Turn AI Risk Into a Resilience Advantage

**Karen Stokes-Lockhart** (0:02)
AI is everywhere, but what does it mean for your business? Gartner is the world authority on AI, with more than 200,000 client conversations, and more than 6,000 written insights on AI in 2025 alone. Leaders across the C-suite, just like you, are partnering with Gartner to turn AI ambition into impact. Go to gartner.com/ai to learn more.
Welcome to Gartner ThinkCast. I'm Karen Stokes-Lockhart. Today, you'll hear from Gartner distinguished VP Analyst, Paul Furtado, on how organizations must use AI, not just to accelerate innovation, but to reduce risk and build resilience. Pulling from his CIO Leadership Forum session, Paul unpacks a growing tension while nearly every executive is racing to adopt AI, most also expect it to increase their organization's risk profile. The challenge isn't whether to use AI, it's how to use it responsibly. You'll hear why leaders must focus on security, governance, and human impact from day one, and how the right use cases can turn AI from a source of exposure into a powerful risk management tool.
Now, here's Paul Furtado.

**Paul Furtado** (1:23)
Now, the good news is, we're here to talk about using AI to build resilience and reduce the risk to the business. Because at the end of the day, that's what we still have to deliver. AI, like any other tool we bring into our environment, it is just that, it is another tool. But there's got to be some benefit to it. We're going to focus on the risk piece. I'm a bit of a car guy, so you're going to see a theme through this presentation. But one of the real interesting things about AI is, I've never seen a technology causes much executive FOMO or fear of missing out as AI.
Think back to when your executive leadership team came to you last year, maybe the end of 23 there, and it was like, hey, we've got to use AI. Great. For what? I don't know, but we got to use it. Now, it's becoming democratized. We're having AI agents out there, and we're having all this other push to use AI in our environments. And that's a good thing, because there are some benefits. 88% of CEOs said they're going to invest in AI. 84% of CIOs said they're going to invest in AI when we did our CIO scenario. So pretty close. We're aligned there.
The bad news is, the majority of us expect the risk profile in the organization to go up as a result of using AI.
And that's the reality. We've got to balance what we're doing with that technology in order to protect the organization and to protect the integrity of what we have to protect, the data sets, those artifacts.
When we start thinking about this and we're looking at it through that lens of strengthening resilience and reducing the risk to the business, there are three key areas we've got to focus on. First and foremost, security and privacy. Your fiduciary duty does not disappear because of the technology you decide to deploy, or the business decides to deploy. Whether it's done through an AI agent or an LLM or some other type of machine learning, we still have to protect that data and the integrity of those assets.
Lack of governance. This can't be a free for all. We have to put guardrails in place. I'll show you a real world example as we get through the presentation here where we've got to start paying attention to this. Because the example I'm going to use probably affected everybody that's in this room, and I'll go as far as saying everybody who's at this conference. And another critical one that we've got to start paying attention to is the impact on our human capital in our organizations.
With the surge of AI in these environments, what does it do to the talent pools we have? Does it water it down? Does it impact the critical thinking skills? And then in turn, how does that impact the organization?
And we start thinking about all the different areas that we're going to bring AI into the organization. Are we bringing in the right use cases? Does it actually make sense? What you really have to be asking yourself, are you bringing it in for the right reasons to solve the right business problem? Challenge the projects, challenge the use cases. Not everything is a use case for using AI. And also importantly, AI has to fit the business. The business doesn't necessarily have to fit AI. And what we're finding a lot right now, especially in the vendor community, this push to be not left behind and put AI in all of our products, is causing some organizations that adopt some of those tools to change how they operate. And it's not always for the bad. Every organization has room for process improvement, but in some cases, it's only change for change sake, just so you could use that tool or that agent. Not necessarily the right use case for that. So when we start thinking about cyber resilience, where is AI coming to play? What does it do for us? Well, ultimately, I like using the concept of what I call EQ. It has efficacy. It has to do it right. Does it do it right? Is it getting things done?