Security leaders are paralyzed by AI. Here's where to actually start.

Security leaders are paralyzed by AI adoption, not because they lack budget or buy-in, but because they face overwhelming options and fear making the wrong investment. The panel argues that AI decision fatigue is real, especially when the market promises silver bullets. The real signal is that teams should stop focusing on the AI tool

itself and instead ask what business outcome they need to achieve. The strongest practical advice is to start AI deployment in repetitive, low-risk tasks like alert triage, vendor risk assessments, and contract analysis. This reduces alert fatigue, frees up senior staff, and allows teams to learn before scaling. Another key recommendation is to arm

red teams with AI tools to simulate attacker techniques, turning offense into defense. However, the panel also highlights that human-in-the-loop is not optional. Over-permissioning AI agents creates new security risks, such as prompt injection attacks like ghostjacking. Agents reading trusted logs can still be compromised. Teams must limit agent permissions and never fully remove

human oversight. Patching is a cautionary tale: AI-generated patches only succeed ~46% of the time and often introduce new issues—comparable to human error. The hype around AI finding and fixing vulnerabilities is premature. The conclusion is clear: AI is a third grader, not an SAT proctor. Treat it as an assistant, not a replacement.