Everybody in every sector is talking about AI. For the most part, these are excited conversations about its reputation for being able to revolutionise businesses overnight. However, the reality after AI systems have been implemented is a little different.
It’s not about having to change mindsets and encouraging the constantly decreasing pool of reluctant employees to use AI tools. Most CIOs and CTOs know that there is cautious optimism about these systems from those who are working at the coalface of the business. The understanding that they can save time and effort on manual processes is becoming more and more embedded.
Instead, there is a cost that hides in plain sight. It’s a tale of spiralling security concerns and requirements surrounding these wondrous new tools. This then leads into a b igger question: how do we put appropriate governance on AI systems in place?
Shadow IT in the present day
We used to call it ‘Shadow IT’, when non-technical departments would acquire software without consulting those in charge of systems. IT departments then had to play catch-up. It was their – complex – job to ensure that the company’s intellectual property was not being shared or stored on another organisation’s system.
This was an issue years ago. Today, it is intensified as anyone with Claude Code can create their own app. Such ease of use and accessibility to a role that used to be strictly techie-only is now nothing short of game-changing, but it raises concerns; that there are now infinitely more systems to secure, verify, control and maintain.
‘AI resilience’ means understanding the problems posed by AI usage within a business, such as unintentionally sharing sensitive data, and then having a plan on how to deal with these issues if they happen. It does not mean withdrawing the use of AI tools completely in the result of problems. An organisation therefore needs appropriate governance in place at implementation. If it doesn’t, the problem can quickly pick up speed and outrun the capabilities of even the most dedicated cyber security team.
The contents of an AI resilient enterprise stack
Back in what feels like the dark ages before the AI revolution, backups were essential. They still are, but perhaps the most important factor of AI resilience is an observance of what is happening across the IT landscape. Traditional tools will only tell you what websites team members have visited and for how long.
Today, we need much more information. What did they do while they were visiting the site? Did they upload data to it? If so, how much? What did it contain? The CIO dreads hearing the news that an upload contains company intellectual property or something that a malicious third party could use to its advantage.
Faster than the speed of humans
This way of thinking is neither a new discipline nor existing cyber resilience but with a new label. Instead, it is a way of thinking that has been moulded over time, but which still rests on some fundamental principles. After all, data loss prevention (DLP) has been a requirement for as long as there have been computers containing data that have been connected to networks.
DLP tools have evolved over the past decade, as have the problems they seek to solve. Security information and event management (SIEM) is not a new concept, but it is one that is more important than ever as we see vast increases in activity across networks. And this is where a steady hand on the controls is so important.
AI has speed on its side. When SIEM emerged, teams only had to work with fellow humans who worked at the same speed as them to contain issues. AI systems learn from countless sources of data and expand in real-time. Preparation is now vital, to ensure that there is an understanding of each AI use case and a playbook to help deal with them if they occur.
Which problems should be resolved now?
A tested DLP system is an absolute necessity in a world where speed is of the essence. There are, however, other priorities too which are just as important. Have you checked your cyber security policies and made sure that you have taken into account the ever-growing use of AI tools?
And have you made certain that the AI tools your colleagues are using are not going to go rogue and grant themselves admin privileges? This can happen, with critical information like payroll data on networked file-sharing systems disappearing without the knowledge of those entrusted with it. It is a scary prospect that is not beyond the realms of possibility.
Your first task is to develop a clear governance strategy, tested against real-world scenarios. But simply implementing a static strategy will not be enough. The nature of the world in which we live, and its accompanying threat levels, means that you will also need to adapt it and make changes to it at pace as the landscape continues to evolve.
It isn’t too late to take this first step. The potential to catch up and get on board with AI resilience is still there, just about. But soon that time will have passed. And when it does, it will be hard to claw back the opportunity that exists today, a time that we will in future call ‘the good old days’.
