Artificial intelligence, also known as AI is becoming deeply embedded in business operations, cybersecurity, software development and corporate decision-making. However as organizations increasingly rely on AI-powered systems the risks that come with using AI are also growing. According to predictions from Forrester Research, 2027 could bring major cybersecurity incidents, legal disputes over AI accountability unexpected global software outages and high-profile data breaches linked to changes in AI technology.
The research firm says that the next stage of AI use will need companies to look beyond new ideas and efficiency. Companies will need governance frameworks, better security controls, clear decision‑making and better cost management to stop AI failures from turning into big business problems.
Among its predictions Forrester expects an AI negligence lawsuit to cause a senior executive to leave a major company. It also predicts that spending on AI tokens will become a part of the security budget, an AI‑generated software defect could cause a worldwide outage and a company could expose sensitive data after switching between AI models to cut costs.
Although these scenarios are predictions and not confirmed events they show the challenges businesses must face as AI systems gain freedom and influence.
AI Negligence Lawsuits Could Force Executive Changes
One of Forresters important predictions is that a high‑profile lawsuit about negligence in the use of AI could happen. The firm expects that case could force an executive officer to resign or cause another big leadership change at a large organization.
The prediction shows growing worry about who should be held responsible when AI systems make decisions that cause money losses, work failures or harm to customers and other stakeholders.
As AI gets more involved in areas like services, hiring, healthcare, cybersecurity and company operations companies are giving more complex tasks to systems whose inner decision‑making can be hard to understand.
Forrester researchers say that a future lawsuit may focus less on whether an AI system made a mistake and more on whether company leaders used judgment before letting that system run.
The main questions could be whether executives understood the risks set up safeguards kept enough human oversight and made sure the technology fit its purpose.
In the United States AI accountability is split across laws, rules and precedents. As civil lawsuits about AI decisions grow courts could play a role in deciding how existing legal duties apply to AI.
AI Governance Moves Beyond the IT Department
Chris Ebert, senior vice president of go‑to‑market at SaaS Consulting Group says that a big AI lawsuit would affect more than just the organization involved.
According to Ebert, corporate boards and audit committees would likely start reviewing AI systems with the care they give to financial reports and other key business tasks.
Executives could be asked who owns AI decisions, which controls guide the system and how companies check that AI tools work as they should.
This change would make AI governance a board job of only an IT or tech team job.
Companies may then need to set up accountability record AI decisions evaluate operational risks and make sure executives get trustworthy information about how AI affects the business.
Ryan McCurdy, vice president of marketing at Liquibase says that putting AI into company workflows does not remove responsibility.
Organizations still decide what data an AI system can see what actions it can take on its own and when a human must approve.
McCurdy also stresses the need to keep records of AI activities. If an AI agent changes a database rolls out software. Alters a key system companies should be able to show exactly what happened what rules were checked, who or what gave permission and what finally went live.
These records could be proof when looking into incidents or showing that proper controls existed.
The main lesson is that businesses can give tasks to AI but they cannot hand over their responsibility to the technology.
Leadership Responsibility Could Become More Centralized
Scott Miserendino, technology officer, at DataBee, a Comcast company says that more legal scrutiny could also change how businesses handle AI leadership.
Organizations may increasingly appoint an identified executive responsible for ensuring that AI systems are deployed safely securely and in compliance with applicable requirements.
Such a role could resemble the information security officer position, which gives organizations a designated leader responsible for coordinating cybersecurity strategy and risk management.
A centralized AI accountability function could help companies coordinate technical, operational and compliance responsibilities that are otherwise spread across multiple departments.
AI could also encourage businesses to replace claims about AI capabilities with more measurable evidence of reliability, safety and performance.
AI Token Spending Could Become a Major Security Budget Issue
Forrester predicts that spending on AI tokens will reach $1.5 billion in 2027 with security operations and application security contributing significantly to demand.
AI tokens are units used by language models to process input and generate output. Depending on the model and provider token consumption often determines how much an organization pays to use an AI service.
As companies introduce AI into cybersecurity investigations, vulnerability management, application testing and automated incident response token consumption could become an operating expense.
