Enterprise AI Adoption Is Entering Its Second Phase

Ido Geffen, CEO and Co-founder, Novee Security.

​Only a year or two ago, companies were still experimenting with AI and what kind of useful work it could do. They were testing whether it could write the necessary code, find security issues and reduce manual work. The measured, cautious adoption fits the usual enterprise pattern: mid-market companies tend to act more bullishly toward new technology (think cloud adoption ten years ago), while slow-moving, larger enterprises take their time to catch up to new trends.​

But this year, in conversations at Black Hat, I was surprised by how aggressively some large enterprises were pushing to more formally operationalize AI. They have more at stake to “get AI right.” Boards and shareholders expect progress, while security teams still have to manage the risks.​

For many enterprises, the question of capability has been answered. Now they have to determine whether AI can work safely, affordably and repeatedly.

That shift becomes especially important when AI moves into security. Enterprises are already spending heavily on AI to speed development and automate knowledge work, with security accounting for a smaller share of that spend. But security introduces its own economic pressures, especially when AI moves from a limited pilot into an always-on function where poor output still requires human review.

Capability Is No Longer The Bottleneck

Cost is one of the first constraints security teams encounter at scale. Frontier models don’t look all that expensive at face value, but once the workload runs continuously at that scale, the program costs add up. Things like continuous pentesting can consume enormous amounts of inference while false positives create downstream validation costs. Expensive output is still a waste if humans have to spend hours proving whether it matters.​