Series
11 essays in this series
Visibility produces data. Understanding produces decisions. Phase II essays examine what it takes to move from raw information to actionable insight — in AI systems that generate output without guaranteeing correctness, in security programs that collect signals without converting them to risk clarity, and in operating models that accumulate tools without building capability. The central tension in this phase is the difference between having information and knowing what it means. Most organizations have more of the former than they realize, and less of the latter than they need.
Consulting expertise and consulting labor are distinct economic goods. The pyramid has bundled them together for so long that most firms have stopped noticing the difference. AI is forcing the unbundling.
The market has overweighted prompt engineering, treating the quality of the prompt as the primary determinant of AI output quality. It is not. The prompt is the input specification — output quality is determined by model quality, data quality, context quality, and evaluation rigor.
The organizations having the most difficulty with cyber insurance are not the ones with the worst security programs. They are the ones with the largest gap between what their policy says they have implemented and what they have actually implemented.
AI-native is becoming the kind of phrase that means everything and therefore nothing. The organizations that will benefit from AI as a structural competitive advantage are those that have built something more substantive than a portfolio of AI tools sitting on top of traditional processes.
Most data governance programs were designed to manage data at the pace of policy-making, not the pace of operations. In environments where AI systems are consuming and generating data continuously, that gap is becoming critical.
The traditional consulting leverage model has been stable for decades. AI is dismantling its base faster than the firms that depend on it are willing to acknowledge.
Organizations moving AI into production are discovering a security problem that was not salient during experimentation: the question of what the AI system is allowed to access, what it is allowed to do, and how the organization knows those boundaries are being respected.
Output and judgment are being treated as if they exist on the same scale — as if producing more output at higher speed is equivalent to making better decisions. They are not the same thing.
The relationship between data integration and security is usually framed in one direction. The more consequential relationship runs the other way: data integration determines what can be seen, correlated, and acted on.
AI does not replace work. It replaces specific cognitive tasks within work. Everything that requires judgment about what the output means and what to do with it remains human — and the enterprise response to AI has consistently blurred this distinction.
Every AI initiative runs into the same obstacle around six to eight weeks in, with the same expression of surprise. The models do not work the way the demos suggested — not because the technology is deficient, but because the data is not what the organization assumed it was.