For CISOs evaluating AI, the key question is whether a model truly understands the environment it operates in.