Portfolio

    Executive Case Studies — Gabriel Guerrero

    Governance and Leadership Cases

    Three business cases: crisis leadership under pressure, governance at board level, and enterprise AI — drawn from real mandates.

    Case Studies

    Case 01 — Enterprise AI & ROI Governance

    When $62K Created
    a Path to $9.1M.
    The AI Mandate.

    Enterprise AI Governance, Executive Productivity, and Organizational Capacity Planning

    An executive business case documenting a governed enterprise AI program: an approximately US$62K advanced-license investment that established an enterprise AI operating model and a framework for US$4.5M–US$9.1M in modeled organizational capacity at scale. Includes validated process outcomes, adoption data, and the governance structure built to sustain and scale the program.

    ~$62K

    Advanced-license investment to establish the AI operating model

    ~1,000

    Employees trained in the enterprise AI program

    586

    Annual hours validated across two finance workflows

    $9.1M

    Upper-bound modeled organizational capacity at scale

    01 — The Business Case

    A $62K investment.
    A board that needed
    to be convinced.

    The business case began not with technology but with a question: how do you justify AI investment to a board that has seen productivity promises before and demands measurable returns? The organization had significant AI potential — but potential doesn't appear on a P&L.

    As CIO, the mandate was clear: build a program that could demonstrate its value in financial terms the board could evaluate — tracking hours recaptured, workflows validated, and a defensible model for organizational capacity that went beyond adoption metrics.

    The answer was a governed AI optimization program with defined scope, measurable outputs, and a governance framework designed to sustain returns long after the initial investment window closed.

    The Starting Conditions

    Executive team skeptical of AI ROI without hard financial metrics

    No existing AI governance or usage policy in place

    Significant executive time lost to manually intensive, high-value workflows

    Board visibility into AI investment required — not optional

    02 — The Program Structure

    Five focus areas. One documented return.

    The program was designed around measurable productivity outputs — not AI adoption for its own sake. Each focus area had a defined scope, a productivity baseline, and an output translatable into financial terms for board reporting.

    Executive Communication

    Focus Area

    AI-assisted drafting, structuring, and review of board communications, strategic memos, and stakeholder reports.

    Highest per-hour value activity; measurable time-to-delivery reduction across the executive team.

    Research & Analysis

    Focus Area

    AI-accelerated synthesis of market data, benchmarks, and competitive intelligence for executive decision support.

    Eliminated multi-day manual synthesis cycles and improved decision speed at the CEO level.

    Meeting Preparation

    Focus Area

    Automated agenda structuring, pre-read generation, and decision brief creation from existing data sources.

    Recaptured 2–4 hours of preparation time per executive per week at documented cost rates.

    Reporting & Governance

    Focus Area

    AI-assisted generation of board packs, operating reviews, and compliance reporting from raw operational data.

    Reduced reporting cycle from days to hours across financial and operational functions.

    Process Documentation

    Focus Area

    Structured AI programs to capture and standardize institutional knowledge into governed, searchable formats.

    Reduced rework and tribal-knowledge dependency across the technology organization.

    03 — The Returns

    586 hours validated. US$4.5M–US$9.1M in modeled organizational capacity at scale.

    Board-Level Outputs

    01

    Delivered a documented AI business case separating investment, adoption, validated process outcomes, and modeled capacity.

    02

    Validated two finance workflows documenting approximately 586 annual hours released at defined organizational cost rates.

    03

    Produced a governance framework the board could read, question, and hold the program accountable to — period over period.

    04

    Established the AI program as a governed organizational capability with defined policy, usage structure, and reporting cadence.

    Key Program Results

    ~US$62K Investment, Governed Program

    An approximately US$62K advanced-license investment created an enterprise AI operating model with defined governance, adoption structure, and a documented methodology for measuring organizational value.

    ~1,000 Employees Trained

    Approximately 1,000 employees entered the enterprise AI program, including 300–400 general users and approximately 40 advanced users. Training was structured, tracked, and reported to leadership.

    586 Annual Hours Validated

    Two finance workflows were independently validated, documenting approximately 586 annual hours released — the first measurable, period-specific outcome of the adoption program.

