> ## Content Index > Fetch the complete content index at: https://www.cybrsecmedia.com/llms.txt > Use this file to discover other available public pages before exploring further. # AI Innovation Requires Risk. Cybersecurity Can't Be the Department of No. - URL: https://www.cybrsecmedia.com/ai-innovation-requires-risk-cybersecurity-cant-be-the-department-of-no/ - Published: 2026-10-29T10:08:05.000Z - Updated: 2026-10-29T10:08:35.000Z - Description: As businesses accelerate AI adoption, security leaders risk becoming obstacles to innovation. It's time to rethink how cybersecurity enables risk-taking. - Author: Michael Farnum - Tags: AI innovation and risk, Risk Management, Article *Michael Farnum is CEO of CYBR.SEC.Community. This commentary is adapted from an episode of CYBR.Signal, where community leaders share perspectives on cybersecurity, leadership and the issues shaping the industry. Full episode:* [AI Governance: Security Can't Be the Department of NoMichael Farnum explains why cybersecurity teams must stop blocking AI innovation and start managing risk to help organizations move forward safely.![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/icon/CYBR.SEC.Media-Logo-copy-b69873d2-d30c-4ad0-b8c4-13f528cc56fb.jpg)CYBR.SEC.Media, and CYBR.SEC.Media![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/thumbnail/CYBR.Signal_Ep-28_ghost-a2b5a27b-b2ff-454b-b25b-ffea54f40551.png)](https://www.cybrsecmedia.com/risk-and-innovation-with-michael-farnum/) I recently participated in an AI governance panel that forced me to confront something I thought I'd learned a long time ago: Cybersecurity isn't supposed to be the department of no. And yet, there I was, slipping back into that mindset. The panel was interesting because we weren't speaking to the usual cybersecurity crowd. Most of the audience consisted of AI developers, entrepreneurs, enthusiasts and people building businesses around artificial intelligence. They weren't necessarily interested in hearing all the reasons they shouldn't do something. They wanted to understand how to move forward. The four of us on the panel came at the subject from different perspectives. [Tommy Todd](https://www.linkedin.com/in/tommy-todd/?ref=cybrsecmedia.com) and I have known each other for years, and we both come from traditional security leadership backgrounds. [Joe Alapat](https://www.linkedin.com/in/joealapat/?ref=cybrsecmedia.com), founder of Liongard, brought a security background combined with the perspective of someone building products and running a business. Then there was [Salim Gheewalla](https://www.linkedin.com/in/iamsalim/?ref=cybrsecmedia.com). Salim came from more of a marketing and business perspective, and he challenged the rest of us in a way I didn't fully appreciate until after the panel. [Subscribe to the CYBR.SEC.Media newsletter](#/portal/signup/free) ## Innovation doesn't happen without risk Salim's argument was fairly straightforward: If we're going to innovate with AI, we have to be willing to take risks. That doesn't mean abandoning governance, ignoring security or connecting AI systems to everything without considering the consequences. Guardrails matter. But so does the willingness to experiment, push boundaries and accept that some things might go wrong. Tommy and I, meanwhile, kept gravitating toward the security concerns. We were thinking about what AI systems should connect to, what access they should have and what could happen if something went wrong. Those are legitimate questions. They're questions security professionals absolutely need to ask. But I realized later that we were approaching the conversation from a familiar defensive posture. We were drifting back toward being the people who tell everyone what they can't do. Salim was pushing us to think differently. He later [shared his perspective on LinkedIn](https://www.linkedin.com/posts/iamsalim%5Fsometimes-i-feel-i-get-put-on-panels-to-talk-ugcPost-7512930585607090176-cj1V/?ref=cybrsecmedia.com), and that prompted me to revisit the conversation. The more I thought about it, the more I realized he had a point. ## The business gets to decide how much risk is acceptable Here's something cybersecurity leaders sometimes forget: Our job isn't to decide how much risk the business is allowed to take. Our job is to help the business understand that risk, manage it and operate within the boundaries its leadership establishes. There's an important distinction. Security professionals are trained to identify threats, reduce exposure and protect systems. Naturally, that training can make us uncomfortable when someone proposes connecting an AI system to sensitive information, giving an autonomous agent access to business processes or experimenting with technology whose behavior isn't entirely predictable. We see the potential failure points immediately. And we should. But identifying those risks doesn't automatically give us the authority to prohibit the activity. Business executives ultimately have to decide what risks they're willing to accept in pursuit of their objectives. Security's responsibility is to make those decisions informed ones and help the organization execute them as safely as possible. That doesn't mean blindly accepting every decision. We should challenge assumptions, explain potential consequences and push back when the exposure is significant. But there's a difference between challenging a decision and assuming we get to make it. ## AI is testing whether security has really changed We've spent years talking about security as a business enabler rather than a roadblock. We've told ourselves that the department-of-no mentality belongs in the past. We've embraced concepts like risk-based security, business alignment and resilience. Then AI comes along, introducing unfamiliar capabilities, unpredictable behavior and entirely new categories of exposure. And suddenly, some of those old instincts return. I caught myself doing exactly that. The uncomfortable reality is that AI innovation requires experimentation. Organizations aren't going to discover every valuable application of this technology by refusing to let anyone take a chance. At the same time, Salim's perspective doesn't mean we should swing completely in the opposite direction. Connecting AI to everything, giving it unrestricted access and hoping for the best isn't innovation. It's recklessness. There's a middle ground between those extremes, and that's where cybersecurity needs to operate. ## Resilience matters as much as prevention One of the biggest lessons I've taken from this experience is that enabling innovation means accepting the possibility of failure. Security teams should absolutely work to prevent breaches, misuse and operational disruption. But we also need to build organizations that can withstand those events and recover quickly. That's especially important with AI. We aren't going to anticipate every failure mode or prevent every mistake. If our entire strategy depends on eliminating uncertainty before the business can move, we're going to become an obstacle. Instead, we need to help organizations establish reasonable boundaries, understand the consequences of crossing them and develop the resilience to recover when something goes wrong. That's what business enablement should look like. It isn't about saying yes to everything. It's about making it possible to say yes without being reckless. ## A lesson I apparently needed to learn again Looking back, I suspect Salim was leaning a little further toward risk-taking than I was comfortable with, while Tommy and I were leaning a little too far toward avoiding risk. The right answer is probably somewhere between those positions. But I want to thank Salim for challenging us, both during the panel and afterward. He made me reconsider my own thinking, and that's exactly what a good discussion should do. I've been in cybersecurity long enough to know that we aren't supposed to be the department of no. I've talked about that lesson plenty of times. Apparently, knowing the lesson doesn't mean you can't occasionally forget it. AI is going to force security leaders to revisit some deeply ingrained habits. We can either help businesses innovate responsibly or retreat into the familiar comfort of telling people what they shouldn't do. I know which role we're supposed to play. Sometimes we just need someone to remind us. [![](https://storage.ghost.io/c/ab/67/ab676516-71e3-473d-8f73-9e0692f5aaee/content/images/2026/10/2027-Events-Banner-57.png)](https://www.cybrsecmedia.com/conference/)