5 AI Questions Leaders and Business Reporters Are Asking Our Firm Right Now, With Practical Answers

5 AI Questions Leaders and Business Reporters Are Asking Our Firm Right Now, With Practical Answers

Some of the most honest conversations about AI happen in conference rooms, on video calls with executive teams, and in quiet one-on-one briefings where a leader finally says, “Here’s what really worries me.”

I’ve had the privilege of leading Fortalice Solutions since 2009, and our team sits in those rooms every week. When business reporters call, they’re often asking the very same questions!

What’s changed since 2009, and what hasn’t

When Fortalice opened its doors, cybersecurity was mostly seen as an IT problem. The conversations were about firewalls, viruses, and phishing emails with obvious typos. Most organizations were just beginning to move to the cloud, and the smartphone in your pocket was still new.

Today, the conversation has moved into the boardroom. Criminals can clone a CEO’s voice, put a convincing fake face on a video call, and send AI agents to do their work around the clock. The questions leaders bring us are less about technology and more about trust: Who can I believe? Who is accountable? What follows are the AI questions leaders are asking:

What happens if the AI technology or AI security breaks?

What hasn’t changed is the heart of the work. Then and now, the best defenses start with people, clear ownership, and good habits. Technology changes every year. Serving people well never goes out of style.

If you’re wrestling with any of these questions, you’re in good company. Here are the five we hear most from the clients we service, what business news reporters want to know, and what actually helps.

1. Is our board asking the right questions about AI?

Short answer: Many are asking the right questions but if they are not, it’s easy to fix. Boards need four simple questions about ownership, errors, contracts, and records for every AI system that touches customers, money, or safety.

This is often the first question in a board briefing, and it’s a wise one.

Many boards are approving AI investments faster than the industry is providing governance or ability to have true oversight.

In the newsroom: Reporters want to know who is accountable when AI gets it wrong. The answer is increasingly clear: the organization that implemented the AI is. In Moffatt v. Air Canada (2024), a Canadian tribunal held the airline responsible for incorrect advice its chatbot gave a grieving customer and rejected the argument that the chatbot was responsible for its own words.

What helps: four questions every board can ask

1.    Who is the named owner of each AI system that touches customers, money, intellectual property or the safety and security of our technology?

2.    When it’s wrong, how do we find out, fix it, and make it right?

3.    Do our vendor contracts cover AI errors, data use, logging, and liability?

4.    Can we produce an immutable record of what our AI said or did, and why?

2. How do we keep employees from leaking our data into AI tools?

Short answer: Give them approved AI tools they actually want to use, plus clear rules about what data never goes in. Bans don’t work; good options do.

Leaders aren’t worried that employees are careless. They’re worried that well-meaning people are trying to get work done with whatever tool is handy.

In the newsroom: Reporters are asking whether employees are resisting AI. Some are: 31% of employees, including 41% of Gen Z, admit to undermining their company’s AI strategy (Writer, 2025). Usually it’s fear or frustration, not malice.

What helps: Give people approved tools they actually want to use, clear rules on what data never goes in, and an honest conversation about what AI means for their jobs. Banning AI doesn’t stop it. It just drives it underground.

3. Is AI actually paying off?

Short answer: For most organizations, not yet in measurable terms, usually because no one measured the old way first. Set a baseline, then test AI side by side on real work.

Executive teams are under pressure to show returns, and many aren’t sure how to measure them.

In the newsroom: The question behind the headlines is whether AI is overhyped. Our view is more hopeful: most organizations never measured what the current way costs, so they can’t tell whether AI is winning.

What helps: Measure the time, cost, error rate, and risk of today’s process first. Then run AI side by side on real work for 30 to 60 days, and count the hidden costs, like human review and fixing mistakes. Let the numbers make the case.

4. Are criminals really using AI against us?

Short answer: Yes. One in four malicious breaches is now AI-enabled, and deepfake impersonation leads the way. The best defense is a verification habit, not a detection tool.

This is the question reporters ask most often, too.

In the newsroom: Reporters often ask whether anyone can spot a deepfake anymore. The honest answer is that spotting isn’t the strategy. Not trusting any interaction and verifying over and over again is. In 2024, a Ferrari executive stopped a deepfake of his CEO by asking which book the real CEO had recommended days earlier.

What helps: Call back on a known number before any payment change, use a verification question only the real person would know, and require a second approver for large payments.

5. What happens to us if our AI goes down?

Short answer: If you haven’t planned for it, business can stop. Keep manual fallbacks and a second provider for critical work, and practice running without AI.

Resilience has moved from the IT agenda to the boardroom agenda.

In October 2025, a hidden flaw in automated systems at Amazon Web Services’ Northern Virginia region disrupted services like Slack, Snapchat, and Atlassian for roughly 15 hours. No hacker, no attack. Now imagine your customer service, scheduling, or fraud detection running through a single AI provider in a single region.

In the newsroom: Reporters are asking about AI’s energy appetite, too. The International Energy Agency projects data center electricity use will more than double by 2030. Resilience and responsibility turn out to be the same conversation: right-sized AI is greener, cheaper, and harder to knock over.

