Summary: CIOs are being asked to choose between AI and security or infrastructure. It is the wrong choice. Runaway AI costs and rising AI risk come from the same place — and so does the fix.
Technology budgets have a new ranking. In McKinsey’s Global Tech Agenda 2026, AI overtook both cybersecurity and infrastructure modernization as companies’ top investment area for the next two years. The same report notes that AI investment, whatever it does for long-term growth, is straining technology budgets in the short term.
Now the AI line itself is growing. In August, Gartner predicted that AI inference costs per agentic workflow will increase more than fivefold through 2028 — even as the price of each token keeps falling. Agents reason, check themselves, and call tools over and over, and those tokens add up faster than prices come down.
So technology leaders are being handed a choice: fund the agents, or fund the security and infrastructure underneath them. I have spent thirty years as an enterprise architect, and I think that choice is false. The AI bill and the risk bill are not competing for the same dollar. They are two invoices for the same problem.
Where the tokens actually go
Watch an agent work on a real business question — say, “Can we ship this customer’s order by Friday?” — and count where the effort goes.
Very little of it is intelligence. Most of it is search and reconciliation. The agent queries the ERP for the order, the scheduling tool for the production slot, the inventory system for material, and perhaps a spreadsheet someone exported last week.
The ERP says the order is complete. The schedule says it is waiting for inspection. The inventory count is from last night’s sync. Now the agent has to reason about which copy to trust, ask a follow-up, try another tool, and check its own answer.
Every one of those steps costs tokens. My reading of the fivefold forecast is that a large share of agentic spend is not the price of thinking. It is the price of an agent reconciling systems that should have been one.
The same gap produces the risk. To answer that question, the agent needs access to five systems, each with its own accounts, permissions, and logs. Its real authority is the sum of five permission models, and its audit trail is scattered across all of them.
Every connector is one more thing to secure, monitor, and patch. When the security team asks “what exactly can this agent see and do?”, nobody can answer in one sentence.
Both bills come due at the integration layer. Gartner’s earlier prediction, from June 2025, makes the link almost explicit: more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs, unclear business value, or inadequate risk controls. Cost and risk appear in the same sentence because they share the same cause.
The model is now the least consequential decision
AI programs still spend a surprising amount of energy choosing a model. That made sense two years ago. Today frontier models are close enough in capability, and change often enough, that the model is the easiest part of the program to swap and the least likely to decide whether it succeeds.
What decides cost, risk, and reliability is what the model stands on. Gartner’s own recommendation for the inference problem is to route each task to the most cost-efficient model capable of handling it. That is good advice, and it only works when tasks are small and well defined.
A small, cheap model can answer “Can we ship by Friday?” if the answer sits in one place, current, with a clear meaning. It cannot do so if the task first requires reconciling five systems. Architecture decides how much intelligence each task needs.
Two properties of that foundation matter most.
First: make the right data easy to get. An agent should be able to ask one question and get one current answer. That means the operational business in one live database — transactions and reporting on the same data, not a warehouse copy refreshed overnight. It means a schema whose tables and fields carry descriptions the agent can read, so it knows what “shipped” means in this company.
And it means direct, permissioned query access, so the agent retrieves exactly what it needs instead of crawling documents and APIs. Every step you remove from “find the right data” is tokens you never pay for and an error the agent never makes.
Second: give AI the tools to validate its own work. An agent that cannot check itself has to spend tokens second-guessing itself, and still cannot be trusted. An agent that can check itself against the system is both cheaper and safer. At run time, that means explicit permissions to specific tables and fields, a short list of allowed actions, automatic validation tooling, approval steps where they matter, and one audit log. The agent logs in like an employee, not a superuser.
At build time, validation matters even more. Most business processes are deterministic. Where the rules are clear, the cheapest agentic workflow is the one you never run. Let AI write ordinary code that does the work at no inference cost, and keep run-time AI for what needs it: documents, email, images, ad-hoc questions.
But once AI writes more code than people can review line by line, the limit is no longer generation. It is verification. A system described in one versioned definition — schema, rules, workflows, applications, permissions — can be checked by a compiler across the whole before a change ships. The agent finds its own mistakes in seconds, and people review intent rather than syntax.
What this looks like in practice: recently a steel fabricator we work with ran a complex, real estimating project through an off-the-shelf AI assistant on a standard $200-a-month plan. Because the assistant could reach the customer’s drawings and emails in one live system, it got most of the bill of materials right on the first attempt, using about 3% of the plan’s weekly limit. The estimators stayed in the loop and there is refinement ahead. The AI did not need to do unnecessary work; the foundation did the heavy lifting.
What a unified foundation gives up
Anyone who has sat through vendor pitches will be skeptical by now, so here is the other side. Consolidating the operational business onto one live foundation has real costs.
You give up some best-of-breed freedom. Departments lose the ability to pick any tool with its own private database. That flexibility has value, and some teams will feel it as a loss. The best tool for every job can still add up to the worst system for the business, but the trade is real.
You take on concentrated dependency. One foundation means one provider operating something critical. Do not accept “no lock-in” as an answer. Ask about data ownership, export in open formats, documented interfaces, contractual rights, and a practical exit plan.
You need an engine built for it. Operations and analytics on the same live data only works if the database can handle both, and if availability, backup, and recovery are excellent. One authoritative truth does not mean one physical copy on one server, but a concentrated foundation has to be engineered for it.
It does not happen overnight. No serious company rips out its ERP in a quarter. The workable path is one capability at a time, where the pain is sharpest, on a complete foundation from day one. Each step should retire a copy, not add one.
Integration does not disappear. Partners, customers, separate legal entities, and retained systems still need interfaces at genuine boundaries. The goal is no integration inside one operating business, not none anywhere.
Clean structure does not mean correct data. A person can still type the wrong quantity. What a unified foundation removes is two systems disagreeing about which quantity is real. That is a narrower claim, and it is the one that matters to an agent.
These are real costs. They are also paid once, and they shrink over time. The costs of the fragmented alternative — reconciliation, sync failures, stale reporting, agents reasoning across copies — recur every day and grow with every agent you add.
Stop trading, start asking
The next time an AI budget is framed as a choice against security or infrastructure, change the question. Ask:
- Can two parts of our systems disagree about a number? If so, which one does the agent believe? If the answer takes a diagram, that is where your tokens and your risk are going.
- What exactly can this agent see and do, and where is the log? If nobody can answer in a sentence, the governance is not there yet.
- Does this task need run-time AI at all? If the rule is clear, have AI build ordinary software instead and pay for inference once.
- How does AI check its own work before it reaches production?
Spending on the foundation is not money taken away from AI. It is what decides whether the AI spend pays off. The companies that get the most value from AI at the lowest cost will not be the ones with the cleverest model. They will be the ones that made the right data easy to reach and gave AI the means to check its own work.
