What does AI mean in the context of security?

The secure AI adoption tug-of-war

If there’s one idiom that will resonate with CISOs everywhere, it’s probably: don’t run before you can walk.  

Security leads have long stressed the importance of laying the right groundwork for successful outcomes. And in today’s rapidly changing AI landscape, that ethos has never been more important.

In the race to innovate and compete (and, often, to please shareholders), businesses are tripping over themselves to bring AI into the heart of their tech stack. But this can be a dangerous game if it means bypassing adequate threat analysis processes.  

It’s a tug-of-war that looks set to stress-test frameworks and redefine roles across the information security industry. So what’s the safest way forward?  

To help find answers, we conducted qualitative research with 22 chief information security officers (CISOs) and security leaders across the DACH region – in complex and, in some cases, highly regulated sectors, such as healthcare, financial services, pharma, government, IT, and transport.

Here we explore what those findings can tell us about the evolving security landscape, secure AI best practices, and the changing role of the CISO.

Secure AI best practices

With multiple risks butting heads with the pressure to adopt AI rapidly, it’s no surprise that less than half of the CISOs we interviewed believe their organisation is well-prepared for the transition to AI. 

So what can we do to hold back the tide of possible security breaches? As is usually the case, the solution often begins with people, not technology.

Let's start with something CISOs have been talking about for years: awareness and education. It sounds overly simple, but with new technology comes new risks, and these new risks must be explained.

Of course, education can be a hard sell. You don’t want to go in front of people and say: here’s another boring, two-hour education session, because people generally hate that. But for compliance and security, education is key. We need AI literacy across employees, society, the economy – across the board.  

'A good way to improve literacy in the AI era is to let people experiment in safe environments. Rather than have colleagues feed sensitive data to public models, they should be given access to well-shielded environments where they can gain their own hands-on experience'.

The second part of the puzzle is about getting processes and technologies under control. That means working on internal governance programmes and frameworks built to handle this new technology, as well as using controllable, open-source, and explainable AI models wherever possible.  

Our recommendations here are clearly outlined in our responsible AI framework, but in the main, we’d suggest that CISOs exercise caution, control, and patience above all else.  

The following eight steps provide a rock-solid starting point for your secure AI strategy: 

1. Don't rush AI adoption; risks can be mitigated by improving existing procedures
2. Build expertise through controlled experimentation and training
3. Create employee awareness about AI risks and guidelines 
4. Adapt internal governance processes 
5. Participate in knowledge-sharing networks 
6. Follow emerging security recommendations and standards 
7. Stay informed about the ever-evolving tools and regulations 
8. Maintain constructive skepticism, while remaining open to AI's benefits 

The good news is that there’s already evidence of this groundwork in action. In our study, 80% said they planned to have policies regarding AI security issues in place in the next 24 months, while 95% plan to educate their entire employee base on AI security.  

Secure AI: a game of caution, control, and patience

Ultimately, while it may be impossible to keep every AI risk under control at all times, it’s important to stay pragmatic in your approach. Combining the strengths of people and machines – and maintaining human oversight – is often the key to secure AI use.  

Zühlke is already helping organisations across industries walk this complex tightrope – providing a guiding hand in translating proofs-of-concept tools into scalable, secure solutions.