who owns that system today? A name, not a department.

3. For any "we can't tell" — sit with that answer. A loss you can't trace to a decision is a loss you can't prevent from recurring.

If those questions are easy to answer, you're in rare company. If they're not, nothing is wrong with your people — you're simply looking at a category of risk your reporting was never designed to see.

That's not a comfortable conclusion. But it's a much better starting point than "we haven't had an AI failure yet."

Because the odds are: you have. You just filed it under something else.

When something goes wrong with AI, most organizations reflexively route it to the same place: the security team. Understandable. For twenty-five years, "technology risk" has effectively meant "cyber risk," and cyber risk means the CISO.

I ran security inside large enterprises for most of my career, so I have no interest in shrinking my old profession's territory. But this reflex is wrong — and it's quietly dangerous.

Cybersecurity is built around an adversary.

Every mature security program rests on the same mental picture: somewhere out there is someone who wants to harm you. Firewalls, detection, incident response, threat intelligence — the entire discipline is organized around one question: is someone doing something they shouldn't be?

It's a good question. It has protected enormous amounts of value. It is also the wrong question for most AI failures.

Most AI failures have no adversary.

Nobody breaches anything. No malware, no stolen credentials, no insider. The system does exactly what it was built to do — in a situation nobody built it for.

A model drifts as the world changes underneath it. An automated decision executes perfectly against a policy that quietly contradicts another policy. A vendor updates their model overnight and your workflow inherits behavior nobody on your side ever tested. A well-intentioned team wires an AI's output directly into a downstream system because it had been right for six straight months.

When EY asked 975 C-suite leaders which AI risks had actually cost them, the top answers were regulatory non-compliance and biased outputs. Governance failures. Not attacks.

Ask the security question of any of these — is someone doing something they shouldn't? — and the honest answer is no. Everything is authorized. Everything is working as designed. And you're still losing money.

The toolbox mismatch.

When AI risk gets filed under cyber, it gets cyber controls: access management, encryption, intrusion monitoring. Keep all of it — genuinely. Some AI failures do begin with weak identity or a manipulated model, and the security program is your defense there.

But none of those controls catch a system confidently making a bad decision it is fully authorized to make. There is no intrusion to detect. The monitoring will sleep peacefully straight through it.

Here's the dangerous part. The board asks, "Are we covered on AI risk?" Someone points to the security program. Everyone nods. That's not coverage — it's coverage theater, and it feels exactly like the real thing right up until the loss arrives.

Whose problem is it, then?

AI failure is a business-decision integrity problem. It lives where decisions live: pricing, hiring, lending, customer treatment, compliance. Which means it crosses legal, HR, finance, operations, vendor management — and yes, security.

That makes it a new category of risk. And new categories don't have owners yet. In most companies, if you ask who owns AI risk, what you get is a pause.

The organizations getting this right aren't the ones with the biggest security budgets. They're the ones who noticed the category difference early, and stopped expecting the cyber program to catch what it was never designed to see.

Two questions worth asking this week:

1. In your company, who owns an AI failure that involves no attacker? Not who would investigate it — who owns preventing it?

2. The last time your board asked about AI risk, did the answer describe attacks — or decisions?

If both answers point at the security team, that's not a knock on them. It's a sign you're using your only mature risk function as a catch-all for a risk it wasn't built to hold.

AI failure deserves its own category. It's already generating its own losses.

Two research firms went looking, separately, at the same question: how ready are companies to govern AI agents? Not chatbots that answer questions — agents. Software that doesn't just recommend, but acts. Books the refund. Adjusts the price. Sends the email. Then decides what to do next, on its own.

Deloitte surveyed 3,235 business and technology leaders. Gartner ran its own survey of executives. Different firms, different questions, different samples, published months apart.

They landed on the same number.

21%. That's the share of companies with a mature governance model for their AI agents.

When two independent research shops, using different methods, converge on the same figure, it stops being a survey artifact and starts being a fact about the market. And Deloitte supplies the other half of the picture that makes the number land: close to three-quarters of companies plan to deploy agentic AI within two years.

So hold those two numbers next to each other. Roughly 75% are moving toward systems that act on their own. 21% have a mature way to govern them. That space — between how fast we're deploying and how well we can govern — is the 21% problem.

Here's why it isn't just a to-do item that governance will quietly catch up on. The gap isn't sitting still. It's structurally designed to widen.

Deployment scales like a switch. You turn an agent on, and by that afternoon it's running thousands of decisions a day. Then someone wires it into the next workflow, then the next. Adding capability is close to instant, and it's what everyone is rewarded for shipping.

Governance scales like a hire. It's people reviewing, arguing, writing policy, sitting in rooms deciding what "acceptable" means. Adding oversight means headcount, process, and time.

One curve is a switch. The other is a hire. They do not stay level with each other. Left alone, the gap between them widens every quarter — not because anyone is negligent, but because the two things grow at different speeds by their very nature. Closing it takes deliberate effort against the grain of how the organization naturally moves.

And an agent is the worst possible place for that gap to sit.

A recommendation engine suggests; a human still decides and can catch a bad suggestion before it does anything. An agent decides and acts. The human check that used to sit in the gap between the mistake and the consequence is exactly the thing agentic AI is built to remove. That's not a flaw — autonomy is the entire point, it's why agents are valuable. But it's also why a small error no longer stays small. It executes. Then it feeds the next automated step. Then the next. By the time a person looks, the error isn't a suggestion anymore — it's a series of completed actions.

This is the part that should hold a board's attention. The move from recommendation systems to agents isn't just "more AI." It removes the natural pause where human judgment used to live, and it does so precisely as the volume and speed of decisions goes up. More consequential decisions, made faster, with fewer moments where a person could intervene — governed, in most companies, by a model that hasn't matured.

Gartner's own numbers sharpen it: roughly three-quarters of executives now view AI agents as a new attack surface, yet only a small fraction feel confident they have the governance to match. Gartner also predicts that more than 40% of agentic-AI projects will be canceled by the end of 2027 — many of them not because the technology failed, but because the risk controls and the value case never caught up to the deployment.

I spent my career as a CISO, and I've learned to be suspicious of comfortable numbers. 21% is not comfortable. But the 79% on the other side of it aren't reckless or less intelligent. Most of them are moving exactly as fast as their competitors and their boards are asking them to. The 21% simply started closing the gap while it was still narrow — before autonomy multiplied the cost of being on the wrong side of it.

Two questions worth asking this week:

1. How many of your live AI systems act on their own — with no human approving each individual decision? Not plan to. Do, today.

2. For those, how many automated steps run before a human sees the result? If you can't put a number on it, that's the number that matters.

You don't need to be in the 21% by next quarter. You need to know which side of the gap you're standing on — and whether it's widening while you read this.