3,136 subscribersSubscribed

We’re Looking at the Trees. The Forest is Quietly Taking Over.

Antonio Ieranò

Information & Cybersecurity Strategist | Digital Sovereignty • AI Governance • Complex Systems | Author, Researcher & Occasional Philosopher | Views stubbornly my own. 🧠

September 22, 2026

Or why I think we’re having the wrong conversation about Artificial Intelligence.

I have the uncomfortable feeling that we’re discussing Artificial Intelligence with the same imprecision with which, years ago, we used to discuss “data”.

At first sight, the comparison doesn’t really work. One is information, the other a collection of technologies. They belong to different worlds.

Or so it seems.

The more I think about it, however, the more I suspect they have something fundamental in common.

Neither is an object.

Both are properties of an ecosystem.

That may sound like the sort of sentence people write after too much coffee and an afternoon reading philosophy instead of technical documentation. Bear with me. I promise there’s a practical point hidden somewhere beneath it.

For years, those of us working in cybersecurity have tried to explain that data isn’t the spreadsheet, the PDF, the database or the USB stick somebody inevitably leaves in a hotel conference room.

The medium changes.

The information doesn’t.

The customer record remains the same customer record whether it’s stored in SQL Server, printed on paper or sitting quietly inside someone’s inbox waiting to become tomorrow’s data breach.

Eventually we stopped talking about protecting files.

We started talking about governing information.

That small change in language completely altered how organisations approached security.

Perhaps we’re approaching a similar moment with AI.

One of the things I enjoy most about working in technology is that it has an extraordinary talent for renaming old mistakes.

Every few years we convince ourselves that this revolution is completely different.

Then, with the benefit of hindsight, we realise we’re arguing about remarkably familiar problems dressed in slightly more fashionable terminology.

Cloud computing was initially treated as though it were a place.

It wasn’t.

It was an operating model.

Digital transformation became synonymous with buying software.

It rarely was.

It turned out to be about changing organisations, which is considerably more complicated and far less enjoyable than buying software licences.

Now we’re doing something rather similar with Artificial Intelligence.

We speak about AI as though it were a product.

Or, more precisely, as though it were a handful of products.

ChatGPT.
Claude.
Gemini.
Copilot.
…

Perhaps another model depending on what happened on social media this week.

The conversation rarely gets much further than that.

I understand why.

These are the tools people see.
They’re visible.
They have interfaces.
Pricing plans.
Marketing departments.
Executive keynotes.

Visible things are easy to discuss.

Invisible systems rarely are.

What strikes me is how quickly we’ve started using the words Artificial Intelligence and Large Language Model almost interchangeably.

It’s an understandable shortcut.

It’s also spectacularly misleading.

Large Language Models are an important branch of Artificial Intelligence.

They’re not Artificial Intelligence itself.

Saying otherwise is rather like saying that the Internet is Google Chrome.

Or that electricity is the lightbulb in your sitting room.

Useful.
Popular.
Visible.
Entirely missing the bigger picture.

Artificial Intelligence didn’t suddenly appear when ChatGPT was released.

Nor will it disappear the day another company produces a better model.

Machine learning was solving business problems long before most people had heard the phrase “prompt engineering”.

Computer vision was already helping factories identify manufacturing defects.

Optimisation algorithms were making supply chains more efficient.

Statistical models were detecting fraud.

Robotics had quietly entered production lines.

Expert systems were making clinical recommendations before today’s graduates were born.

The history of AI is considerably longer, and considerably less glamorous, than our current fascination with chat interfaces might suggest.

We’ve simply become fixated on one particularly impressive family of trees.

We’ve stopped noticing the forest.

That image has been following me around for a while.

Perhaps because forests behave rather differently from individual trees.

People admire trees.

Forests change climates.

A single oak can be beautiful.

A forest creates an ecosystem.

It changes humidity, temperature, biodiversity, the movement of water, the quality of the soil and the life that develops beneath the canopy.

None of those properties belong to a single tree.

They emerge from relationships.

Technology, I think, behaves in much the same way.

We tend to become fascinated by individual products because products are tangible.

You can compare them.
Benchmark them.
Argue about which one performs better.

It’s a comforting conversation because it has winners and losers.

Ecosystems are untidy.

They’re harder to measure. Their most interesting properties rarely belong to one component.

The Internet wasn’t revolutionary because of web browsers.

Cloud computing wasn’t transformative because of virtual machines.

Neither succeeded because one vendor built a better product.

They changed the way every other technology related to one another.

The forest mattered far more than the trees.

I’m beginning to suspect AI is reaching exactly that point.

That may also explain why so many discussions around AI feel oddly incomplete.

