Everyone is buying AI. Almost nobody is governing it.
Powered by Single Fin
Welcome to this week’s edition of CIOsurge!
This week:
Shanief Webb, CISO at Headspace, on the three-lens review every AI tool request has to pass
SAP's Value of AI study: spend is up, ROI expectations are up, and governance is lagging behind both
Schellman's audit reality check: 74% think they would pass, 27% are actually mature
Let’s make this week a game-changer.
Stay sharp. Stay ahead.
The Three-Lens Review Every AI Tool Request Should Have to Pass
Every CIO and CISO in our community is fielding the same request right now: can we use this AI tool? In my conversation with Shanief Webb, CISO at Headspace, he laid out the most disciplined review process I have heard for answering that question, and it is worth copying.
Headspace assembled a committee of reviewers who look at every AI tool request through three different lenses. First is GRC. "Is that tool or integration compliant with what the company needs? Is it HIPAA compliant for if there's any PHI exposure?" They also check it against customer contracts, since some carry stipulations about how and where data can be accessed.
Second is security engineering, which threat models the integration. As Shanief put it, they examine "what that integration looks like in our environment, what data flows through it, who has access to it, can personal accounts be connected to this thing," and then judge whether it is too risky to introduce.
Third is IT, which asks a question the first two cannot: are there controls we could implement inside that integration to limit or mitigate the risks GRC and security just identified? "So it's kind of a three-party, three-pronged approach where we're all looking at it from different perspective and different lenses."
The piece I liked most is that they also demand the business case from the requester. Why is this tool needed in the first place, what are we trying to solve, and is the value worth the risk it creates? Then the committee decides.
Two non-negotiables came with it. Auditing, monitoring, and logging have to be in place for any AI tool. And on production data, Shanief was unambiguous: "we were pretty adamant about not having any production data go through any AI tools that are third party in our company."
The takeaway for security and technology leaders: a single reviewer will always miss something, because compliance risk, architectural risk, and configurable controls are three different problems. Stand up a three-lens review, make the requester defend the business case, and set a hard line on production data before the requests pile up.
SAP's Value of AI Study: The Money Is Moving Faster Than the Controls
Enterprises are facing two simultaneous challenges with AI, according to The Value of AI study commissioned by SAP from Oxford Economics: the risks are evolving faster than governance frameworks, while the business benefits remain difficult to measure. Now in its second year, the study surveyed 2,600 executives across 13 countries. The average surveyed enterprise plans to spend around $28 million on AI, up from $26.7 million last year, and expects a 21% ROI, up from 16%. Expectations for AI agents are climbing even faster, with expected agent ROI reaching 17% this year from 10% last year, and 83% of respondents saying agentic AI has the potential to fundamentally transform their organization. Yet despite investments running into the millions, many companies lack control over the agentic AI they are deploying.
Read the two halves of this study together and the problem names itself. Spend is up, expectations are up, transformation talk is at 83%, and control is the thing lagging all three. This is exactly the moment where the enthusiasm outruns the inventory. Before your next AI budget conversation, be able to answer three questions: what is running, who owns each deployment, and what data can each one touch. If those answers do not exist, that is the first line item, ahead of any new tool.
74% Think They Would Pass an AI Audit. 27% Are Actually Mature.
Although most companies think their AI governance is up to par, the maturity of their programs is lacking, according to a report from compliance services firm Schellman that surveyed 525 US-based professionals involved in governance at their organizations. Nearly three-quarters of respondents said they could pass an AI compliance audit, but just 27% described their programs as fully mature. Companies are spending on governance, the report found, but they are not fully prepared as agentic AI spreads through their environments.
That 47-point spread between confidence and maturity is the most dangerous number in this edition. It means most organizations are not lying to their auditors, they are lying to themselves. Confidence without maturity is how you end up explaining to a board why the framework existed on paper and nowhere else. The test is simple: pick one AI deployment and trace it end to end, from approval through access to audit log. If you cannot complete the trace, you are in the 74%, not the 27%. Do that exercise before a regulator or an incident does it for you.
💡 CIO Spotlights
Christian Winward named Chief Information Security Officer at PNC
Appointed CISO of PNC Financial Services Group (NYSE: PNC), the ninth-largest US bank by assets, reporting to Debbie Guild, head of technology
Joins from FirstBank, which became part of PNC earlier this year, where he served as CIO and sat on the bank's senior leadership team
His FirstBank career spanned more than 30 years, beginning as a teller and rising through technology and project management leadership
As CIO, led the modernization of FirstBank's technology capabilities and supported its integration into PNC
