Your AI Is Moving Faster Than Your Security Team Can Follow
Boards want CISOs to greenlight AI projects at speed. The problem is that the tools to track what those AI systems actually touch, and whether they are behaving safely, have not kept up.
Key points
- AI agents connected to company data and workflows can make a single weak security control far more damaging than it would have been two years ago.
- The biggest risks are not exotic AI attacks but familiar problems: accounts with too many permissions, weak access controls, and passwords left in old code repositories.
- Most organisations have no single team that can see the full picture of what an AI system can access and trigger.
- Security chiefs are now expected to tell boards in real time which AI projects are safe to accelerate and which need to slow down.
- A control that passed a security review six months ago may already be out of date after one vendor update or permission change.
The nurse who books shifts through an AI scheduling tool, the shop owner whose accountant uses an AI assistant to pull invoices, the teacher whose school just rolled out an AI writing helper: none of them chose those systems. Someone higher up decided AI would make things faster. Security leaders are now being asked to make sure that speed does not quietly create disasters.
The piece, originally published by CSO Online, frames the problem clearly. AI has spread through companies far faster than the programmes designed to govern it.
How does AI make old security problems worse?
It does not invent new problems so much as turbocharge existing ones. Think of an AI agent, a software program that can take actions on its own, connected to customer records, internal documents, and supplier systems. If that agent runs under an account with too many permissions (access rights wider than the job actually requires), a criminal who manipulates it can reach far more data than they could by targeting a single human employee. The blast radius, meaning the total damage a single incident can cause, grows quickly.
The classic culprits are not glamorous. Credentials, which are the usernames and passwords that prove who you are, left behind in old code repositories. Sensitive customer data scattered across systems with no central record of where it sits. Logging gaps, where the system fails to record what the AI agent actually did, making incidents hard to detect and almost impossible to unpick afterwards.
Prompt injection, where a criminal hides hidden instructions inside text the AI reads and tricks it into taking unintended actions, does exist. So do jailbreaks, where users find ways to make a model ignore its own safety rules. But the security chiefs losing sleep are worrying about the basics first.
The visibility problem is structural. Security, IT, procurement, and privacy teams each hold a fragment of the picture. One team knows the agent exists. Another knows where it runs. A third knows who paid for it. Nobody has the full map of what it can reach and whether it is operating within policy today, not just on the day it was approved.
That last point matters. A system that passed a risk review six months ago may have quietly gained new permissions since then.
What ordinary people should watch for. If you use an AI tool at work that can access customer information or financial records, ask your IT team what it can actually see and whether its access is logged. You are not being paranoid. You are asking exactly the right question.
The answer security leaders are working toward is continuous monitoring rather than one-time sign-off: watching AI systems the way a smoke alarm watches a room, not the way a fire inspector visits once a year.
