Council Post: Verification Debt: Why The Boardroom And The Server Room Are Fighting Two Different Wars

TK Keanini, Field CTO, DNSFilter.

getty

Here’s an experiment I’d encourage any leader to run this week: Ask your executive team whether your organization could maintain critical operations through a 72-hour cyberattack. Then, ask the people who actually run those systems.

If the answers match, congratulations! You’re in rare company.​

The Security Gap Hiding In Plain Sight​

My company recently released the results of a survey of 400 IT and cybersecurity professionals in the US and Canada, and they confirmed something I’ve observed for years in this industry. Executives and practitioners are operating from two different pictures of reality. Nearly three-quarters of executives (73.9%) believed they could sustain critical operations through a 72-hour attack. Among the IT managers running those systems day-to-day, that number dropped to 47.5%.​

That’s a significant gap between what leadership believes and what the people closest to the systems are experiencing. In my view, that gap is now the most underappreciated attack surface in the enterprise.​

Thirty-five years in cybersecurity has taught me that attackers never bother with your strongest control. They work the gap between what you believe is secured and what you’ve actually verified. Every unverified assumption is an entry point.​

When Leadership’s Picture Doesn’t Match Reality​

Nearly half of IT management (45.8%) said their organization has had security incidents that went unreported, yet only 17.4% of executives believed that was the case. The majority of IT managers admit that incident severity has been downplayed because they lacked the resources to fully remediate. If your board is making risk decisions based on the 17.4% picture while your defenders are living the 45.8% picture, an attacker doesn’t need a zero-day. All they need is to operate in the space between those two numbers.​

AI Is Widening The Gap​

AI is widening that gap. Roughly 70% of IT and network professionals we surveyed said attackers are adopting AI faster than their own teams can keep pace. Among executives, only 43% agreed, and about a quarter believed their team was actually ahead of attackers. When the people furthest from the systems are the most optimistic about them, that optimism becomes a liability. This is especially alarming, given that 40% of organizations have reported experiencing a security incident tied to a third-party SaaS or AI tool in the past 12 months. ​

The Rise Of Verification Debt​

Every technology leader knows the concept of technical debt. I’d argue organizations are now carrying “verification debt,” the accumulating gap between perceived security posture and operational reality.​

Like technical debt, verification debt compounds very subtly. Every downplayed incident, every unreported near-miss, every AI tool connected before IT is notified adds to the balance. Like technical debt, it doesn’t announce itself. Instead, the bill arrives during an incident, when the continuity plan the board believed in turns out to be just a well-written slide without any substance.​

Why More Spending Isn’t Enough​

Here’s what makes this moment different: Money alone isn’t paying it down. In our research, roughly three-quarters of organizations increased security budgets over the past year, and AI governance was simultaneously flagged as the largest security gap and the top investment priority. The spending is going to the right category, yet the gap remains. Notably, some of the most mature, best-resourced organizations reported the highest rates of shadow AI incidents. Governance maturity and actual safety, it turns out, are two different things.​

So, how do leaders close a gap that the budget alone won’t fix? Based on my experience, I’d start with three disciplines.​

1. Instrument Reality, Not Sentiment

Verification should be earned from telemetry, not asserted in a corporate deck. If executives believe new AI tools require admin approval before access (as 73.9% in our survey did) while practitioners report notification often happens after access is granted, or not at all, then the policy exists on paper and not on the network.

Audit the actual sequence of events: discovery, approval, connection. Every AI agent and integration is a machine identity, and it deserves the same authentication, authorization and audit discipline you’d apply to any other identity on your network.

If you can’t produce an audit trail of what an AI tool accessed last week, then you don’t have governance, you have a document.

2. Create Safe Channels For Bad News

When half of your IT management says incidents go unreported, that’s not a technology failure. It’s a cultural one. Practitioners downplay incidents when the incentive structure punishes visibility.

Leaders should treat an increase in reported incidents as a sign of improved detection and honesty, rather than deteriorating security. The organizations I’ve seen handle this best make “we found something” a rewarded behavior at every level.

3. Govern The AI Surface You Have, Not The One You Recognize

In our survey, executives overwhelmingly flagged the household-name model as their top AI risk, while practitioners tracked a much wider surface of lesser-known models and tools.

Attackers don’t limit themselves to the brands your board has heard of. Your inventory, your policies and your blocking decisions need to cover the full landscape of AI connections that touch your environment, including those nobody asked permission to install.​

The Bottom Line​

Verification debt is seductive because, right up until the incident, it feels free. The board sleeps well, the budget conversations go smoothly, and the dashboards stay green. But you cannot defend a network you’re only imagining.

The organizations that will fare best in the AI era aren’t the ones with the most verification. They’re the ones where the boardroom’s picture of reality and the server room’s picture of reality are the same picture.

Close that gap first, since everything else you invest in depends on it.​

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?