Making AI Work at Scale Is the CIO’s Next Challenge

For much of the past two years, enterprise leaders have been focused on a single question: How do we adopt AI?

The urgency was understandable. Generative AI exploded into the mainstream, boards demanded AI strategies, and organizations rushed to pilot tools that promised productivity gains, automation, and competitive advantage.

But at Gartner Security & Risk Management 2026, a different conversation emerged.

Across keynote sessions, analyst presentations, and executive discussions, a common theme surfaced: AI adoption is no longer the primary challenge. For many organizations, AI is already embedded in workflows, business processes, and employee productivity initiatives. The challenge now is operational maturity. Organizations must establish the governance, workforce readiness, visibility, security, and resilience needed to manage AI at scale.

For CIOs, this shift represents a defining moment. Success will no longer be measured by how quickly organizations deploy AI. Instead, it will be measured by how effectively they operationalize it.

The AI Conversation Is Changing

One of the most compelling messages from Gartner’s opening keynote came from Leigh McMullen, Distinguished Vice President Analyst and Gartner Fellow, who challenged attendees to rethink how they view the future of AI and cybersecurity.

While headlines continue to focus on increasingly sophisticated AI-driven threats, McMullen argued that organizations should focus less on fear and more on transformation.

The larger opportunity, he suggested, lies in automation, modernization, and resilience.

“The most tangible value to be had from AI today is not replicating or replacing existing workers with AI reasoning,” McMullen said. “It is eradicating our technical debt and renovating it into a secure-by-design software stack that is designed around AI.”

His comments highlight changes taking place across the enterprise.

The question is no longer whether AI will become part of business operations. That question has already been answered. The challenge now is determining how organizations can effectively manage, secure, and optimize those investments over time.

In many ways, the industry is entering a second phase of AI adoption, one focused less on experimentation and more on execution.

Governance Becomes the New Competitive Advantage

As AI adoption accelerates, organizations are discovering that visibility may be just as important as innovation.

According to Neil Cohen, Vice President of Marketing at Portal26, conversations with enterprise customers have evolved considerably over the past year.

When AI governance first emerged, discussions largely centered on security and risk management. Today, organizations are asking broader operational questions:

• Who is using AI?

• Which tools are delivering measurable value?

• How can organizations identify successful use cases?

• How should leaders measure return on investment?

• How can they determine whether AI initiatives are actually driving business outcomes?

“AI is not about security,” Cohen said. “AI is about how are you going to be more competitive.”

That perspective reflects a growing reality facing CIOs.

While security remains essential, enterprise leaders increasingly need visibility into how AI is being used across the organization. They need to understand adoption trends, monitor costs, evaluate business impact, and identify opportunities for optimization.

The challenge is particularly complex because AI adoption often begins organically. Employees experiment with tools independently. Teams develop their own workflows. New applications emerge faster than governance frameworks can keep pace.

As a result, organizations are moving beyond simple risk management toward evidence-based AI governance. Rather than asking whether AI is being used, they are asking how it is being used and whether it is delivering measurable value.

The organizations that answer those questions effectively may gain a significant competitive advantage.

The Talent Gap Has Become an AI Gap

Technology alone will not determine success.

According to Victoria Cason, Senior Principal Analyst at Gartner, workforce readiness remains one of the most significant barriers to enterprise AI maturity.

During her breakout session focused on building AI-ready cybersecurity teams, Cason described the challenge as a familiar problem taking on a new form.

“Cybersecurity has always had a talent problem,” she explained. “Now we don’t have the right AI skills or we don’t have enough AI skills.”

The issue extends well beyond cybersecurity.

Across industries, organizations are struggling to develop the knowledge and expertise needed to support rapidly evolving AI initiatives.

Cason highlighted a critical distinction that many organizations overlook: the difference between AI literacy and AI proficiency.

AI literacy involves understanding foundational concepts, identifying hallucinations, and recognizing the limitations of AI systems.

