Your CFO has the best map of your AI risk

Ask the CISO how many AI agents the company runs, and you will get an estimate.

Ask the CFO, and you will get something better: the bills.

Somewhere in the card statements is a model provider nobody in security has heard of. Somewhere in the software spend is an AI add-on switched on by one team. Somewhere in the cloud bill is an agent that runs every night and costs a little more each month. None of it is hidden. It is just sitting in the wrong department.

Here is our view. Your AI budget is the most honest inventory of your AI risk, and finance is holding it.

Scanners find what they are pointed at. Policies cover what people declare. But every agent that does real work costs money, and money leaves a trail that nobody can forget to file. An unrecognized charge on a corporate card is not a finance query. It is an agent nobody has reviewed.

There is a second reason the CFO matters. Most executive teams we talk to are asking the same question about AI: what are we getting for this? Nobody can answer it, because the cost is in one place, the activity is in another, and the results are in a third. Companies end up judging AI by enthusiasm. They cut what was working and keep funding what wasn't.

The fix is not a new tool. It is a new meeting.

What we would do on Monday: put the CISO and the CFO in a room with one list, every place the company pays for AI. For each line, ask three questions. Who owns it? What is it connected to? What did it produce?

The lines nobody can answer are your shadow AI. The lines that answer all three are your business case.

Same list. Two problems solved.