AI failures could cost executives their jobs, disrupt businesses worldwide, and expose sensitive data in 2027, according to new cybersecurity predictions from Forrester Research.
In the executive suite, for example, the company predicts an AI negligence lawsuit will force a CEO exit or leadership change at a large company.
“AI accountability in the US remains fragmented yet is veering toward the courts, where civil litigation is already testing liability for AI-enabled decisions,” Forrester researchers noted in their report, “Predictions 2027: Cybersecurity And Risk.”
They explained that the central argument in the case won’t be whether AI failed, but whether leadership exercised informed judgment before delegating consequential decisions to systems they couldn’t explain.
If such a lawsuit happens, the biggest ripple effect will be in boardrooms rather than in the AI industry, maintained Chris Ebert, senior vice president of go-to-market at SaaS Consulting Group, a technology consulting company in Austin, Texas.
“Boards and audit committees will start asking the same questions about AI that they ask about financial reporting — who owns it, what controls are in place, and how do we know it’s working as intended?” he told TechNewsWorld.
“AI governance would move from an IT conversation to a governance and accountability conversation, which is where it belongs,” he declared.
AI Accountability Reaches the Boardroom
Ryan McCurdy, vice president of marketing at Liquibase, a database-change automation company in Austin, Texas, asserted that as AI starts making more decisions and taking more actions inside companies, accountability doesn’t go away. “Someone still decides what the AI can access, what it can do on its own, and where a person needs to get involved,” he told TechNewsWorld.
“Companies also need a record of what actually happened,” he continued. “If an agent changes a database, deploys code or takes another action against a critical system, you should be able to see what it changed, what policies it passed, what authorized the action and what actually reached production.”
“That trail becomes the proof that the controls were there and working,” he said. “You can delegate work to AI. You can’t delegate accountability.”
Legal accountability for AI usage could lead to the end of fear-based marketing of frontier AI capabilities and the appointment of a single executive responsible for safe and compliant execution of AI, similar to the CISO, added Scott Miserendino, chief technology officer at Philadelphia-based DataBee, a Comcast company and developer of a data fabric for compliance, risk management, and security.
“Frontier AI lab CEOs will no longer be so willing to publicly call out the dangers of their product in order to make them seem cutting edge,” he told TechNewsWorld.
AI Tokens Become a Security Budget Item
Forrester predicts AI token spending will reach US$1.5 billion in 2027, with security operations and application security driving demand. Tokens are units used to measure AI model inputs and outputs and often determine usage charges. Security leaders will manage that spending as a core budget category, the firm said. Vendors will embed tokens into licensing agreements, and frontier model providers will compete directly for security budgets.
Organizations will need to shift from managing the adoption of AI to managing its cost and value, it added.
“Token costs will become a real constraint on how organizations deploy AI, particularly agentic AI,” noted Robbie Mueller, technical lead for cybersecurity at ArmorCode, a unified vulnerability management company in Palo Alto, Calif.
“The issue is not simply the price of individual tokens,” he told TechNewsWorld. “Agents typically consume far more tokens than standard chat interactions, and multi-agent systems can consume substantially more again.”
“When those agents are applied across millions of vulnerabilities, costs can scale with the volume of findings rather than the amount of risk actually reduced,” he said.
AI-Generated Code Could Trigger Global Outage
Forrester also predicts that a bug or regression in AI-generated code will cause a global outage across multiple industries. AI-assisted vulnerability discovery will increase pressure to release patches faster than software review and testing teams can keep up, the firm warned.
The resulting outage could rival the disruption caused by CrowdStrike’s July 2024 software update, Forrester warned. It urged organizations to strengthen their ability to quickly roll back faulty vendor patches.
“We are already seeing buggier performance with more frequent outages in several critical providers for global software distribution and operations such as GitHub and AWS that have been connected with AI,” observed DataBee’s Miserendino.
“While not AI-generated, the recent worldwide outage caused by a CrowdStrike software update demonstrated that even a relatively small bug or regression can have global implications given widespread adoption of some vendors across enterprises,” he added.
ArmorCode Senior Principal Solutions Engineer Ramy Rahman pointed out that the outage prediction also raises a broader concern about critical infrastructure, particularly the power grid. “If multiple operators rely on the same software or AI systems, a shared defect or coordinated attack could cause simultaneous disruptions,” he told TechNewsWorld.
“The Department of Energy has identified AI failures and adversarial attacks as risks to energy infrastructure,” he said. “My concern is whether operators can isolate those failures and maintain essential services through independent safeguards, manual controls and tested recovery plans.”
A repeat of the CrowdStrike outage is less concerning than what happens when agents are given a task and the access to carry it out without the right boundaries in place, added Rishi Bhargava, co-founder of Descope, an operator of an identity-and-access-management platform in Los Altos, Calif.
“Agents are designed to complete the task they’re given,” he told TechNewsWorld. “Organizations need to think carefully about what an agent can access and what actions it can take so that a mistake doesn’t have a much larger impact.”
Switching AI Models Could Expose Data
Forrester also predicts an enterprise will suffer a high-profile data breach after switching AI models to cut costs. Safeguards established for one model may not carry over to another, leaving gaps in data protection, the firm warned.
“Forrester’s model-switching prediction holds up because the industry is already in the phase where organizations are optimizing AI costs faster than they are updating their governance to match, and the guardrails you validated against one model do not fully carry over when an application dynamically routes to a different one,” explained Sameed Ahmed, CEO of BreachLock, a penetration testing as a service company in New York City.
“Most teams running this at scale cannot easily tell you which model saw which data on which day, which is where the breach scenario Forrester describes actually plays out,” he told TechNewsWorld.
“The organizations most at risk right now are the ones treating dynamic model selection as a routing decision rather than a governance decision, which is the specific gap the report is calling out,” he said.
Darin Fredde, offensive security leader at Ridge Security Technology, a developer of an AI-powered offensive security platform based in Milpitas, Calif., argued that there is real value in the kind of scenarios Forrester puts forward because they force security leaders to consider risks that they may not yet see in day-to-day operations.
“We know that fear can motivate change, but usually only for a short time,” he told TechNewsWorld. “The more durable path is helping organizations rethink their security worldview, align it with how the business operates and make risk decisions based on demonstrable exploitability rather than narrative alone.”
“Some of Forrester’s predicted scenarios will prove material, others may not,” he continued. “The real question is whether organizations can determine which risks matter before an attacker, outage or regulatory event answers the question for them.”
