The Specific Event

KPMG US CEO Tim Walsh has gone on record saying that the concern he keeps hearing from other executives is about cybersecurity risk as AI systems expand the organizational attack surface. This is not a surprising observation on its face. What is worth examining carefully is the structural reason why this concern dominates executive conversations, and why framing AI primarily as a cybersecurity problem is likely to produce worse organizational outcomes than framing it as a coordination problem.

Why Executives Default to the Threat Frame

The cybersecurity frame is cognitively accessible and organizationally familiar. Boards have threat committees. Firms have CISOs. There are established compliance regimes, vendor relationships, and insurance products built around the concept of digital threat. When AI enters the executive conversation, it gets routed through the nearest existing organizational schema, and for most large enterprises, that schema is risk mitigation, not capability development. This is a predictable consequence of what Kellogg, Valentine, and Christin (2020) describe as the tendency of organizations to interpret novel technological systems through incumbent control logics rather than through the logic of the system itself.

The problem is not that cybersecurity concerns are wrong. They are real. The problem is that threat-framing selectively activates certain organizational routines while suppressing others. When leadership asks "how do we defend against AI," they are less likely to simultaneously ask "how do we build the internal competencies to coordinate with AI systems effectively." These are not the same question, and organizations that default entirely to the first question tend to build compliance infrastructure without building adaptive capacity.

The Unlearning Problem Hidden Inside the Cybersecurity Conversation

A parallel piece of business commentary this week makes this tension visible from a different angle. Writing on enterprise AI transformation, several organizational commentators have argued that the critical variable in AI adoption is not implementation speed but what they call "strategic unlearning," the deliberate dismantling of process assumptions that no longer apply when AI systems are embedded in workflows. This framing is closer to the actual organizational problem, though it still underspecifies the mechanism.

What unlearning actually requires, at the cognitive level, is schema revision rather than procedure revision. Hatano and Inagaki (1986) distinguished routine expertise, the ability to execute procedures reliably, from adaptive expertise, the ability to modify one's approach when the underlying problem structure changes. Executives who have built careers on managing identifiable risks through established governance channels have deep routine expertise in that domain. AI coordination does not call for more of that expertise. It calls for a different kind of reasoning about organizational systems, one that existing seniority and experience do not automatically provide.

The Governance Mismatch

What Walsh is observing in his peer conversations is the early expression of a governance mismatch. Executives recognize that AI changes their risk profile, and they are reaching for the governance tools they already possess. This is rational behavior given their institutional context, but it produces a structural gap. The gap is between awareness of AI as a consequential organizational variable and the capacity to govern AI as a coordination system rather than a threat vector.

Rahman (2021) documented a similar dynamic in platform work contexts, where organizational actors who were aware of algorithmic influence over their outcomes nonetheless lacked the structural understanding to translate that awareness into effective action. The awareness-capability gap is not a problem of information access. It is a problem of schema inadequacy. Executives hearing the same AI risk briefings from consultants and vendors are accumulating information without necessarily building the structural understanding that would allow them to act differently.

What the Right Question Actually Is

The question KPMG and its peers should be facilitating in those executive conversations is not only "how do we protect organizational boundaries from AI-enabled threats," but "how do we build organizations capable of coordinating with AI systems whose decision logic is partially opaque, rapidly evolving, and consequential to operational outcomes." The second question does not replace the first. But it activates a different set of organizational capabilities, and it is the question that most executive conversations, by Walsh's own account, are not yet asking with sufficient precision.

The cybersecurity frame is a starting point. It should not become the ceiling of organizational thinking about AI governance. The transition from threat-awareness to structural competence is exactly the kind of schema revision that Gentner (1983) argued requires deliberate analogical reasoning across domains, not just incremental elaboration of existing frameworks. Until executive conversations move in that direction, the concern Walsh keeps hearing will remain a symptom in search of a diagnosis.

References

Gentner, D. (1983). Structure-mapping: A theoretical framework for analogy. Cognitive Science, 7(2), 155-170.

Hatano, G., & Inagaki, K. (1986). Two courses of expertise. In H. Stevenson, H. Azuma, & K. Hakuta (Eds.), Child development and education in Japan (pp. 262-272). Freeman.

Kellogg, K. C., Valentine, M. A., & Christin, A. (2020). Algorithms at work: The new contested terrain of control. Academy of Management Annals, 14(1), 366-410.

Rahman, H. A. (2021). The invisible cage: Workers' reactivity to opaque algorithmic evaluations. Administrative Science Quarterly, 66(4), 945-988.