When was the last time you had sweet cybersecurity dreams?
If keeping things secure has been one of the most difficult tasks for years, the AI revolution is making it even more challenging. Add to that the fact that these tools are increasingly capable and available to everyone, and nightmares turn into insomnia for those in charge.
So how can organizations prepare to secure something they don’t fully understand?
How can they plan for something that’s changing every day?
How can they identify the gaps if those gaps are constantly changing?
If you are reading this article hoping to find a simple five-step framework to have your CISO sleeping like a baby, I’m afraid you will be terribly disappointed. I don’t think anyone has figured it out yet. But since you’re already here, I believe the answers begin with the following questions.
Six Questions Every Leadership Team Should Be Asking
Do you know which AI tools your employees are using without approval?
We began with Bring Your Own Device policies, which evolved into Bring Your Own Cloud, and now we are dealing with Bring Your Own AI, each introducing greater risks of data breaches. Are you willing to wait until you reach Bring Your Own Disaster?
Does your acceptable use policy specifically address generative AI, or was it written for a pre-AI world?
Most policies are reviewed annually. One full year in AI times is enough for new tools to become available and be adopted before anyone reviews them. How many new AI threats do you think will spread before your next policy review?
Has your security team been trained to recognize AI-generated phishing, deepfake audio and synthetic identity attacks?
Deepfakes and voice clones have become hard to spot. Without a formal training program, identifying these attacks becomes a challenge nobody wants their team to face. If a cloned voice of your CEO called your finance team today, how many people would know to hang up?
Do you know if your vendors and partners are using AI in ways that create new entry points into your systems?
Most software vendors are adding AI components to their products. Some are vague about which AI providers power their features. When your approved tools add AI features overnight, who in your organization finds out, and how?
Do you know exactly what data your organization has fed into third-party AI platforms, and where that data lives now?
This may be the most uncomfortable question on this list. Once information goes into a platform you don’t control, you can’t pull it back out. For data that has already left, the plan may be hope. If a regulator or customer asked you today to list every AI platform that holds your data, how long would it take you to answer?
Is your cybersecurity strategy built to adapt, or built for a world that no longer exists?
Cyberattacks are no longer launched at human speed. Today, a handful of people can direct hundreds of AI agents. If an attack launched tonight at machine speed, who would be awake to respond, and what would they do in the first ten minutes?
The Wrap
These questions are just a starting point. Answer them honestly, keep asking them, and add your own questions with each iteration.
Remember that the difference between attackers and defenders is that the attacker’s primary business is finding vulnerabilities, while defenders often treat cybersecurity as a budget line to minimize. How much advantage are you willing to give them? They just need to get it right once, while you need to get it right every time.
Back to your CISO’s sleep, and yours: the more you answer the uncomfortable questions, the more comfortable your nights will be. You can’t eliminate surprises, but you can shrink them.
Sweet dreams!
