The pitch you hear about AI in portfolio planning is that it makes the plan for you. It is a good pitch. It is also not what serious organisations actually want. What they want is more boring, and more useful.

It is 2am. An alert fires. An analyst sees a hostname, an IP, a process and a severity score. What the alert does not tell them is what the machine is, who owns it, or whether it should still be on the network at all. The SIEM is not wrong. It just has no idea what it is looking at.

Most organisations can tell you what they have approved spending money on this year. It just takes them a week and three phone calls to do it.

Walk into any large organisation and you will hear “we’re agile now” followed seconds later by “but the regulatory programme is waterfall, obviously”. That second sentence is the one worth paying attention to. Here is why supporting both matters.