AI for a Chief Security Officer (CSO) at a $5M to $50M company covers 2 jobs: putting AI to work inside security operations, and securing the AI tools your staff already use. IBM’s 2025 breach report found that extensive AI use in security operations cut the average breach cost by about $1.9 million and shortened breaches by 80 days.
Most small security teams haven’t started the second job. Netskope’s 2026 report counted 223 generative AI data policy violations a month at the average organization, and IBM found breaches cost about $670,000 more where shadow AI use was high.
Staff AI policies live under AI policies and compliance, and Copilot rollouts under AI for the CIO.
At a $5M to $50M company, AI in cybersecurity mostly does triage: sorting user-reported phishing, summarizing and grouping alerts from endpoint and email tools, ranking vulnerability scan results, and drafting incident reports. An analyst still makes every call, and IBM found extensive AI use in security operations cut average breach costs by about $1.9 million.
Most of that AI arrives inside tools you already pay for. Many endpoint, email security and firewall vendors now include AI triage and plain-English search in current plans, and much of it sits switched off or unused.
So the first question I ask a security lead is simple: what AI features do you already own, and who turned them on?
At this size, security is often 1 or 2 people, sometimes an IT director wearing it as a second hat, sometimes a managed security provider plus 1 internal owner. The work that eats their week is repetitive reading.
Hundreds of alerts that turn out to be nothing. Phishing reports from staff who did the right thing and now expect an answer. Scan reports with 400 items and no sense of which 10 matter.
That reading is exactly what current AI does well, and it’s the safest place to start, because a person still decides what happens next.
I recommend keeping 3 actions behind a human approval: disabling a user account, isolating a machine from the network, and deleting anything. AI can recommend all 3 and draft the ticket.
A wrong call on any of them stops someone’s workday or destroys evidence. Wait until you have 90 days of the AI’s recommendations matching your analyst’s decisions before you loosen that rule, and loosen it 1 action at a time.
Shadow AI is any AI tool staff use without the company’s approval or visibility, usually a free chatbot, a browser extension, or an AI feature switched on inside a SaaS app. Verizon’s 2025 DBIR found 72% of employees using generative AI on corporate devices signed in with personal email, so the company has no admin control or log.
Gartner surveyed cybersecurity leaders in 2025 and found 69% had evidence or suspected that employees use public generative AI at work. It predicts that by 2030, more than 40% of organizations will suffer security or compliance incidents linked to unauthorized AI.
The cost is already showing up. IBM’s 2025 report found 1 in 5 organizations had a breach involving shadow AI, and high levels of shadow AI added about $670,000 to the average breach.
This is the sweep I run before recommending any AI security tool. It takes about 2 weeks of part-time work and needs no new software.
| Step | Where to look | What you’re counting | Time |
|---|---|---|---|
| 1. DNS and proxy logs | Firewall or DNS filter, last 30 days | Distinct AI domains and the number of users reaching each | 3 hours |
| 2. Browser extensions | Endpoint management or browser admin console | Extensions with AI, “assistant,” “writer” or “summarize” in the name or permissions | 2 hours |
| 3. Expense reports and card statements | Finance, last 6 months | AI subscriptions paid personally and expensed | 1 hour with finance |
| 4. SaaS sign-ins | Identity provider and “sign in with” logs | AI apps connected to company accounts through single sign-on or OAuth grants | 2 hours |
| 5. No-blame staff survey | 5 questions, anonymous | Which tools people use, for what tasks, and what data goes in | 1 week open |
The survey matters most. Logs show domains, while the survey is where someone admits to pasting customer contracts into a free summarizer every Friday.
Expect the sweep to find more AI tools than IT has approved. Treat the list as demand: every tool on it is a task someone wants help with.
Here’s an illustrative scenario. A 150-person professional services firm starts an AI security review with 3 tools on its approved list.
30 days of web-access logs, app permissions, expense records and staff interviews turn up 11 AI tools in use, and 8 of them aren’t on the list. Of 32 people identified as AI users, 15 have used personal accounts for work.
The sweep also finds 2 unregistered meeting assistants and an AI summarization workflow with read access to a shared customer-service mailbox. That workflow has no support owner.
