The Twice Rule
Gartner’s fourth-quarter Business Quarterly (link) opens with a number. Organisations should “plan to spend at least twice as much on derisking AI” as they spend on the tools.
I went looking for where the two comes from.
A ratio without a derivation
The public edition of the journal covers the opening message and the CEO Watch section. Neither shows how the ratio was reached. It may sit somewhere in the full journal, behind the client login. But a rule of thumb that reaches a board slide unaccompanied tends to stay unaccompanied, and it will travel well. It is round, memorable and easy to put in a budget template.
None of this means the underlying instinct is wrong. AI systems in production do cost more to run safely than their licence fees suggest, and most organisations find that out after the pilot rather than before it. My question is narrower: does the evidence in this issue support a multiplier of two, or any fixed multiplier at all?
The investment gap is a category gap
The headline chart comes from the 2027 Gartner CEO Survey: 75% of CEOs plan to raise investment in technology, data and IT through 2027, while only 28% plan to raise investment in legal, risk, security and resilience. The journal reads this as risk being underfunded relative to ambition.
The comparison is between business functions, not AI budget lines. In most organisations I have worked with, a substantial part of security spend sits inside the IT budget. The growth on the left of that chart already contains some of the protection the right side is accused of neglecting. And 56% of respondents expect risk spending to stay flat. Flat is not zero, and for a function whose budget was already growing during the last three years of cyber incidents, flat may be a reasonable position.
A gap in growth rates is not a gap in coverage. The chart cannot tell you which one you are looking at.
The readiness chart has two denominators
The second figure carries more weight. Of the CEOs surveyed, 77% say AI industrialisation will have a high or medium impact on their strategic objectives. Only 20% report high readiness to address it. The same pattern appears for AI competitive polarisation, at 75% against 26%.
The footnote changes how this reads. Impact is reported as high plus medium. Readiness was only asked of respondents who rated a factor as high impact. The chart places two different populations on the same bar, and the visible gap is partly the distance between those denominators. Add a sample of 203 executives, self-reported readiness, and Gartner’s own disclaimer that the results reflect respondents’ sentiment rather than the market, and the direction looks plausible while the magnitude is not established.
The figure I found most telling is the quiet one. Only 37% of CEOs feel highly ready for cyber escalation, a risk domain with two decades of frameworks, standards, insurance products and incident playbooks behind it. If that is the score on the exam we have been rehearsing for, the AI readiness figure is probably generous.
The cost iceberg is right
On cost, I have no quarrel. The journal cites its own C-suite survey: only 45% of senior functional leaders stayed on planned budget for their 2025 AI investments. It lists the costs that sit below the licence: energy, hardware, data engineering, continuous observability, workflow redesign and compliance audits.
I would push the argument further than the journal does. Software overruns are not new, and most technology programmes miss their original budget. What is new is variance. A licensed seat costs the same whether it is used once or a thousand times a day. Inference does not. It scales with usage, and agentic systems multiply usage in ways a pilot rarely exposes. An agent that retries a failed call, reflects on its own output and consults three tools can turn one user request into thirty model calls. Pilots are priced on demonstrations, and demonstrations are run by enthusiasts on clean data at a sensible hour.
This is the strongest reason to budget for derisking before scaling. It is also the strongest reason not to do so with a fixed ratio. The cost of making a system safe depends on what it touches, not on what it cost to buy.
Two ideas worth taking, one worth questioning
The C-suite recommendations are a mixed set.
The first worth taking is procurement discipline. The journal cites DataGrail research suggesting over 63% of enterprise software vendors advertising AI capabilities do not disclose their AI subprocessors. If you cannot name the model running inside a product, you cannot assess its data handling, its training provenance or its terms. Making disclosure a contract condition costs almost nothing and closes a gap most organisations do not know they have.
The second is architectural: small language models on edge devices or private servers, behind an abstraction layer that lets you swap one model for another. For anyone building in regulated sectors or on connected hardware, this is not a matter of taste. It is how you survive a vendor changing its pricing, its terms or its jurisdiction.
The one I would question is the sanitised sandbox, an environment where staff can experiment with AI tools but have no access to real company data. It is The Truman Show for AI: everyone learns how the tool behaves, and nobody learns whether it solves the problem they actually have. Value appears when real data meets real controls. Removing the data removes the risk, and with it most of the learning.
What to do with this
For boards and CFOs, my suggestion is to resist adopting the ratio and budget derisking per use case instead, scaled to its blast radius: what data the system touches, what decisions it makes and how autonomously it makes them. A meeting summariser and an agent that can raise purchase orders should not share a multiplier.
For CTOs and technical leads, the priority is to build observability and model abstraction in from the first deployment, and to measure cost per outcome rather than cost per seat. Retrofitting either after scale is where the iceberg does its damage.
For legal and risk teams, the action is the cheapest one available: add subprocessor disclosure and data provenance terms at the next contract renewal.
A number is not a method
What interests me most about the twice rule is not whether it is right. It is how readily a ratio fills the space where a method should be. Organisations reach for a multiplier because the alternative, actually mapping what each AI system can see, decide and change, is slow and unglamorous work. Yet that mapping is the derisking. The budget follows from it, not the other way round.
Derisking is a real cost. It is a function of what you let the system touch.
RogueLoop. Where AI meets real-world innovation.