Cybersecurity's AI 95% problem.

Where AI is failing cyber programs today

The headline number is the same one MIT NANDA's State of AI in Business 2025^[1] reports for enterprise GenAI broadly: 95% of pilots fail to deliver measurable P&L impact. MIT names the failure modes: missing learning loops, integration gaps, governance scaffolding, and workflow adaptation. Inside cyber programs — federal and commercial — the same failure modes show up in domain-specific shapes:

• Threat-intel triage pilots stall because there's no agreed delegation boundary — when does the AI summary go to the watch floor (federal) or SOC (commercial) unreviewed, and when does it require human sign-off?
• Log-analysis copilots get shadow-banned because operators can't explain to an inspector general (federal) or a Big-4 auditor (commercial) which control objectives the model satisfies and which it doesn't.
• Identity-governance AI gets shelved when the audit team can't produce machine-readable evidence aligned to NIST 800-53, NIST AI 600-1, ISO 27001, or SR 11-7 (banking) within an audit window.
• Incident-response orchestration plateaus at PoC because the runbook can't cite the regulation that authorizes a given autonomous action — whether the controlling framework is DoD RAI, Colorado AI Act, or NYDFS Part 500.

MIT also finds that vendor-led implementations succeed roughly twice as often as internal builds — 67% vs. 33%^[1]. For any cyber program running internal AI builds without a governance partner, that ratio compounds the 95% failure rate. The cost isn't just wasted budget. It's audit deficiency, regulator exposure, and — for federal agencies — erosion of authorization to operate AI at all; for commercial enterprises, board-level risk and potential fines under cross-border regimes.

What good AI could look like for cyber programs — by role and task

Imagine the same cyber program — federal or commercial — with the governance scaffolding in place. The AI doesn't change. It's the same large language models, the same agent frameworks, the same automation primitives. What changes is that every workflow has a documented delegation ceiling, a regulatory citation chain, and machine-readable audit evidence on the back end. Three roles, the workflows each could run:

The non-negotiable — governance is the bottleneck

None of the role-by-role workflows above are possible without disciplined governance underneath. And neither federal nor commercial cyber programs have the option to defer the governance work. The regulatory floor solidified between January 2023 and August 2024, with parallel mandates on both sides:

• OMB Memorandum M-24-10 (March 2024)^[2] — requires every federal agency to designate a Chief AI Officer, stand up an AI Governance Board, and maintain a public AI use-case inventory. Binding policy.
• NIST AI Risk Management Framework 1.0 (January 2023)^[4] + AI 600-1 Generative AI Profile (July 2024)^[5] — the de facto US federal standards every agency must reference.
• DoD Responsible AI Strategy & Implementation Pathway (June 2022)^[6] — DoD-wide responsible-AI tenets with working-council enforcement.
• Colorado Artificial Intelligence Act (SB 24-205, signed May 2024, effective February 2026)^[8] — first comprehensive US state-level AI regulation; mandates impact assessments for high-risk AI systems used in consequential decisions, with state attorney-general enforcement.
• Sector-specific commercial regimes — including SR 11-7 (US bank model risk management), NYDFS Part 500 (NY financial services cybersecurity), FDA AI/ML SaMD framework (medical devices), HIPAA (health information), and Gramm-Leach-Bliley Act safeguards.

The slope is steepening, not flattening. Stanford HAI's 2025 AI Index^[7] counted 59 new US federal AI-related regulations introduced in 2024 — more than double the 25 counted in 2023. US state-level AI regulation is following the curve: Colorado leads with SB 24-205; California, New York, Texas, Connecticut, and Illinois have all introduced or passed comparable bills. Any cyber program — federal or commercial — that builds governance scaffolding once and abandons it will fall out of compliance within a quarter. What's needed is a framework engine that absorbs new standards as they emerge and produces audit-defensible deliverables in weeks, not quarters.

Introducing ARKONA + COMET

What an engagement could look like

Intrepid's COMET engagements are designed to ride a three-tier ladder. Each tier maps to the agency's stage in the governance buildout:

• Assessment (4–6 weeks). Map the organization's current AI use-case inventory against the controlling obligations — M-24-10 (federal), Colorado AI Act / NIST AI RMF (commercial), or sector-specific US regimes. Identify gaps. Deliver a baseline governance posture report with framework cross-reference.
• Delegation roadmap (12 weeks). Build the framework architecture for the organization. Produce evidence templates, delegation-ceiling decision trees, and a trained-operator handoff. Customer leaves the engagement self-sufficient.
• Strategic retainer (ongoing). For organizations in steady-state production. New use cases come in; COMET classifies them; new regulations are absorbed; audit cycles run cleanly.

About Intrepid