Harnessing AI for cyber security without losing control

AI governance is no longer a simple technical issue; it is a fiduciary matter that every CISO should be aware of. Periodic audits provide limited visibility over AI controls and performance, which allows risks to develop between reviews. However, in today’s AI ‘Wild West’, where employees are adopting AI tools faster than security teams can govern them, organisations need continuous assurance, real-time visibility and clear guardrails to enable safe innovation. This allows organisations to identify risks as they emerge. 

To scale AI responsibly, stronger governance is invaluable to drive innovation, build confidence and provide transparency across entire systems. The tell-tale signs that once gave cyberattacks away – poor grammar, suspicious links or an obviously fake sender – have all but disappeared. AI-generated phishing is now often indistinguishable from legitimate correspondence, while deepfake audio and video are driving genuine financial losses. Organisations must assume attackers are operating at a sophistication and scale that simply didn’t exist two years ago.  

AI adoption is outpacing regulatory exposure  

Traditional governance models are struggling to keep up with rapidly evolving AI capabilities, with AI models capacities doubling every few months, which is pushing with coding benchmarks to the limits. While countering AI attacks remains the key focus, companies must also strive to manage their internal AI adoption as both enable responsible innovation and protect AI systems from evolving risks. As AI is increasingly used to fuel cyberattacks, the same technology needs to be employed and protected efficiently. Standards such as ISO/IEC 42001 formalise this shift, which specifies requirements including living risk registers and continuous monitoring rather than static annual assessments.  

Experts predict the ‘quantum horizon’ will hit by 2029, which exposes traditional AI governance models to extreme risk, compounded by the “harvest now, decrypt later” threat, where adversaries are already stealing encrypted data with the intention of decrypting it once quantum computing matures. Many organisations still don’t know where their vulnerable cryptography sits or what ciphers they have, with audits revealing 30% of ciphers were one’s organisations didn’t know they had. A Cryptographic Bill of Materials (CBOM) gives organisations visibility into what ciphers they have, where they are and whether they are using them. Ultimately, AI-powered attackers will be able to process and handle vast numbers of variables simultaneously, increasing the need for continuous monitoring and human intervention, as AI governance models struggle to keep up with the speed and efficiency of attackers. 

Where scheduled audits fall short   

When a major cloud provider can be hacked by AI in under ten minutes, the risks of periodic audits are exposed. In five minutes, the network session was compromised, leaving multiple credentials exposed to harvest. By the seventh minute, an unauthorised proxy was registered, but the cloud provider was still unaware of the attack. It was not until the tenth minute, the attack was finally detected, exposing the vulnerability of current AI defences and advanced AI attacks on the largest players in the industry.   

To handle AI systems responsibly, real-time visibility and clear evidence is required to capture the performance of data and controls. Traditional audit and reporting cycles prevent organisations from identifying AI attacks early, which can lead to greater problems further down the line. Inevitably, routine and infrequent assessments invite an almighty attack and several regulatory issues, reducing confidence in long-term compliance. The question is why are organisations relying on their assumptions, when they can depend on real-time evidence?   

Third-party technologies significantly widen the attack surface with SaaS platforms, plug-ins, and vendor embedded AI features often operating outside traditional security visibility and creating potential unmanaged entry points. Organisations must look beyond their own boundaries and consider supply chain, third-party and fourth-party risks, where vulnerabilities can exist through a vendor’s own ecosystem. Traditional vendor due diligence and contracts have not always kept pace with AI adoption, creating potential blind spots around data handling, training data, and security controls. Continuous assurance with an AI-specific lens is essential to ensure third-party technologies are secure, governed, and aligned with organisational risk standards.   

Building trust through real-time AI transparency  

Visibility helps businesses build trust by allowing them to demonstrate how AI systems make decisions and operate. Continuous oversight into the boundary settings, mistakes and reasoning processes AI models adopt helps businesses prevent bias and future error. Without visibility, reliable and stable operations are extremely hard to maintain and showcase.   

Security cannot be maintained without regular intervention. Major threats such as data misuse and AI attacks become increasingly common without consistent oversight over systems. Through continuous assurance, companies can make strong AI decisions and drive innovation. This not only helps businesses maintain good relationships with stakeholders, but regulations like DORA and the FCA and the AI ISO also reward organisations that can demonstrate visibility and continuous assurance. 

When it comes to AI models, precision and transparency are key. Assumptions are no longer enough to showcase AI systems and their performance. Real-time data gives companies the evidence they need to instil confidence. Boards, auditors and insurers increasingly want risk-based evidence they can act on, rather than raw data or a clean report once a year. Continuous assurance provides that ongoing proof, giving stakeholders confidence that controls are working as intended and organisations can demonstrate governance with evidence rather than assumptions. 

Safe AI scales faster 

AI innovation is chaotic without robust governance. While many will believe that governance is a restrictive factor, it is a driver for its development. In business, some professionals will be eager to employ the technology, whereas others may be uncomfortable using it. When clear governance is established alongside clear boundaries, people can be assured they can use AI and drive innovation safely.  

