Artificial Intelligence & Machine Learning
,
Next-Generation Technologies & Secure Development
Forrester Warns of AI-Driven Outages, Security Costs and Regulatory Risks
Jennifer Lawinski •
October 15, 2026
Image: Shutterstock
Artificial intelligence is creating new kinds of risk and failure across the enterprise, adding a need for resilience beyond traditional disaster and recovery playbooks, according to a look-ahead report from Forrester Research.See Also: Webinar | Verifying AI Agent Activity Against Your Data Policies
The firm’s predictions for cybersecurity and risk for 2027 span AI, software reliability and physical disruption. An AI-generated software flaw could trigger a global outage, analysts warn. A lawsuit over an AI-enabled decision could force a CEO out. Token spending will reach $1.5 billion, led by security operations and application security. A natural disaster may cause an outage and a regulatory violation for a European organization. And an effort to cut costs by switching AI models could lead to a data breach.
Taken together, the predictions show the ways in which the CIO and CISO roles are expanding. Tech leaders will need to manage AI costs and governance while preparing for software failures and disruptions that have no malicious attacker behind them, according to James Plouffe, principal analyst at Forrester.
“If you have resilience between your different environments,” he said, organizations “can sort of take a big chunk out of three of these five predictions without a lot of heartburn.”
The Patch Tsunami
AI-assisted tools are accelerating vulnerability discovery and creating urgency to patch systems quickly, escalating pressure on organizations already struggling to prioritize vulnerabilities before the volume of findings surged, Plouffe said.
Microsoft addressed close to 1,000 vulnerabilities in its September 2026 security update and more than 1,400 in October’s release.
“We all sort of intuitively understood that patching was necessary, but has never been sufficient,” he said. Forrester predicts that an AI-generated bug or regression could cause an outage on the scale of the July 2024 CrowdStrike incident (see: CrowdStrike Says Code-Testing Bugs Failed to Prevent Outage).
“When you’re dropping 1,400 patches at a time, QA is going to fall by the wayside and eventually that’s going to burn us somehow,” he said.
Plouffe said the technology industry needs to change its approach.
“Every great city in the world burned to the ground at least once until we figured out better construction methods,” he said. “We have to think about sort of structural changes rather than procedural ones.”
Plouffe said large-scale changes, including a rush to deploy patches, increase the chance of failure. Staged deployments and rollback plans can limit how far a flawed update spreads, while resilience between environments can keep a disruption from becoming enterprise-wide.
AI Decisions Still Require Human Judgment
Forrester predicts that an AI-related negligence lawsuit will force out a CEO or prompt another leadership change. The case would test whether executives exercised informed judgment before delegating consequential choices to systems they could not explain.
“If you turn to the AI and said, ‘Should we do A or should we do B?’ and the AI comes back and says, ‘You should do B,’ then … is that really judgment?” Plouffe asked. AI can support research and due diligence, he said, but “it can’t be, we asked the AI and the AI told us.”
The question for boards and executives will be whether they can explain how they reached a decision, including what role AI played and what human oversight took place. Plouffe said leaders still need to take the information provided and exercise their own judgment.
AI Security Needs a Budget
Forrester expects security-related token spending to reach $1.5 billion in 2027, led by security operations and application security. As vendors embed AI into security products, organizations may not yet see the full cost, Plouffe said. He expects token usage to become “a discrete budget line item.”
If teams rely on tokens to investigate alerts and respond to incidents, their capacity could be limited by how much usage they can afford. Security leaders will need to plan for spikes in demand and decide whether each task requires the newest, most expensive model.
“Do we actually need the frontier capabilities? And the answer may well be no,” Plouffe said. A less expensive model, supported by a better harness, could deliver similar results for some workloads.
Switching models to save money creates a separate risk. Switching between models from the same provider is probably less of a concern, Plouffe said, than routing requests to the cheapest available model across providers. A model from another provider may not have the same safeguards as the one an organization has tested. With an untested switch, he said, “you’ve changed the playing field without sort of being aware that you’ve done that.”
Real-World Disruptions
Forrester also predicts that a natural disaster could take a critical service offline and trigger a reporting violation under Europe’s NIS2 directive, which requires significant disruptions to be reported within 24 hours. Plouffe said organizations should not assume reporting obligations apply only to cyberattacks. “Your reporting obligations are the same regardless,” he said.
Teams need to know who will own the response and have a plan for how security, IT and facilities will coordinate when an outage has a physical cause. Plouffe said he would be surprised if the United States adopts a similar national reporting requirement soon, but organizations still need plans for disruptions affecting critical services.
Across the five scenarios, Plouffe said, resilience is the priority. Organizations that build separation between environments can contain failures and reduce the impact of several different risks.
While AI is creating new categories of risk for the enterprise, Plouffe said technology leaders will still need to look out for familiar threats, such as stolen-credential attacks.
“The biggest breach of 2027 is still going to be something boring, not caused by AI,” he said.
Click Here For The Original Source.
——————————————————–