What helps: Run an “AI-off” drill. Could you serve customers for 72 hours if your AI vendor or cloud region went dark? Keep manual fallbacks, a second provider for critical functions, and copies of the data you need to keep operating.

Your Monday Morning Checklist

•    Board: Name a human owner for every AI system that touches customers, money, or safety.

•    For Your People: Publish an approved AI tools list and a one-page rule on what data never goes in.

•    True ROI: Pick one AI project and measure the old way’s time, cost, and error rate.

•    Fraud: Require a callback to a known number before any payment change.

•    Resilience: Schedule a 72-hour “AI-off” drill for one critical process.

The good news

Every one of these questions has a practical answer, and most of those answers start with people, clear ownership, and good habits, not a massive budget. The leaders asking these questions are already ahead, because they’re asking.

Our calling at Fortalice Solutions is to serve: to listen first, share what we’re seeing, and help you protect the people and organizations who count on you. If you’d like a thinking partner on any of these questions, call us at 877.487.8160 for a complimentary consultation. We’ll tell you honestly whether we’re the right fit. Learn more at https://www.fortalicesolutions.com.

Blessings,

Theresa

Frequently Asked Questions

What AI questions should a board of directors ask?

Boards should ask who owns each AI system that touches customers, money, or safety; how errors are found and fixed; whether vendor contracts cover AI errors and liability; and whether the organization can produce a record of what its AI said or did.

Who is responsible when an AI chatbot gives wrong information?

The organization that deploys it. In Moffatt v. Air Canada (2024), a Canadian tribunal held Air Canada responsible for incorrect information its chatbot gave a customer.

What is shadow AI, and why does it matter?

Shadow AI is employees’ use of AI tools their organization hasn’t approved. IBM found one in five organizations reported a breach tied to shadow AI in 2025, so approved, useful tools and clear data rules matter.

How can a company tell if AI is worth the cost?

Measure the current process first, including time, cost, error rate, and risk, then run AI side by side on real work for 30 to 60 days and include hidden costs like human review.

How common are AI-enabled cyberattacks?

IBM’s 2026 Cost of a Data Breach Report found one in four malicious breaches were AI-enabled, costing an average of $6 million, with deepfake impersonation the largest category.

How can organizations stay resilient if their AI fails?

Run an “AI-off” drill, keep manual fallbacks, use a second provider for critical functions, and keep copies of essential data so operations can continue for at least 72 hours.

How has cybersecurity changed since 2009?

In 2009, cybersecurity was mostly treated as an IT problem focused on firewalls, viruses, and phishing emails. Today it is a boardroom issue, as criminals use AI to clone voices, fake video calls, and automate attacks. What has not changed is that the best defenses start with people, clear ownership, and good habits.

What does Fortalice Solutions do?

Fortalice Solutions helps organizations, leaders, and the people they care about navigate the risks of an increasingly digital, AI-powered world. Founded in 2009 and led by former White House CIO Theresa Payton, Fortalice is a Digital Trust and Protection firm that brings together cybersecurity, AI risk management and governance, cyber resilience, and Digital Executive Protection.

We help organizations adopt AI responsibly, strengthen their defenses, prepare for and respond to cyber incidents, and protect the executives, families, and digital identities that matter most.

Our services include AI security and risk assessments, cybersecurity strategy, tabletop exercises, red team/purple team/pen testing, security engineering, threat hunting and threat assessments, digital threat monitoring, and Digital Executive Protection.

The Fortalice Way is simple: We put people first. We combine deep cybersecurity expertise, protective intelligence, and practical guidance to help clients anticipate threats, make confident decisions, and build digital trust before a crisis hits.

Whether you're leading a company, navigating AI adoption, protecting a high-profile executive, or strengthening your organization's cyber resilience, Fortalice helps you move forward with greater confidence.

Technology should enhance human flourishing and advance people, not put them at greater risk.

We help make that possible.

Sources

•    British Columbia Civil Resolution Tribunal, Moffatt v. Air Canada, 2024 BCCRT 149: https://decisions.civilresolutionbc.ca/crt/crtd/en/525448/1/document.do

•    Writer, 2025 AI Survey press release: https://www.businesswire.com/news/home/20250318607263/en

•    IBM, 2025 Cost of a Data Breach Report press release: https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls

•    IBM, 2026 Cost of a Data Breach Report press release: https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average

•    Baker Donelson, Ten Takeaways from IBM’s 2026 Cost of a Data Breach Report: https://www.bakerdonelson.com/ten-takeaways-from-ibms-2026-cost-of-a-data-breach-report

•    Fortune via Yahoo Finance, MIT report on generative AI pilots: https://finance.yahoo.com/news/mit-report-95-generative-ai-105412686.html

•    MIT Sloan Management Review, How Ferrari Hit the Brakes on a Deepfake CEO: https://sloanreview.mit.edu/article/how-ferrari-hit-the-brakes-on-a-deepfake-ceo/

•    Amazon Web Services, Summary of the Amazon DynamoDB Service Disruption: https://aws.amazon.com/message/101925

•    International Energy Agency, Energy and AI, Executive Summary: https://www.iea.org/reports/energy-and-ai/executive-summary