Forrester to CISOs: Stop Debating Whether AI Works. Start Pricing What It Actually Costs.

Forrester analysts Jess Burn and Jeff Pollard have a blunt message for CISOs still fighting the “does AI work” battle: that argument is over, and losing it. The more useful fight, they argue in a September 14 post, is over what trustworthy AI actually costs — and most enterprise AI business cases simply omit three categories of that cost: security consequences as AI consumption grows more complex and unpredictable, governance overhead as autonomous agents gain access to credentials and sensitive data, and talent-pipeline risk as automation eliminates the entry-level roles organizations rely on to grow future expertise. Their framing is direct: “the business case often fails to account for the security, governance, and workforce investments” sustainable AI deployment actually requires.

The recommendation isn’t a security veto — it’s three specific questions CISOs should force onto the executive table: who funds AI security work, who governs the behavior and cost of autonomous systems, and who builds the long-term expertise these systems require. The thesis repositions AI security spending as a shared enterprise investment rather than a security-department line item, which matters directly for revenue teams: sales and GTM organizations are deploying agentic AI into revenue workflows at the same pace as everyone else, typically without budgeting for the governance and oversight Burn and Pollard say sustainable deployment actually requires.

The cost side of that equation is bigger than security teams tend to model. Bain’s FinOps-for-AI framework, published earlier this month, models a typical $10 billion company’s annual AI-inclusive IT spend rising from roughly $250 million today to $550 million by 2035 without intervention — and finds only 13% of tech executives say they currently have adequate spending transparency at all. Read together, the two pieces make the same point from different departments: AI’s real cost isn’t the token bill anyone is already tracking, it’s the security, governance, and workforce spend nobody has priced in yet.