13. Enterprise Strategy, Frameworks and Digital Transformation

Introduction and Context

Cybersecurity is no longer a specialist activity confined to network operations or compliance departments. It is an enterprise capability that influences strategy, architecture, investment, customer trust, operational resilience, legal exposure, and organizational legitimacy. Digital transformation intensifies this relationship. Cloud services, application programming interfaces, artificial intelligence, connected devices, remote work, platform ecosystems, and data-driven business models create new opportunities while expanding the attack surface and increasing dependence on third parties.

The strategic problem is therefore not simply how to purchase better security technology. It is how to decide which risks matter most to the enterprise, how much risk is acceptable, how security requirements should shape business and technology decisions, and how leaders can determine whether investment is producing meaningful reduction in exposure. This requires integration among enterprise architecture, corporate governance, risk management, portfolio management, procurement, internal audit, and operational security.

Several frameworks support this integration. The NIST Cybersecurity Framework (CSF) 2.0 provides a flexible vocabulary and outcome-oriented structure. ISO/IEC 27001 defines requirements for an information security management system (ISMS). COBIT connects governance and management of information and technology with enterprise objectives. The CIS Controls provide prioritized, practical safeguards. These frameworks are complementary rather than interchangeable. Strategic competence depends on understanding their purposes, mapping them intelligently, and avoiding the assumption that certification or checklist completion is equivalent to security.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain cybersecurity as an enterprise strategy and governance concern.

2. Compare the purposes and relationships of NIST CSF 2.0, ISO/IEC 27001, COBIT, and CIS Controls.

3. Align cyber risk, enterprise architecture, portfolios, budgets, and digital transformation.

4. Design governance approaches for suppliers, cloud providers, and software supply chains.

5. Construct meaningful executive reporting and security performance measures.

6. Critically evaluate strategic limitations, trade-offs, and emerging developments.

From Security Function to Enterprise Capability

An enterprise capability is the combined ability of people, processes, information, technology, authority, and funding to produce a repeatable outcome. Cybersecurity becomes a capability when responsibility is distributed across the enterprise rather than assigned exclusively to a chief information security officer (CISO). The board governs risk appetite and oversight; executives allocate resources and accept residual risk; architects embed security into business and technology design; product owners protect services; procurement manages supplier requirements; and employees and contractors perform assigned controls.

This perspective changes the central question from “Is the security department compliant?” to “Can the enterprise prevent, withstand, respond to, and recover from events that threaten important objectives?” A hospital, for example, may tolerate temporary unavailability of an internal social platform but not prolonged disruption of clinical systems. A manufacturer may regard manipulation of operational technology as more consequential than theft of ordinary marketing data. Risk must therefore be expressed in relation to mission, value creation, safety, legal duties, and continuity.

Enterprise architecture provides an important bridge. Business architecture identifies capabilities and value streams; data architecture describes information assets and flows; application architecture maps systems and dependencies; and technology architecture describes infrastructure, platforms, networks, and devices. Security architecture overlays these domains with trust boundaries, identity relationships, control requirements, threat assumptions, and recovery dependencies. Security decisions made without architectural context often produce duplicated tools, unmanaged interfaces, inconsistent identity models, and controls that protect low-value assets while critical pathways remain exposed.

A Strategic Vocabulary for Cybersecurity

Cyber risk is the effect of uncertainty on enterprise objectives arising from digital systems, information, people, suppliers, or connected operations. Risk is not synonymous with a vulnerability or threat. A vulnerability is a weakness; a threat is a potentially harmful circumstance or actor; an event is an occurrence; and risk combines potential consequence with uncertainty about occurrence and impact.

Risk appetite is the broad amount and type of risk an organization is willing to pursue or retain in achieving objectives. Risk tolerance defines acceptable variation around specific objectives. Residual risk is the exposure remaining after controls are applied. Risk acceptance is a deliberate decision by an authorized person to retain that exposure; it is not the same as failing to remediate it.

Security objectives should be translated into business outcomes. Confidentiality, integrity, and availability remain foundational, but strategic contexts may also require authenticity, accountability, safety, privacy, resilience, and non-repudiation. Cyber resilience emphasizes the capacity to anticipate, withstand, recover from, and adapt to adverse conditions.