Forrester expects security leaders to manage spending as a dedicated budget category rather than treating it as an incidental technology cost. Vendors may also incorporate allowances or consumption-based pricing into their licensing agreements placing AI providers in more direct competition for cybersecurity budgets.
This development could force organizations to evaluate AI investments according to both their costs and their measurable security benefits.
Autonomous AI Agents Could Increase Operating Costs
Robbie Mueller lead for cybersecurity at ArmorCode explains that token costs are particularly important when businesses deploy agentic AI systems.
Unlike chatbot interactions AI agents can perform multiple steps consult different tools analyze large volumes of information and repeat tasks until they reach a specified objective.
These activities can consume more tokens than a simple question-and-answer exchange. Systems involving collaborating agents may increase consumption even further.
The financial impact becomes especially important in security operations, where AI tools may analyze thousands or millions of vulnerabilities investigate alerts or evaluate software risks.
If an organization measures AI usage primarily by the number of findings processed than the amount of risk actually reduced spending could increase without delivering proportional improvements in security.
For example an AI-powered vulnerability management system might repeatedly analyze numbers of low-priority findings while critical vulnerabilities remain unresolved. Although the system may demonstrate activity its financial value could be limited.
Companies will therefore need to monitor consumption alongside operational outcomes, including reduced investigation time, faster remediation, fewer false positives and improved identification of exploitable weaknesses.
Practical measures could include setting usage limits prioritizing high-risk tasks evaluating more efficient models for routine activities and measuring the cost of each completed security operation.
The challenge will be to achieve improvements in cybersecurity without allowing AI consumption costs to grow faster than the benefits.
AI-Generated Code Could Trigger a Global Software Outage
Another major prediction from Forrester concerns the possibility that a defect in AI-generated code could trigger an outage affecting multiple industries.
AI coding assistants are increasingly used to generate software suggest code changes identify vulnerabilities and accelerate application development. These capabilities can improve developer productivity. They also introduce new challenges for software quality assurance.
Forrester warns that AI-assisted vulnerability discovery could create pressure on organizations to release patches quickly. If security teams identify weaknesses faster than development and testing teams can safely address them companies may begin prioritizing speed over validation.
Under these conditions an AI-generated coding error or regression could pass through development pipelines. Reach production systems before its consequences are fully understood.
The impact could be particularly severe when the affected software is widely used by enterprises, cloud providers, financial institutions or critical infrastructure operators.
Lessons From the CrowdStrike Incident
Forrester compares the consequences of such a failure with the widespread disruption caused by a faulty CrowdStrike software update in July 2024.
That incident demonstrated how a small software‑related problem can affect organizations across multiple countries and industries when the affected product is deployed throughout large parts of the global economy.
The predicted AI‑related outage would not necessarily need to originate from an autonomous AI system. A defect introduced or overlooked during development could produce similar consequences if it reached widely distributed software.
Miserendino points to increasing concerns about the reliability of technology providers and the potential consequences of software failures, across interconnected business environments.
The key difference is that the CrowdStrike incident was not caused by code. It shows how large a disruption can become when a bad update touches technology that many people use.
For organizations this incident highlights how vital testing, staged releases watching for problems and having a recovery plan are.
Software vendors must check patches before sending them out. They should roll out changes slowly. Keep a way to undo a bad change fast.
Enterprises also need rules for finding which systems are hit separating out the failures and fixing work so they do not rely only on the broken technology.
Critical Infrastructure Faces Additional Risks
The bad effects could reach past normal business use and touch essential services like making and sending electricity.
Ramy Rahman, principal solutions engineer at ArmorCode warns that organizations that use the same software or AI systems may all break at once if a common fault or a planned attack hits them.
Power grids and other key infrastructure are very sensitive. A stop in their work can hurt homes, hospitals, transport links and factories.
If many operators use the software parts one weakness can pile up risk for many separate groups.
So independent safety steps become more vital. Operators of infrastructure must have proven recovery plans, proper network cuts, manual ways to work when other methods to keep key services alive.
AI‑powered systems should also stay inside limits that stop a software bug or wrong auto decision from spreading wildly.
