This is part 3 of 3 in a series of posts: The Missing Layer in Cybersecurity. You can catch up on part 1 here, and part 2 here if you haven’t read them yet.

A recent survey of 200 U.S. cybersecurity leaders found that 100% of organizations had granted security or compliance exceptions in the past year to move high-risk digital work forward (Replica Cyber Exception Economy Report). What was once a carve-out for genuine emergencies has become standard operating procedure, and most leadership teams do not have clear visibility into how often it is happening or what it is costing.

High-Risk Work Is No Longer Confined

Three years ago, most of the work that required direct engagement with untrusted content sat in specialized functions such as dedicated security teams, specific fraud units, niche threat intelligence groups. Those teams had their own challenges, but the practitioners doing this kind of work had been bounded…not anymore.

Widespread AI adoption has put model evaluation and agent testing on the project list of technology teams that had no such function in 2022. A team assessing a third-party AI tool before deployment is now doing the same category of work that malware analysts do: running untrusted code in an environment they also use for other things, and hoping the separation holds.

Fraud and financial crime teams are doing more of their investigative work further into hostile territory. Cryptocurrency tracing, scam operation research, account investigation in criminal networks. This work has extended well beyond what a standard compliance environment was designed to support. AML investigators are touching external systems and data that exist outside the normal corporate perimeter, often with no dedicated infrastructure to do it from.

Threat intelligence has distributed from specialized teams into broader security organizations. Analysts investigating adversary infrastructure and accessing hostile sites are now common across security teams of varying sizes and maturity levels.

The aggregate result is that high-risk work has become a regular part of the week for a much larger share of the workforce than it was five years ago. The infrastructure to support it has not kept pace.

Governance Reaches Its Ceiling

When teams need to conduct high-risk work without dedicated environments, the options narrow fast. The organizations in our survey settled into a recognizable set of responses: proceed on corporate systems despite reservations, delay or cancel the work, or hand it to a third party.

Each of those carries a real cost. Proceeding on corporate systems is the path most organizations take, and it is the one that turns every high-risk investigation or evaluation into a potential exposure. Delays and cancellations mean the work does not get done at the pace the business requires. Third-party handoffs solve the infrastructure problem by creating a dependency and a new risk surface.

The approval process that precedes most of these decisions (the exception, the sign-off, the formal waiver) does not change the underlying exposure. It documents that someone made a decision. What a change management approval cannot do is prevent malware analyzed on a corporate endpoint from propagating if something goes wrong or prevent a dark web investigation from creating a path back to production data.

Governance documents the risk, but unfortunately, it still isn’t contained.

Separation

A purpose-built environment for high-risk work changes what a failure can reach, not the work itself. The analyst still conducts the investigation. The engineer still evaluates the model. The fraud team still traces the transaction. What changes is that a failure in that environment stays within the boundary of the isolated environment rather than propagating into the systems the organization depends on.

The risky activity still needs governance, monitoring, and policy. Those things do not become irrelevant. They become more effective, because the environment they are governing is separated from the environment that cannot afford to fail.

The organizations that have built this infrastructure describe the same operational shift: their teams move faster on high-risk work, not slower, because the question of whether to proceed stops being tangled up with questions about what a failure might reach.

Both Spending and Risk are Up

U.S. cybercrime losses are up 33% year over year (IC3 Annual Report). The average data breach now costs $4.4 million globally (IBM Cost of a Data Breach Report). AI-assisted fraud is outpacing the investigative infrastructure built to counter it. The volume of high-risk digital work will increase, not decrease, as AI adoption continues and threat actors grow more sophisticated.

The governance layer that the industry has built over thirty years has immense value, but now, the scale of high-risk work now being performed as routine business has grown past what governance alone was designed to handle. The containment layer is the part of the risk model that most organizations have not built yet. The data on exceptions, losses, and exposure suggests the cost of that absence is no longer theoretical.

To learn more about secure environments for high-risk work, check out our demo video.

