The STRIDE Framework: Isolating the Barriers to Mission-Critical Scale

Boards approved AI experimentation in 2024 and 2025. In 2026, they are asking what reached production, what changed the P&L, and why so many pilots remain trapped between demonstration and deployment. The constraint preventing scale is often organizational: unclear decision rights, weak governance, fragmented funding, no accountable business owner, or talent models that cannot support adoption. Santiago & Company developed STRIDE to separate visible gaps from binding constraints, so CEOs and CIOs know what to fix first.

STRIDE evaluates six dimensions of AI readiness specifically to help executives identify the decisive constraint. Eliminating this primary roadblock enables the transition from demonstration to deployment.

The trap is not failing at AI, but not knowing which weakness blocks scale.

Enterprise AI adoption is no longer the question. Stanford's Human-Centered AI Institute reports that 78 percent of organizations used AI in at least one business function in 2024, up from 55 percent the year before, and the share continued climbing through 2025 and early 2026. The Census Bureau's Business Trends and Outlook Survey, which tracks more than 1.2 million U.S. firms biweekly, finds that roughly 18 percent of firms had adopted AI as of year-end 2025, a figure that more than tripled in two years. The Federal Reserve Bank of Atlanta's Survey of Business Uncertainty, which targets senior business leaders, finds that 78 percent of the U.S. labor force works at firms that have adopted AI in some form.

Scaling that adoption into measurable enterprise value is a different matter. RAND's 2024 study of 65 experienced AI and machine learning practitioners reports that more than 80 percent of AI projects fail at the project level, and identifies five recurring root causes, three of which are leadership and problem-framing failures rather than technical limitations. MIT NANDA's 2025 review of 300+ enterprise AI initiatives, 52 executive interviews, and 153 leader surveys finds that 95 percent of organizations see no measurable P&L impact from a collective $30–40 billion in generative AI spend, and that only 5 percent of integrated AI pilots reach production. Cisco's 2025 AI Readiness Index, drawing on a double-blind survey of 8,000 senior leaders across 30 markets, identifies 13 percent of organizations as Pacesetters, a share that has been stable for three consecutive years.

The methodologies differ. The conclusion does not. Most organizations are not failing to experiment. They are failing to scale. The successful minority stays small, even as model capability improves and adoption becomes universal.

Most readiness assessments make this gap worse rather than better. They evaluate the organization across dimensions: strategy, data, infrastructure, talent, governance, and produce a heat map of weaknesses. Every assessment finds gaps, because every enterprise has them. What the heat map does not say is which gap is currently preventing scale. Without that, the assessment becomes a procurement document for parallel workstreams, each addressed by a different team, all moving at the same time, none unblocking the others.

The CIO's first answer is often directionally right and structurally incomplete.

The CIO's vantage point is structural, not evaluative. Across the six dimensions of AI readiness, the CIO typically has the clearest institutional visibility into two: Development (data, models, engineering practices) and Environment (infrastructure, integration, security). On the other four dimensions, Strategy, Talent, Rules, and Investment, the CIO has partial visibility at best, and primary authority on none of them. Decision rights for AI risk sit with the General Counsel and the Chief Risk Officer. Funding model and capital horizon sit with the CFO. Adoption ownership sits with business unit heads. Talent model and change management sit with the CHRO. None of these executives reports to the CIO, and none of them has a complete view of the others.

This is not a competence problem. It is what every functional executive sees about their own domain. The CIO sees infrastructure constraints with high resolution because that is what the IT organization is built to monitor. The CIO sees adoption barriers, funding gaps, and decision-rights ambiguities at a lower resolution because those are not what the IT organization is built to monitor. When the CEO asks the CIO what is blocking AI, the CIO reports. The reply is often in the right direction, but there are real technical gaps and structural incompleteness because the cross-functional dimensions of the readiness system lack a single owner who can see the whole. Who can see the whole?

