Your AI Is Moving Faster Than Your Security Team Can Follow
Boards want CISOs to greenlight AI projects at speed. The tools to track what those AI systems actually touch, and whether they're behaving safely, haven't kept up.
Key points
- AI agents connected to company data and workflows can make a single weak security control far more damaging than it would have been two years ago.
- The biggest risks aren't exotic AI attacks but familiar ones: accounts with too many permissions and credentials left in old code repositories.
- Most organisations have no single team that can see the full picture of what an AI system can access and trigger.
- Security chiefs are now expected to tell boards in real time which AI projects are safe to accelerate and which need to slow down.
- A control that passed a security review six months ago may already be out of date after one vendor update or permission change.
The nurse who books shifts through an AI scheduling tool, the shop owner whose accountant uses an AI assistant to pull invoices, the teacher whose school just rolled out an AI writing helper: none of them chose those systems. Someone higher up decided AI would make things faster. Security leaders are now being asked to make sure that speed doesn't quietly create disasters.
How does AI make old security problems worse?
It doesn't invent new problems so much as turbocharge existing ones. Take an AI agent, a software program that can take actions on its own, connected to customer records and supplier systems. If that agent runs under an account with too many permissions (access rights wider than the job actually requires), a criminal who manipulates it can reach far more data than they could by targeting a single human employee. The blast radius, meaning the total damage a single incident can cause, grows fast.
The culprits aren't glamorous. Credentials left behind in old code repositories. Sensitive customer data scattered across systems with no central record of where it sits. Logging gaps, where the system fails to record what the AI agent actually did, making incidents hard to detect and almost impossible to unpick afterwards.
Prompt injection, where a criminal hides instructions inside text the AI reads and tricks it into taking unintended actions, does exist. So do jailbreaks, where users find ways to make a model ignore its own safety rules. But the security chiefs losing sleep are worrying about the basics first. As we reported on 13 July, most AI risk programmes can document the problem but can't answer who actually shuts the system down when something goes wrong.
Should you worry about who holds the full picture?
The visibility problem is structural. Security, IT and procurement each hold a fragment. One team knows the agent exists. Another knows where it runs. A third knows who paid for it. Nobody has the full map of what it can reach or whether it's operating within policy today, not just on the day it was approved.
That last point matters more than it sounds. A system that passed a risk review six months ago may have quietly gained new permissions since then.
What ordinary people should watch for. If you use an AI tool at work that can access customer information or financial records, ask your IT team what it can actually see and whether its access is logged. It's not paranoid. It's the right question.
The answer security leaders are working toward is continuous monitoring rather than one-time sign-off: watching AI systems the way a smoke alarm watches a room, not the way a fire inspector visits once a year. The real test isn't whether a risk programme looks good on paper. It's whether anyone in the building can act on it before the damage is done.
