Think of Enterprise AI risk as a puzzle with several distinct pictures inside it: security, legal, finance, operations, strategy. Each picture is complete on its own, but only when they all line up together do they look right.
Generative Security has always started from the need to protect business outcomes. To achieve that, we look at how technology can be abused in unexpected ways. That vantage point is how we spotted a gap in the intersection between AI and traditional enterprise risk. Today, each discipline mentioned above has its own way of framing and quantifying the risks and benefits associated with AI, but as far as we could find, nothing shows how they fit together at the enterprise level.
Consider what two kinds of failure cost. A failed security control has a well-documented price tag: IBM's 2025 Cost of a Data Breach study put the average breach at US$4.44 million globally and a record US$10.22 million in the United States. A failed AI investment is just as real, but it rarely shows up as an incident. In S&P Global's 2025 survey of more than 1,000 respondents across North America and Europe, 42% of companies had abandoned most of their AI initiatives, up from 17% a year earlier, and the average organization had scrapped 46% of its proofs of concept before they reached production.
Gartner estimates a fine-tuned virtual assistant at around US$5 million to US$6.5 million upfront, and in 2024 they predicted that at least 30% of GenAI projects would be abandoned after proof of concept by the end of 2025 because of poor data quality, inadequate risk controls, escalating costs, and unclear business value.
Projects that do go live can miss too. Gartner predicts that by 2027, half of the organizations that expected to significantly reduce their customer service workforce will abandon those plans, as many struggle to leverage AI instead of human agents. In Australia, Commonwealth Bank reversed its decision to replace 45 customer service roles with an AI chatbot, saying it "was wrong" after the Finance Sector Union said call volumes had risen.
Both of these outcomes represent the realization of risk to the enterprise, with material business impact, and yet often times when security folks talk about risk we only ever see the former.
Each picture in this puzzle has its own owners, its own outcomes, and its own people asking for a number. Below are five risks from those pictures, each with a named owner and a figure that owner would recognize.
Laws and regulations (General Counsel and HR) Hiring and customer decisions are where AI turns into legal exposure. iTutorGroup, which denied the allegations, agreed to pay US$365,000 to settle an EEOC lawsuit alleging its recruiting software automatically rejected older applicants. The EU AI Act sets fines of up to €15 million or 3% of worldwide annual turnover for most deployer obligations, and up to €35 million or 7% for prohibited practices. Air Canada's tribunal loss was only CA$812, but it established that a company owns what its chatbot tells customers, a precedent every deployer now carries.
Finance (CFO) Gartner expects at least 50% of GenAI projects to overrun their budgets through 2028, citing poor architectural choices and a lack of operational know-how, and its report notes that a production-ready system can cost orders of magnitude more than a pilot. Running costs matter too: Gartner's 2024 cost table puts a fine-tuned virtual assistant at roughly US$8,000 to US$11,000 per user per year, against US$280 to US$550 for a commercial GenAI app such as a coding assistant. Security has a role to play here as well, though, both in getting the tool into production as quickly as makes sense and in maintaining its availability.
Operations (COO and revenue owners) When a revenue-generating system goes offline, someone loses the revenue. In Verizon's 2026 Breach Impact Study, business interruption had the highest median loss of any category at around US$90,000 per claim, the top 2.5% of cases approached US$5 million, and in retail it made up 44% of known losses. A chatbot that has to be pulled because people are manipulating it, as DPD did in 2024, creates reputation loss as well as financial loss.
Security (CISO) This is the picture with the most mature numbers, and AI is adding to it. In the same IBM report, 13% of organizations reported a breach of an AI model or application, and 97% of those lacked AI access controls. One in five reported a breach caused by shadow AI, and organizations with high levels of shadow AI paid an average of US$670,000 more per breach.
Strategy (CEO and board) But understanding the upside of AI is absolutely critical as well, because lower top and bottom lines are the risk of moving too slowly. BCG's 2026 survey found its "future-built" companies, 7.5% of those surveyed, delivering 2.4 times the revenue growth and 2.8 times the EBITDA growth of laggards. That is a correlation from a consultancy survey and not proof that AI caused it, and BCG's own figure for companies getting substantial value was 5% a year earlier, so these numbers move quickly.
A board will still hear those numbers whenever someone suggests slowing down, and they sit against the failure rates above. Shadow AI, noted under Security above, also represents an efficiency gain for employees that cannot be ignored. And it's this holistic view, balancing threats to business outcomes across the entire ownership spectrum against the benefits that come when enterprises adopt AI right, that we couldn't find a good model built around. So we decided to build one.
The Business Outcome Risk Analysis for Enterprise AI (BORA-EAI) model starts from that holistic view. Instead of asking what could go wrong with a particular system, it asks what the proposed use case for AI is for the business and who would answer for it. A coding assistant, a customer-facing chatbot, and an AI feature a vendor quietly switched on inside software you already own are three different use cases. Even though they might run on the same underlying model, they differ because of who uses them, what data they touch, what they are allowed to do, and which executive carries the consequence. That makes the use case the unit of analysis, since it is also the thing an executive actually funds, approves or declines.