Digital transformation is a sustained redesign of products, processes, relationships, and operating models through digital technologies and data. It differs from digitization, which converts analogue information into digital form, and digitalization, which improves existing processes using digital tools. Transformation changes how value is created and consequently changes the organization’s risk model.

Four Frameworks and Their Strategic Roles

NIST Cybersecurity Framework 2.0

NIST CSF 2.0 organizes cybersecurity outcomes through six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The addition of Govern emphasizes that cybersecurity decisions are inseparable from organizational strategy, supply chains, roles, policies, oversight, and risk management. The framework is intentionally flexible: it does not prescribe a single technology, organizational structure, or implementation sequence.

Organizations can describe a Current Profile, representing present outcomes, and a Target Profile, representing desired outcomes. A gap analysis then supports prioritization. Tiers provide context about the rigor and sophistication of governance and risk management, although they should not be treated as a maturity score or a universal ranking. CSF 2.0 is especially useful for executive communication, cross-functional alignment, and organizing transformation road maps.

ISO/IEC 27001

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS. It requires organizational context, leadership, risk assessment and treatment, objectives, documented information, operational controls, performance evaluation, internal audit, and management review. Annex A offers a reference set of controls, but an organization is not expected to implement every control without risk-based justification. The Statement of Applicability records which controls are included, excluded, and justified.

The ISMS is valuable because it institutionalizes a management cycle rather than treating security as a one-time project. Certification by an accredited body may provide assurance to customers and partners, but certification does not prove that every threat is prevented or that the organization is secure in an absolute sense. Scope is crucial: a narrowly scoped ISMS may be valid while excluding strategically important services.

COBIT

COBIT is a governance and management framework for enterprise information and technology. It distinguishes governance—evaluating stakeholder needs, directing priorities, and monitoring performance—from management activities that plan, build, run, and monitor services. COBIT’s objectives, design factors, performance management, and focus areas help organizations connect technology processes to enterprise goals, risk, resources, and compliance.

COBIT is particularly useful for boards, audit committees, CIO functions, enterprise governance, and assurance. It helps answer questions such as whether decision rights are clear, whether performance is measured, whether benefits are realized, and whether technology risk is integrated into enterprise governance. It is not a technical control catalogue and should not be used as a substitute for operational security engineering.

CIS Controls

The CIS Controls are prioritized safeguards intended to reduce common attack pathways. They translate broad security expectations into concrete practices such as asset inventory, software inventory, data protection, secure configuration, account management, vulnerability management, audit logging, email and browser protections, malware defenses, and incident response. Implementation Groups support proportionate adoption based on organizational risk and resources.

CIS Controls are effective for establishing a practical baseline and converting strategic priorities into operational work. Their limitation is that a control list alone does not establish enterprise governance, risk appetite, business alignment, or assurance. They should be embedded in a wider management system and adapted to sector, architecture, and mission.

Complementarity and Mapping

A useful relationship is to treat the frameworks as operating at different levels. COBIT helps govern and direct enterprise technology. NIST CSF 2.0 provides an outcome-oriented cybersecurity structure and common language. ISO/IEC 27001 supplies a formal management system and assurance discipline. CIS Controls support implementation of prioritized safeguards.

Mapping can reduce duplicate reporting, but it can also create false confidence. Similar words do not always indicate equivalent requirements. A mapped control must be examined for scope, strength, ownership, evidence, frequency, and effectiveness. Framework integration should therefore begin with business outcomes and risk scenarios, not with a spreadsheet that mechanically equates clauses.

Governing Portfolios, Budgets, and Architecture

Cybersecurity investment should be managed as a portfolio rather than a collection of unrelated tool purchases. A portfolio may include identity modernization, secure software development, resilience improvements, data protection, detection engineering, third-party assurance, workforce capability, and legacy-system replacement. Each initiative should have a problem statement, affected business capability, risk scenario, dependencies, expected outcome, cost profile, accountable owner, and method of evaluation.

Budget decisions involve trade-offs. Preventive controls may reduce the probability of an event, while resilience investments reduce duration and consequence. A security operations platform may improve detection but create staffing and integration costs. A zero-trust program may reduce implicit trust but require identity remediation, application redesign, and user-experience investment. Sound governance compares alternatives using risk reduction, regulatory necessity, architectural fit, operational feasibility, time to benefit, and opportunity cost.

