As AI adoption surges, executives are learning tough lessons about security, oversight and accountability.
Companies across the globe are implementing AI across their operations, ranging from AI agents to adding AI to existing security tools and other internal technology systems.
AI adoption typically moves much faster than organizations can set up the guardrails and governance necessary to protect systems and customer data, according to security experts. They warn that senior leaders and board members need to pay close attention to cybersecurity and oversight issues before going all in with AI.
An October report from PwC shows that companies are less prepared to protect against cyberattacks targeting AI systems. Half of security leaders said that protecting AI was the largest single preparedness gap, outranking cloud-related security threats, third-party breaches and ransomware.
“ I actually think we’re seeing a growing awareness among business leaders that AI opportunity and AI risk have to be considered together,” Tonya Ugoretz, co-leader of the Cyber and Risk Innovation Institute at PwC, told Cybersecurity Dive.
The findings are based on a survey of more than 3,900 business and technology leaders across 71 countries worldwide.
Among the key governance issues related to AI is the need to define clear ownership over the technology. At many companies, there is a lack of clarity over who is responsible for AI implementation and who decides what measures are required to protect data and secure other critical systems.
“Our findings show there isn’t yet one ownership model for AI governance and risk,” Ugoretz said.
Less than 30% of AI accountability sits with CIOs, CTOs or other technology leaders, the report found. About one-quarter of organizations have a dedicated AI executive, and 17% of organizations said AI accountability sits with the CISO.
Without clear lines of accountability, it remains unclear who ultimately is responsible for managing AI cyber risk and ensuring that the organization’s AI programs addressed security concerns prior to implementation.
Companies have invested heavily in implementing agentic AI tools, in many cases to boost productivity or make their existing products more efficient. One of the top concerns that cyber risk leaders face is the amount of access these tools are given and whether there is sufficient human oversight to monitor what these AI-based tools are actually able to do.
“Treat every agent as a new identity with a named human owner,” George Gerchow, chief security officer at Bedrock Data, told Cybersecurity Dive. “An agent inherits the access of whoever it runs as. It never has to break it, it walks through the doors we left open.”
A third-quarter report by KPMG shows that 49% of organizations have established high-risk use scenarios where access by autonomous agents is restricted. This compared with 28% in the same quarter the previous year.
One of the leading security issues that companies face is how to monitor the cyber risk of third-party software. Many companies implementing AI employ third-party tools rather than develop their own AI products in-house.
Third-party tools often have wide access to sensitive information and privileged access, which grants them direct access to connected systems. If security leaders don’t have the proper visibility into third-party connections, the AI-based tools can access information that existing security tools cannot see.
“So, vetting those vendors from both a cybersecurity and a technical standpoint” is an important requirement, according to Pasha Sternberg, a principal and privacy and cybersecurity attorney at Polsinelli.
An ongoing security risk within organizations is shadow AI, meaning AI-based tools that are not authorized or vetted by the organization. Corporate employees continue to download AI-based applications in order to boost productivity or learn a new skill, or for their own personal use.
However, companies often have limited visibility into how these tools are being used or what potential risks they could introduce when interacting with corporate systems or customer data.
The National Cyber Security Centre in the U.K. warned companies last month that shadow AI can introduce unintended risks into an enterprise environment
Legal experts warned that companies often fail to understand the impact on unsanctioned tools being used by their own employees.
“It’s hard to secure and manage what you don’t know exists,” said Sarah Glover, a shareholder and privacy and cybersecurity attorney at Polsinelli.