PART ONE — FOR THE CISO

‍

The Executive Briefing

Read this in the next ten minutes. It's what you need to walk into a board meeting, staff aworkstream, and know whether your program is real or performed.

‍

The Reality Check

Every AI security conversation starts the same way: someone asks “how many AI tools do wehave?” and the honest answer is “more than we think, and fewer than we'll admit to the board.”That's not a discovery problem — it's a categorization problem. Most organizations are trying togovern AI with a single policy, a single risk questionnaire, and a single approval workflow, as if thewriting-assistant plugin in Legal's browser carries the same risk profile as an autonomous agentwith write access to your CRM.

‍

It doesn't. And treating it like it does is why AI governance programs stall. Some AI is invisible andlow-risk, already embedded in tools you've had for years. Some is autonomous and high-risk,capable of taking actions in your environment without a human in the loop. Your governanceprogram has to flex across that entire range, or it will either strangle the low-risk work or wavethrough the high-risk work. Both failures land on your desk.

‍

Why This Matters at the Board Level

Boards don't want an inventory. They want to know whether the organization is exposed, where,and how much it would cost if something went wrong. A flat list of “47 AI tools in use” tells themnothing — it's noise dressed up as diligence. A tiered risk view tells them: 40 of those tools carrynegligible incremental risk, 5 need contractual and monitoring controls, and 2 require board-levelsign-off because they can act autonomously on sensitive systems.

‍

That second version is a governance program. The first version is a spreadsheet. Audit committeesare asking sharper questions about AI risk classification specifically because “we have an AI policy”stopped being a satisfying answer sometime in the last eighteen months.

‍

The Board Conversation

Three things to remember every time you're in that room:

• Lead with tiers, not tool counts. “We've classified our AI footprint into four risk tiers, andhere's where the real exposure concentrates” beats any number of tools discovered.
• Name the autonomous systems specifically. Boards understand that a chatbot and an agentwith transaction authority are different categories of risk. Don't let them get flattened into “AI”as a single line item.
• Show the trend line, not just the snapshot. The tier distribution today matters less thanwhether Tier 4 (autonomous/agentic) is growing quarter over quarter — that's the number thatshould set the pace of your program.

‍

Business Translation for the Board

‍

We can't put a dollar figure on ‘AI risk' as a category, but we can tell you exactly what itcosts to leave our two highest-risk AI systems ungoverned — and it's a number worthfunding a program to avoid.

‍

Bringing In CTO, CIO & Business Teams

This pillar fails if it stays a security-only project. Use this to make the ask concrete when you'rerecruiting each function.

Program Objectives

Four things this pillar has to deliver before anything downstream — access, monitoring, incidentresponse — can be considered real.

The Roadmap

This is the pace CISO Next Gen members have used to move from an ungoverned AI footprint to aboard-reportable tiering program — without stalling the rest of the security program to do it.

Metrics to Track

Five is the ceiling before a board stops actually tracking them. Report these on the same cadenceevery quarter — consistency matters more than volume

‍

PART TWO — FOR YOUR TEAM

‍

The Implementation Playbook

This is the working section — hand it to whoever owns execution. It defines the four categories ofAI assets, what a complete tier entry looks like, the 30/90/365-day build sequence, and the failuremodes that derail this work most often.

‍

The Governance Gap

Before tiering anything, your team needs to internalize why most programs stall. It isn't a missingpolicy — it's a missing scoring layer between the policy and the decision.

‍

‍

The Four Asset Categories

Every AI system your organization touches falls into one of four tiers, based on two variables:autonomy (does it act, or does it inform a human who acts?) and data sensitivity (what does ittouch?).

‍

1. Embedded & Invisible

AI features baked into tools you already use and have likely never separately reviewed: writingassistants, meeting transcription, smart-compose features, recommendation engines inside SaaSplatforms. A meeting transcription feature that summarizes an internal call is Tier 1; the samefeature auto-emailing that summary to an external distribution list has quietly become somethingcloser to Tier 3.

Governance posture: Light-touch. Register it, confirm it inherits the underlying vendor's existing contract terms,move on.