Twenty years of academic research on information technology and productivity supports the structural argument. The "productivity J-curve" literature, established by Brynjolfsson, Rock, and Syverson and extending earlier work by Bresnahan, Brynjolfsson, and Hitt, finds that the productivity gains from a new general-purpose technology require complementary organizational investments, process redesign, role redefinition, skill development, and operating-model change that take longer to implement than the technology itself. Productivity initially appears to stagnate or decline while these adjustments take place. Only as the technological and organizational complements come together does the productivity benefit materialize. The dynamic that played out with computing in the 1990s and with enterprise software in the 2000s is the same dynamic playing out now with enterprise AI: the technical work is necessary but not sufficient, and the organizational work determines whether the technology produces enterpIn this context, CEOs must actively assemble the cross-functional perspective lacking in any single leader. STRIDE is designed to facilitate this executive diagnostic process and to support.

STRIDE asks which dimension is currently load-bearing

STRIDE evaluates AI readiness across six dimensions:

• A strategy where AI creates enterprise value.
• Talent who owns, builds, adopts, and sustains AI.
• Rules how risk, governance, and decisions work.
• Investment in how AI is funded, measured, and scaled.
• Development of how data, models, and engineering delivery work.
• The environment, including infrastructure, integration, and security, supports production.

Most readiness models ask how mature each dimension is. STRIDE asks a different question: which dimension is currently load-bearing? That distinction matters because a weak dimension is not always the binding constraint. A company can have imperfect infrastructure and still scale if governance, ownership, and funding are clear. It can also have strong infrastructure and still stall if no one owns adoption, risk approval, or the P&L outcome. The output of a STRIDE diagnostic is not a heat map. It is a single answer to a single question: in this organization, today, what is the constraint that, if addressed, would unblock scale, and what is the constraint that, if addressed first, would not?

What a STRIDE diagnostic delivers. Four First, the binding constraint is the dimension currently preventing scale, which is precisely one of the six. Second, the false fix the intuitive action, usually a technical investment, that would consume budget without unblocking scale. Third, the right first move is the decision or investment that removes the constraint, sized to a ninety-day execution. Fourth, the sequenced roadmap, whose dimensions are addressed second, third, and later, once the binding constraint has been resolved.

What we look for in the first two weeks. Across an enterprise, the STRIDE diagnostic identifies four signals that usually identify the binding constraint before the third week of work. First, where the AI use cases sit in the funding model, annual IT capital, multi-year value pool, or undefined. Second, where the risk-approval authority lives, and whether it has a written escalation path. Third, who owns the P&L outcome of each pilot, by name. Fourth, what is the central AI team's relationship to the operators who would have to use the output? The pattern across these four signals tends to point to a single load-bearing dimension. Two weeks of disciplined work are usually enough to identify the leading constraint and test the remediation sequence in enterprises that have already invested seriously in AI.

In stalled programs, the binding constraint is often not where the next dollar is headed.

Cisco's 2025 data is useful here precisely because Cisco is a networking company that weighs infrastructure most heavily in its own framework. Even by Cisco's own measurement, the dimensions where Pacesetters open the largest gaps over the rest are not infrastructure. The largest absolute gap is in governance, with guardrails: 84 percent of Pacesetters have it, against 24 percent overall, a 60-point gap. In-house AI capability shows the same 60-point spread. AI proficiency among staff shows a 59-point gap. Centralized data shows a 57-point gap. Funding strategy shows a 53-point gap. The smallest gap on Cisco's list is investment in new datacenter capacity, 77 percent of Pacesetters versus 43 percent overall, a 34-point gap.

The infrastructure gap is the smallest because everyone is spending on infrastructure. It is the dimension most directly addressable through capital spending, and the one most reliably approved by boards. Cloud platforms get bought. GPUs get procured. Networks get upgraded. The organizational dimensions are harder to spend on, harder to measure, and lack a single owner. They tend to lag.

The governance gap is now well-documented across independent sources. The International Association of Privacy Professionals' 2025 AI Governance Profession Report, drawing on more than 670 respondents across 45 countries, finds that 47 percent of organizations rank governance among their top-five strategic priorities, but 49 percent struggle with AI technical comprehension, 39 percent face unclear expectations from leadership, and 61 percent lack board-ready metrics on AI risk and impact. The National Association of Corporate Directors' 2025 governance survey finds that while 62 percent of boards now hold regular AI discussions, only 27 percent have formally added AI governance to their committee charters. Recognition has run ahead of ownership. Conversation has run ahead of accountability.