Guardrails are the built-in safety barriers that protect the business, but they cannot function effectively without strong governance. Technical guardrails highlight this partnership, with governance ensuring they align with company policies. Without governance, guardrails become disconnected from the main system, and without guardrails, governance becomes a set of rules without any true meaning. Policy, usage and approved tools also interact with both and are fundamental for structured AI innovation.  

Governance and oversight promote AI innovation by helping businesses gain trust and create robust procedures. Through continuous assurance, visibility can be maintained across the entire AI system. When unusual activity that breaches the set guidelines is detected, evidence can be gathered and clearly demonstrates the controls are functioning. Continuous monitoring is the standard, but it will only drive responsible AI innovation if people read AI policies and are knowledgeable about governance.   

AI acceleration meets governance reality  

On paper, maintaining governance is a simple process; however, business realities present immense roadblocks to responsible AI innovation. Senior leaders want instant results and will often push for rapid AI adoption, which creates pressures to skip critical governance procedures. Despite current efforts, AI is becoming increasingly hard to regulate as it is built into office software and is near impossible to block.  

Internal governance is preventing businesses from maintaining secure systems and driving innovation responsibly. The reality is that there is no clear individual who approves AI-built apps and anyone can override AI decision, so written policies need to be monitored consistently. Recently, it has become increasingly prominent for non-engineers to build complex AI applications in a mere few hours, without support. Some of the most prominent weaknesses include neglecting human-in-the-loop governance, ‘red/green light’ evaluation and regular checkpoints coupled with rash AI rollouts.  

To remain competitive, businesses are prioritising speed at the cost of resilience. The rise of ‘vibe coding’ is accelerating this challenge. As an example, a non-technical employee building an application in a few hours that duplicated a system the organisation had already invested hundreds of thousands of pounds in may demonstrate innovation, but bypassing security, governance, data protection and technical review creates unnecessary risks, so the right approach is to involve the appropriate teams to assess, secure, and properly implement it. While speed is valuable, governance risks emerge when organisations don’t establish clear boundaries around what should be built internally and what should be sourced from established vendors.   

As organisations embrace AI development, it must be managed responsibly. There is no doubt that AI is emerging as one of the most beneficial business enablers, but it must be visible, governed and understood to drive innovation. The speed of AI adoption cannot come at the expense of security, compliance or accountability. By establishing clear frameworks, businesses can empower teams to innovation, while ensuring AI is deployed in a controlled and responsible way.  

Moving towards mature governance 

When it comes to AI, human intervention is non-negotiable. When AI agents act in continual sequence, they can create immense failures, so there must always be checkpoints for evaluation. Institutional knowledge is a must. There will come a time where the developers or AI-built code are no longer available, and organisations will have to control their own critical processes independently.  

Policies should be codified so AI can read and enforce them, transforming static documents into guidelines. However, approved AI tools and use cases evolve far faster than annual policy reviews, so they should be supported by a living, dynamic risk register, alongside technical guardrails, committee-level oversight and continuous assurance. As governance matures, organisations will progressively move towards automated remediation, where issues are identified and addressed automatically, with a human validating the outcome. Alongside codified policies, data boundaries, data loss prevention and classification are invaluable for maintaining governance and secure AI models. 

Mature governance is invaluable for driving innovation as it ensures models are tested regularly. This not only helps businesses promote trust by setting clear safety limits but also ensures costly legal or ethical mistakes are prevented. Without clear rules, AI cannot be scaled and it becomes difficult to test new ideas confidently. Governance should empower businesses to experiment, attracting customers and helping them establish themselves as industry leaders.  

The promise and constraints of AI 

AI has been shown to add genuine value when it comes to controlling AI systems. Not only can it mine immense data sets at speed, but AI can also identify patterns humans typically overlook. It is already helping organisations identify vulnerabilities faster, detect subtle anomalies such as look-alike domains, and analyse years of operational data to uncover systemic weaknesses in areas such as architecture, coding practices and testing. By correlating alerts across multiple security tools, AI also enables security teams to respond more quickly to incidents, while keeping a human responsible for the final decision. Businesses have several focus areas which enable efficient operations; however, workloads can be simplified through AI support, giving professionals time to focus their efforts on higher-value work. 

However, AI cannot replace humans indefinitely. Human context is a critical security layer, informing judgements computers do not account for. AI should accelerate strong governance and architecture that are already in place, not act as a substitute for them. Governance remains a key differentiator when it comes to employing AI and driving innovation responsibly. While AI continues to inform professionals on the best responses, humans remain the best at applying strategic judgement, creativity and context.  

It is clear AI is outpacing governance, leaving businesses increasingly susceptible to risks. Despite this trend, continuous assurance is helping businesses gain visibility across their models to uncover shortfalls they are likely to overlook. Governance and clear guidelines are no longer barriers to innovation; they are what enable organisations to adopt AI with confidence and at scale. AI does not create entirely new risks so much as expose and amplify existing ones. Weak vulnerability management, poor data governance and unclear access controls become far more significant in an AI-driven environment. By getting these fundamentals right, organisations can build the governance, guardrails and continuous assurance needed to innovate safely and at pace.