We spend an extraordinary amount of time asking which model performs best.

It’s not an unreasonable question.

It simply isn’t the one I find myself asking anymore.

I’m much more interested in something else.

What happens when AI stops being something we buy…

…and quietly becomes something everything else contains?

I suspect we’re already there.

Most people simply haven’t noticed yet.

A surprising number of products are suddenly described as AI-powered.

Firewalls.
Endpoint protection.
Productivity suites.
Email platforms.
Industrial automation.
Medical devices.
Cars.
Security cameras.

Even household appliances seem unable to resist adding two fashionable letters to their marketing material.

Part of that is, undoubtedly, marketing enthusiasm. Technology companies have always displayed an impressive ability to discover whichever adjective investors happen to like that year.

But dismissing the whole phenomenon as hype would be another mistake.

Because beneath the marketing there is something much more interesting happening.

Artificial Intelligence is slowly ceasing to be a product category. It’s becoming a characteristic of technology itself.

And history suggests that this is precisely the moment when governance becomes significantly more difficult.

Because once a technology becomes infrastructure…

…people stop noticing it’s there at all.

We’ve Made This Mistake Before

There’s another reason why I keep coming back to the comparison with data.

Years ago, when people spoke about “protecting data”, they usually meant protecting databases.

Or files.

Or perhaps laptops.

It was an understandable simplification, but it was wrong.

Eventually we realised that information doesn’t really care where it happens to live. It flows between systems, applications, cloud services, paper documents, backups, mobile devices and, occasionally, somebody’s memory.

The information remains the same.

Only the container changes.

That realisation fundamentally changed cybersecurity.

We stopped asking “Where is the data?”

Instead we began asking “What information are we trying to protect, regardless of where it happens to reside?”

It sounds like a subtle distinction.

It wasn’t.

It changed governance.
It changed regulation.
It changed architecture.
It even changed language.

I increasingly suspect we’re approaching exactly the same moment with Artificial Intelligence.

Today, when somebody says “We’re deploying AI”, I often find myself wondering what they actually mean.

Are they talking about a language model?
Machine learning?
Computer vision?
Predictive analytics?
An optimisation engine?
Autonomous planning?
A recommendation system?
An agent?
A swarm of agents?
A robotic system?

Most of the time they simply mean a chatbot.

Nothing wrong with that.

Except that it quietly reduces one of the broadest technological disciplines we’ve ever built into a conversational interface.

It’s remarkably similar to confusing “the cloud” with Microsoft 365.

Convenient.

Not particularly accurate.

The consequence isn’t merely academic.

It changes how organisations think about governance.

If AI is just another application, governance becomes procurement.

Vendor assessments.
Security questionnaires.
Data Processing Agreements.
Model comparisons.
Useful activities.
Necessary ones.
Entirely insufficient.

Because if AI is gradually becoming a characteristic of technology itself rather than a product category, then governance can’t stop at the product.

It has to move up a level.

Exactly as Data Governance eventually moved beyond databases.

The image that keeps returning to me is still the forest.

Perhaps because forests are wonderfully awkward things.

You can catalogue every tree and still fail to understand the forest.

The interesting behaviour happens between them.

Roots share nutrients.
Fungi create networks.
Moisture changes.
Light changes.

The environment itself begins behaving differently.

Nobody would seriously claim they’ve understood a forest simply because they’ve measured the tallest oak.

Yet this is more or less how we currently discuss AI.

Benchmarks.
Context windows.
Token throughput.
Leaderboards.

Interesting?

Certainly.

Important?

Absolutely.

Enough?

Probably not.

The behaviour we’re actually interested in is beginning to emerge between systems rather than inside individual models.

That may explain why

I find the current obsession with model rankings slightly amusing.

Every few weeks another benchmark appears.

Another leaderboard.

Another declaration that somebody has overtaken somebody else.

Technology journalism rather likes league tables.

They’re simple.

Sporting events have taught us to appreciate winners.

Reality is less cooperative.

The organisations creating the greatest business value with AI are rarely those with the highest benchmark scores.

They’re usually the ones that quietly figured out how to connect people, processes, data and software without making everyone’s working life considerably more complicated.

Which, admittedly, is a far less exciting headline.

A few months ago I wrote that AI had become successful because it had started behaving like Excel.

Some readers thought the comparison was provocative.

It wasn’t.

I genuinely meant it.

Excel didn’t change business because it was mathematically sophisticated.

It changed business because spreadsheets became an ordinary way of thinking.

PowerPoint didn’t become ubiquitous because slide transitions were particularly elegant.

It became ubiquitous because presentations quietly became the grammar of corporate communication.

