What Will You Say?
You have about 18 months before this question lands in a board meeting. Here is how to have an answer ready.
Boards have learned to ask about cybersecurity. After a decade of headline breaches, most directors can ask competent questions about incident response plans, backup strategies, and third-party risk. They learned because they had to. Regulators, insurers, and shareholders forced it.
The same forcing function is arriving for AI. Your SOC deployed AI agents that triage alerts, enrich investigations, and in some cases take containment actions autonomously. Your board does not yet know the details. But the EU AI Act, the SEC’s evolving disclosure expectations, and the first wave of AI-related litigation will make sure they find out. When they do, they will ask a question that sounds simple: how does the AI decide?
If your answer involves the phrases “it’s a machine learning model” or “the vendor handles that,” you are not prepared.
Why This Question Is Coming Now
Three things are converging. First, the EU AI Act entered enforcement in 2025 with obligations for high-risk AI systems, including transparency requirements and human oversight mandates. AI used in security operations at critical infrastructure organizations will fall under this scope. Second, cyber insurance underwriters are beginning to ask about AI decision-making in their questionnaires. They want to know whether AI verdicts are explainable, whether overrides are tracked, and whether autonomous actions have defined boundaries. Third, plaintiff attorneys in breach litigation are going to ask discovery questions about AI-made security decisions. If your AI dismissed an alert that turned out to be the initial access vector, opposing counsel will ask how it reached that conclusion. “We don’t know” is not a defensible answer.
| The board question is not really about AI. It is about governance. Can you demonstrate that the automated decisions in your security operations are accountable, auditable, and subject to human oversight? That is a governance question your organization either can or cannot answer. |
Five Questions to Prepare For
These are the questions a well-briefed board member will ask about AI in your SOC. If you can answer all five clearly and concisely, you are in good shape. If any one of them makes you pause, that is where your preparation gap is.
- “What decisions does the AI make without a human in the loop?” You need a crisp inventory. The AI auto-closes false positives below confidence threshold X. It enriches IOCs from these five sources. It isolates endpoints only when severity is critical and confidence exceeds 95%. If you cannot enumerate the autonomous actions, you do not have governance. You have a deployment.
- “How accurate is it, and how do you know?” This requires metrics, not anecdotes. Your triage agent’s true positive rate is 94.2% this quarter, measured by tracking analyst overrides on a sample of 2,400 verdicts. If you do not have accuracy numbers derived from production data, you are operating on vendor claims.
- “What happens when it gets it wrong?” The answer should describe your feedback loop: overrides are logged, categorized, and fed back into model evaluation weekly. When override rate exceeds 8%, the agent’s confidence thresholds are adjusted. When a missed true positive is identified, the case is reviewed and the detection rule or model input is updated.
- “Can you show me the reasoning behind a specific decision?” This is the explainability test. Pull up any case where the AI made a verdict. Walk the board through the structured reasoning chain: what data the agent evaluated, what it matched, what confidence it assigned, and why. If you cannot do this, your AI is a black box and your governance claim is hollow.
- “Who is accountable when the AI makes a mistake?” This is the question that matters most. The answer is not “the vendor” and it is not “the model.” It is a named role in your organization — typically the CISO or the SOC director — who owns the governance framework, sets the autonomy boundaries, and is responsible for the agent’s performance. If nobody owns it, nobody is accountable.
What to Build Before the Question Arrives
You do not need to solve AI governance in the abstract. You need four concrete things ready before your next board cycle:
- An AI decision inventory. A one-page document listing every autonomous action your AI agents take, the conditions under which they take it, and the supervision level for each. This is your governance artifact. It fits on a slide.
- A quarterly accuracy report. True positive rate, false positive rate, override rate, and confidence calibration, segmented by agent type. Four numbers on one slide, trended over the last four quarters. The board does not need to understand the model. They need to see whether it is getting better or worse.
- One worked example. A single case pulled from production showing the full reasoning chain: alert came in, agent evaluated these data points, matched this pattern, assigned this confidence, took this action. Walk through it in 90 seconds. This is more convincing than any architecture diagram.
- A named owner. Someone whose title and reporting line the board recognizes who can say: I am responsible for the governance of AI in our security operations. Here is how I verify it is working. Here is what I do when it is not.
The board is not going to ask you to explain neural network architectures. They are going to ask whether the AI decisions in your security operations are governed with the same rigor as every other critical process. The organizations that can answer yes will earn trust. The ones that cannot will earn scrutiny.
You have a window to prepare. Use it.