Rishi Bhargava co‑founder of Descope says organizations must look closely at what rights they give to self‑acting agents.
An agent told to finish a job can act on linked systems unless its power and access are limited. Therefore a small mistake can cause trouble if the agent has too many powers.
Companies should give agents the access needed for their jobs ask for approval before big actions and watch their work on important systems.
Switching AI Models Could Lead to Serious Data Breaches
Forresters forecast warns that a company could suffer a big data breach after swapping AI models to cut costs.
Businesses now use AI providers or send requests to different models to keep performance, uptime and money in balance. This can give flexibility but it may bring security holes if a company thinks the safety rules for one model will also protect another.
AI models can act differently have safety rules treat data in various ways link to tools in distinct ways and answer sensitive questions in unique ways.
A safety set‑up that fits one model may not be enough when an app starts sending data to another provider or model.
If companies switch AI systems without re‑checking these differences important business data could leak through data paths, weak access limits or wrong system actions.
Model Changes Require Governance and Security Testing
Seemant Sehgal, CEO of BreachLock says that firms are cutting AI costs faster than they are updating the rules that keep them safe.
He says that changing models on the fly can be weak because firms may see it as a technical switch not as a change that touches security and compliance.
The problem grows when firms cannot clearly know which model handled data, when that happened or what safety rules were, in place then.
For firms that hold customer records, money data, secret documents or regulated facts these gaps can make it hard to check incidents. Prove they follow rules.
A safe model‑switching method must start by looking at what the new model can do its limits, how it handles data and its safety needs.
After that firms should test their safety rules against the new model instead of assuming the rules will work the same.
More shields could mean limiting who can see data using data‑loss prevention tools keeping audit records and setting rules that say which models can handle which kinds of data.
Companies must also watch where each model is used in their apps and keep notes of any AI setting changes.
These steps can help security teams spot data paths look into odd activity and find out if a model switch added new dangers.
The goal is not to stop firms from swapping models. It is to make sure that cutting costs does not break the safety rules that guard company data.
Businesses Need Risk‑Based AI Security Strategies
Forresters predictions show possible challenges but not every scenario will happen exactly as described. The value of Forresters predictions is that Forresters predictions push organizations to look at weaknesses before a big incident reveals them.
Darin Fredde, security leader at Ridge Security Technology believes that these scenarios can help security leaders rethink how security leaders evaluate emerging threats.
However Darin Fredde cautions that fear alone should not set cybersecurity strategy. Dramatic predictions may attract attention. Long‑term improvements need organizations to understand how specific risks connect to Forresters predictions and which weaknesses attackers could realistically exploit.
Companies should therefore link AI governance with security testing, business continuity planning and measurable risk reduction.
An effective strategy should include ownership of AI systems, documented permissions for autonomous agents, rigorous testing of AI‑generated code, controlled software deployments and repeatable validation of security controls when models change.
Organizations should also set up processes to monitor spending and to decide whether automated systems give enough operational value to justify their costs.
Regular assessments can help businesses spot permissions, unreliable workflows, poorly documented integrations and vulnerabilities that might otherwise stay unnoticed.
As important employees and executives should know where AI systems can work independently and where human review is still needed.
AI Accountability Will Become a Business Priority
Forresters 2027 cybersecurity predictions suggest that the next phase of enterprise AI adoption could bring scrutiny of leadership decisions more pressure on security budgets possible widespread software failures and new chances for data exposure.
An AI‑related lawsuit could force executives to show that executives used oversight. Rising token consumption could make security teams justify AI investments with outcomes. Defects in software development could endanger interconnected systems while poorly managed model changes could weaken data protection.
These risks share a theme: organizations cannot rely on AI capabilities alone to ensure safe and reliable operations.
Businesses will need to mix automation with responsibilities restricted permissions, continuous monitoring, rigorous testing and reliable recovery procedures.
The organizations ready, for 2027 will be those that treat AI security and governance as essential business functions instead of technical afterthoughts.
By putting controls in place before incidents happen companies can enjoy AI benefits while lowering the chance that an operational mistake becomes a legal, financial or reputational crisis.
