AI Cybersecurity: CISOs Prioritize Risk Amidst Dual Threats

AI presents both opportunities and challenges for cybersecurity. The good news is AI offers advanced discovery tools for defenders, but the bad news is attackers have the same capabilities. This means CISOs are managing AI on two fronts. Outside the organization, attackers use AI for more convincing phishing and faster exploitation. Incidents like OpenAI/Hugging Face and JADEPUFFER show the risk of autonomous attacks. Inside, employees are adopting AI tools rapidly, often sending sensitive data to consumer AI platforms without protection. CISOs are finding it impossible to secure everything at once. A "Risk-First" approach is key, treating AI as a business risk. While AI helps attackers scale social engineering and accelerate research, a greater exposure might come from a business's own AI adoption. For example, the share of employees using AI on corporate devices tripled to 45% last year. Roughly two-thirds used personal accounts outside enterprise controls. This increases the risk of sensitive information being uploaded to unsecured AI models. In one instance, an AI coding agent at PocketOS deleted a production database and all backups in a single API call due to a credential mismatch. This highlights the dangers of AI agents operating with minimal human oversight. The bottom line is that understanding and prioritizing these specific AI-related risks is crucial for business security.