Keep permissions and data transfers separate in the report. Mailbox access is confirmed, but only the execution logs show which messages the workflow actually processed.
The plan that follows assigns an owner to every tool, moves legitimate use onto managed accounts, strips permissions nothing needs, and puts the meeting recordings and the mailbox processing at the top of the review queue.
The tool counts are assumptions for illustration. The personal-account share is anchored to research: Netskope’s 2026 report found 47% of generative AI users on personal AI apps, and 15 of 32 is about 47%.
Stop AI data leakage with 3 controls working together: give staff an approved AI tool on a company account, publish a simple rule for which data can go into which tool, and add data loss prevention checks on the browser and endpoint for your most sensitive data. Netskope’s 2026 report found source code made up 42% of generative AI data policy violations and regulated data 32%.
The approved tool comes first. Netskope saw personal AI app use fall from 78% to 47% of generative AI users in a year as companies rolled out managed accounts, which tells you staff will switch when the sanctioned option works.
Company accounts give you the controls personal accounts never will: single sign-on, admin logs, retention settings, and a contract saying your data doesn’t train the vendor’s models.
Staff remember a short table. Here’s the whole rule on one screen.
| Data level | Examples | Approved company AI tool | Personal or free AI tool |
|---|---|---|---|
| Public | Website copy, published prices, press releases | Yes | Yes |
| Internal | Meeting notes, internal procedures, draft emails | Yes | No |
| Confidential | Customer lists, contracts, financials, source code | Yes, inside approved workflows only | No |
| Regulated | Health records, card data, Social Security numbers, controlled technical data | Only where legal and security have signed off in writing | Never |
I tie the 4 levels to the same labels your file and email systems already use, if they use any. A rule that matches what staff see on screen gets followed.
The signed policy and the training behind it are a separate piece of work, covered under AI policies and compliance.
Blocking public AI tools first is common advice, and at this size it backfires. Netskope found 90% of organizations block at least some AI apps, averaging 10 blocked apps each, and violations still doubled in the same year.
Blocks push the same work onto personal phones and home laptops, where your logs see nothing. You trade a risk you can measure for one you can’t.
Block the narrow set of tools with known bad data terms. Everything else gets steered toward the approved tool, with data loss prevention watching the Confidential and Regulated levels.
Data loss prevention for AI works best on 2 or 3 patterns you can define exactly: customer account numbers, source code repositories, files carrying a Confidential label. Broad keyword rules flood you with false positives within a week.
If you’re on Microsoft 365, check whether your licenses already include data loss prevention before you buy anything new. The permission cleanup that keeps Microsoft 365 Copilot from surfacing the wrong files is a systems job, and I cover it in AI for the CIO.
AI brings 3 attack types a mid-sized security team now has to plan for: deepfake voice and video used for payment fraud, prompt injection against AI tools your company runs, and faster, cleaner phishing at volume. Gartner’s 2025 survey of 302 cybersecurity leaders found 62% of organizations faced a deepfake attack in the prior 12 months.
The same Gartner survey found 32% faced an attack on an AI application through its prompt, and 29% an attack on generative AI infrastructure. And 67% of the leaders said these risks need significant changes to their security approach.
The basics still carry most of the risk. Verizon’s 2025 DBIR found the human element in about 60% of breaches, and ransomware in 88% of breaches at small and mid-sized businesses.
A deepfake voice call from “the CEO” asking for an urgent wire is a process attack, and process controls stop it. Require a callback to a number already on file for any payment change or urgent transfer above a set amount (a common line is $10,000), and never accept the number given on the call.
Add a code word for the 5 or 6 people who can approve money movement. It costs nothing, and it works even when the voice on the line sounds exactly right.
Prompt injection is an instruction hidden in content an AI tool reads, such as an email, a web page or a shared document, that tells the AI to ignore its rules or send data somewhere. It matters most once AI tools can read your inbox or files and take actions.
Give every AI tool the narrowest access its job needs, keep a person approving anything it sends outside the company, and log what it reads and does. Agents that act inside business systems need their own identities and monitoring, which I cover in AI Agents for the CIO.
