1. The AI bill comes due: budgets, caps and cost per run

TechTarget · Business Standard (Bloomberg) · CIO · November 2–6, 2026

Gartner’s Daryl Plummer told TechTarget’s Amanda Hetler that AI spending among IT executives has risen 18-fold in two years, and Gartner forecasts global IT spending will grow almost 15% to $7.35 trillion in 2027. The pressure runs both ways: in Gartner’s CIO survey 58% say they are under more pressure to cut costs through AI, while 51% expect AI to raise total technology costs, and 44% of CEOs struggle to show investors a return. Usage escapes budgets quickly. Principal Financial Group licensed one AI tool for 2,000 of its 20,000 employees and now has 10,000 users. Celigo logs the cost of every agentic workflow run in its data warehouse so it knows the cost per execution. “We are in a period of AI inflation during a trust recession,” Plummer said.

At Forrester’s Technology & Innovation Forum East, principal analyst Kevin Ogunsua heard from an attendee whose surprise OpenAI invoice for one month roughly matched what the organisation normally spent in a year. Forrester expects AI to make up 20% of business technology spending in 2027. Ogunsua’s prescription is to put agents on a budget: cap the data sent to a model, cap model calls per workflow and cap how many other agents a workflow can enlist. He also suggests a funding check before AI spend is approved, and a single accountable owner for each AI project with quarterly milestones. “You don’t know what your bill is going to be like. So it becomes very hard to budget,” he said.

Large employers are already setting per-person limits. Bloomberg, republished by Business Standard, reports that Apple lowered some engineers’ daily AI allowance from $300 to $200 last month and may take some teams to $100; many non-engineering groups are already at $100 and $25 has been considered for some. Tesla reportedly limits employees to $200 a week and Uber caps individual AI coding tools at $1,500 a month. In a CIO opinion piece, Enrique Camacho of eSource Capital Group describes a customer that burned 18% of its annual infrastructure commitment on AI tokens over one weekend, and argues for separating fast-changing AI contracts from stable SaaS and infrastructure deals. For a CISO the overlap is direct: the controls that cap spend, such as scoped keys, per-agent limits and cost alerts, are also the controls that reveal misuse.

Sources: TechTarget (AI spending is up 18x: How IT leaders are ma…) · TechTarget (AI spending horror show? Put agents on a bud…) · Business Standard (Bloomberg) (Apple lowers internal AI usage budgets in mo…) · CIO (In the era of AI, we are all buying technolo…)

2. LLMjacking: $100,000 a day for AI nobody ordered

CSO Online · November 3, 2026

CSO’s Shweta Sharma reports on research from the Google Threat Intelligence Group into LLMjacking, in which attackers hijack an organisation’s cloud or model access and resell it through underground subscription services. Fraudulent charges can exceed $100,000 in a single day, and in some 2026 incidents across North America, South America and Asia Pacific the total reached $1 million before victims revoked access.

The operations are organised. The group tracked as UNC6993 used open tools to pool stolen keys and spread requests across accounts. One token-routing service, Jet Night, made more than 500,000 model API calls in under eight hours on stolen third-party keys, passing nearly $1 million in costs to one victim while advertising unlimited frontier-model access for about $60 a month. Attackers test stolen keys with single-token requests that stay below normal consumption alerts, and a follow-on actor exploited a flaw in a LiteLLM gateway, CVE-2026-40217, to turn ordinary virtual keys into admin credentials. “Testing a stolen key with a single-token request barely registers as consumption,” said Nick Tausek of Swimlane.

Google’s recommendations are basic hygiene applied to a new meter: tighter credential management, least-privilege permissions, narrowly scoped API keys, monitoring for low-volume suspicious requests and hard spending limits on model use. For boards that are already asking about AI cost, LLMjacking is a useful way to show that cost control and security control are the same project.

