The Security Cost of Intelligence: AI Capability, Cyber Risk, and Deployment Paradox
For firms and policymakers, this work highlights that governance maturity is a prerequisite for translating AI capability gains into productive deployment, rather than a mere constraint.
The paper models how firms' AI deployment decisions are affected by cybersecurity risks when governance controls lag behind AI capability, finding a deployment paradox where better AI can reduce deployment in high-loss environments. Optimal deployment falls below the no-risk benchmark, with the shortfall widening as breach-loss magnitude and authority exposure increase.
Firms are deploying more capable AI systems, but organizational controls often have not kept pace. These systems can generate greater productivity gains, but high-value uses require broader authority exposure -- data access, workflow integration, and delegated authority -- when governance controls have not yet decoupled capability from authority exposure. We develop an analytical model in which a firm jointly chooses AI deployment and cybersecurity investment under this governance-capability gap. The central result shows a deployment paradox: in high-loss environments, better AI can lead a firm to deploy less when capability is deployed through broader authority exposure under weak governance. Optimal deployment also falls below the no-risk benchmark, and this shortfall widens with breach-loss magnitude and with the authority exposure attached to more capable systems. Governance investment that reduces breach-loss magnitude shrinks the paradox region itself, while breach externalities expand the range of environments in which deployment is socially constrained. Governance maturity is therefore not merely a constraint on AI adoption. It is a condition that shapes whether capability improvements translate into productive deployment.