AI has made phishing grammatically clean and specific to your company, so “look for typos” training is out of date. Retrain staff on the request itself: urgency, a payment or credential ask, and a new channel.
Then use AI on the defense side to sort what staff report. That’s the first row in the table below.
Hand AI the security tasks that are high-volume, repetitive reading where a person still makes the final call: phishing report triage, alert summaries, vulnerability ranking, log searches, and incident write-ups. For a 2-person team, those 5 tasks can give back about 15 hours a week, worth $38,880 a year at a $54.00 loaded hourly rate.
Here’s the math for a $20M company with 2 people covering IT and security. The hours are planning assumptions from the kind of week I see at this size, so measure your own baseline for 2 weeks before you budget against them.
| Security task | Hours/week now | With AI | Hours given back | Mechanism |
|---|---|---|---|---|
| Triage of staff-reported phishing | 5 | 1.5 | 3.5 | AI classifies each report and drafts the reply to the employee; an analyst checks the verdict |
| Endpoint and email alert triage | 10 | 5 | 5 | AI groups duplicate alerts and writes a plain-English summary with context; the analyst decides |
| Vulnerability scan review | 4 | 1.5 | 2.5 | AI ranks scan results by internet exposure and by CISA’s Known Exploited Vulnerabilities list; a person approves patch order |
| Log searches during investigations | 4 | 2 | 2 | AI turns a plain-English question into the query; the analyst checks the query before trusting results |
| Incident reports and post-incident reviews | 3 | 1 | 2 | AI drafts the timeline from tickets and logs; the incident owner edits and signs |
| Total | 26 | 11 | 15 |
The worked calculation, with each assumption stated:
The math on the security table
Security staff usually cost more than the private-industry average, so this figure probably runs low. Those 15 hours go to the work that keeps slipping: the access review, the tabletop exercise, the backup restore test that hasn’t run since last year.
Every row clears my 20% rule. If AI would give back less than 20% of a task’s time, I cut or redesign the task.
The table above is a planning estimate. Here’s a more cautious scenario that counts the review time AI adds.
A 3-person security team handles 100 staff-reported suspicious emails a week. For each one, an analyst pulls headers, checks links and authentication results, looks for related alerts, and writes up a disposition.
An AI triage assistant gathers that evidence and proposes a classification with its reasons. The analyst checks it and approves closure or escalation, and suspending an account or pulling a message stays a human decision.
| Weekly analyst effort | Before | With AI |
|---|---|---|
| Gathering evidence and drafting case notes | 12 hours | 7 hours |
| Reviewing evidence, deciding and escalating | 8 hours | 9 hours |
| Total | 20 hours | 16 hours |
Review time goes up by 1 hour, and the team still gets 4 hours back each week. That’s a 20% cut, right at my threshold, so this workflow just qualifies.
The team puts 2 of those hours into investigating recurring phishing patterns and 2 into tuning detection rules. It also tracks misclassifications and reopened cases, so faster closing can’t hide missed threats.
All hours in this scenario are assumptions. Measure your own before you budget against them.
Track 4 numbers from day 1: mean time to detect, mean time to respond, false positive rate on the alerts AI touches, and analyst hours per week on triage. Take a 2-week baseline before switching anything on.
If false positives rise or response time doesn’t move in 60 days, turn the feature off. Plug your own hours into the AI ROI Calculator to see whether the license pays for itself.
Use the NIST Cyber AI Profile as your map. NIST released it as a preliminary draft in December 2025, overlaying the Cybersecurity Framework 2.0 with 3 focus areas: Secure (protecting AI systems you use), Defend (using AI in cyber defense) and Thwart (countering AI-enabled attacks).
Those 3 focus areas line up with the sections of this page. If you already report against NIST CSF 2.0, the Cyber AI Profile slots into the same Functions and Categories, so you add AI rows to the scorecard you already keep.
For the data your AI tools train on or read, the May 2025 joint guidance from CISA, NSA and the FBI, “AI Data Security,” covers protecting data across the AI lifecycle and monitoring for tampering.
A $15M company can cover AI security with 1 named owner, an inventory of AI tools, the 4-level data rule, and a quarterly review.
