After years of investment, experimentation and pressure to adopt artificial intelligence, some businesses are reportedly reassessing their AI strategies, as promised productivity gains prove elusive for many organizations outside the tech sector, while errors, security incidents and rising costs have complicated the business case.
Rather than benefiting from the efficiency gains executives anticipated, employees are spending more time correcting AI-generated mistakes. Meanwhile, ethical concerns surrounding privacy, workforce displacement and the environmental costs of AI infrastructure are adding to the resistance.
This pullback creates a genuine dilemma for CISOs, who can’t opt out of the technology their adversaries are already weaponizing against them. The same technology that introduces new attack surfaces and security risks has become an increasingly important component of cyber defense.
AI can help security teams analyze enormous volumes of telemetry, identify suspicious behavior, prioritize alerts and respond to threats at machine speed. Abandoning AI because other parts of the business have struggled to realize its value could leave security operations struggling to keep pace with increasingly automated adversaries.
Why businesses are pushing back on AI
The initial rush to adopt AI often emphasized experimentation and adoption rates over measurable business outcomes. That approach is now facing scrutiny.
A 2026 Workday study found that nearly 40% of the time saved through AI was lost to correcting low-quality output, rewriting content and checking results. The pattern played out publicly at Meta, where an ambitious push to replace human staff with AI tools reportedly unraveled amid quality and reliability issues, underscoring the gap between AI’s promised capabilities and its real-world performance.
Meanwhile, according to Deloitte, the typical payback period for AI spend is up to four years, and only 6% of organizations have seen measurable ROI. Most strikingly, 56% of CEOs report seeing zero ROI from AI, with neither increased revenue nor decreased costs over the past 12 months. Only 12% report achieving both outcomes.
Leaders also cite security concerns as they reconsider adoption. Employees may expose confidential information by entering it into unauthorized AI services, while AI integrations and agents can introduce new avenues for data exposure, privilege misuse and exploitation.
Resistance to AI has an ethical dimension, as well. Concerns about job displacement, workplace surveillance and data center development are contributing to public opposition. In the wake of the Hugging Face breach and high-profile warnings about AI’s existential risk, some are questioning whether the benefits justify the costs to society.
From ‘AI-free’ toward ‘human-full’
For enterprises, there is no easy answer. They can limit AI and potentially trail behind competitors, or continue investing in tools that may not deliver sufficient value and could introduce additional costs and liabilities.
Major firms, including Microsoft, Palantir, Booz Allen Hamilton, Meta and Nvidia, have limited or restricted employee use of certain AI tools due to growing concerns over proprietary and organizational data security.
Vendor selection is also changing. Some businesses are looking for software providers that allow customers to disable AI features, giving them greater control over where AI is used and how data is processed. Apps such as Zoom, WordPress and Slack offer AI opt-out features, and many developers are marketing “AI-free” — or at least AI-optional — as a selling point, appealing to customers who value privacy, predictable functionality or human-created work.
These initiatives reflect a shift from indiscriminate adoption toward selective deployment. At the same time, however, the trend poses a potential problem for security leaders: policies designed to reduce AI risk across the organization could inadvertently restrict the tools security teams need to defend the business.
Yaron Kassner, co-founder and CTO at identity security platform Silverfort, believes that competing without AI is feasible only in the short term, as organizations continue to experiment and results remain nebulous.
“Within a couple of years, this reality is bound to change, and organizations that don’t invest in AI will fall behind,” he warned. “As a result, most organizations will not go AI-free, but ‘human-full.’ Humans will be kept in the right places to maintain security, safety and a human touch, while AI will be used to speed them up.”
The CISO case for AI
Whatever happens with the broader AI pullback, security operations cannot afford to treat AI as just another productivity tool that can be switched off when the business case weakens. Threat actors are already using AI to accelerate reconnaissance, automate phishing campaigns, generate malicious code and modify attacks. As these capabilities mature, defenders will need ways to analyze and respond to threats at comparable speed.
AI is not a substitute for security expertise, and it does not guarantee better outcomes. But removing effective AI capabilities from security operations without a viable replacement could increase the time needed to detect and contain attacks, overwhelm analysts with alerts and make it harder to identify threats hidden in large volumes of data.
- Build a security-specific business case. CISOs should measure AI against security outcomes rather than general productivity claims. Relevant metrics include mean time to detect and respond, alert false-positive rates, analyst workload, incident containment time and the volume of threats investigated.
- Separate defensive AI from general-purpose AI. Enterprise AI policies should distinguish between consumer chatbots, employee productivity assistants, embedded software features and security-specific AI systems. These technologies have different risk profiles and operational requirements.
- Demonstrate value to executive leadership. CISOs should explain the consequences of withdrawing AI from security operations in business terms. Rather than arguing that the organization must embrace AI to remain competitive, they should show how specific tools reduce investigation time, improve coverage or help contain threats.
- Protect the budget through targeted investment. Security leaders should identify which AI capabilities deliver demonstrable value, which can be scaled back and which are essential to maintaining defensive coverage. They should prioritize use cases with clear benefits, negotiate contracts that provide flexibility and regularly reassess performance.
- Make security part of enterprise AI governance. CISOs should work with IT, legal, privacy, procurement and business leaders to establish risk-based approval criteria for AI adoption. This includes reviewing vendor data handling, retention practices, model training policies and incident notification requirements.
Calibrating the AI tradeoff
As AI skepticism builds across some enterprises, CISOs must consider where to draw the line between responsible restraint and a retreat that leaves the enterprise more vulnerable to attack.
AI adoption should not be a binary choice between embracing every new capability and rejecting the technology altogether. Enterprises need a sliding scale, deploying AI where it improves performance, restricting it where risks outweigh benefits and rejecting tools that introduce operational drag. While companies may have good reasons to slow their AI ambitions, they should not let that decision become a blind spot in their cybersecurity strategy.
Brent Midwood, senior product director at endpoint management company Tanium, told TechTarget, “Enterprises need to find the sweet spot on the dial between AI cost and business efficiencies gained. They have to weigh tradeoffs between using AI for innovation and risks created by connecting internal data sources to AI.”
That calculation, more than any blanket policy, will determine whether security teams are equipped for what comes next.
Richard Livingston is an editor for TechTarget Cybersecurity, covering news, trends and analysis. Livingston’s professional background includes editorial positions in the national defense industry covering the U.S. Army Medical Department, as well as offensive and defensive cyber strategy for military and government audiences.
