SECTIONS
MORE
For breaking news and daily updates, subscribe to our newsletter.
“As attacks grow more complex and identity compromise becomes more common, assuming a constant state of breach is the right mindset for maintaining vigilance and strengthening security.” – David Nuti, Extreme
SHARE
Share this article on:
Saurabh Sood
Cybersecurity Presales Architect at SoftwareOne
Recent reports of AI systems acting beyond their intended scope are a timely reminder to get the basics right. We wouldn’t give a new contractor access to every file with no supervision, yet that is effectively what happens when AI is introduced on top of unclassified data and broad permissions. We onboard contractors properly, and the same discipline is what lets us use AI with confidence.
The lesson isn’t that AI is too risky to adopt. It’s that the technology is only part of the picture. What matters is the data beneath it, who is accountable for it, and how well governance keeps pace with experimentation. The good news is that it’s fixable.
Start with your data. In my client conversations, AI adoption is often outpacing governance. When data isn’t classified and access is too broad, AI can surface information people were never meant to see. Before anything else, organisations need to know where their data is stored, who can access it and how it’s classified. It isn’t glamorous, but it’s the core of the problem.
Plan for accountability. Access controls are only half the picture. If an AI agent does something unintended, who is responsible, and how quickly would you know? Directors should be asking that question. Answering it takes clear ownership, active alerting, a tested incident response plan, and agreed breach notification timelines with vendors. These are often overlooked until something goes wrong.
Size changes the safeguards, not the risk. Organisations under APRA or critical infrastructure obligations tend to move cautiously, because they know AI isn’t as simple as flipping a switch. Smaller businesses face the same risks with fewer safeguards, and are often more ambitious about experimenting with AI. That’s understandable, but it’s where I’d urge the most care.
Be proportionate. Scale the depth of your risk assessment to the risk. A large organisation may need a formal gap analysis, while a small business may need a simple check of what data the AI can reach and what it can do. If you’re considering a privately hosted or tenant-isolated AI service, check the access controls, retention terms and data residency. Hosting alone isn’t enough: limiting what any AI can reach and do matters wherever it’s hosted.
The ASD Essential Eight provides a valuable cybersecurity baseline for organisations of any size, although it should sit alongside AI-specific governance, privacy and risk-management controls.
Govern the cost too. Unmonitored AI usage can also run up unexpected charges, and unusual spikes can signal misuse or compromised credentials. Set spending limits and usage alerts from day one. Treat identity, data, cloud and governance as one connected problem rather than separate tools, and plan how you would recover and keep operating if an AI agent or supplier fails. The practical way forward is to assess where you stand today, build a roadmap that fits your budget, and work with a reputable partner who can help you implement and monitor the controls over time.
AI shouldn’t be a leap of faith. With the right foundations, security is what lets organisations adopt it with confidence.
David Nuti
Head of Security Strategy at Extreme
CISOs should be defining security outcomes that go beyond perimeter authentication and access enforcement to include the continuous monitoring of identity behaviour beyond initial verification. As attacks grow more complex and identity compromise becomes more common, assuming a constant state of breach is the right mindset for maintaining vigilance and strengthening security.
AI can be an effective tool for maintaining security policies and hygiene, but its effectiveness depends on having the right data foundations to support analysis and guide decisions. This makes identity-based security policies, particularly through the Zero Trust framework, a business-critical priority as organisations look to strengthen their security posture.
As AI becomes more deeply integrated across the enterprise, organisations need to consider not only the capabilities of their AI agents, but also the knowledge, context and controls they bring to the environment. Agents should be able to provide recommendations based on the specific environment they operate in, with the controls needed to adopt AI at a pace that matches the organisation’s level of trust. Expertise, context and control are key to building a secure foundation.
That same approach must extend to how organisations secure AI agents themselves. Security teams should treat AI agents as identities in their environment, with the same need for guardrails, access controls and continuous monitoring as human users. As AI can be used to automate attacks, monitoring east-west movement and behaviour across the network is key to ensuring activity stays within defined permissions. The Zero Trust principle of “never trust, always verify” must apply equally to every identity, whether an employee, an IoT device or an AI agent.
David Hollingworth
Author
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
This section requires JavaScript to display the latest content.