Eventually nobody talked about Excel.

Nobody talked about PowerPoint.

People talked about budgets.

Strategies.
Forecasts.
Projects.

The tools disappeared behind the work.

I suspect AI is heading towards exactly the same destination.

Not because language models will become perfect.

They won’t.

Every technology has limitations.

But because they’ll become ordinary.

And ordinary technologies are usually the ones that matter most.

There’s another reason this matters.

When technologies become ordinary, they also become invisible.

That’s when governance becomes genuinely difficult.

Nobody asks whether their organisation uses electricity.

Or TCP/IP.

Or databases.

Or operating systems.

Those questions would sound faintly ridiculous.

The answer is obviously yes.

The interesting questions concern architecture, resilience, dependency and control.

I wonder whether we’ll soon stop asking whether we use AI.

The answer will simply be yes.

The more interesting questions will become:

Where?
How much?
Connected to what?
Making which decisions?
Using whose data?
Operating under which constraints?

Those questions feel considerably less glamorous.

They’re also considerably more important.

“The visible prompt is only the tip of the iceberg. The real challenge begins underneath, where context, retrieval, telemetry, metadata, memory, operational logs and governance quietly determine how the system actually behaves.”

When I first sketched this diagram, I thought it was mainly about data.

Looking at it today, I think it’s really about visibility.

The prompt is visible.

Everything else isn’t.

That hidden layer is where AI actually becomes useful.

Retrieval.
Grounding.
Identity.
Authorisation.
Operational memory.
Security monitoring.
Observability.
Policy enforcement.
Context.

The irony is almost amusing.

The things that make AI genuinely valuable are largely the same things that make governance significantly harder.

Technology has always had this habit.

The more useful it becomes, the less visible it becomes.

Cloud hid infrastructure.

Virtualisation hid hardware.

Containers hid operating systems.

Large Language Models are beginning to hide complexity behind conversation.

Which is wonderful for productivity.

Slightly less wonderful for governance.

And this, I think, is where my own thinking changed.

At first I believed the interesting question was:

“What data does AI move?”

I still think that’s important.

Just not sufficient anymore.

Because something else has quietly started moving as well.

Capability.

From Data Governance to Capability Governance

Somewhere along the way I realised I was asking myself the wrong question.

For quite a while I thought the interesting discussion was about data.

What data enters the model?
Where does it go?
Who stores it?
For how long?
Under which jurisdiction?

They’re all important questions.

They’re also the questions I’ve spent a good part of my career asking.

Then something changed.

Not suddenly.

Quietly.

Almost politely.

AI stopped being particularly interested in generating text.

It started doing things.

That sounds like a trivial observation.

I don’t think it is.

When ChatGPT appeared, most people used it to write emails, summarise documents or produce the sort of presentation that everyone secretly hoped PowerPoint would one day create on its own.

Useful.

Occasionally impressive.

Mostly harmless.

Today’s systems look rather different.

They retrieve information from SharePoint.

Query CRM platforms.

Search engineering documentation.

Open support tickets.

Update records.

Trigger workflows.

Schedule meetings.

Generate code.

Deploy infrastructure.

Approve transactions.

Increasingly, they don’t simply answer questions.

They participate in business processes.

The distinction matters.

One system informs.

The other acts.

Perhaps this is where cybersecurity quietly re-enters the conversation.

For years we’ve repeated a fairly simple principle.

Risk is rarely created by technology.

Technology amplifies existing conditions.

The Internet didn’t invent fraud.

It industrialised it.

Cloud computing didn’t invent configuration mistakes.

It made them wonderfully scalable.

Automation didn’t invent human error.

It removed many of the natural limits that kept those errors relatively contained.

Artificial Intelligence behaves in much the same way.

It doesn’t suddenly create entirely new categories of organisational risk.

What it does rather well is amplify existing ones.

Usually at machine speed.

I’ve heard people describe AI as dangerous.

Personally, I find that slightly unhelpful.

Electricity is dangerous.

So is gravity.

Neither statement tells us very much.

A better question is whether we’ve designed a system that assumes people, software and processes will occasionally make mistakes.

Because they will.

Always have.

Always will.

The interesting part isn’t the mistake.

It’s what happens next.

Imagine somebody accidentally grants excessive permissions to an AI assistant connected to an internal knowledge platform.

Without AI, that mistake might sit unnoticed for weeks.

A curious employee might stumble across an unexpected document.

Perhaps nothing happens at all.

Introduce an autonomous workflow capable of retrieving, correlating and acting upon thousands of documents within minutes and the nature of exactly the same mistake changes dramatically.