The failure pattern follows from this. In a typical stalled AI program, technical investment continues, with more pilots, more platforms, more data engineering, while four organizational conditions stay unresolved. Use cases are approved without a quantified P&L outcome or an accountable business owner. Funding stays inside IT's annual capital cycle, with no patient capital and no authority to redirect spend mid-program. Governance decisions get stuck between Legal, IT, and the business unit, with no escalation path. Adoption is concentrated within a central AI team that is structurally disconnected from the operators who would use the output. The technical work compounds. The organizational gaps stay where they are. Scale does not happen.

This pattern persists because the technical work is ownable, fundable, and measurable in ways the organizational work is not, by default. A data center expansion has a sponsor and a delivery date. A decision-rights map for AI risk does not exist until someone insists on one. The diagnostic moves the organizational work onto the same footing as the visible, owned, and budgeted technical work.

The visible symptom rarely points to the right first move.

The reason the diagnostic creates value is that the prescription depends on the diagnosis. STRIDE produces a single binding-constraint answer, and that answer determines what to do, including, often, what not to do. The contrarian moves are the most consequential.

If rules bind Legal, slowing every use case, decision rights for AI risk are stuck between Legal, IT, and the business. The obvious fix is more model documentation, more guardrails, more compliance overhead. The actual fix is upstream of all that: define who has authority to approve AI risk, and what the escalation path is. Without a decision-rights map, additional documentation only adds friction to a process that has no terminal node. With a decision-rights map, much of the documentation problem solves itself, because someone is empowered to decide what is enough.

If Investment binds pilots dying after proof of concept, every program needing new approval to cross the experimentation threshold, the obvious fix is more innovation budget. The actual fix is a different funding model: a multi-year AI value pool with reallocation authority, sized for the lead. Annual IT capital often cannot support that pattern; adding more of it does not address the missing piece. IT capital does not change what is missing.

If Strategy or Talent binds, the principle is the same: the visible symptom suggests a fix that adds capability, while the binding constraint requires a structural decision the organization has been postponing. If use cases multiply but none scale, the answer is not another use-case workshop; it is stopping pilots until the value cases name a business owner. If a central AI team builds while operators do not adopt, the answer is not to hire more data scientists; it is to push ownership to the operators and align their incentives before scaling.

If Development or Environment binds a specific use case blocked by a named, scoped data quality, MLOps, or infrastructure gap, technical remediation is the right move. Fund it directly and measure to closure. The diagnostic creates value here too, by distinguishing the cases where technical remediation is the answer from the much more common cases where it is the visible response to an organizational problem.

The standard counterargument is that real organizations face multiple binding constraints simultaneously, whereas the diagnostic asks for a clean answer when reality offers a messy one. The counterargument is fair, with one calibration: constraints rarely bind equally. In most stalled programs we observe, a single primary constraint, if unblocked, would allow several adjacent constraints to ease. Two weeks of disciplined diagnostic work are usually enough to identify the primary constraint and sequence the remaining work behind it. The point of the diagnostic is not to deny that other dimensions matter. The point is to refuse the assumption that they all matter equally, all at once, and that the right response is to fund parallel workstreams against all of them.

The right artifact is a single answer, not a heat map.

In most enterprises, the readiness conversation has been producing the wrong artifact. It has been producing a heat map of weaknesses across many dimensions, which functions as a procurement list for parallel technical and organizational workstreams. What it has not been producing is a binding-constraint diagnosis, the single answer to the single question of what is preventing scale right now.

STRIDE is built to produce that answer. It does so by starting from the structural fact that no single executive can see across all six dimensions, and by reading the pattern of weaknesses to identify which one is currently load-bearing. Two weeks is enough time to do this work properly when the engagement is sponsored at the right level and brings the CFO, General Counsel, CHRO, and business-unit owners into the same fact base.