In June 2017, a piece of malware called NotPetya got into Merck & Co. without climbing a single wall. It arrived through a backdoor in accounting software supplied by a Ukrainian vendor, the kind of trusted, routine traffic every perimeter is built to let through. It spread to some 40,000 of the drugmaker’s computers, and Merck put the damage at more than $1.4 billion.
Then several of Merck’s insurers argued they owed nothing, because the attack was attributed to Russian military intelligence and their policies excluded acts of war. The fight ended in a confidential settlement in January 2024.
Two lessons sit in that story. The moat didn’t matter, because the threat came in with the traffic the moat was designed to admit. And the people who price risk for a living were the first to notice and the first to send the bill.
That was 2017, when attackers still needed humans at the keyboard. Increasingly, they don’t.
Here is the argument of this two-part series in two sentences. Security stopped being a technology problem with business consequences; it is now a business risk with a technology component. Most organizations are still organized the other way around, and the person they hold responsible for that risk sits inside the IT department, reporting to the people whose work they are supposed to check.
What AI actually changed
IBM’s 2026 Cost of a Data Breach Report, based on 602 breached organizations, found that one in four malicious breaches was AI-enabled, a 56% jump in a single year. Those breaches averaged $6 million, about $1 million above the global average of $4.99 million. In the U.S., the average breach now costs $11.5 million.
You don’t need a computer science degree to understand what changed. Three things matter:
- The con got a better voice. Deepfake impersonation was the most common AI-driven attack in IBM’s data, at 45%. The oldest scam in business, the urgent wire transfer, now arrives in the CFO’s actual voice on a video call.
- Your software can be talked into things. “Prompt injection” means hiding instructions inside an email, document or web page that an AI assistant reads and then obeys. It is social engineering aimed at the software instead of the employee, and no amount of annual phishing training protects against it.
- You’ve hired employees with no background check. Every AI agent holding credentials is, in effect, a new hire with keys to your systems, no manager and no HR file.
Notice what those three have in common. Each one is an attack on trust, on whom we believe, what we obey and whom we let in, and only then on technology. That distinction matters for everything that follows.
Meanwhile, employees aren’t waiting for permission. Shadow AI, meaning tools staff use without sanction, showed up in 43% of breached organizations this year, up from 20% the year before. Breaches involving AI systems themselves rose to 21% of all incidents, and the most common way in wasn’t the model at all. It was the plumbing around it: compromised APIs and plug-ins, and misconfigured cloud workloads.
Why the moat is dry
Moat security is easy to recognize. There’s a perimeter, a couple of expensive appliances, an annual training module, and a binder of procedures nobody reads until the auditor visits. It assumes the enemy is outside.
Today, much of the risk has been invited in the assistant reading the email, the agent holding the credentials, the vendor pushing the update. When Johnson Controls was hit by ransomware in 2023, the attackers first got into the company’s Asia offices and spread from there across the network. The company confirmed data theft and more than $27 million in costs, net of insurance. One breach in a distant office, and the moat was irrelevant.
Moat organizations measure activity. Attackers measure time. IBM found the average time to identify and contain a breach rose to 247 days, the first increase in five years. Breaches contained in under 200 days cost $4.32 million; those that ran longer cost $5.65 million. And 53% of breached organizations hadn’t encrypted sensitive data at rest and in transit. The basics still aren’t done.
My email signature reads “Process is the evil twin of progress.” Moat security is process mistaken for protection.
Prepared versus old school: the numbers
In fairness, IBM sells security tools, and I’m aware of the irony of citing a vendor in a piece that warns against learning from vendors. The fieldwork is done by the Ponemon Institute, though, and the pattern matches what independent CISO surveys show. The gap between prepared and unprepared organizations is not subtle:
| What separates them | Prepared | Old school |
| AI and automation in security operations | Breach costs nearly $2M lower | One in four still without |
| Breach found and contained | Under 200 days: $4.32M | Over 200 days: $5.65M |
| Employee use of unsanctioned AI | Low: $4.63M per breach | Widespread: $5.39M per breach |
| AI security maturity (CISO self-rated risk) | 3.7 out of 10 | 7.8 out of 10 |
| AI governance and security teams coordinated | 19% of organizations | Everyone else |
Sources: IBM/Ponemon, Cost of a Data Breach 2026; IANS/Artico Search, CISO Perspectives on AI Risk 2026.