Sources: CSO Online (Enterprises pay $100,000 a day for AI they n…)

3. AI risk moves into the strategy deck, and shadow AI is already inside

Gartner · Cybersecurity Dive · Infosecurity Magazine · TechTarget · November 2–6, 2026

Gartner’s Quarterly Emerging Risk Report for the third quarter surveyed 308 enterprise risk leaders, auditors and senior executives. Two new risks enter the top five: AI strategy miscalculation at No. 3, meaning investing too aggressively, picking unsuitable use cases or moving before the organisation is ready, and AI-driven competitive displacement at No. 4. The AI workforce preparedness gap is fifth, and AI discovery of cyber vulnerabilities holds the top spot for a second quarter, ahead of energy supply shocks. Gartner flags strategy miscalculation and the workforce gap as blind spots that score high but get little attention. “AI risk is moving beyond technology and governance concerns into the core of enterprise strategy,” said Gartner’s Kevin Mercado.

Three vendor surveys show where the gaps are. DNSFilter, reported by Cybersecurity Dive’s Eric Geller, polled 400 IT and security workers: three-quarters had bigger budgets this year and four in ten would put the next dollar into AI security and governance, yet 46% are confident unapproved AI apps are connected to their systems, a fifth say such an integration caused an incident and 37% only learn about new AI connections after the fact. “Governance spending is not the same as governance,” the report warns. BlackFog’s research, reported by Infosecurity’s James Coker, found 47% of security leaders have had sensitive data exposed through an AI tool, and 77% of those incidents involved an approved tool. Almost all (98%) have an AI usage policy but only 56% back it with technical controls, and 56% say autonomous agents fall outside their existing controls.

Dave Shackleford’s guidance for TechTarget turns that into a SaaS checklist: extend inventories to embedded AI features, agents, OAuth integrations and the non-human identities behind them; give agents narrow, short-lived access under their own identities; and assign every AI-enabled service a named owner, data classification and acceptable level of autonomy. “The CISO’s goal is to make sanctioned AI easier to use safely than unsanctioned AI,” he writes.

Sources: Gartner (Gartner Survey Finds Two New AI-Related Risk…) · Cybersecurity Dive (Companies spend more on cybersecurity but st…) · Infosecurity Magazine (Half of Security Leaders Report Sensitive Da…) · TechTarget (What CISOs should know about SaaS security i…)

4. What does “normal” look like for an AI agent?

Cybersecurity Dive · CIO · TechTarget · November 2–6, 2026

A report from Abnormal AI, covered by Cybersecurity Dive’s Eric Geller, surveyed 525 security professionals at organisations with at least 1,000 employees in six countries; about 85% were CISOs or security operations leaders. Forty-six percent say they cannot set secure reference points for agent behaviour, and 53% have no baselines for machine identities, including agents. More than 40% of organisations using behavioural monitoring already point it at agents, more than for any other technology. The biggest obstacles are trust, defining normal behaviour and false-positive volume, ahead of staffing, budget or tools.

Adoption is moving faster than confidence. CIO’s Grant Gross cites a KPMG survey in which 62% of IT leaders were building or deploying agents, up from 53% a quarter earlier. Barracuda’s CIO runs about 2,000 agents with humans still checking their actions, and an energy-switching start-up keeps customers approving any change before it takes effect. “The consequences of a mistake should determine how much evidence you need before giving an agent more authority,” said Barracuda CIO Siroui Mushegian.

A vendor-authored TechTarget guide sets out four controls for agents employees build themselves: start with no default privileges and require approval for moving money, deleting data or sending data outside; give each agent its own identity; tie every connection to a stated business purpose; and provide approved tools so the safe route is also the fastest. A CIO feature on 2027 agendas adds a governance point: Celigo’s CIO wants vendor agents held to the same standard as any integration, as California and Colorado rules on automated decisions take effect in January. “‘The vendor’s agent did it’ is not a defensible answer,” she said.