Quantitative risk analysis can support decisions when data quality permits, but numerical precision should not conceal uncertainty. Expected-loss estimates are sensitive to assumptions about event frequency, impact, control effectiveness, and dependency relationships. Qualitative analysis remains appropriate where consequences include safety, reputation, strategic disclosure, or social harm that cannot be reliably monetized. Scenario analysis, sensitivity testing, and explicit confidence statements strengthen executive decisions.

Architecture review should occur before procurement and design become irreversible. Security requirements should be expressed in terms of identity, data flows, trust boundaries, resilience, logging, recovery, privacy, and supplier dependence. Patterns such as centralized identity, least privilege, segmentation, secure interfaces, immutable backups, and policy-as-code can accelerate delivery when treated as reusable architectural capabilities rather than isolated controls.

Third Parties and Digital Supply Chains

Modern enterprises are ecosystems. Cloud providers host workloads, software vendors deliver libraries and updates, managed service providers operate infrastructure, and business partners exchange data through interfaces. A supplier can therefore become a path into the enterprise, a source of operational disruption, or a processor of regulated information.

Third-party risk management should begin with criticality and dependency analysis. Not every supplier requires the same due diligence. Important questions include: What service does the supplier support? What data can it access? Can it affect safety or revenue? What recovery alternatives exist? Where are operations performed? Which subcontractors are involved? How quickly must an incident be reported? How can access be revoked and data returned or destroyed?

Contracts should translate risk decisions into enforceable obligations. Depending on context, these may include security standards, breach notification, audit rights, vulnerability disclosure, access controls, encryption, personnel requirements, business continuity, recovery testing, geographic restrictions, subcontractor governance, evidence retention, and exit assistance. Questionnaires are useful for screening but are weak evidence when unsupported by independent reports, testing results, architecture discussions, or direct assurance.

Software supply-chain governance extends beyond vendors. It includes open-source components, build pipelines, package repositories, signing processes, developer identities, provenance information, secrets, and update mechanisms. Software bills of materials can improve visibility, but they do not by themselves establish that components are safe. Organizations must also manage vulnerability response, dependency ownership, secure development practices, and the ability to rebuild or replace compromised components.

Executive Reporting and Assurance

Executives require information that supports decisions, not operational noise. A board report should connect cyber conditions to strategic objectives and typically address material risks, changes since the previous period, significant incidents, resilience of critical services, third-party exposure, regulatory obligations, investment progress, and decisions requiring leadership attention.

Useful measures distinguish activity, capability, and outcome. The number of vulnerabilities closed is an activity measure; the proportion of critical assets covered by reliable vulnerability management is a capability measure; reduced exposure to exploitable weaknesses in critical services is closer to an outcome. Mean time to detect and recover can be useful, but averages may conceal severe outliers. Better reporting includes distributions, trends, coverage, confidence, exceptions, and business impact.

Metrics should have defined populations, owners, collection methods, frequencies, targets, and limitations. For example, “95 percent patch compliance” is ambiguous unless the organization defines what assets count, which severity levels apply, the measurement date, and whether excluded systems are concentrated in critical environments. Independent assurance through internal audit, control testing, exercises, red-team activity, supplier reviews, and management attestations helps validate reported claims.

An Illustrative Case: Meridian Health Network

Background

Meridian Health Network, a fictional regional healthcare group, operates hospitals, outpatient clinics, laboratories, and a patient portal. It has grown through acquisitions and uses several electronic health-record environments, cloud-hosted analytics, medical devices, and outsourced revenue-cycle services.

Situation and Problem

The board receives numerous reports: vulnerability counts, phishing statistics, audit findings, and supplier questionnaires. Yet leaders cannot determine whether clinical services are resilient. Identity systems differ across acquired entities, several medical devices cannot be patched easily, and a critical cloud supplier has access to sensitive data. A proposed security budget focuses on purchasing a new detection platform without addressing architectural fragmentation.

Analysis

The CISO and enterprise architect first identify critical capabilities and services rather than beginning with tools. Patient registration, medication administration, emergency communications, laboratory reporting, and clinical records are classified as high-consequence services. Dependency mapping reveals that identity, network connectivity, a cloud analytics platform, and a managed service provider support several of them.