We are currently sharing a high-level description of BORA-EAI for review, with a draft in our Generative Security GitHub BORA-EAI repository.
BORA-EAI takes each use case and runs it through a set of layers that establish governance and ownership; possible threats of misuse, abuse, and technical attacks; and then assigns the right owners. From here, we look at potential losses based on these malicious or unexpected outcomes, the benefits and value derived from the use of AI, the cost of governance, and balance it against the potential benefits and the organization's risk appetite. This provides a general idea of the expected value of the AI use, with the chance of failure and the cost of operating all factored in.
Balancing loss against benefit in BORA-EAI is deliberate, and it is not a new idea. ISO 31000 defines risk as the effect of uncertainty on objectives, and that effect can be positive as well as negative. The NIST AI RMF likewise asks organizations to document an AI system's potential benefits as well as the potential costs of its errors, including non-monetary ones. The consequence is that declining to deploy shows up in BORA-EAI as a cost and not as a safe default, and a use case can fall short of expectations because it never delivers just as easily as because it gets attacked. What we could not find was that principle applied use case by use case across all of the owners.
BORA-EAI also doesn't review every use case through one lens. An internal use case, such as a coding assistant or a copilot over company data, is mostly about permissions, data exposure, and whether the productivity gain is real for the people using it. A customer-facing chatbot is mostly about what it may say or offer, who is liable when it gets that wrong, and what revenue it protects or puts at risk, which is the territory of the Air Canada and DPD cases above. Applying one lens to both would misclassify one of them, so BORA-EAI deliberately looks harder at any use case that touches regulated personal data or speaks for the company to its customers.
Not every exposure arrives with a price tag, either. Air Canada's loss was small in dollars and the precedent was the real cost, and reputation, customer trust, and sovereignty exposure resist clean quantification. That's why BORA-EAI matches its depth of analysis to the stakes, with a fast lane for uses that match a pre-approved pattern, a qualitative screen for lower-risk uses, and quantified ranges for the ones that warrant it.
The benefit side gets the same care as the loss side in BORA-EAI, because the evidence says it is a range and not a single figure. In the best-known study of AI in customer support, covering 5,179 agents, productivity rose about 14% on average, about 34% for novices, and very little for the most experienced agents. In a field experiment with BCG consultants, AI improved the work on tasks inside its capability and made people 19 percentage points less likely to reach the correct answer on a task outside it.
Developer studies have moved in both directions: METR's 2025 trial found experienced open-source developers 19% slower, while its 2026 update says developers are probably more sped up now than they were then, although METR describes its own data as very weak evidence of how much. For that reason BORA-EAI treats the benefit of a use case as depending on who uses the tool and for what, and not as a single figure from a vendor slide.
We looked for an existing model that takes BORA-EAI's holistic approach at the business level, and while we didn't find a complete one, we did find several that earn partial credit. FAIR-AIR quantifies loss, but only loss. The CSA's capabilities-based risk assessment tiers a system by autonomy and impact, AWS's generative AI and agentic AI scoping matrices sort systems by how much of the stack you control and how much autonomy they have, and NIST's draft Cyber AI Profile maps AI security onto the Cybersecurity Framework.
Several others cover pieces BORA-EAI also needs. Huwyler's taxonomy, MIT's AI Risk Repository, the Geneva Association's insurer view of GenAI risk, and NIST's generative AI profile enumerate negative impacts. ISO 42001, the NIST AI RMF, and COSO say what to govern.
But we found gaps in all of these models, and these are the ones BORA-EAI is designed to address: the risks of embedded AI in COTS products, the impact of social engineering on a chatbot's commercial logic (as opposed to hacking it), the opportunity cost of both lost revenue for business units and forgone efficiency gains in back-office functions like HR and IT, the cost of internal governance, and the impact of data sovereignty across deployment models.
The closest anything came was ISO 42001 and the NIST AI RMF. Both tell you to weigh opportunities and benefits against risks and costs, but they don't get into what the AI-specific business scenarios are, who owns them, or how to quantify them for business benefits and outcomes, and that is where BORA-EAI picks up. Of course, we might have missed some models, so if you know of more please share them with us at questions@generativesecurity.ai.
For security teams, we think BORA-EAI points to a role that is bigger than the technical controls and different from owning every risk. Most pictures in the puzzle belong to someone else, but security is essential in lining them up. We have the experience to maintain a register of AI use cases with a named owner for each, to run a regular review, and to translate the results into the enterprise risk standards the other owners already use, such as ISO 23894 and ISO 42001. After all, compliance with ISO standards is something we've been doing for a while now.
BORA-EAI is a work in progress available on GitHub, and its new parts have not been validated, so we want your help testing it. Read the one-page summary and email your comments to questions@generativesecurity.ai. Tell us whether it makes sense to the executives it's meant for, where it falls short, and which references we've missed.
About the author
Michael Wasielewski is the founder and lead of Generative Security. With 20+ years of experience in networking, security, cloud, and enterprise architecture Michael brings a unique perspective to new technologies. Working on generative AI security for the past 3 years, Michael connects the dots between the organizational, the technical, and the business impacts of generative AI security. Michael looks forward to spending more time golfing, swimming in the ocean, and skydiving... someday.