Sources: Cybersecurity Dive (Companies struggle to know what normal looks…) · CIO (AI agent autonomy remains an elusive work in…) · TechTarget (4 steps to govern employee-built AI agents f…) · CIO (13 key questions shaping CIOs’ 2027 IT agend…)

5. Who is accountable? NIS2 boards and the CISO liability question

Security Affairs · Infosecurity Magazine · November 3–6, 2026

Security Affairs walks through what NIS2 asks of directors. Article 20 requires the management bodies of essential and important entities to approve cyber risk-management measures, oversee their implementation and undergo cybersecurity training, and lets them be held liable under national law. Article 21 lists the measures, including access-control policies, asset management and multi-factor or continuous authentication where appropriate. Fines reach at least €10 million or 2% of global turnover for essential entities and €7 million or 1.4% for important ones. Under Article 32 authorities can, in specific circumstances, temporarily bar a chief executive of an essential entity from management duties, though not automatically after an incident. Around 160,000 entities are in scope, and in July the European Commission referred four member states to the EU Court of Justice over incomplete transposition. The board’s job is governance, not administration: “Directors are not expected to decide who gets administrator rights or review individual user accounts.”

In an Infosecurity opinion piece drawing on his company’s own research, Fastly CISO Marshall Erwin points to a gap between blame and authority. Seventy-three percent of organisations say the CISO is ultimately accountable for a breach, yet only 43% say ownership of breach response is clear, and IT operations is involved in incident management more often than the security team. Ninety-four percent have changed policies on CISO liability, some to improve security and some mainly for legal protection. Organisations that call themselves AI-first fare worse: half lack clear accountability structures, recovery takes 6.8 months against 3.9, and incident costs are 135% higher. Erwin argues that boards should ask whether security leaders had the authority and resources to manage the risk. “CISOs must be held accountable for the security decisions, programs and risks within their remit,” he writes; the key words are “within their remit”.

Sources: Security Affairs (NIS2 Makes Board Members Personally Liable f…) · Infosecurity Magazine (CISO Accountability Needs an Operating Model…)

6. Stretched teams, AI-shaped skills

CSO Online · SecurityWeek · November 2–5, 2026

CSO’s John Leyden reports on a skills-gap survey of 2,000 IT and security decision-makers by Barracuda. Two-thirds (67%) say their security teams are under pressure and struggling to scale to business needs; the most common challenges are AI-related risks (68%) and identity and phishing threats (67%). Half are expected to support growing digital operations with no extra resources, and 56% report AI-linked reductions in security headcount. Other research points the same way: CSOs in Foundry’s priorities study name cloud security, agentic AI and AI-enabled technology as their top skill-building areas, Europe is short more than 300,000 security professionals, and G7 job postings requiring AI skills doubled, with senior roles up 65% against 5.9% for junior ones. “AI is changing the cybersecurity landscape faster than many security teams can build the necessary skills,” said Barracuda’s Siroui Mushegian.

SecurityWeek’s CISO Conversations profiles Ryan Davis, CISO at New Charter Technologies, a private-equity-backed group that acquires managed service providers. He argues that a CISO who cannot talk in business terms will struggle to reach executives, builds teams for complementary skills, and is candid about the burnout that came with 80- to 100-hour weeks. His top worry is shadow AI and technology nobody has told him about, so he works on visibility every day.

CSO’s feature on a strategy that survives 2027 offers practical markers: Equifax removed passwords for its 22,000 employees and contractors, 32% of organisations already use AI extensively in detection and response (63% expect to by 2027), and the median time to remediate known exploited vulnerabilities rose to 43 days from 32. “We’re not able to deal with attacks and vulnerabilities manually anymore,” said Florida State University CISO Bill Hunkapiller.

Sources: CSO Online (67% of security leaders say their teams stru…) · SecurityWeek (CISO Conversations: Ryan Davis – The Unknown…) · CSO Online (What a security strategy that survives 2027…)

7. The market correction: measure what reduces risk

SC Media · Dark Reading · OpenAI · The Motley Fool · November 2–7, 2026

At OWASP Global AppSec USA in San Francisco, Root Evidence co-founder Jeremiah Grossman told the keynote audience that the security industry is due a “market correction”, reports SC Media’s Paul Wagenseil. Cyber insurers now hold enough data on vulnerabilities, exploits and claims to see which products and methods work. Grossman’s analysis of 250,143 CVEs published between 1999 and mid-2025, excluding WordPress, found that only 3,769 (1.5%) were ever exploited and only 711 (about 0.3%) were true zero-days; insurers have told him informally that about 600 CVEs really matter. The median window between disclosure and first exploit is getting longer, not shorter; the only thing rising fast is the number of new CVEs. He sees two paths for vendors: spend heavily on AI to chase “vulnerability zero”, or fix what attackers actually use first and stand behind the result with guarantees. “You don’t buy a coffee maker on faith. Why do we buy security that way?” he asked.

