Better Questions Before Better Answers: Decision-Making with AI and Data
In the previous article in this GSX 2026 series, I reflected on Peter H. Diamandis’s message that AI is advancing faster than many of our security playbooks.
The next question is more practical: when AI gives us faster answers, how do we make sure we are making better decisions?
Cassie Kozerkov, Google’s first Chief Decision Scientist and a leading voice in decision intelligence, addressed that question in her GSX session, Upgrading Your Decision-Making with AI and Data. Her message was simple, but important: before we ask AI for an answer, we need to decide what we are actually trying to achieve.
AI can analyze information at extraordinary speed. It can summarize reports, identify patterns, surface possibilities, and support complex work. But it cannot determine our purpose for us. It cannot decide which tradeoffs are acceptable. And it cannot tell us what should never happen.
Those are leadership decisions.
The Question Before the Technology
Many AI conversations begin with a tool: Which platform should we use? Where can we automate? What can an agent do?
Kozerkov encouraged a different starting point:
What is worth wanting?
This question may sound abstract, but it is highly practical. It asks an organization to clarify its priorities before assigning technology to solve a problem.
In security, that could mean asking:
- What decision are we trying to improve?
- What outcome are we seeking?
- What risk are we willing to accept?
- What information do we trust?
- Who is accountable for the final action?
- What must not happen, even if the technology appears efficient?
Without this clarity, an AI tool can make an unclear process move faster. It can produce more reports, more recommendations, and more activity without improving the result.
The quality of the answer depends heavily on the quality of the question.
Judgment Comes Before Decision-Making
Kozerkov made a useful distinction between judgment and decision-making.
Decision-making is choosing among options. Judgment is the work that happens before that choice: defining the purpose, setting criteria, identifying boundaries, and deciding what success means.
She demonstrated this with a simple question: Is an animal a cat or not a cat?
At first, the answer seemed obvious. But it became less clear once the purpose of the classification system changed. Is the objective to identify any feline? A household pet? An adult animal that is safe to approach? The appropriate answer depends on the context.
The same principle applies to AI in security.
Before asking a system to prioritize incidents, detect anomalies, summarize video activity, assess risk, or recommend an action, we need to define the task's purpose. We need to know what information matters, what standard to use, and what action may follow.
Otherwise, the system may be technically accurate but operationally unhelpful.
AI Is the Genie, Not the Strategy
Kozerkov used an analogy that stayed with me: AI is like a genie.
The model is the genie. It can be powerful, capable, and increasingly available to almost everyone. But the genie is not the most important part of the story.
The “lamp” represents the controls around the technology: policies, access permissions, testing, approval processes, monitoring, and operating procedures. Those controls matter because they shape how people use technology.
But even the lamp is not enough.
The most important part is the person or organization making the wish.
In other words, AI's value depends on whether users can clearly describe what they want to achieve and the limits within which the technology must operate.
This becomes more important as organizations begin using agentic AI. A simple chatbot may provide a draft that a person reviews before acting. An agent may be able to access data, plan steps, interact with systems, and take actions with less direct supervision.
That creates opportunities, but it also increases the consequences of unclear objectives and weak controls.
The question is not whether an AI tool is impressive. The question is whether the organization has prepared itself to use that capability well.
Objectives and Boundaries Are the Language of AI
For many years, we have interacted with technology by giving it instructions. We explained each step a system should follow, and we could often trace the result back to those instructions.
Generative AI changes that relationship. It allows us to describe an objective in everyday language and ask the system to help determine the path.
That sounds simple, but it requires a different skill.
Organizations need to become more fluent in the language of objectives and boundaries:
- What do we want this process to accomplish?
- What quality standard is required?
- What information may be used?
- What information must be protected?
- Which actions require human approval?
- What decisions should be escalated?
- What conditions should stop the process?
Security professionals already think this way. Risk management requires defining exposure, establishing controls, identifying escalation paths, and understanding the consequences of failure.
That experience can help organizations adopt AI with more discipline. Security can contribute not only by identifying risks, but also by helping teams define the guardrails that enable responsible use.
Set the Criteria Before Reviewing the Data
One of the most valuable parts of the discussion focused on confirmation bias.
Confirmation bias can cause us to interpret the same information differently depending on what we already want to believe. A number may seem alarming when it supports a change we favor, or insignificant when it challenges a decision we already made.
The antidote is to establish the criteria before looking at the result.
Before reviewing a dashboard, requesting an analysis, or asking AI to evaluate options, determine what outcome would lead to action. What threshold would justify an investment? What combination of factors would require escalation? What result would indicate that a process needs to change?
This is especially important when decisions involve multiple data points. If we do not establish the criteria in advance, it is easy to select only the information that supports the conclusion we prefer.
Data should help us test our thinking. It should not simply make an existing opinion appear more objective.
Use AI to Protect Human Attention
AI also creates an opportunity to rethink how we use human attention.
Not every task deserves the same level of expertise and time. Repetitive, low-risk work may be appropriate for automation, delegation, or AI assistance. If that work can be handled reliably, people can focus more effort on decisions that require experience, context, creativity, and accountability.
Kozerkov suggested an honest review of how we are currently using AI. What are we asking these tools to do? Do our prompts, workflows, and agents reflect our real priorities?
This is a useful exercise for any organization.
Are we using AI to improve an important process, reduce unnecessary work, or strengthen a decision? Or are we simply finding faster ways to produce activity that does not materially improve the outcome?
The goal should not be to automate everything. It should be to invest our best attention where it has the greatest value.
Learn From Surprise, Not Only From Results
A good result does not always prove that a decision was well made. Sometimes a sound process produces a difficult outcome because of circumstances no one could control. At other times, a favorable result may include a significant amount of luck.
This is known as outcome bias: judging a decision's quality only by what happened afterward.
Instead, organizations should capture important decisions as they are made. Record the information available at the time, the assumptions, the alternatives considered, the expected outcome, and the reasons behind the choice.
Later, the most valuable source of learning is often surprise.
What happened that we did not expect? What information did we overlook? Which assumption needs to be revised? What should we include in the next decision process?
This approach helps organizations strengthen their judgment over time. It turns decision-making from a series of disconnected meetings into an organizational capability that can be reviewed, improved, and reused.
A Growing Leadership Role for Security
Security professionals are accustomed to complex environments. We consider people, facilities, technology, operations, data, risk, and business continuity at the same time. We understand that not every decision can be reduced to a single number or simple metric.
That systems perspective is valuable as organizations bring more AI into their operations.
Business leaders will need people who can translate objectives into practical controls, identify unintended consequences, define escalation paths, and help teams operate responsibly when information is incomplete and the stakes are real.
This is an opportunity for security professionals to contribute beyond systems and incidents. We can help organizations think more clearly about how decisions are made, where technology should assist, and where accountability must remain visible.
Five Questions Before Asking AI for an Answer
Before using AI to support an important decision, consider these five questions:
- What decision are we trying to improve?
Define the decision, its owner, and the action that may follow. - What outcome are we trying to achieve?
Be clear about the purpose, not only the task. - What are the criteria and boundaries?
Establish acceptable risk, quality expectations, thresholds, and non-negotiables before reviewing the information. - What should AI do, and what requires human review?
Use technology where it adds value, while keeping accountability clear. - How will we learn from the decision later?
Record assumptions, reasoning, and expected results so the team can learn from surprise rather than only from the final outcome.
The first article in this series asked us to recognize the speed of technological change. This one asks us to develop the discipline to use that technology well.
AI may help us reach answers faster. Better questions, clear objectives, and thoughtful decision processes are what help us reach the right ones.