# AI Governance: Tech Problems Without Tech Solutions

AI is a technology problem without a technology solution. Guiding leadership principles for governing AI adoption and managing its risks safely.

Author: [Alex Sharpe](https://www.ians.com/faculty/alex-sharpe) 5 min read February 15, 2024

This piece is part of our ‘Faculty Focus’ series, an interview-style article where a member of the IANS Faculty shares firsthand, practitioner-based insights on an infosec topic. In this feature [Alex Sharpe](https://www.ians.com/faculty/alex-sharpe) discusses common AI adoption challenges for organizations and provides guiding principles to craft AI governance strategy.

## AI Governance Q&A with IANS Faculty member, Alex Sharpe

[Alex Sharpe](https://www.ians.com/faculty/alex-sharpe) *is a long time Cybersecurity and Privacy expert (+30 years) with real world operational experience. He has spent much of his career helping large corporations and government agencies reap the rewards afforded by advances in technology like digital transformation.*

*He began his career at NSA moving into the Management Consulting ranks building practices at Booz Allen and KPMG. He subsequently co-founded two firms including successful exits. He has participated in over 20 M&A transactions and has subsequently delivered to clients in over 20 countries on 6 continents. Alex holds degrees in Electrical Engineering, Management and Business from New Jersey Institute of Technology (NJIT), Johns Hopkins University (JHU) and Columbia Business School. He is a published author, speaker, instructor and advisor. He serves on industry forums and is a mentor at an incubator.*

AI can be a powerful tool for organizations, but governance policy on org use must be carefully managed to ensure it does not lead to unintended consequences.

AI as we know it today has been around for about 70 years. Alan Turing wrote his seminal paper, [“Computing Machinery and Intelligence,”](https://en.wikipedia.org/wiki/Computing_Machinery_and_Intelligence) in 1950. Arthur Samuel, in 1955, developed a program to play checkers. That same year, he held a workshop at Dartmouth on “Artificial Intelligence.” Widely regarded as the first use of the term.

Why suddenly has AI become all the rage, and how do I, as a business leader, fold it into my strategy?

The answer is simple, but the execution takes time. AI is driven by data – large amounts of data. We have more data today than we ever had before. Current estimates show we produce about 2.5 quintillion bytes of data every day. That is 2.5, followed by 18 zeros. The cost to create, store, and process that data has decreased dramatically. The average person has more computing power in their watch than we had to land on the moon. To give you a sense of how much data is required, ChatGPT, the most widely recognized product name in AI, is reported to have required the equivalent of 10,000 years of continuous conversations to train the model.

AI is a technology problem without a technology solution. The ability to reap the rewards of AI safely and security requires the cooperation of technology, people, processes, and the organization. It requires us to take a holistic approach up and down and across the organizational chart. It also requires public/ private partnerships along with active engagement across industries.

AI is following a very familiar path towards adoption, as we have seen with other disruptive technologies throughout time similar to when the internet was first introduced.

When it comes to [managing risk](https://www.ians.com/blog/8-ways-to-mitigate-chatgpt-and-generative-ai-risks), Dr. A. Prabhakar, Director of the Office of Science and Technology Policy (OSTP) and the former Director of the Defense Advanced Research Projects Agency (DARPA), said it best:

> “When we look at what’s happening with AI, we see something very powerful, but we also see the technology that is still quite limited. The problem is that when it’s wrong, it’s wrong in ways that no human would ever be.”

With this in mind, we can list some guiding principles to craft our AI Governance strategy. We do not have enough room to explore these here, but we can introduce the principles.

## AI Adoption Guidance for Leadership

### The Genie Is Out of the Bottle, Embrace It

As humans we adopt new technology at different rates and at different times in the adoption cycle. There are two critical differences with AI. First, the widespread availability of AI and AI-powered tools allows your staff to use AI whether you have sanctioned the use. Second, recent studies show that 75% of respondents want to know your AI policy before entering into business.

### If It Is Not a Good Idea, It Is a Worse Idea With AI

It also sounds obvious. The news is full of incidents where an employee uploads sensitive information to an AI tool or relies on the output from an AI tool without checking the results. We have seen this before when other technologies, like when social media, first appeared. At some point, every organization will want an Acceptable Use Policy (AUP) for AI. That can take a while. In the near term, you will want to communicate the broad strokes to the staff. Executive communication from senior leadership is the best way to go. In parallel, fold AI into your security training & awareness programs.

The same communication is a perfect opportunity to engage the staff. Please encourage them to share ideas and suggestions for use cases. Ask for their suggestions for the safety and security of AI. Whichever AI policy path you choose, be sure to address AI:

- Uses that are prohibited
- Uses that are permitted with some restrictions; and
- Uses that are generally permitted without any restrictions

### Create an AI Sandbox

Create a safe place to explore, learn, and experiment without doing any damage. We are in the early stages of reaping the rewards afforded by Artificial Intelligence (AI). The idea is to foster creativity without worrying about making mistakes; try, fail, build, and destroy. Establishing room for creative muscles to develop and explore is essential to building problem-solving, cooperation, and ideation skills. While exploring ways to unlock value, be sure to explore ways to ensure safety and security using the dimensions of people, process, technology, and the organization.

