Lisa Ventura MBE FCIIS of the AI and Cyber Security Association argues that AI risk falls between teams, and sets out five steps security leaders can take this quarter, starting with naming one accountable owner.
A sales team connects an AI assistant to the customer database. Data science checks its accuracy and legal reviews the contract. Months later, an audit finds the assistant will hand over any customer record to anyone who phrases the request the right way, and the security team is hearing about the tool for the first time.
This is the story that opens an Experts Corner article by Lisa Ventura MBE FCIIS, Chief Executive and Founder of the AI and Cyber Security Association (AICSA). Her point is that nobody in it did anything wrong by the standards of their own job. The failure sat in the gap between them.
The article starts with ownership. A Pentera survey of 300 US security leaders found 67% had limited visibility into how AI is used in their organisation, and none claimed full visibility. It then looks at two professions speaking different languages: AI specialists talk about accuracy and drift, security specialists about threats and controls. Prompt injection and data poisoning fall between them.
From there, it turns to AI agents, which take actions rather than just answer questions, so every permission they receive becomes a possible route in for an attacker. It closes with five steps for this quarter, from naming one accountable owner to red team exercises against AI tools, and the reasons Ventura founded the AICSA.
For security and risk leaders, the takeaway is practical. Ventura notes you do not need a new budget line, only the right two people in the same room, early.
Read the full article on ITSPmagazine: https://www.itspmagazine.com/blog?p=ai-security-has-no-owner-and-that-is-the-problem-f50c682e
This is an Experts Corner on ITSPmagazine. Learn and view more stories at https://www.itspmagazine.com/blog?topic=experts-corner
If you want to contribute your own story to the Experts Corner, visit https://www.itspmagazine.com/advertise
Hello, I’m Lisa Ventura, Chief Executive and Founder of the AI and Cyber Security Association, the AICSA.
My article for Experts Corner is called AI Security Has No Owner, and That Is the Problem.
AI tools are now in almost every part of the business. Sales, HR, finance and marketing all use them. When I ask organisations who is responsible for securing those tools, I usually get several different answers, and that tells me nobody is.
Research from Pentera this year found 67% of CISOs have limited visibility into how AI is used in their organisation. None of them said they had full visibility.
The problem sits between two professions. AI specialists focus on accuracy and performance. Security specialists focus on threats and controls. Risks like prompt injection and data poisoning fall into the gap, and each team assumes the other is handling them.
In the article, I set out 5 steps to close that gap this quarter, starting with naming one accountable owner for AI risk. I also explain why I founded the AICSA to bring these 2 communities together.
Have a read, and let me know who owns AI security in your organisation.