A contributed Dark Reading piece makes the same case from the vulnerability-management side. Scanners differ in how they identify packages, which databases they use and how often they update, so two scanners can report different findings on the same image. The question for leaders is therefore not which scanner is best but which source of truth the organisation trusts, and how it adds context: exposure, business function and whether a flaw is realistically exploitable. SBOMs in SPDX or CycloneDX give the inventory; risk context turns it into decisions.

AI is now being used to do that work at scale. OpenAI says its last internal security sprint put 25% of its product engineers on finding and fixing weaknesses, using Codex to reproduce vulnerabilities in isolated environments and prepare patches. The next sprint brings in outside researchers from Cathedral, and OpenAI has more than quadrupled bug bounty rewards for critical findings.

Investors are also voting on where security spend goes. The Motley Fool’s review of JFrog’s third quarter highlights revenue up 31% to $179.2 million, cloud revenue up 60%, net dollar retention of 124% and a raised full-year outlook, which management linked to customers consolidating security alongside the system of record for their software and AI artifacts. For security leaders, it is a market signal that software supply chain controls are moving from an optional tool to core infrastructure.

Sources: SC Media (OWASP Global AppSec: Cybersecurity industry…) · Dark Reading (Vulnerability Scanners Aren't the Problem—Ri…) · OpenAI (Preparing our next security sprint to harden…) · The Motley Fool (Globe and Mail) (JFrog: 3 Key Takeaways for Long-Term Investo…)

8. Sharing and hardening: the information-sharing deadline and the NCSC warning

Cybersecurity Dive · Infosecurity Magazine · Nextgov/FCW · November 3–5, 2026

About three dozen business groups, including the American Bankers Association, the American Petroleum Institute, the U.S. Chamber of Commerce and USTelecom, wrote to the chairs and ranking members of the armed-services committees asking for a 10-year renewal of the Cybersecurity Information Sharing Act of 2015 in the fiscal 2027 defence authorisation bill, reports Cybersecurity Dive’s Eric Geller. The law gives companies legal protection when they share threat indicators with each other and with federal agencies. Its original 10-year term ended in 2025, and the latest short-term extension lapses on 11 December. The House draft would renew and rename the law and add AI to the topics companies can share; the Senate draft does not include a renewal. “The speed and breadth with which defenders share information determines whether they keep pace with adversaries,” the groups wrote.

In London, NCSC chief executive Richard Horne launched the agency’s annual State of the Cyber Nation report with a warning that AI-powered malware is “highly likely” to be used by financially motivated attackers against UK power stations, airports and hospitals by 2028, Infosecurity’s Kevin Poireault reports. Horne said the risk arises “not because AI has invented new ways to attack us”, but because long-tolerated weaknesses can now be exploited at scale. The NCSC has sent 110,000 proactive notifications about the PHP2Shell flaws. The government is funding a £60 million first phase of a national Cyber Shield and a £40 million National Agentic Security Unit to monitor uncontrolled AI bots, and is cutting the cost of Cyber Essentials certification by 75% for smaller firms.

In Washington, Nextgov’s Grace Dille reports that the Justice Department has formed an AI task force that absorbs its earlier AI litigation task force and will coordinate criminal and civil AI enforcement, recommend priorities and develop guidance on prosecuting unlawful AI-related conduct.

Sources: Cybersecurity Dive (AI threats create urgent need to renew cyber…) · Infosecurity Magazine (NCSC Chief Warns of AI Ransomware Threat to…) · Nextgov/FCW (Department of Justice forms AI task force)