‍

2. Predictive & Analytical

Traditional ML and statistical models used for forecasting, scoring, or classification — frauddetection, credit risk scoring, demand forecasting, churn prediction. Informs human decisions;doesn't act on its own. Often touches sensitive or regulated data, which is why this tier existedunder the name “model risk management” long before “AI governance” became a category.

Governance posture: Standard model risk management — validation, bias testing, documented data lineage, periodicre-validation.

‍

3. Generative & Conversational

LLM-based chatbots, copilots, and content-generation tools, whether built in-house or purchased.No autonomous multi-step action, but capable of processing and potentially exposing sensitiveinputs, and capable of producing outputs that get acted on directly by end users. This is the tiermost existing policies were actually written for — which is part of the problem, since it's also thetier most organizations have already moved past.

Governance posture: Data handling review, output monitoring, clear usage policy, DLP controls on inputs.

‍

4. Agentic & Autonomous

Systems that take multi-step actions with minimal human review — agents with tool access,systems connected via MCP or similar protocols, anything with write access to production systems,financial systems, or customer data. This tier didn't meaningfully exist in most enterprises threeyears ago and is now the fastest-growing category by adoption rate.

Governance posture: Full pre-production review, least-privilege access design, human-in-the-loop checkpoints forconsequential actions, continuous monitoring, and — increasingly — a named executive owner per agent, not perdepartment.

‍

The tier boundary that matters most right now is the line between Tier 3 and Tier 4. A chatbot thatdrafts an email is fundamentally different from an agent that sends it, and most existing AI policieswere written before that distinction needed to exist.

‍

From the Field: Real CISO Stories

These are composite scenarios drawn from patterns CISO Next Gen members report repeatedly —not any single named organization, but the kind of story every practitioner in the room recognizesimmediately.

‍

The forecasting tool that upgraded itself

A CISO at a global pharmaceutical distributor discovered, six months into a formal AI inventoryeffort, that a demand-forecasting tool procured by the supply chain team two years earlier hadquietly been upgraded by its vendor to include an ‘autonomous reorder' feature — turning a Tier 2tool into a Tier 4 tool without a single internal conversation. The contract hadn't changed. The riskprofile had, completely. The team only caught it because they'd started asking ‘has this tool'scapability changed' as a standing question, not just ‘do we still use this tool.'

‍

The self-certification bet that paid off

A CISO at an asset management firm built their tiering model around a simple rule that madeadoption easy: any team could self-certify a tool as Tier 1 using a five-question form, no securityreview required, as long as they were willing to have it audited quarterly. They got radical honestybecause they made the cheap path the honest path — the moment self-declaring became easier thanhiding it, teams stopped playing whack-a-mole with their own security function.

‍

The agent nobody in engineering wanted tiered

A CISO at an HR technology platform found the hardest part wasn't building the framework — itwas getting engineering to apply it to systems they'd built internally, not just vendor tools they'dbought. Everyone wanted to point the risk framework at procurement; nobody wanted to point it attheir own roadmap. Tiering only stuck once it became a required field in the team's own SDLCticket templates.

‍

The agent hiding inside a statement of work

A CISO at a regional financial services firm had an internal audit surface a Tier 4 candidate nobodyin security had reviewed: a customer service agent, built by a vendor's professional services teamduring an implementation project, quietly given write access to account notes and case status. Ithad never appeared in any AI inventory because it wasn't purchased as an ‘AI feature' — it waspurchased as ‘implementation services.' Every statement of work involving a vendor's professionalservices team now requires an explicit AI-capability disclosure clause, reviewed before the SOW issigned.

‍

‍

The pattern across all four: the gap wasn't a missing tool. It was a missing re-review trigger,a missing internal owner, or a missing line item nobody's inventory process was built tocatch.

‍

How to Build It: Manual and Automated Methods

Most teams default to one approach and miss what the other catches. Manual methods surfaceintent and ownership no tool can infer. Automated methods surface scale and blind spots nointerview will uncover. A real tiering program uses both, run in parallel, reconciled against eachother on a set cadence.