A NIST CSF 2.0 Current Profile shows strong detection in the central environment but weak governance of acquisitions, inconsistent asset visibility, and incomplete recovery testing. An ISO/IEC 27001 risk assessment identifies unclear ownership and inadequate supplier evidence. COBIT analysis shows that investment decisions are not linked consistently to enterprise objectives or benefits realization. CIS Controls provide a practical sequence for asset inventory, account management, secure configuration, vulnerability management, logging, and recovery safeguards.

Strategy and Solution

Meridian establishes a board-approved cyber risk appetite and assigns service owners for critical clinical capabilities. Its portfolio is rebalanced into four streams: identity consolidation, clinical-service resilience, supplier and cloud assurance, and detection and response engineering. The architecture team creates a common identity pattern, privileged-access controls, segmentation requirements, and recovery objectives. Procurement introduces tiered supplier due diligence and contract clauses based on criticality.

Instead of reporting raw vulnerability totals, executives receive service-oriented measures: percentage of critical services with tested recovery procedures, privileged accounts under strong authentication, critical suppliers with validated continuity evidence, and unresolved high-risk exceptions with accountable owners. The ISMS provides continual review, COBIT governance practices clarify decision rights, the CSF Target Profile organizes desired outcomes, and CIS safeguards guide implementation.

Outcome

After the first planning cycle, Meridian has not eliminated all risk, and some legacy devices remain difficult to secure. However, leadership can identify its most important dependencies, prioritize investment, and understand which risks are accepted. Recovery exercises expose weaknesses that ordinary compliance reviews had missed. The major improvement is not a single security product but a shared governance model connecting clinical mission, architecture, suppliers, budget, and assurance.

Learning Points

The case illustrates five strategic lessons: critical services should anchor prioritization; frameworks are most effective when combined by purpose; architecture and procurement are security decisions; metrics must describe exposure and resilience rather than activity alone; and residual risk requires explicit ownership.

Challenges, Limitations, and Common Errors

Framework proliferation can create administrative burden, especially when teams maintain separate inventories, assessments, and dashboards for each standard. A single integrated control environment with traceable mappings is preferable, but mappings must preserve the distinct intent of each framework.

Compliance bias is another danger. Organizations may optimize for audit evidence while neglecting unmeasured risks, unsafe workarounds, technical debt, or rapidly changing dependencies. Similarly, maturity models can encourage symbolic improvement in scores without demonstrable reduction in harm. Frameworks are abstractions; they cannot replace threat intelligence, engineering judgment, testing, or knowledge of organizational culture.

Other common errors include treating risk registers as static lists, accepting supplier attestations without examining scope, measuring speed rather than quality of response, assuming cloud responsibility is transferred to the provider, and implementing zero trust as a product rather than an architectural and governance approach. Overcentralization can also slow business delivery, while excessive decentralization can produce inconsistent control and accountability.

Ethical, Regulatory, and Professional Considerations

Strategic cybersecurity decisions affect privacy, autonomy, equality, safety, and access to essential services. Surveillance used to improve security may intrude on employees or customers; automated fraud detection may disadvantage particular groups; and strict authentication requirements may exclude people with disabilities or limited connectivity. Proportionality, necessity, transparency, data minimization, accessibility, and due process should inform such decisions.

Regulatory obligations vary by jurisdiction and sector, but governance should address privacy, breach reporting, records management, critical infrastructure, outsourcing, resilience, and sector-specific safety duties. Legal compliance is a floor, not a complete security strategy. Professionals should communicate uncertainty honestly, preserve evidence, avoid misleading assurance statements, and escalate material risks even when doing so creates organizational discomfort.

Digital Transformation, Automation, and Emerging Practice

Cloud-native architecture, infrastructure as code, continuous delivery, application programming interfaces, and artificial intelligence make security more programmable. Policy-as-code can enforce configuration requirements; automated identity governance can detect excessive privileges; security orchestration can accelerate containment; and analytics can identify anomalous behavior across large environments. These capabilities improve scale but also amplify errors. A flawed automation rule can propagate rapidly, and an AI model may generate false positives, expose sensitive data, or be manipulated by adversarial input.

