Why CIOs Are Shifting Away From Experimental IT Spend

A Chief Data Officer at a mid-cap logistics firm I advise was showcasing an AI tool designed to optimize container stacking. The other business executives were enamored with the sleek interface and the promise of a few points of efficiency gain. Meanwhile, a few floors below, a dormant script—likely purchased for a few hundred bucks on the dark-web—was quietly enumerating the firm’s unpatched endpoints. By the time the CDO reached the final slide, the script had identified a two-year-old vulnerability on a remote contractor’s laptop. The “shiny” experimental project was still in beta; the breach, however, was already in production.

This tension exemplifies the current conundrum in IT spending. The honeymoon phase with experimental AI and speculative “moonshots” is cooling, replaced by a pragmatism grounded in economics and risk management. As organizations realize that a single unpatched endpoint is a liability that can neutralize any amount of innovation-driven gain, I observe that the purchasing pendulum is swinging back to core infrastructure. Specifically, CIOs more often are prioritizing endpoint management as a structural determinant of corporate survival, favoring autonomous solutions to do so.

Interest Rates on Ignorance

Organizations often treat cybersecurity as a technical hurdle, though economic evidence suggests we should characterize it as a financial constraint. A 2026 study published by Research Square finds that cybersecurity risks disclosed in earnings conference calls directly elevate corporate debt costs. Firms with higher perceived risk scores face higher default probabilities, which investors now quantify through increased interest rates on loans. In this light, an unpatched fleet of servers is a weight on the balance sheet that increases the cost of capital. Yes, technical debt is increasingly finding its way onto financial statements.

For years, executives treated patching as a routine maintenance task—a simplistic view that obscures the reality of technical debt. When data utility is hampered by downtime or the threat of encryption, the asset itself devalues. This is an anthropogenic failure. Industry analysts at HelpNetSecurity recently highlighted the specific risk of this visibility deficit: “The average enterprise device spends approximately 76 days per year outside a state where its security controls are reliably enforceable.”

The financial consequences of ignoring these foundations are becoming quantifiable. IBM research shows that organizations that ignore technical debt in their AI business cases see an ROI decline of 18% to 29%. CIOs increasingly look at agentic maturity—the ability of systems to self-remediate without human intervention—as the new benchmark for operational excellence.

Systemic Malpractice

The move away from experimental spend responds to the terrifying mathematics of modern networks. Jason Kikta, Chief Technology Officer at Automox, captures the psychological and professional weight of this new reality:

“It’s one thing to be wrong. It’s a whole other thing to be wrong at scale. If I’m wrong on an individual computer, that’s a problem. If I’m wrong on the entire network, I might get fired. If I’m wrong for a day on a backup, that’s not good. If I’m wrong for three months, that might end the company. And so that’s where people’s fears take them.”

This fear is well-founded because in a manual or semi-automated environment, the time-to-remediate is often measured in weeks or months, while attack timelines have compressed into days. The traditional “human-in-the-loop” model fails because it cannot compete with the speed of automated exploitation. To counter this, organizations must deploy systems that operate through an autonomous execution loop: perceiving the environment, deciding on a fix, and executing the patch without waiting for a ticket to be cleared. As Guy Holland, KPMG International’s CIO Center of Excellence lead, notes, organizations are moving beyond “AI roulette” and scattered bets toward embedding automation directly into workflows to scale effectively.

Machina Ex Machina

The reframing of endpoint management requires moving from reactive failover to proactive, adaptive, context-aware systems. Agentic AI involves systems that act rather than merely respond. Unlike the generative tools that dominated recent cycles, agentic systems for endpoint management prioritize “decisioning.” They utilize planning mechanisms to decompose the abstract objective of compliance into manageable subgoals, such as identifying high-risk assets and applying patches during low-usage windows.

Establishing a closed, aware control loop is the goal. When a system can mathematically prove the correctness of its security state and remediate deviations in real-time, it achieves a level of agentic maturity that manual teams cannot replicate. Stuart Hughes, Chief Digital Officer at Kerry Group, observes this strategic assumption shift: “The shift is moving from pivoting and experimenting with AI to extending and scaling, with agentic AI as a direct path to measurable ROI.” This transition is essential because the barriers to entry for attackers are vanishing quickly.

Kikta further observes the shift in the threat topography:

“The good news is that a strong compliance program prioritizing depth of coverage and speed of enforcement will hold up against AI-enabled fraud. The main threat from AI misuse isn’t faster execution, as automation has been leveraged for years. The true dangers are lower barriers to entry and faster adaptation, giving attackers the ability to pivot techniques in near real-time.”

More Cabbage To Patch With

If the true danger is faster adaptation, then the CIO’s primary duty is to build an infrastructure at least as adaptive as the threat. This requires a shift in how we value IT spend. Experimental projects are often anthropogenic in their failures; they depend on human oversight and intervention to succeed. In contrast, autonomous endpoint management aims to remove the human as the bottleneck. Filippo Rossi, CIO of AXA Switzerland, frames the necessity of this shift toward self-healing systems: “We need to move toward a more autonomous way of operating…. The complexity of the environments we are managing is increasing to a point where human-driven processes can no longer keep up.”

Organizations must decide whether they want to be a series of disconnected experiments or a cohesive, self-optimizing system. The latter requires moving resources away from the sandbox and into the in-situ environment where the actual work happens. By prioritizing solutions that deliver immediate, measurable outcomes, leaders reduce their exposure and eliminate the operational drag that accompanies manual processes.

At least as important as the technology is the shift in authorial posture within the IT department. The goal is to ensure the security needle exists in a verifiable state. As we move toward a future of agentic, self-optimizing systems, the CIO who prioritizes depth of coverage and speed of enforcement will be the one who not only survives the breach but also maintains the lowest cost of debt. The era of experimental fluff is over; the era of autonomous resilience has begun.