The most revealing finding comes from the IANS survey of 113 CISOs. Mature AI security programs explained why some security chiefs feel safer today. But confidence about the next two years tracked something else: whether leadership understood AI risk, whether someone clearly owned AI governance, and whether the security team had budget authority and enough staff. In other words, the factor that matters most is governance, not technology.
The CISO problem: under-trained and under-armed
Under-trained. Many of today’s security leaders learned the job defending against people, not software that behaves like people, and much of what they know about AI came from the companies selling the cure. When IANS released its research this year, one of its partners pointed out that most AI risk data comes from vendors and so reflects the supply side. If your threat briefings, your training and your tools all come from the same sales channel, you’ll end up with a well-funded blind spot. Only 53% of CISOs in a LevelBlue survey said they felt prepared to defend against AI-enabled adversaries.
This is not about age. A veteran who keeps learning beats a newly certified buyer of AI-branded appliances every time. What matters is whether someone is still learning now, not when they first learned.
Under-armed. The IANS 2026 board engagement study found that 95% of CISOs brief their boards regularly, but only 10% influence financial decisions. Only a quarter say board discussions of cyber risk run longer than 30 minutes. And 64% of CISOs still report into IT leadership. That leaves the CISO accountable for the breach without authority over the budget.
The lab is not the accounting department
Everything above gets harder in a research organization. Research runs on unpredictable workflows, tools adopted the week they appear, enormous data transfers and outside collaborators. A control that slows a scientist doesn’t stop the work. It moves the work somewhere security can’t see.
The stakes are rising at the same time. Google’s threat intelligence group reported that in the second quarter of this year it investigated extortion cases involving stolen AI research, including one in which a healthcare organization lost drug research and an AI model. It also tracked a China-linked group targeting academic, medical and military research institutions in North America.
R&D doesn’t need an exemption. It needs a different deal: wide freedom in how the work gets done, in exchange for a short list of fixed rules around the assets that matter most. In practice, that means protecting around the lab rather than inside it:
- Make the safe path the fast path. Offer pre-approved sandboxes, compute environments and AI tools that are quicker to use than the workarounds. Researchers don’t resist security; they resist friction.
- Watch instead of block. Monitor what leaves the lab and how, rather than putting a checkpoint in front of every action. Unusual data movement and odd access patterns are how theft gets caught without slowing discovery.
- Classify by value, not by department. Open science, pre-publication results and proprietary or controlled work need different protection. Lock down the crown jewels, not the whole lab.
- Borrow from the research networks. The research and education networking community solved a version of this years ago with the Science DMZ, a design that moves high-performance research traffic outside the enterprise firewall and secures it with targeted controls and monitoring instead.
Some rules don’t bend: federal research-security requirements, defense contracting standards, export controls. But that list should be short, explicit and explained, not a binder of procedures nobody in the lab can name.
We regulate security by tax status, not consequence
Public companies must describe board oversight of cyber risk to the SEC, though the final rule dropped a proposal to disclose whether they even have a CISO. New York’s financial regulator requires the CISO to report to the board in writing every year, and the board must understand and fund the program, public or private. Hospitals still operate under a HIPAA Security Rule written in 2003; its overhaul has slipped to July 2027. A privately held research firm can fail as badly as any public company, and the rules barely notice. Don’t wait for a regulator to tell you what your risk already has.
That is the diagnosis. In Part 2, the prescription: an eight-step roadmap for rebuilding, starting with the reporting line that most organizations never chose and simply inherited.