This is part 2 of 3 in a series of posts: The Missing Layer in Cybersecurity. If you missed part 1, you can read it here.

In 1912, the Titanic sank in less than three hours. The ship had watertight bulkheads designed to contain flooding before it could spread. The design seemed to make sense, but these bulkheads only extended partway up the hull, so water went over top and filled each adjacent compartment in sequence. The water was contained, yes…but the boundary was wrong.

That failure gets taught in engineering programs to this day, because it illustrated something every mature industry eventually learns: when a process is inherently dangerous, containing the consequences of failure matters as much as preventing it.

Has cybersecurity learned this lesson for infrastructure? Has it been implemented correctly?

Drawing Boundaries

This is part 1 of 3 in a series of posts: The Missing Layer in Cybersecurity

The cybersecurity industry has spent thirty years and hundreds of billions of dollars building better defenses. Frameworks, certifications, compliance programs, vendor ecosystems, detection tools. The investment has been real, and it has made a difference, right? The trendline is hard to explain—as is the ROI.

Cybercrime is projected to cost $12.2 trillion annually by 2031 (Cybersecurity Ventures). U.S. cybercrime losses climbed 33% in 2024 (IC3 Annual Report). Consumer fraud losses rose 25% in the same year (FTC Consumer Fraud Data). Financial crime runs above $4 .4 trillion globally per year (Nasdaq Global Financial Crime Report), while institutions spend $190 billion annually on compliance operations just to fight it (Celent: IT and Operational Spending on Financial Crime Compliance, 2024). More spending, more programs, worse outcomes.

The standard response to those numbers is to invest more on the same things: better policies, stricter approvals, more monitoring, expanded detection, faster response. Those investments are defensible, but they share a structural limitation that the industry has been slow to name.

Governance, Behavior & Outcomes

Governance works by influencing what people do, and it reduces the probability of a bad outcome. There’s value in that, of course, and no serious organization should stop investing in it.

What governance cannot do is control what a bad outcome can reach once it occurs. A policy can make unauthorized activity less likely. It cannot prevent that activity from propagating through the network if it happens anyway. An approval workflow can require sign-off before someone accesses sensitive data. It cannot contain the exposure if that access turns out to be compromised.

There is a deeper question—one most organizations have never fully built infrastructure to answer—if something does go wrong, what can it reach? That is a different risk model. So, it requires a different kind of investment.

The Impact of Infrastructure

Security teams oftentimes analyze malware from the same machines they use for everything else. Threat intelligence analysts investigate adversary infrastructure, run persona operations, and visit hostile websites from corporate endpoints. Fraud investigators trace cryptocurrency and dig through account activity connected to criminal networks. Technology teams evaluate AI models before deployment and run code from sources they cannot fully vet, often from standard development environments.

This type of core business activity is expanding. The volume of work that requires direct engagement with untrusted content has grown significantly in the past few years, and AI adoption is accelerating it further.

Governance responds to this with controls: acceptable use policies, monitoring, approval workflows, user training. Those controls are real. But the risky activity still occurs on trusted infrastructure. If something goes wrong, the environment that’s trusted is also the environment where it goes wrong. That is an architectural problem, and governance frameworks are not designed to solve it.

The Unfunded Risk Model

While the cybersecurity industry has continued to build out a robust governance layer, there isn’t a real containment solution. There is no widely adopted, purpose-built environment where risky work can happen without directly exposing trusted systems. Governance manages behavior, true…but containment manages consequences.

Every dollar of fraud loss produces roughly $4.41 in total downstream costs (LexisNexis 2024 True Cost of Fraud Study). Every exception granted to push high-risk work through corporate infrastructure is an exposure that compounds costs. At the frequency those exceptions are now being granted, the aggregate risk is no longer a footnote in a compliance report.

The governance layer needed to come first, and it still needs investment. The next layer of risk reduction requires building something different.

Continue with part 2: how mature industries have already solved for the governance challenge, and what lessons you can take from them.