### AI Testing Strategy: Crawl, Walk, Run

To paraphrase Dr. Prabhakar’s quote, when AI fails, it fails in ways a human never would. The sandbox limits the damage by controlling the blast radius as you explore, experiment, and create. Be sure to think two steps ahead. As something you are working on starts to look viable, ask yourself, how would we begin to put it into practice? Core to the strategy is keeping the human in the loop to catch those not expected fails. As you build confidence over time, you can reduce the role of the human. Be mindful that while AI is a technology, the ability to ensure safety and security cannot be achieved solely through technical controls.

### Not All AI Is Created Equal

Most people hear AI and think ChatGPT. ChatGPT is one example of a subcategory called Large Language Models (LLM). AI, as it exists today, is mainly single-use. AI applications rarely perform more than one task. When looking at the role of AI in your strategy, you have many potential touchpoints. No single class of AI will get you where you want to go. Unfortunately, a single taxonomy does not exist across the industry.

Although reasonable efforts will be made to ensure the completeness and accuracy of the information contained in our News & blog posts, no liability can be accepted by IANS or our Faculty members for the results of any actions taken by individuals or firms in connection with such information, opinions, or advice.

Share this article

About the author

[![Headshot of Alex Sharpe](https://www.ians.com/_astro/alex-sharpe.BJhMD6nY_Z1cR8Ho.webp)](https://www.ians.com/faculty/alex-sharpe)

## [Alex Sharpe](https://www.ians.com/faculty/alex-sharpe)

IANS Faculty

Mr. Sharpe is a long-time (+30 years) Cybersecurity, Governance, and Digital Transformation expert with real-world operational experience. Mr. Sharpe has run business units and has influenced national policy. He has spent much of his career helping corporations and government agencies create value while mitigating cyber risk. This gives him a pragmatic understanding of the delicate balance between Business realities, Cybersecurity, and Operational Effectiveness. He began his career at NSA, moving into the Management Consulting ranks building practices at Booz Allen and KPMG. He subsequently co-founded two firms with successful exits, including the Hackett Group (NASDAQ HCKT). He has participated in over 25 M&A transactions. He has delivered to clients in almost 30 countries on 6 continents. Alex is one of the few who has been part of executive teams, has run business units, and served as a CIO and as a CISO.

[View full profile](https://www.ians.com/faculty/alex-sharpe)

## Frequently asked questions

Why is AI called a technology problem without a technology solution?

Reaping the rewards of AI safely and securely takes more than tools. It requires cooperation across technology, people, processes, and the organization, plus public and private partnerships and active engagement across industries. Technical controls alone cannot ensure safety and security.

Why can't organizations simply ban employees from using AI?

The genie is out of the bottle. AI and AI-powered tools are so widely available that staff can use them whether or not leadership has sanctioned it. Rather than trying to block use outright, leaders should communicate clear expectations and fold AI into security training and awareness programs.

What is an AI sandbox and why does it help?

An AI sandbox is a safe place to explore, learn, and experiment without doing any damage. It lets teams try, fail, build, and destroy while controlling the blast radius, which fosters the creativity, cooperation, and problem-solving skills needed to unlock value safely.

How should leaders test and deploy AI responsibly?

Take a crawl, walk, run approach. Start in a sandbox to limit the damage, think two steps ahead about how a viable idea would work in practice, and keep a human in the loop to catch the unexpected failures AI produces. Reduce the human role only as confidence grows over time.

Is all AI the same?

No. Most people equate AI with ChatGPT, but ChatGPT is just one example of a subcategory called Large Language Models. AI today is mainly single-use, so applications rarely perform more than one task. No single class of AI will meet every need, and a single industry taxonomy does not yet exist.

Vendor evaluations

Peer benchmark data

Expert answers

Compliance mapping

Program guidance

Threat intelligence

Templates & tools

Technical deep dives

Emerging tech signals

IANSMCP

Claude

Copilot

![ChatGPT](https://www.ians.com/icons/llms/chat-gpt-logo.svg)

Coming soon

Everything the IANS MCP server draws on

- Vendor evaluations
- Peer benchmark data
- Expert answers
- Compliance mapping
- Program guidance
- Threat intelligence
- Templates & tools
- Technical deep dives
- Emerging tech signals

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Still have questions? Ask IANS in your AI tool

IANS MCP brings practitioner- and peer-validated security intelligence into every AI answer, cited and delivered right to the AI tool you already use.

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Still have questions? Ask IANS in your AI tool

IANS MCP brings practitioner- and peer-validated security intelligence into every AI answer, cited and delivered right to the AI tool you already use.

[Explore IANS MCP](https://www.ians.com/mcp-server)

## Further Reading

[Browse all articles](https://www.ians.com/blog)

[AI Is Reshaping the Security Org Chart New benchmark data shows how security teams are structured and how AI is changing leadership roles and accountability. Findings are split by company revenue. Oct 19, 20261 min read Read more](https://www.ians.com/blog/ai-is-reshaping-the-security-org-chart) [How Security Organizations Are Evolving: 5 Key Findings for CISOs Explore five findings from the 2026 IANS and Artico Search report on security staffing, leadership roles, AI security, and outsourcing, by company size. Oct 19, 20265 min read Read more](https://www.ians.com/blog/how-security-organizations-are-evolving-5-key-findings-for-cisos) [Managing AI Risk Today Won't Fully Prepare You for Tomorrow AI security controls aren't enough. New CISO data shows what separates organizations managing today's risks from those ready for what comes next. Sep 10, 20264 min read Read more](https://www.ians.com/blog/managing-ai-risk-today-wont-fully-prepare-you-for-tomorrow)