Not because AI became malicious.

Not because the model suddenly acquired ambitions of world domination.

Simply because we’ve attached industrial-scale capability to an error that used to remain largely local.

The mistake hasn’t changed.

The consequences have.

That’s why I increasingly think we need a different vocabulary.

We’ve become reasonably comfortable with Data Governance.

Perhaps it’s time we started talking about Capability Governance.

Not because data has become less important.

Quite the opposite.

Because capability now sits on top of data in much the same way applications once sat on top of infrastructure.

When an AI system is connected to a finance platform, what exactly have I delegated? Access to invoices?

Or the ability to approve payments?

When it’s connected to Active Directory, have I shared information?

Or have I delegated administrative capability?

When it’s connected to an industrial control system, am I exposing operational data?

Or the ability to influence physical processes?

The distinction is subtle.

The consequences aren’t.

It also explains why the current obsession with prompts occasionally feels like discussing road safety by concentrating exclusively on steering wheels.

Important?

Certainly.

Sufficient?

Not remotely.

Prompts are becoming the interface.

Capability is becoming the architecture.

This is also where another misconception begins to unravel.

We still tend to treat cybersecurity as though it belonged exclusively to IT departments.

As though cyber incidents lived inside computers.

They don’t.

Or at least, not for very long.

The digital world has become so deeply intertwined with the physical one that the distinction is beginning to lose practical meaning.

When a hospital loses access to clinical systems, the incident isn’t digital.

The consequences certainly aren’t.

When manufacturing stops because production systems fail, the impact isn’t confined to servers.

Products simply don’t leave the factory.

When logistics platforms become unavailable, supermarket shelves have an irritating habit of reminding us that supply chains are physical objects.

Cybersecurity stopped being about computers years ago.

It simply took the rest of us rather longer to notice.

Artificial Intelligence is following exactly the same path.

Today we mostly notice it because it writes remarkably competent emails.

Tomorrow we’ll notice it because electricity arrives more reliably.

Because ambulances are dispatched more efficiently.

Because aircraft maintenance is scheduled more intelligently.

Because traffic flows slightly better.

Or perhaps because none of those things happen when something goes wrong.

Technology has a habit of becoming visible only when it fails.

That’s true of electricity.

It’s true of the Internet.

I suspect it will become true of AI as well.

Something else has struck me over the last year.

Whenever we discuss AI risk, we instinctively imagine attacks against AI.

Prompt injection.
Model theft.
Data poisoning.
Hallucinations.

Those are real issues.

But they’re only one side of the story.

Artificial Intelligence occupies an unusually awkward position in the technology landscape.

It’s simultaneously the thing we use to defend systems…

…the thing attackers increasingly use to compromise systems…

…the thing we have to protect…

…and increasingly the thing that helps operate the systems themselves.

I’m struggling to think of another technology that comfortably occupies all four roles at the same time.

Firewalls don’t usually attack people.

Databases don’t investigate security incidents.

Identity platforms rarely generate phishing campaigns.

AI can sit on every side of the same chessboard.

That’s unusual.

And unusual technologies generally deserve unusual governance.

Which brings me back to the forest.

Perhaps I’ve been thinking about the wrong metaphor all these years.

We often describe technology as layers.

Infrastructure.
Platform.
Application.
Data.
Security.

It’s tidy.

Comforting.

Architects like layers.

Reality, unfortunately, behaves rather more like ecosystems.

Everything influences everything else.

Remove one species and another flourishes.

Introduce a new one and the entire balance shifts.

Artificial Intelligence feels much closer to ecology than architecture.

It doesn’t simply sit on top of existing systems.

It changes the relationships between them.

And if that’s true, then perhaps governance has to evolve as well.

Not because AI is unprecedented.

But because ecosystems are governed rather differently from individual components.

The Forest Doesn’t Care What We Call the Trees

There is one last thought that has been quietly following me throughout this piece.

It isn’t really about Artificial Intelligence.

At least, not exclusively.

It’s about the way technological revolutions disappear.

Not fail.

Disappear.

The technologies that genuinely change society don’t remain visible for very long. They stop being products, stop being projects and eventually stop being topics of conversation altogether.

Electricity became a utility.

Networking became infrastructure.

Databases became assumptions.

The cloud became… well… somebody else’s data centre, although marketing departments would probably object to such an unromantic definition.

I suspect AI is travelling exactly the same road.

Perhaps rather faster.

Which also explains why I find many of today’s discussions oddly unsatisfying.

We continue asking questions that belong to the previous technological era.

Which model should we choose?
Which vendor is safer?
Which benchmark matters most?

Useful questions.

Necessary questions.

