As artificial intelligence becomes more embedded in daily operations, companies face new challenges in managing its risks and benefits. To keep profit margins healthy, business leaders need to put strong AI governance in place. This means creating clear rules and processes for how AI is developed, used, and monitored across the organization.

The Evolution of Software from Product to Infrastructure

According to Rob Thomas, SVP and CCO at IBM, software typically goes through three stages of maturity. It starts as a standalone product, then becomes a platform, and eventually transforms into a foundational infrastructure. During the initial phase, companies prefer tight control, with closed systems that allow for quick updates and focused management. This approach helps capture value within a single organization, which makes sense early on.

However, once software reaches a core infrastructure level, the rules change. When other systems, markets, or operational processes depend on it, openness becomes essential. Closed systems can’t keep up with the demands of a broader ecosystem. Openness isn’t just a philosophical stance anymore; it’s a practical necessity for supporting widespread use and innovation.

AI’s Shift into Critical Infrastructure and Security Risks

Today, AI is moving into this infrastructure role within enterprises. Models are integrated into security systems, code authoring tools, automated decision-making, and even revenue-generating processes. AI is no longer just a test or experimental tool; it’s now a core part of how businesses operate.

This shift brings new risks. For example, a recent preview of Anthropic’s Claude Mythos model shows that AI can identify and exploit software vulnerabilities at a level comparable to top human experts. To address this, Anthropic launched Project Glasswing, which restricts access to these powerful AI capabilities to trusted network defenders first.

From IBM’s perspective, such developments highlight the need for companies to rethink their approach to AI security. If autonomous models can generate exploits or influence security environments, having only a few vendors control these tools increases operational risks. It’s critical to understand how these models are built, governed, and regularly improved over time.

Managing Complexity and Ensuring Safe AI Deployment

As AI systems become more complex and vital, maintaining closed development pipelines becomes difficult. No single vendor can predict every possible system failure, attack vector, or operational need. Relying on opaque, proprietary AI structures can create vulnerabilities and make it harder to respond quickly to issues.

IBM emphasizes that the focus should shift from what AI models can do to how they are managed. This means establishing transparent governance frameworks, ongoing inspection, and continuous improvement. Proper oversight helps prevent misuse, reduces operational risks, and protects profit margins in the long run.

Overall, as AI moves deeper into enterprise infrastructure, strong governance practices are essential. They help organizations balance innovation with security, ensuring AI contributes positively to business success without exposing critical systems to unnecessary risks.

Inspired by

• https://www.artificialintelligence-news.com/news/ibm-how-robust-ai-governance-protects-enterprise-margins/

Sources

• ibm.com
• ai-expo.net