Emerging practice is moving toward continuous control monitoring, machine-readable evidence, software provenance, confidential computing, improved identity standards, and resilience engineering. Generative AI is being used for code assistance, security analysis, and incident triage, while creating risks involving data leakage, insecure generated code, prompt manipulation, model supply chains, and unclear accountability. Governance should require approved use cases, data controls, human review, testing, logging, and clear responsibility.

Digital transformation should therefore be security-enabled rather than security-delayed. Security teams need product and architecture literacy, while business leaders need sufficient cyber understanding to make informed trade-offs. The strategic objective is not perfect prevention; it is trustworthy, adaptive, and recoverable enterprise performance.

Best-Practice Principles

Effective enterprise cybersecurity strategy generally follows these principles:

• Anchor priorities in critical services, business capabilities, and plausible harm.
• Assign risk ownership to accountable business leaders, not only security specialists.
• Use each framework for its intended purpose and maintain transparent mappings.
• Integrate security architecture into product, procurement, and transformation decisions.
• Fund a balanced portfolio covering prevention, detection, response, recovery, and capability.
• Govern third parties according to criticality, access, data, and substitutability.
• Report trends, coverage, outcomes, uncertainty, and exceptions rather than raw activity.
• Test controls and recovery arrangements under realistic conditions.
• Treat privacy, accessibility, safety, and fairness as strategic design requirements.
• Reassess risk when business models, technologies, suppliers, or threat conditions change.

Chapter Summary

Enterprise cybersecurity is a governance and strategy capability that connects business objectives, architecture, risk, investment, suppliers, and operational resilience. NIST CSF 2.0 provides flexible outcome language through Govern, Identify, Protect, Detect, Respond, and Recover. ISO/IEC 27001 establishes a risk-based ISMS and continual-improvement discipline. COBIT links governance and management of information and technology to enterprise objectives, while CIS Controls translate priorities into practical safeguards. Their value increases when they are integrated without confusing their purposes.

Strategic implementation requires service-based prioritization, explicit risk ownership, portfolio governance, security-informed architecture, proportionate third-party controls, and executive reporting focused on outcomes. Digital transformation expands both value and dependency, making identity, data, software supply chains, automation, resilience, privacy, and ethical judgment central to enterprise design. No framework eliminates uncertainty; effective governance makes uncertainty visible and decisions accountable.

Key Terms

Risk appetite: The amount and type of risk an organization is willing to pursue or retain.

Risk tolerance: The acceptable variation around a particular objective or risk condition.

Residual risk: Risk remaining after controls and treatments are applied.

Cyber resilience: The ability to anticipate, withstand, recover from, and adapt to adverse cyber conditions.

Enterprise architecture: The structured description of business, information, application, and technology domains and their relationships.

Digital transformation: Redesign of organizational value creation and operations through digital technologies and data.

NIST CSF 2.0: An outcome-oriented framework organized around Govern, Identify, Protect, Detect, Respond, and Recover.

Current Profile: A description of an organization’s existing cybersecurity outcomes and practices using the CSF.

Target Profile: A description of desired cybersecurity outcomes used to guide improvement.

ISO/IEC 27001: An international standard specifying requirements for an information security management system.

ISMS: A systematic management structure for governing information security through risk assessment, controls, review, and improvement.

Statement of Applicability: A record explaining which ISO/IEC 27001 controls apply and why.

COBIT: A framework for governance and management of enterprise information and technology.

CIS Controls: Prioritized safeguards designed to reduce common cybersecurity attack paths.

Portfolio governance: Coordinated prioritization and oversight of related investments and initiatives.

Third-party risk: Exposure arising from suppliers, service providers, partners, or other external dependencies.

Software supply chain: The people, processes, tools, components, and services involved in producing and delivering software.

Security architecture: The design of security capabilities, trust relationships, controls, and recovery properties across an enterprise.

Continuous control monitoring: Ongoing collection and analysis of evidence about control operation and exposure.

Residual risk acceptance: An authorized decision to retain identified risk after treatment options are considered.

