Episode Details

A sales team connects an AI assistant to the customer database. Data science checks its accuracy and legal reviews the contract. Months later, an audit finds the assistant will hand over any customer record to anyone who phrases the request the right way, and the security team is hearing about the tool for the first time.

This is the story that opens an Experts Corner article by Lisa Ventura MBE FCIIS, Chief Executive and Founder of the AI and Cyber Security Association (AICSA). Her point is that nobody in it did anything wrong by the standards of their own job. The failure sat in the gap between them.

The article starts with ownership. A Pentera survey of 300 US security leaders found 67% had limited visibility into how AI is used in their organisation, and none claimed full visibility. It then looks at two professions speaking different languages: AI specialists talk about accuracy and drift, security specialists about threats and controls. Prompt injection and data poisoning fall between them.

From there, it turns to AI agents, which take actions rather than just answer questions, so every permission they receive becomes a possible route in for an attacker. It closes with five steps for this quarter, from naming one accountable owner to red team exercises against AI tools, and the reasons Ventura founded the AICSA.

For security and risk leaders, the takeaway is practical. Ventura notes you do not need a new budget line, only the right two people in the same room, early.

Read the full article on ITSPmagazine: https://www.itspmagazine.com/blog?p=ai-security-has-no-owner-and-that-is-the-problem-f50c682e

This is an Experts Corner on ITSPmagazine. Learn and view more stories at https://www.itspmagazine.com/blog?topic=experts-corner

If you want to contribute your own story to the Experts Corner, visit https://www.itspmagazine.com/advertise