AI is spreading through companies faster than the knowledge to use the technology safely. People with the right training and knowledge are the solution, though not all organizations will acquire them in time.
Companies are rolling out AI at a rapid pace, and the people tasked with securing, auditing, and governing it cannot keep up. This is the common thread throughout conversations and sessions at the ISACA Europe conference in Munich. And that scenario describes the best-case case, where organizations even realize that security, governance, and audits matter at all.
Proliferation without returns
Erik Prusch, CEO of ISACA, sees AI penetrating organizations at record speed. “Within eighteen months of its emergence, we saw AI everywhere in an organization,” he says in a conversation with ITdaily. “We have never seen a technology adopted so quickly. Trillions of dollars are now flowing into data centers, language models, and AI agents.” To Prusch’s dismay, the emphasis is currently on revenue and efficiency, with far less focus on controlled growth.
We have never seen a technology adopted so quickly.
Erik Prusch, CEO ISACA
What all those investments are actually delivering is less clear. The return on investment (ROI) for AI today is “very vague,” agrees Chris Dimitriadis, Chief Global Strategy Officer at ISACA. Often, data is not ready or processes have not been adapted. “Many companies are moving very fast just because the competition is doing it, so they can say they are using AI,” he observes.
This is a sentiment that recurs regularly. For instance, Steven Vindevogel, Head of Panasonic Toughbook Europe, recently told us that companies definitely want AI-capable laptops and want to ‘do something’ with AI, and then proceed to ask Panasonic what that ‘something’ should actually be. In roundtable discussions organized by ITdaily, experts also confirm that the urge to do ‘something,’ combined with the fear of doing ‘nothing,’ is sometimes powerful. With the right guidance, it is usually possible to deploy the technology effectively.
No off switch
Consequently, AI is being implemented everywhere. Few companies are thinking about a way to turn it off again. Earlier this year, Prusch told ITdaily that barely ten percent of companies have a tested kill switch. “A kill switch is also a matter of resilience. You must be able to restart the system in a controlled manner,” he says. “No progress has been made there yet.”
Furthermore, a single switch does not exist, as companies use multiple models in different ways, often outside the CISO’s view. “If AI is embedded in an application used by the marketing or sales team, the attack vectors multiply at an alarming rate. Do you really reach all systems when you flip the switch?” According to Prusch, this requires an inventory of all AI, what it touches, and what controls are in place.
He recalls the ERP implementations of the late 1990s. When those failed, production sometimes ground to a halt for months. “That was one specific system. AI is everywhere in an enterprise and spreads rapidly across multiple systems. Organizations often don’t even know how many systems are involved.”
Knowledge dates quickly
“You cannot protect what you do not understand,” Dimitriadis adds. He states that there is currently a shortage of approximately 300,000 cybersecurity professionals in Europe. According to Dimitriadis, that gap will only grow, including in the types of skills required. “A country might have 100,000 cybersecurity professionals. That gap can widen quickly, not because people disappear, but because their knowledge becomes obsolete fast as digital ecosystems change.”
You cannot protect what you do not understand.
Chris Dimitriadis, Chief Global Strategy Officer ISACA
Julia Hermann, who provides infrastructure for AI models at the Munich-based security firm Giesecke+Devrient and served on the board of ISACA Germany for seven years, sees companies getting into trouble. They are not hiring extra staff and are putting the pressure on existing personnel. “You want to upskill people because you don’t want to expand your workforce. At the same time, the training budget is being cut.”
Four AI certificates and a maturity model
ISACA is looking for the solution in training, certification, and frameworks. When Prusch took office in 2023, the association primarily had white papers and research regarding AI. Today, there are three AI certificates: AAIA for IT audit, AAISM for security management, and AAIR for risk management. The first two build on the well-known CISA and CISM certifications. A fourth, for AI governance, is in development.
In June, ISACA also launched CMMI-AIM. This is an AI maturity model that builds on the 30-year-old CMMI. Companies use it to assess the maturity of their AI approach, from ROI to the question of how to audit an AI agent. In the EU, the model is linked to the AI Act.
New certificates are not enough; existing ones must also keep pace faster. “In the past, it took us five years or more to update some certifications. We no longer have that luxury,” says Prusch. Updating on an annual basis may sometimes be the bare minimum.
According to Dimitriadis, the adoption of AI certifications is growing rapidly, especially in countries where AI is most advanced, such as the US, Europe, and several Asian countries. ISACA itself has been growing in membership, revenue, and profit since 2023, says Prusch.
It all starts with people
For ISACA, certificates and frameworks must ultimately lead to people with sufficient knowledge. “Even though AI is changing the world we live in, I still believe that everything starts with people,” says Dimitriadis. “If they are well-trained for their current and future professions, they will make the right decisions.” For him, digital sovereignty also begins with having well-trained European professionals.
Prusch advocates for directors who understand AI and their own company’s vulnerabilities, and for a workforce trained in AI. In his view, IT auditors and security professionals are best positioned because they have long worked with IT controls.
AI is outpacing training
Prusch does not dare to hope that everyone will be ready in time. “I have no doubt that AI is evolving and penetrating faster than people can be trained. Employees are not being trained fast enough, and frameworks are not being adapted quickly enough.”
I see the trillions for new data centers and the budgets for language models and agents. I do not yet see the large sums for cybersecurity, IT audit, risk, and governance.
Erik Prusch, CEO ISACA
IT specialists today may need to upskill ten times faster than they did when the cloud arrived, Prusch suspects. “Back then, we had time to think and apply knowledge. We don’t have that time now.”
According to Prusch, the money is also primarily going toward the technology itself. “I see the trillions for new data centers and the budgets for language models and agents. I do not yet see the large sums for cybersecurity, IT audit, risk, and governance.”
Two scenarios at once
Is Prusch, as CEO of ISACA, an optimist or a pessimist regarding the future? “Optimist,” he says, but with some nuance. “Positive and negative scenarios are not mutually exclusive.” He sees AI having both a positive and a negative impact in the future.
ISACA members are already following their own training paths and will help lead organizations, which gives Prusch confidence, as those organizations will integrate AI in a secure manner. “I am also certain that there will be very serious problems with catastrophic consequences for companies and even for governments,” he adds.
In both scenarios, profiles with expertise become highly sought-after experts. Prusch has big ambitions for ISACA: “The greatest leaders in the AI era will come from our membership.” He therefore wants governments to do more to accelerate the retraining of workers. The message is clear; whether it will be received en masse by companies and governments so that they allocate the necessary funds before drama strikes is more doubtful.