But increasingly tactical ones.

The strategic question is different.

What happens when AI stops being something we consciously adopt…

…and quietly becomes something every other technology simply contains?

Because that future isn’t arriving.

It’s already here.

Word processors.
Operating systems.
Security products.
Email platforms.
Industrial controllers.
Medical devices.
Financial systems.
Development tools.
Search engines.
Cars.
Robots.
Consumer electronics.
Enterprise software.

Some genuinely use sophisticated AI capabilities.

Others merely discovered that investors and marketing departments have an unhealthy fascination with the letters “A” and “I”.

History suggests that distinction won’t matter for very long.

Eventually nobody will advertise “AI-enabled” software.

In much the same way nobody advertises software that supports TCP/IP.

Or electricity.

Or databases.

Capabilities eventually become expectations.

That’s when another thought occurred to me.

Perhaps we’ve been making the same conceptual mistake with AI that we once made with cybersecurity.

For years cybersecurity was treated as an IT discipline.

Some organisations still see it that way.

The wording alone reveals the misunderstanding.

A cyber incident sounds like something that happens to computers.

Until electricity disappears.

Or fuel distribution stops.

Or hospitals lose clinical systems.

Or trains stop moving.

Or supermarket shelves begin looking surprisingly philosophical.

The incident may begin in software.

The consequences never stay there.

The physical world has become inseparable from the digital systems that coordinate it.

Artificial Intelligence will follow exactly the same trajectory.

Today it drafts reports.

Tomorrow it quietly decides which reports deserve to exist in the first place.

Today it summarises meetings.

Tomorrow it determines which meeting should happen at all.

Today it recommends.

Tomorrow it orchestrates.

Not because anyone deliberately handed over control one dramatic afternoon.

Because capability accumulates.

One connector.
One integration.
One workflow.
One automation.
One agent.

None particularly remarkable on its own.

Together they begin changing the behaviour of the organisation.

Forests rarely appear overnight.

There is another consequence of this shift that I find particularly interesting.

The more AI becomes embedded into technology, the less useful it becomes to discuss “AI” as though it were a discrete thing.

Perhaps we’ve reached the point where Artificial Intelligence should be thought of rather differently.

Not as software.

Not even as a platform.

More as a property.

Data taught us this lesson years ago.

Information exists independently of the medium carrying it.

A customer record remains a customer record whether it’s stored in a relational database, a PDF, a spreadsheet or someone’s notebook.

Governance therefore focuses on the information rather than the container.

Perhaps AI deserves exactly the same treatment.

Its cognitive capability increasingly exists independently of whichever product happens to expose it.

Today it appears through a chatbot.

Tomorrow through an operating system.

Next year through a robotic arm.

Five years from now it may surface somewhere nobody currently considers particularly interesting.

The implementation will change.

The capability will remain.

This is why I no longer find myself particularly interested in debating whether GPT is better than Claude, whether Gemini has finally caught up, or whether the next benchmark slightly favours one model over another.

Those conversations resemble arguing about individual trees while the forest quietly changes the climate around us.

The interesting questions have moved elsewhere.

How much autonomy have we delegated?

Can we explain why a decision was made?

Can we withdraw that capability without disrupting the organisation?

Have we designed systems that expect mistakes rather than assuming perfection?

Do we understand the dependencies we’ve quietly created?

Perhaps most importantly…

Have we noticed that those dependencies now extend well beyond the digital world?

There is an old habit in technology.

We tend to believe that every revolution begins with invention.

In reality, revolutions usually begin with normality.

Not when the technology appears.

When it becomes boring.

Nobody wakes up thinking about electricity.

Until there isn’t any.

Nobody congratulates TCP/IP every morning for functioning correctly.

We simply expect it to.

The same happened with cloud computing.

The same happened with smartphones.

The same happened with search engines.

The technology disappeared into everyday life.

Its importance increased precisely because its visibility declined.

I suspect Artificial Intelligence is approaching that moment now.

Which means that, paradoxically, this may be the last period in which we consciously think of AI as something separate from the rest of technology.

After that…

…it will simply be technology.

So perhaps the question isn’t whether your organisation has adopted Artificial Intelligence.

There’s a reasonable chance the answer is already yes, whether that decision was made consciously or quietly introduced through the latest software update.

The more useful question is this:

Do we understand how cognitive capability is now distributed across our organisation?

Not where the models are.

Not which vendor we selected.

Not which benchmark won last month.

But where capability now resides.

Who controls it.

Who supervises it.

Who can revoke it.

Who remains accountable when something inevitably goes wrong.

Because governance has never really been about technology.

It has always been about responsibility.