    US$4.5M–US$9.1M Modeled Capacity

    At full adoption scale, a payroll-equivalent capacity model documents US$4.5M–US$9.1M in organizational value. This represents modeled capacity, not booked cash savings — realized only through avoided hiring, eliminated external spend, or productive redeployment.

    04 — The Governance Model

    Four board-ready commitments built into the AI program.

    A productivity program without governance is a one-time event. The framework was built to ensure the board retained visibility, the organization retained accountability, and the returns compounded rather than decayed after the initial investment.

    CommitmentBoard QuestionEvidence Artifact

    Documented methodology

    How are outcomes measured and what are the assumptions?

    Validated-hours log + organizational cost-rate model + capacity methodology documentation

    AI usage governance policy

    Who decides what AI can and cannot do here?

    Approved AI usage policy and exception register

    Quarterly program reporting

    Is the program still generating measurable outcomes?

    Quarterly board update with validated-hours register and adoption progress

    Scale and expansion roadmap

    What does reaching full organizational capacity actually require?

    Phased adoption roadmap with investment milestones and capacity model assumptions

    Case 02 — Technical Debt & Digital Resilience

    The Cost of Invisible
    Technical Debt.

    Digital Resilience, Governance, and Executive Accountability

    A crisis MBA case following a CIO from the first ambiguous signals through a coordinated attack on revenue-critical digital channels — exposing five categories of invisible technical debt and the governance reset that followed.

    5

    Categories of invisible technical debt exposed by the crisis

    3

    Strategic options presented to CEO and board

    90–180

    Days in the approved staged resilience program

    4

    Governance cadences institutionalized post-incident

    01 — The First Signals

    Ambiguous signals.
    A targeted attack.
    An exposed foundation.

    The first signs were easy to misread. Users reported intermittent failures. Some services behaved inconsistently. The website showed symptoms that could be explained by routine performance issues, vendor instability, traffic variation, or configuration drift.

    For the CIO, the first question was not purely technical — it was whether the pattern represented a normal incident or an emerging attack on a critical revenue platform. A performance incident requires speed. A security event requires containment. A revenue disruption requires executive communication. This incident required all three simultaneously.

    As the pattern became clear, it exposed something more important: the organization was not facing a single failure point. It was facing the accumulated cost of invisible decisions — architecture built for yesterday's load, documentation that lived in individuals, vendor relationships without enforceable controls, and monitoring that could not translate technical alerts into revenue impact.

    Signal Interpretation

    Intermittent website instability → performance, vendor, or configuration issue

    Unusual traffic patterns → possible automated activity or coordinated attack

    Slow recovery despite fixes → architecture fragility beneath the visible incident

    Limited dependency visibility → inherited technical debt and fragmented ownership

    Competing stakeholder updates → crisis visibility escalating across the enterprise

    02 — The Exposed Debt

    Five categories of invisible debt that turned a crisis into a structural problem.

    The attack was important not because of its immediate disruption, but because of what it revealed. The architecture showed signs of stress that had existed long before the incident — deferred decisions whose cost was hidden, accumulated, and eventually compounded under pressure.

    Architecture Debt

    Debt category

    Systems built for yesterday's load had become permanent dependencies, never redesigned for current scale.

    Stress revealed fragile connections and limited containment options during the incident.

    Documentation Debt

    Debt category

    Critical knowledge lived in individuals, vendors, and historical decisions rather than formal documentation.

    Teams reconstructed dependencies in real time during recovery, slowing diagnosis.

    Governance Debt

    Debt category

    Ownership, change control, and escalation paths were informal — functional in normal operations, absent under pressure.

    Decision rights became unclear precisely when clarity was most needed.

    Vendor Debt

    Debt category

    Key operational knowledge and escalation leverage sat with external parties rather than internal ownership.

    Recovery speed and control depended on parties outside the organization.

    Security Debt

    Debt category

    Security controls were adequate for routine operations but not designed for coordinated, targeted pressure.

    Containment choices forced trade-offs between blocking the attack and blocking legitimate customers.

    03 — Crisis Response

    From firefighting to a governed recovery mandate.

    CIO's Recovery Mandate

    01

    Escalated to CEO and senior leadership with a four-category briefing: known facts, unknowns, actions underway, and decisions required.

    02

    Established a crisis operating room — a decision system bringing together infrastructure, application, security, vendor management, and business stakeholders.

