AI Security, Risk, and Cybersecurity Priorities for 2027

The issues landing on security leaders’ desks aren’t waiting for the next planning cycle. AI capabilities are advancing, attackers are moving faster, and a single trusted identity can now open doors across an entire business.

In this candid conversation, Vinnie Liu, CEO at Bishop Fox; Justin Greis, CEO at acceligence; and Evan Wolff, Partner at Akin Gump Strauss Hauer & Feld LLP, compare notes on what’s changing, what’s being underestimated, and which decisions leaders need to make now as they head into 2027.

This quarter, they’ll dig into:

• Who gets access to advanced cyber capabilities? Programs like OpenAI’s Daybreak are testing ways to put powerful models in trusted hands with stronger safeguards. But the bigger questions around access, monitoring, accountability, and shared responsibility are far from settled.
• What are frontier AI incidents telling us? Recent disclosures from Anthropic and OpenAI offer an early look at what can happen when capable models connect to tools, data, and external systems. Enterprises should pay attention now, before they face the same problems with fewer resources and less visibility.
• Can security programs keep up? Attackers can move from access to impact in minutes. Defenders still lose hours to validation, ownership questions, and approvals. The discussion will explore how offensive testing and AI-assisted defense can help close that gap.
• What should leaders fund, fix, or kill in 2027? As budget decisions take shape, it’s time to pressure-test which investments reduce real risk, and which ones produce reassuring dashboards without proving the business can withstand an attack.

Session Summary

AI capabilities are moving faster than most organizations can keep up with. Bishop Fox CEO Vinnie Liu with Justin Greis, CEO of acceligence, and Evan Wolff, Partner at Akin Gump Strauss Hauer & Feld LLP, discuss why attackers have the edge right now and what legal, governance, and budget changes security leaders need to make heading into 2027. Their verdict: AI doesn't change the fundamentals. It forces security teams to execute them faster and at scale. The conversation covers patching at scale, orphaned AI agents, shadow AI, vendor risk, and liability. It ends with each speaker's answer to one question: what would you fund, fix, and kill in 2027?

Key Takeaways

1. AI puts pressure on security fundamentals instead of replacing them. CISOs in early-access frontier model programs said they weren't prepared to patch vulnerabilities at the volume those models detected. Patch management, identity and access management, and data protection now have to work at scale, all at once.
2. Kill the annual budget cycle. Attackers work continuously, but security teams still run on the business's quarterly and yearly cycles. Greis's advice is to expect to request out-of-band budget, tools, and skills. Any request that gets declined should be documented as risk.
3. For now, AI helps attackers more than defenders. Attackers follow a direct attack tree and can tolerate a much higher failure rate. Defenders need EDR, identity, network, and cloud tools to work together, which slows adoption. Once it has a foothold, an AI-driven attacker can read an entire IT infrastructure wiki in 30 seconds and know exactly where to go next.
4. Build around capabilities, not headcount, and invest in people. AI decouples security capability from the org chart. It can't supply leadership or judgment, which is why both guests put people first on their "fund" lists.
5. AI adoption is outpacing the guardrails. An employee builds a finance agent on a personal account, it goes into production, and then the employee leaves. Now it's an orphaned agent. Wolff's five steps for managing AI risk:
   1. Set ground rules for sensitive data.
   2. Separate approved from unapproved (shadow) AI.
   3. Fix governance.
   4. Enable technical controls.
   5. Train and audit.
6. AI liability runs on existing law: negligence is still negligence. The Computer Fraud and Abuse Act, DFARS 7012, and SEC materiality rules apply whether a human or an AI does the work. What's new is state AI regulation in California and Colorado and the EU Cyber Resilience Act. The goal isn't perfection. It's detection and a well-managed incident response.
7. Replace 300-page vendor questionnaires with clear principles. Vendors must not train models on your data and must use enterprise-grade tooling. They must also be transparent about where your data goes and how they use AI.
8. Cut the noise in vulnerability management. AI models can reverse engineer binaries and find vulnerabilities almost as well as they can with full source code, so no codebase is secure. AI-driven testing works only when findings are validated and prioritized by real risk, not by default vendor severity ratings.