Every security leader I speak with is wrestling with the same question: we've invested in AI, so where's the return? If they’re being honest, the answer is that they likely can’t tell. Research indicates that an estimated 70 to 80% of AI initiatives either don’t scale out of the pilot stage or fail altogether, but the reason is rarely that the technology doesn't work. It's that organizations haven't defined what "working" means for them. In cybersecurity, this problem is even more acute as security success is, by nature, invisible. When AI stops an attack, nothing happens, and this doesn't make it onto a dashboard or into a board report. Outcomes are probabilistic and value is routinely misunderstood, so without a clear definition of value, scaling AI becomes an exercise in hope. The Adoption Curve Nobody Talks About There's a familiar trajectory to AI adoption in cybersecurity, whereby the tools are purchased and deployed, but the expectations aren’t well defined, and nobody has clearly outlined the goals or metrics of success for what the AI is improving. As a result, while they may see an occasional win, for example a false positives reduction, the project is doomed to be seen as a costly experiment. The result is AI layered on top of existing workflows, so the analysts are still drowning in alerts and spending time on tactical tasks that don't make use of their expertise. The AI is running in the background, but the fundamentals of the work hasn't changed. This is where most organizations stop or change course because they don’t see the promised transformation, despite not articulating the desired ROI from the start. Defining Value at the Level That Matters The issue isn't that AI can't deliver meaningful outcomes. At Abnormal AI, we've seen it reduce missed detections, automate