AI proficiency, however, requires practical application. It involves prompt engineering, model validation, AI governance, workflow integration, and the ability to securely deploy and manage AI systems in real-world environments.

That distinction matters because organizations often assume that exposure to AI tools automatically creates readiness.

In reality, AI-ready organizations require structured learning programs, role-specific training, continuous education, and cross-functional collaboration.

The challenge is particularly urgent because AI innovation continues to outpace workforce development.

As organizations push forward with ambitious AI initiatives, many employees are still learning how to use the technology effectively.

For CIOs, workforce development can no longer be treated as a secondary consideration. Building AI capabilities has become just as important as deploying AI technology.

Infrastructure Still Matters

While AI dominates executive conversations, foundational technology disciplines remain as important as ever.

John Walsh, Field CTO for Government and Critical Industries at IGEL, believes AI is accelerating conversations that many organizations should have already been having around modernization, identity, and Zero Trust.

“It’s interesting in the sense that there’s two pieces,” Walsh said. “One is modernization, including the edge. And of course, you can’t get out of any conversation around modernization and advanced workloads without talking about AI.”

For many enterprises, AI adoption is exposing weaknesses in existing infrastructure.

Organizations are discovering that successful AI strategies require more than powerful models and ambitious roadmaps. They also require trusted endpoints, resilient architectures, strong identity frameworks, and integrated security controls.

Walsh argues that Zero Trust remains one of the most effective foundations for addressing those challenges, particularly as organizations attempt to balance modernization efforts with increasing regulatory requirements.

The discussion becomes even more complex as enterprises move toward agentic AI.

As autonomous agents begin participating in business processes, traditional approaches to identity and access management may need to evolve.

“We need to treat it like a non-human identity,” Walsh said.

The idea reflects a growing realization across the industry.

AI systems are no longer simply tools that employees use. Increasingly, they are becoming active participants in workflows, making decisions, accessing information, and executing tasks independently.

As those capabilities expand, organizations may need to apply many of the same principles used to govern human users, including identity management, access controls, monitoring, and accountability, to AI agents themselves.

The future of AI governance may ultimately look a lot like the future of identity management.

Resilience Becomes the Defining Strategy

Perhaps the most important takeaway from Gartner Security & Risk Management 2026 was the growing emphasis on resilience.

For years, cybersecurity conversations have centered on prevention.

• How do we stop attacks?

• How do we eliminate risk?

• How do we prevent breaches?

McMullen challenged that mindset.

As AI accelerates both innovation and cyber threats, he argued that organizations must focus on their ability to adapt, recover, and continue operating when disruptions occur.

“Resilience is the only strategy,” he said.

The concept extends far beyond cybersecurity.

Operational resilience encompasses technology, people, processes, governance, and culture. It requires organizations to continuously test recovery capabilities, modernize aging systems, automate repetitive work, and build operating models capable of responding to change.

In an AI-driven world, resilience becomes inseparable from business performance.

Organizations that can rapidly adapt to new technologies, evolving threats, and changing market conditions will be positioned to move faster than competitors.

Those that cannot may find themselves struggling to keep pace.

The Bottom Line

Taken together, the conversations at Gartner reveal a larger transformation underway.

• AI governance is no longer separate from workforce strategy.

• Workforce strategy is no longer separate from infrastructure modernization.

• Infrastructure modernization is no longer separate from resilience.

• Resilience is no longer separate from business success.

The CIO now sits at the center of all four.

The next phase of AI will not be defined by who adopts the most tools.

It will be defined by who can operationalize AI most effectively.

That means creating visibility into AI usage, developing AI-ready talent, modernizing foundational technology, establishing governance frameworks, and building resilient operating models capable of adapting as AI continues to evolve.

The AI race is entering a new chapter.

The organizations that gain an advantage will not necessarily be the ones deploying the most AI tools. They will be the ones that can govern, secure, scale, and continuously optimize AI across the enterprise.

For CIOs, the challenge is no longer getting started.

It is making AI work at scale.