A(I)larm Phase 2 for CISOs and CEOs!
It's a bold title, but we want to take this seriously to to draw attention to. A recent media story it turns out that that “your own secure AI environment” isn’t necessarily a better alternative than using ChatGPT or Google Gemini. Why there’s cause for A(I)alarm phase 2? Be sure to read on, because there are two red flags that could go off go offgo off and the impact is significant.
1: Public AI or Private AI Environment
Does this situation sound familiar? At management’s request, the company developed its own AI engine. The main reason given was that this would be safer than sharing all the data with a public AI environment. It feels like a good decision. Everything seems under control…
That’s probably what they thought at McKinsey* as well. Yet recently, 46.5 million chat messages, 728,000 files, and personnel data from 57,000 user accounts were left out in the open. The reason? The AI platform “Lilli” from this renowned consulting firm turned out not to have been the right advice internally—one might say sarcastically. But there was something even worse:
AI Attacks AI
It’s well known that managers in the boardroom, including the CISO, are afraid of cybercriminals. But these days, you have to take into account that attacks don’t just come from people—this is the second wake-up call. It changes our perspective on cybersecurity and makes it more complex. In the case of McKinsey, it was an AI agent—software operating autonomously—that carried out this attack. This example demonstrates that artificial intelligence can also turn against you.
In fact, it wasn’t a human hacker but an autonomously operating software agent that carried out the attack. Without any login credentials or prior knowledge, the agent managed to penetrate McKinsey’s digital defenses. Furthermore, we’ve entered A(I)larm Phase 2 because an AI agent can discover unsecured endpoints much faster than humans. “AI agents can continuously detect and exploit vulnerabilities at top speed and without human intervention,” we read in the Dutch IT Channel article. This applies to you, too. So what about the crown jewels in your self-built or custom-built AI solution?
And now...?
That’s the sense of uncertainty that lingers. After all, being 100% secure is now practically a pipe dream in a world increasingly ruled by AI. Even having a paid version of an AI solution shouldn’t be a reason to assume you’re safe anymore. Still, there are preventive measures you can take yourself. For example:
- Developing an AI policy: that is the foundation needed to help employees understand which AI applications may be used and what data may be used in connection with them.
- A risk assessment that identifies strategic vulnerabilities and their potential impact.
- Anonymizing privacy-sensitive data. If an AI assistant were to misuse the data, it would have no impact on individuals, such as your customers or employees. This is because the data cannot be traced back to specific individuals.
- Controlled data classification and risk analysis by the CISO. Our recommendation is to always obtain the CISO’s approval first when using privacy-sensitive or business-sensitive information. He or she will need to verify that there are no unsecured endpoints or other vulnerabilities within the AI application that may have been overlooked.
Our Final Conclusion
AI can bring both benefits and harm. It often seems as though AI is primarily embraced as a “holy grail.” Something like a boat you can’t afford to miss, because otherwise… That’s precisely where the danger may lie. Be sure to take your time and don’t let yourself be distracted by all kinds of AI gurus who claim to know it all: your cybersecurity could end up under pressure as a result. Source: Dutch IT Channel