‍

Manual methods — run these first

‍

• Five-question intake form: scores autonomy and data sensitivity against the tier rubric inunder five minutes per tool
• Business unit self-attestation survey: a short, recurring form asking each team to list AI tools inactive use — low completion rates are themselves a signal.
• Contract and renewal audit: pull every active SaaS contract and renewal due in the next 12months; ask each vendor directly whether AI features have been added since signing.
• Structured changelog review: assign someone to read release notes for your top 20 SaaSvendors monthly — this is often the only place capability changes are disclosed before a usertells you.

‍

Automated methods — run these continuously

‍

• Browser telemetry / DLP: tune existing DLP or endpoint tooling to flag traffic to known AIdomains — the fastest way to surface unsanctioned personal-account use.
• CASB / SSPM platforms: discover connected and OAuth-authorized apps automatically,including AI features employees have granted access to company data.
• API and network egress monitoring: flag outbound calls to LLM provider APIs directly fromyour network — catches engineering-built integrations that never went through procurement.
• Identity and access log review: query your IdP for OAuth grants and service accounts createdin the last 90 days — new agent and integration accounts often appear here before anyonereports them.

‍

Reconciliation is the step teams skip. Once a month, compare what your automated toolsfound against what your manual tiering has logged. Every unmatched entry on either side isa gap — either a tool no one interviewed about, or a tool your scanning missed.

‍

‍

Implementation Guide — 30 / 90 / 365

‍

The 30-day foundation

Week 1 is building and pressure-testing the tiering rubric with 10–15 known AI systems you canalready name. Weeks 2–4 focus on securing business unit and engineering sign-off on the tierdefinitions — arguing over definitions later, one tool at a time, is a much slower fight.

‍

The 90-day build-out

Run full discovery across procurement records, SSO logs, and business unit self-reporting. Classifyeverything found. Stand up the standing review board for Tier 3–4 systems. Report the first tierdistribution to the board.

‍

The 12-month target

Intake becomes the default path for all new AI adoption, not an afterthought. The Tier 1–2 auditprogram runs on autopilot. Every Tier 4 system has a named executive owner and documentedcompensating controls. Quarterly board reporting on tier distribution and the Tier 4 trend line isroutine.

‍

Common Failure Modes

‍

• Building the framework before securing the mandate to enforce it — a tiering model withoutteeth becomes a taxonomy exercise nobody uses.
• Making every tier feel like Tier 4 — if self-certifying a writing assistant takes the same effort asreviewing an autonomous agent, teams stop disclosing anything.
• Treating classification as a one-time event — vendor capability creep is one of the mostcommon ways a tool silently moves up a tier without anyone noticing.
• Excluding internally built systems — the framework has to apply to what your ownengineering team ships, not just what procurement buys.
• Excluding AI bundled into professional services — vendor-delivered AI capability doesn'talways show up as a line item; sometimes it shows up inside a statement of work.
• No named owner for Tier 4 systems — autonomous systems without a specific accountableexecutive are the ones that cause board-level incidents.

‍

‍

This Week's Action

‍

Pick five AI tools your organization already uses — pull them from procurement records,not memory — and manually score them against the four-tier framework above. You willalmost certainly find at least one that's a tier higher than whoever approved it assumed.

‍

Chapter Toolkit

This chapter includes the AI Risk Tiering Scorecard (five-question intake form), a VendorCapability-Change Questionnaire for contract renewals, a Tier 3–4 Review Board Charter template,a Board Reporting one-pager, and sample SDLC ticket-field language for internally built systems.Provided alongside this chapter.

‍

Exclusive Invitation for CISO NextGen Members:

‍

If you are a CISO or Security leader within an enterprise, please reach out for an invite to our first CISONextGen NYC Dinner Summit: Inside Mythos: GlassWing Lessons for the AI Era

New York, NY · September 29 5:30-8:30pm

A closed-door mini-summit and dinner for security leaders navigating the next wave of AI risk. SecurityExecutive from a leading bank who's leading GlassWing remediation efforts, opens with hard-won lessonsfrom the front lines. Use these lessons to defend your own organization.