    03

    Sequenced recovery to protect the highest-value revenue and customer flows first, before lower-priority systems.

    04

    Positioned stabilization as the beginning of recovery — not the end of the incident — to prevent premature declaration of victory.

    Crisis Operating Principles

    One recovery narrative

    Replace fragmented team activity with a single prioritized action list and one spokesperson to the business.

    Four-category briefing

    Known facts · Unknowns · Actions underway · Decisions required — reduces noise, allows progress reporting without false certainty.

    Revenue-first sequencing

    During crisis, importance is not enough. Work is ranked by direct impact on revenue, customer access, and operational continuity.

    Stabilization ≠ closure

    Returning to normal operations is not the end of the incident. Root causes require structural remediation with funded governance.

    04 — The Decision Point

    Three options. One board decision. A permanent change in how risk is governed.

    By the end of the recovery phase, operational control had been restored — but the strategic question remained unresolved. The CEO and board had to decide whether to treat the crisis as a closed incident or use it as the trigger for a formal resilience program with explicit ownership and funding.

    Option

    01 — Patch & Monitor

    Fix immediate weaknesses, improve monitoring, return to normal execution.

    Lowest short-term cost and least disruption to current projects.

    Root causes remain largely intact. Recurrence risk stays high.

    Option

    02 — Staged Resilience

    Fund a 90–180 day program for critical dependencies, monitoring, recovery procedures, vendor governance, and lifecycle ownership.

    Balances speed, cost, and risk reduction. Creates board visibility without overloading the organization.

    Requires executive discipline and may delay lower-value projects.

    Option

    03 — Full Redesign

    Broader modernization across revenue-critical systems and operating model.

    Best long-term resilience and scalability.

    Highest cost, strongest change-management burden, and greater execution risk.

    Board Decision

    The board approved Option 2: a staged resilience program with quarterly visibility, explicit residual risk ownership, and a funded modernization roadmap focused first on revenue-critical and high-exposure systems. Technical debt ceased to be an IT backlog. It became a visible business risk with ownership, funding logic, and governance cadence.

    Case 03 — Risk & Resilience

    The Day the
    Network
    Disappeared.

    Cloud Control, Vendor Power, and Executive Accountability

    A teaching case based on a real headquarters network outage — the inherited governance gaps that made it catastrophic, the crisis leadership that contained it, and the control model rebuilt from scratch.

    ~2.5 wk

    Time to full network stabilization and governance reform

    ~8 days

    Finance and bookkeeping backlog accumulated at headquarters

    195+

    Operating locations in the national network footprint

    5

    Critical control gaps identified and closed post-incident

    01 — The Incident

    A routine failover.
    A missing tenant.
    A total loss.

    The headquarters network was designed to run almost entirely over Wi-Fi, with all management and configuration centralized in a cloud control plane (Aruba Central). When an ISP outage triggered a failover event, the external network provider — holding administrative access to the cloud environment — removed or deleted the company's Central tenant and organization.

    With no usable configuration backups and no offline exports, every managed device lost synchronization and became effectively unmanaged. Finance systems, call center operations, IT service management, and corporate functions — all dependent on headquarters connectivity — went down. Bookkeeping fell approximately eight days behind. Late-payment penalties followed.

    An independent audit later established the facts: no cyberattack. The cause was administrative deletion of the cloud environment combined with a complete absence of configuration backups. Recovery required rebuilding the entire management workspace and re-onboarding every device from scratch.

    What Went Offline

    Corporate finance and payment-related processes

    Call center operations and internal IT support

    IT service management and corporate functions

    Network management and remote site administration

    Internal communication infrastructure

    Customer-facing cloud applications were largely unaffected, limiting direct revenue impact.

    02 — The Inherited Gaps

    Five gaps that turned a deletion into a disaster.

    The incident was not a technical anomaly — it was the predictable result of five control gaps that had accumulated before the CIO took the role. Each gap on its own was manageable. Together, they made the deletion of a single cloud tenant an unrecoverable event.

    Identity & Access

    Control gap

    External provider retained high privileges; activity not independently audited.

    A single actor could remove the control plane without detection or immediate accountability.

    Backup & Recovery

    Control gap

    No usable configuration backups in the management platform; no offline exports.

    Deletion became a total loss event rather than a recoverable incident.

