Gartner's 2x AI derisking rule falls hardest on engineering and security teams

Gartner's derisking ratio

Gartner's latest Business Quarterly advises organizations that, to protect the value they get from AI, they should plan to spend at least twice as much on derisking it as they spend on the tools themselves. The research frames the shortfall between expected and realized AI value as fundamentally a risk problem, split across three pillars: cost, cybersecurity and trustworthiness. Miss any one, Gartner argues, and the value being chased is lost.

That guidance targets CEOs and CFOs, but Manos Saratsis, writing on dev.to in a post originally published on the Dromeas blog, argues it lands fastest on engineering and security leaders, because the release pipeline is where AI-generated output becomes real software. He is explicit about the limits of that connection: Gartner's numbers concern AI in general rather than code, and mapping them onto releases is his interpretation, not the analyst firm's.

The numbers behind the risk gap

According to Gartner's CEO survey of 203 executives, conducted between April and May 2026:

• 75% of CEOs are increasing spending on technology, data and IT, while only 28% are increasing spending on security and risk.
• 37% of respondents say they are highly prepared for cyber escalation; for what Gartner calls AI industrialization, the figure is 20%.
• Only 23% of CxOs express confidence in their organization's generative AI outputs.

Gartner notes the survey reflects the executives it asked rather than the whole market, so it should be read as a signal rather than a census.

On cost, the research points to hidden outlays beyond license fees, including energy, data engineering, observability, workflow redesign and compliance audits, and reports that just 45% of senior functional leaders stayed within their planned 2025 AI budgets.

The release as the control point

Saratsis's core argument is that derisking AI sounds like an enterprise-wide governance effort, but software offers a single choke point every change must pass through: the release. It is the last moment a team can reject a change and the place where evidence can be attached to an approval.

Mapped onto Gartner's three pillars:

• Trustworthiness. If only 23% of leaders trust their AI outputs, an agent's own assurance that code is fine will not satisfy auditors or customers. A release should carry a verdict plus the evidence behind it: what was checked, what was found, and who or what signed off.
• Cybersecurity. Gartner's advice to CISOs emphasizes automated guardrails and containment over reviewer vigilance. For agent-written code, Saratsis suggests checks that run on every change and are scoped to what actually changed, so they stay fast enough that nobody routes around them. The 28% security-spend figure implies most security budgets were never sized for the volume of code agents produce.
• Cost. The engineering analogue of Gartner's hidden costs is rework: bugs and security findings caught after release cost far more than those caught before. Saratsis declines to put a multiplier on that claim, saying only that the direction is not in doubt.

Certify before pilots scale

One Gartner recommendation Saratsis singles out: no AI pilot should receive scale funding until the CFO, CIO and general counsel jointly certify its cost structure, value potential, data provenance and risk controls. His engineering translation is a short checklist: know which agents touch the codebase, including the ones developers installed themselves; gate every release on a documented verdict rather than intuition; retain the evidence so questions about why something shipped can be answered quickly; and keep an inventory of the AI components inside shipped software.

That last item draws on DataGrail's 2026 Privacy and AI Trends Report, which found that 63.6% of software vendors advertising AI capabilities do not disclose an AI subprocessor. A bill of materials for the AI inside a product matters more, the post notes, for organizations covered by the EU AI Act.

One caveat worth weighing: Saratsis works at Dromeas, which sells code review and release-check tooling with generated audit documentation, so he has a commercial stake in the argument that the release is where derisking money should go.

Why it matters

The 2x guidance reframes AI budgets as verification budgets. If the tooling line grows and the checking line does not, an organization is running exactly the imbalance Gartner describes, and its survey data suggests most already are, with security spending rising at 28% against 75% for technology overall. For engineering and security teams, the practical consequence is that release gates, automated diff-scoped checks and retained evidence stop being nice-to-haves and become funded requirements. It also shifts accountability: when only 23% of leaders trust AI outputs by default, the burden of proof moves to whoever signs the release.