Review Questions

Short Answer Questions

1. Why should cybersecurity be treated as an enterprise capability rather than solely as an IT function?

2. Distinguish risk appetite, risk tolerance, and residual risk.

3. What are the six functions of NIST CSF 2.0?

4. What is the purpose of an ISO/IEC 27001 Statement of Applicability?

5. Why are raw vulnerability counts insufficient for executive reporting?

Long Answer Questions

1. Compare the strategic purposes of NIST CSF 2.0, ISO/IEC 27001, COBIT, and CIS Controls.

2. Explain how enterprise architecture can improve cybersecurity investment and digital transformation.

3. Discuss how an organization should govern critical suppliers and cloud service providers.

4. Analyze the advantages and limitations of managing cybersecurity through a portfolio model.

5. Explain why certification and compliance do not necessarily demonstrate effective cybersecurity.

Analytical / Application Questions

1. A university is migrating student services to the cloud while retaining several legacy systems. Develop a framework-based strategy for identifying critical services, assigning risk ownership, and prioritizing investment.

2. An executive dashboard reports a 98 percent patching rate, but a ransomware incident disrupts a critical service. Analyze how the measurement system failed and propose improved indicators.

3. A software provider refuses audit rights but offers a recent independent assurance report. Decide what additional evidence and contractual protections should be required before the provider is classified as critical.

22. Multiple Choice Questions with Answers

Question 1

Which framework function in NIST CSF 2.0 most directly emphasizes cybersecurity strategy, roles, oversight, and supply-chain governance?

A. Govern

B. Protect

C. Detect

D. Recover

Correct Answer: A. Govern

Question 2

What is the principal strategic contribution of ISO/IEC 27001?

A. It provides only a list of technical firewall rules.

B. It establishes a risk-based information security management system.

C. It replaces enterprise architecture planning.

D. It guarantees that no security incident will occur.

Correct Answer: B. It establishes a risk-based information security management system.

Question 3

An organization wants to connect technology decisions with enterprise objectives, benefits, accountability, and oversight. Which framework is most directly suited to this purpose?

A. CIS Controls

B. COBIT

C. NIST CSF Profiles only

D. A vulnerability scanner

Correct Answer: B. COBIT

Question 4

Why should CIS Controls normally be used with broader governance frameworks?

A. They cannot address any operational safeguards.

B. They provide practical safeguards but do not by themselves establish enterprise risk governance.

C. They are designed only for legal compliance.

D. They eliminate the need for security architecture.

Correct Answer: B. They provide practical safeguards but do not by themselves establish enterprise risk governance.

Question 5

Which measure is most clearly an outcome-oriented executive indicator?

A. Number of security meetings held

B. Number of alerts generated

C. Percentage of critical services with tested recovery procedures

D. Number of pages in the security policy

Correct Answer: C. Percentage of critical services with tested recovery procedures

Question 6

A supplier processes sensitive data and supports a service with no practical substitute. Which response is most appropriate?

A. Apply the same questionnaire used for every low-risk supplier.

B. Ignore the supplier because the service is outsourced.

C. Use tiered due diligence, stronger contractual obligations, and validated continuity evidence.

D. Require the supplier to purchase the organization’s preferred security tool.

Correct Answer: C. Use tiered due diligence, stronger contractual obligations, and validated continuity evidence.

Question 7

What is the main purpose of a NIST CSF Target Profile?

A. To describe desired cybersecurity outcomes and guide improvement.

B. To certify that all controls are effective.

C. To calculate the exact financial value of every threat.

D. To replace incident response planning.

Correct Answer: A. To describe desired cybersecurity outcomes and guide improvement.

Question 8

Which statement best describes residual risk?

A. Risk before any controls are applied

B. A vulnerability with no associated threat

C. Risk remaining after controls and treatments are applied

D. Risk that has been transferred completely to a supplier

Correct Answer: C. Risk remaining after controls and treatments are applied

Question 9

Why can a high compliance score still coexist with serious cyber exposure?

A. Compliance frameworks always measure too many technical details.

B. Audits may have limited scope, outdated evidence, or insufficient attention to actual service dependencies.

C. Security controls are never useful.

D. Risk cannot be influenced by management decisions.

Correct Answer: B. Audits may have limited scope, outdated evidence, or insufficient attention to actual service dependencies.

Question 10

In digital transformation, why must automation and AI governance include human review and testing?

A. Automated systems cannot process any security data.

B. Automation can propagate incorrect decisions rapidly, while AI can produce errors or be manipulated.

C. Human review prevents all cyber incidents.

D. AI is unrelated to enterprise risk.

Correct Answer: B. Automation can propagate incorrect decisions rapidly, while AI can produce errors or be manipulated.