There are two AI plans on the table and both are wrong. One is the multi-year transformation program with a steering committee and a roadmap that reaches past the current CEO’s tenure. The other is doing nothing until things settle down, which they will not. Between those two is where a security leader can actually show progress: one useful thing in a quarter, with bounded, understood risk.

Here’s the thing. The first project is not about the project. It is about proving the company can adopt AI on purpose, with controls, and come out the other side with something useful that meets defined acceptance criteria. Get that once and the second project is easy to approve. Skip it and every proposal after is the first one again.

Scope a 90-day AI pilot with a clear finish

Pick one low-risk, high-visibility use case. Lowest effort, highest gain, easiest to explain in a hallway. Summarizing internal documents that are not sensitive. Drafting first versions of routine responses. Answering questions from a policy manual with the source cited. The test is whether you can describe it in a sentence and whether the likely harms are understood and a practical stop and recovery plan exists.

Scope it to ninety days. One planning example is thirty days to discover, thirty to build, and thirty to deploy; adapt it to the work and approvals. If a use case needs a year, it is not the first project. The ninety-day box is not arbitrary. It is short enough that the people who started it are still there when it finishes, and long enough to do the boring parts properly.

Staff it for the quarter, not forever. The team that owns this is already short-handed, and a ninety-day project is the wrong reason to open a permanent requisition. Borrow the specialized skills you are missing for the defined stretch, and scope that person the way you would scope the AI itself: named systems, least access, an end date. Then write knowledge transfer into the engagement, so the runbook and the lessons stay with your team when the contractor leaves. A quick win that walks out the door with a consultant was not a win.

Define “done” and “safe” in writing before day one. What does the thing do when it works? What will you measure: answers with sources, time saved, tickets closed, complaints? And what does safe mean: which data it can reach, which actions it can take, who approves. Writing it down first is what turns a pilot into a control you can point at later, instead of a science project you have to explain.

Make it reversible. If you cannot turn it off in an afternoon, do not turn it on. Think of it like a circuit breaker. Nobody is planning to flip it, but knowing it is there is what lets you plug things in without worrying. A reversible first project means the risk conversation is short, because the answer to “what if it goes wrong” is “we stop it, assess the effects, and follow the recovery plan.” Turning it off does not undo data already disclosed or records already changed.

Tell the story internally when it works. This is the step that gets skipped, because engineers do not like to brag and security leaders do not like to draw attention. Do it anyway. A short note to the company: here is what we tried, here is what it did, here is what we learned, here is what is next. The first win is what earns the second. If nobody hears about it, it did not happen.

The key thing is that ninety days of visible, controlled progress changes how the whole organization talks about AI. It goes from “are we allowed” to “what is next,” and you are the person who made that happen with the guardrails already in place.

So basically the strategy is a stepping stone. Put one down, make sure it holds, and the far bank looks a lot closer than it did.

Practical next step: write down three candidate use cases and score each one on effort, visible payoff, and how fast you could turn it off. Pick the one that wins on all three. Then write the “done” and “safe” definitions before you tell anyone else about it.

Where Ovatio fits

An AI Readiness Assessment helps define the first useful project within an agreed scope. Project staffing can address a defined skills need and engagement window.