I write that as a one-page AI security scorecard: 1 row per NIST focus area, the controls in place, the gaps, and an owner and date for each gap. The board gets the same page.
Ordered people first, then process, then tech. Each step names who does it and what it produces.
Days 1 to 30: people
Days 31 to 60: process
Days 61 to 90: tech
I’m Lee Pomerantz, Certified Chief AI Officer, founder of eMediaAI, Fort Wayne, Indiana. Every engagement runs in one order: people first, then process, then tech.
The AI Opportunity Blueprint™ is where that starts. It’s a 10-day, $5,000 forensic audit: your staff record the tasks, I map where the hours and the data go, and you get a prioritized workflow map, an ROI projection, an implementation roadmap and governance recommendations.
For a security leader, the Blueprint doubles as a shadow AI sweep. Mapping how work really gets done shows which AI tools are already in use and what data flows through them.
If a task returns less than 20% of its time, the report says cut it. If the numbers don’t hold, it says don’t build.
AI is unlikely to replace cybersecurity analysts at a $5M to $50M company; it takes over repetitive reading, such as sorting phishing reports and summarizing alerts, while analysts keep every decision. For a 2-person team, handing 5 triage tasks to AI can give back about 15 hours a week. Those hours go to access reviews, tabletop exercises and restore tests that small teams rarely have time for.
AI for cybersecurity often costs a mid-sized company little in new licenses, because endpoint, email and firewall vendors already include AI triage features in current plans. The main costs are a security lead’s time, about 4 to 6 hours a week for 90 days, plus data loss prevention licenses where missing. Compare that against IBM’s 2025 average US breach cost of $10.22 million.
A company should block only the few public AI tools with unacceptable data terms and steer everyone else to an approved AI tool on company accounts. Netskope’s 2026 report found 90% of organizations block some AI apps, yet generative AI data violations still doubled in a year. Blanket bans push AI use onto personal phones, where security teams have no logs or controls.
Prompt injection is an attack that hides instructions inside content an AI tool reads, such as an email, web page or shared file, so the AI ignores its rules or leaks data. Gartner’s 2025 survey found 32% of organizations faced an attack on an AI application through its prompt. The defense is least-privilege access, human approval for outbound actions, and logging what the AI reads.
A first AI security program takes a security or IT lead about 4 to 6 hours a week for 90 days at a $5M to $50M company. That covers a 2-week shadow AI sweep, publishing a 4-level data rule, a 45-minute staff session on deepfakes and phishing, and switching on AI triage features already licensed. Staff each spend about 1 hour on training and an anonymous survey.
A security leader’s first AI move is naming 1 owner for AI security and asking staff, with no penalty, which AI tools they already use. Next comes a 5-step shadow AI sweep across DNS logs, browser extensions, expense reports, SaaS sign-ins and a staff survey. IBM’s 2025 report found 1 in 5 organizations had a breach involving shadow AI.
Measure the ROI of AI in security operations against a 2-week baseline of 4 numbers: mean time to detect, mean time to respond, false positive rate, and analyst hours on triage. Multiply hours given back by a loaded rate; 15 hours a week at the BLS full-time rate of $54.00 over 48 weeks equals $38,880 a year. Turn off any feature that hasn’t moved those numbers in 60 days.
Deepfake attacks on businesses are common enough to plan for now: Gartner’s 2025 survey of 302 cybersecurity leaders found 62% of organizations faced one in the previous 12 months. Most target payments through a cloned executive voice or video call. A mandatory callback to a number already on file for any payment change above a set threshold, such as $10,000, closes the most common version of this attack.
One named person should own AI security in a mid-sized company, usually the security lead or IT director, with legal, HR and finance joining a 30-minute monthly review. The owner keeps the AI tool inventory, the 4-level data rule and a one-page scorecard mapped to the NIST Cyber AI Profile’s Secure, Defend and Thwart focus areas. A separate AI security team is rarely needed below $50M.
Book a free 20-minute call to see if the AI Opportunity Blueprint™ is right for you.
Book Your Call
© 2026 eMediaAI.com. All rights reserved. Terms and Conditions | Privacy Policy