    Vendor Governance

    Control gap

    No contract, no SLAs, no change control, limited escalation mechanisms.

    No enforceable obligations or guardrails during the crisis.

    Asset Assurance

    Control gap

    Warranty and support coverage inconsistent; some devices could not be supported through vendor channels.

    Slowed recovery support and increased cost and uncertainty.

    Architecture Resiliency

    Control gap

    Headquarters heavily Wi-Fi dependent; limited perimeter architecture in the original design.

    Reduced options for staged recovery and containment.

    03 — Crisis Response

    From discovery to full stabilization in 2.5 weeks.

    CIO's Immediate Actions

    01

    Briefed the CEO and senior leadership on the operational impact and recovery path under uncertainty.

    02

    Brought in an expedited emergency network and security component to restore basic connectivity to critical functions.

    03

    Sequenced recovery to prioritize finance, treasury, and call center operations first.

    04

    Non-essential staff temporarily shifted to remote work where feasible.

    Incident Timeline

    Day 0 — AM

    ISP outage triggers a network failover to the backup routing backbone.

    Restore basic connectivity; establish incident command.

    Day 0 — Midday

    External provider engaged to switch the active internet line.

    Speed vs. control: who executes the changes?

    Day 0 — PM

    Internal team discovers the Aruba Central workspace and tenant are missing. Cloud-managed devices lose synchronization and become effectively unmanaged.

    Escalate to executives; choose the recovery path.

    Days 1–2

    Emergency approach selected. A firewall is expedited and installed to restore critical connectivity.

    Prioritize critical functions under uncertainty.

    Days 3–10

    Critical areas stabilized; phased rebuild of the network configuration continues.

    Balance quick fixes with long-term redesign.

    ~2.5 Weeks

    Full stabilization achieved. Governance changes initiated across vendor access, backups, and incident protocols.

    Lock accountability model and vendor controls.

    04 — The Governance Model

    Five board-ready commitments built from the incident.

    Every significant incident produces a governance obligation — or it should. This one produced five board-level commitments with explicit evidence artifacts, designed so the board can ask the right questions and receive a verifiable answer.

    CommitmentBoard QuestionEvidence Artifact

    No destructive admin actions without dual control

    Who can delete or disable a control plane?

    Quarterly privileged access review + approval workflow evidence

    Backups with restore testing

    Can we rebuild in hours, not weeks?

    Latest restore test report and RTO/RPO metrics

    Vendor access lifecycle

    Do vendors still have access after projects end?

    Vendor access register + expiry logs

    Incident playbook

    Who runs command in the first hour?

    Incident runbook and escalation tree

    Architecture resilience roadmap

    Where are our hidden single points of failure?

    Top 10 operational dependency map + remediation plan

    Executive Summary

    Three Cases. One Mandate.

    Three cases, one executive context — a CIO governing a $4.5B enterprise through platform fragility, vendor risk, deferred technical decisions, and the pressure to prove AI to the board. Each documents the moment a structural problem or strategic bet became a board-level event.

    Case 01

    When $62K Created a Path to $9.1M. The AI Mandate.

    A US$62K advanced-license investment created a governed enterprise AI operating model — approximately 1,000 employees trained, 586 annual hours validated, and a governance-backed framework projecting US$4.5M–US$9.1M in modeled organizational capacity at scale.

    Enterprise AI value requires a structured adoption framework — not just tool deployment

    Process-level validation, not adoption metrics alone, is what turns AI investment into defensible board reporting

    A governed AI program separates modeled organizational capacity from realized financial value

    Case 02

    The Cost of Invisible Technical Debt

    Ambiguous performance signals escalate into a structural crisis. Individually defensible deferrals compound into an inescapable risk exposure requiring a board decision.

    Technical debt accumulates invisibly through misaligned incentives and gradual deferrals

    Platform decisions deferred under budget pressure compound into remediation emergencies

    Board visibility into debt requires structured reporting — not project-level status updates

    Case 03

    The Day the Network Disappeared

    A cloud-managed HQ network is deleted by a vendor during an ISP failover. No backups exist. Full connectivity loss for 2.5 weeks — and a complete governance rebuild.

    Cloud control plane dependency without recovery architecture is an existential risk

    Vendor access governance failures compound operational incidents into board crises

    Crisis command structure must be defined before the incident — not during it