In the AI Era, CIOs and CISOs Must Decide Together
Picture the call. It’s 7:40 on a Tuesday morning, and a flaw has just been disclosed in the internet-facing application that processes your customers’ orders. By the time your security team finishes reading the advisory, attackers are already scanning for it. A fix exists, but it just hasn’t been tested against the integrations that keep orders flowing and applying it blindly, without testing, could take revenue-generating systems offline during the busiest hours of the week.
Your security team argues to, “Patch now.” IT says, “Not yet.” Both are right, and that’s precisely the problem.
I’ve sat on both sides of that call, and the gap that worries me most isn’t technical. It sits between the warning and the decision, and artificial intelligence is rapidly shrinking the time we have to close it.
The Bottleneck Isn’t the Patch
AI has made sophisticated exploit development cheap. Attackers with modest skills can now digest a fresh advisory and iterate toward a working exploit faster than many experts could just a few years ago.
Let’s look at it the way a CFO would. AI has cut the attacker’s cost per attempt and multiplied the number of attempts they can make each day. Attackers don’t weaponize every flaw. They chase those that offer the biggest return: flaws that are reachable, reliable, and widely deployed. Early in my career, a published flaw bought defenders weeks to respond. Now it buys mere hours.
Plenty has been written about attacker speed and far less about why defenders stall. Defenders have AI too, and can find and score weaknesses faster than ever. But a faster stream of findings can’t determine what to fix first, or who has the authority to decide. Many of us have spent a decade compressing detection time while our decision-making processes still run on a meeting calendar.
AI is also rewiring our own environments. As AI-enabled workflows connect systems, data, and permissions in new ways, last quarter’s “medium” can easily become this quarter’s bridge to customer data. These same vulnerabilities have an entirely new blast radius, and neither the CIO nor the CISO can see that whole picture alone.
One Mandate, Two Lenses
For years, the shorthand was that IT was the accelerator and security was the brake. Here’s how I frame the two jobs now: The CIO helps the business move faster. The CISO helps the business move faster with confidence. A remediation decision is where those mandates fuse or fracture.
The CISO owns exposure. Is this vulnerability exploitable in our environment? Can an attacker reach it? Where will they go next? Inclusion in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities Catalog confirms the threat is real. The CISO’s job is to explain what that means for the business, today, in one sentence.
The CIO owns operational reality. What does the system connect to? What breaks if we patch? How fast can IT make the change and roll it back? Those answers turn “patch now” from a gamble into a plan.
Put both leaders in the same room, and options appear. If the full patch can’t land today, reduce the attacker’s reach: Restrict access to the vulnerable component or place a temporary control in front of it while testing proceeds. Orders keep flowing and the attacker loses the easiest way in.
A Three-Step Playbook for the Next 7:40 a.m. Call
Here’s the approach I use, and the one I teach technology leaders who are tired of relitigating every urgent patch.
1. Build the escalation path before you need it
Agree in advance on what qualifies as an urgent, credible exposure and who gets pulled in once triggered. Anchor the response in a shared view of the business function at risk, not a ticket number. If you’re designing the process at 7:40 a.m. on a Tuesday, you’ve already lost hours.
2. Name the decision owner
Some decisions will still leave real exposure in place for days, and this is where capable technology leaders stumble: We accept the risk ourselves. Don’t. Risk to a critical business operation is a business decision. The CIO and CISO frame it and recommend a path. The executive who owns order fulfillment should make the call and own the residual risk. Say it plainly: “If we wait until Thursday, here’s the risk you’re accepting.” Absorb that decision yourself, and you’ve created an accountability gap that will surface at the worst possible moment, often in front of the board.
3. Put a clock on the decision
Set a deadline for deciding, measured in hours, and track it. Nearly every organization measures time to remediate. Few track the time from validated exposure to an agreed-upon action. That number tells you whether your CIO and CISO are operating as partners or just passing a hot potato in the form of an undetermined risk. Attackers are already tracking the delay for you.
Speed Is Now a Leadership Skill
AI has handed attackers velocity and scale at a discount. The businesses that pull ahead will answer with something harder to buy: two executives who can decide fast, and decide well, together.
