A recurring conversation with CIOs on the modern technology-driven enterprise

Proving hard dollar business value

The AI spending spree has ended. CIOS are increasingly being scrutinized by their CFOs and their financial committees over AI expenditures. A multi-million-dollar spend that delivers employee convenience or anecdotal stories of productivity gains is no longer acceptable. 

Value realization that would address scrutiny is a key focus for Matteo Colombo, Global Data & AI Leader at KPMG. “How we define and achieve ROI, to what degree do we experiment versus focusing on large initiatives.”

While deploying tools like Copilot to knowledge workers yields soft productivity gains of 10-15%, these savings are often filled with busy work or calendar bloat rather than saving on operational expenses.

“We don’t have a way to measure productivity across the workforce that everybody will sign off on, but that is what our CEO is really trying to force,” acknowledged the CIO of a major consumer brand.

To unlock this capacity, CIOs are partnering with business units to rebalance employee roles, responsibilities, and expectations. By aggregating 10% savings across teams, they are effectively creating full-time equivalents that could be dedicated to strategic initiatives.

As one CIO put it, “Take that 10% productivity gain amongst 10 people and create one FTE’s worth of free time to do something greater.”

To avoid layoffs during budget reductions, organizations are leveraging headcount attrition, as well as refusing to backfill vacant roles as automation takes over rote tasks.

Measurability and accountability are easier to manage with defined business cases that are more thought out and even if they have a degree of experimentation. Some CIOs are forcing business unit leaders to attest for projected outcomes. A distinct operational baseline allows for pre- and post-automation costs that can be systematically compared.

For example, with any major AI-driven automation initiative, like in the case of a call center routing or backend claim adjudication, the expected savings are calculated and directly clawed back from the department’s operating budget. 

A CIO for a medical supply company shared their experience. “We have seven big rock initiatives. Each one has baked into it either expected savings or a direct withdrawal from the budget because of the expected productivity. Those are the only initiatives we’re measuring.”

AI freed up 15 minutes a day for everyone, but I can’t reduce my headcount.

— CIO, chemical company 

Companies deploy unified AI harnesses

As AI becomes a bigger factor in human workdays, from facilitating a multi-model environment to managing user-based fees and runaway token usage, CIOs are starting to question AI costs. A $20 per seat enterprise license for Microsoft Copilot scaled to 60,000 or 90,000 employees becomes a major capital expenditure.

While a predictable flat-rate monthly fee is initially appealing to procurement departments, a major financial trap emerges when power users and development teams transition to raw, token-based consumption. Cost optimization is particularly critical in software engineering. Unmonitored users running repetitive automated scripts can present unchecked fees that raise eyebrows. CIOs have observed instances where advanced developer environments using token-measured AI rack up bills of $5,000 to $10,000 per day.

“We have people using Claude when they could have used Copilot or GitHub for less spend. The costs can go up extremely high,” remarked the CIO of a chemical company.

To prevent these blowouts, enterprises are deploying unified AI harnesses. They act as front-end gateways, automatically selecting the most cost-efficient large language model behind the scenes based on the complexity of the user’s task.

By dynamically routing simple queries to smaller, in-house models and reserving premium models only for highly complex cognitive tasks, CIOs can more efficiently approach AI spend. A process that would otherwise consume $1,000 in token APIs costs pennies.

The outlier that concerns many CIOs is productivity and costs associated with coding. AI delivers eye-popping 50-80% speed improvements in raw code writing. However, these gains are instantly reduced by manual bottlenecked processes, including automated unit testing, deployment validation, and compliance gates. When all is factored in, AI presents the software development lifecycle with a more modest, realistic improvement of 10-20%. 

These same CIOs warn against using gamified developer metrics, which are easily manipulated to show progress. Leading organizations are bringing accountability to the software development lifecycle with DORA, which stands for DevOps Research and Assessment. CIOs are deploying AI dashboards anchored to DORA metrics, which allows them to measure true feature delivery frequency and connect real-time token consumption to business outcomes. 

As AI becomes a bigger factor in human workdays, CIOs will have to be gatekeepers for costs while facilitating the demand for a multi-model environment.

We had a bunch of people using Claude, but they didn’t realize the cost model. Suddenly, $20 a month became $1,000.

— CIO, automotive industry 

Adopting a post-breach strategy and tightening vendor requirements

Microsoft's vulnerability index jumped five-fold in September 2026, which necessitated nearly 1,000 security updates. AI has ushered in the golden age for the hacking community. Manually testing patches over a traditional multi-week period is no longer viable. It calls for automated, machine-learning-driven patch pipelines.

CIOs understand they must automate and accelerate deployment cycles to a window of mere days. Achieving this speed requires managing executive expectations, as rapid patching inherently cuts testing windows and will occasionally lead to minor, temporary corporate disruptions. Leadership needs to be prepared for that.

"I've done quite a bit of campaigning internally to set expectations. We are patching much more quickly now, in some cases, it’s automated. What this means is that testing is not as robust as it historically was. Therefore, we should anticipate that there will be more disruptions,” said the CIO for an industrial supplier.

As CIOs start to expect a certain level of disruption, they’re practicing business continuity tactics like recovery time objective (RTO) under the assumption that at some point the primary networks will be disabled.

“The view is we’re going to get hacked,” according to the CIO of a speciality chemicals manufacturer. “What’s our minimal viable operations needed to conduct business, and how do we restore them quickly.”

CIOs are also reviewing their vendor contract service-level agreements (SLAs). Malicious actors are using AI to aggressively daisy-chain minor and medium-rated vulnerabilities across different software as a service (SaaS) platforms. Low-risk software bugs have the potential to become major security breaches. By stringing together three or four low-risk bugs together, malicious AI can autonomously construct a highly sophisticated, multi-stage exploit payload that completely bypasses traditional security monitors.

To address this, CIOs are turning to defensive AI and machine learning, including AI-generated threat intelligence feeds, automated vulnerability mapping, and autonomous patch deployment. AI enabled tools actively hunt for vulnerability intersections within the corporate firewall and flag them for immediate mitigation.

"The daisy-chaining of medium vulnerabilities is the big thing. We’re reviewing vendor contracts to ensure we have the right SLA requirements. It’s the only way to get our partners to play ball,” shared the CIO of a healthcare company.

In our last tabletop exercise, the question came up: Who owns the kill switch? Turns out, I do.

— CIO, Consumer products sector