Welcome to this week’s edition of CIOsurge!

This week:

Let’s make this week a game-changer.

Stay sharp. Stay ahead.

This week I had the privilege of guest lecturing at the UCLA Anderson School of Management, spending time with the next generation of technology and business leaders at the intersection of AI, cybersecurity, and enterprise strategy. A few things the conversation reinforced for me, and all of them apply directly to the CIO chair.

Technology initiatives are won or lost on how clearly they communicate measurable business value. The best-engineered projects stall when the business case is not made in terms the organization can act on. Building support also requires understanding the economic and personal motivations of your stakeholders, not only the technical problem you are solving.

AI agents are changing the speed of decision-making, but extracting real value takes continuous iteration. The first deployment is rarely the one that delivers. And the same capabilities expanding your competitive surface are expanding your attack surface at the same time. Security has to be a first-principles consideration in AI strategy, treated as foundational from day one.

The final point generated the most discussion: long-term competitive advantages compound. Organizations building seriously around AI and cybersecurity today are creating leads that will be increasingly difficult to replicate in three to five years. The window is open now.

Grateful to the UCLA Anderson community for the invitation. These conversations with future leaders are a reminder of why the work matters.

👉 If you want to talk shop, grab 30 minutes on my calendar.

I sat down with Woo An, CEO of Zaun, who is building security for the post-AI enterprise. Woo came up through Palantir on the defense side, with a traditional ML background before that, and he has a sharp read on where enterprise AI adoption is outrunning enterprise security.

I asked him about the new threat surfaces showing up as companies roll out copilots, MCP servers, and SaaS with AI baked in. His answer reframed how I think about the gap.

"The biggest enterprise adoption we're seeing are the coding agents, your Claude Code, your Cursor, your Copilots," Woo told me. There are a handful of ways to protect the org in that space, he explained, like writing a simple rule that blocks a destructive command before it runs. The problem is everything outside the coding agents. "People aren't looking at the AI tools inside HubSpot or Salesforce or Glean," he said. "AI is being used in many different places other than coding agents, and enterprises don't really know the risks there."

What makes it worse is the pressure from the top. The board and the CTO are enforcing that everybody use AI because it means efficiency and better margins. "But the CIOs are like, I don't have a choice in the matter. I have to adopt these tools in two weeks, but then I have no security capability, no security monitoring. They're getting fire hosed, and they still have to do their day jobs, which is protecting from adversaries across cloud and endpoints."

That matches what I hear constantly. I asked Woo where the single biggest blind spot is, and he named two: visibility into the tools already in use, and cost. Most organizations, he said, do not even look at the telemetry coming out of their coding agents. And when a major AI vendor changes its pricing model, an org can burn a full quarter of budget in a week.

The takeaway for any CIO: inventory the AI already running in your SaaS stack before you greenlight the next tool. The coding agents are visible. The AI quietly embedded in the platforms your teams already pay for is where the exposure hides.

- Zack Tembi

At FinOps X 2026 in San Diego this week, the FinOps Foundation's State of FinOps 2026 report landed with a number that reframes the discipline: 98% of practitioners now manage AI spend, up from roughly 31% two years ago. The survey of 1,192 organizations also found 90% now manage SaaS costs and a growing share track licensing and private cloud, and the Foundation formally widened its mission from managing the value of cloud to managing the value of technology. A recurring warning from the event: many teams budgeted assuming token prices would fall, but GPU and energy constraints mean those costs are structural. The FinOps and Linux Foundations announced a joint effort to build open, unified standards for AI billing across providers.

This is the macro version of what Woo described to me on the podcast. The cost surprise is no longer a cloud problem, it is an AI problem, and it is hitting nearly every organization at once. If you are still treating AI spend as a line item somebody will reconcile at quarter end, you are already behind. Put financial telemetry next to your AI workloads now, before the bill teaches you the lesson.

- Zack Tembi

Read the full story

OWASP's 2026 agentic AI security report now catalogs real CVEs and breach reports, with coding agents driving most of the new attack data.

Cyera raised $600 million at a $12 billion valuation to keep building a trust layer for the age of AI agents.

Oracle posted $19.2 billion in Q4 revenue with OCI up 93% and a $638 billion backlog driven largely by AI infrastructure contracts.

Oracle is rolling out outcome-based AI pricing, charging per business result rather than per token, though analysts caution the meter is still running behind the scenes.

Amazon claims its data centers are now seven times more water-efficient than the industry average as AI buildouts strain resources.

CIO.com reports that an organization's most AI-savvy employees are often the ones quietly driving shadow AI.

Send us your story

CIO, SAHARA Las Vegas

CIO, tms

CIO, Medpace

CIO, Vaco by Highspring

Virtual CIO, eMazzanti Technologies