AI is helping businesses move faster. It can automate work, analyse huge amounts of information and help organisations get more value from their data. That’s exciting, and businesses shouldn’t be afraid of embracing it.
But we do need to be realistic about what’s happening on the other side.
AI can also help cybercriminals research targets, scale phishing campaigns and make social engineering more convincing. What I find interesting, though, is that the weaknesses they’re exploiting aren’t necessarily new. Compromised credentials, excessive permissions, poor visibility and slow remediation are problems we’ve been talking about for years. AI can simply make exploiting them faster.
We can spend a lot of time worrying about sophisticated new AI-powered attacks when some of the biggest risks are already sitting within our businesses. The question isn’t whether we should slow down AI adoption. It’s whether the security foundations underneath it are strong enough to let us move forward with confidence.
The recent ASOS incident is a useful example.
ASOS said an unauthorised party impersonated a trusted contact to obtain an employee’s login credentials. Those credentials were then used to access information on certain third-party platforms. The company said some names and contact details were accessed, while payment card information and account passwords were not.
Following the incident, the National Cyber Security Centre advised customers to remain alert to suspicious messages and links.
The worrying thing is how easily this could happen. The threat wasn’t necessarily a hidden hacker or a breach of the network; it was someone being convinced that the person they were dealing with could be trusted.
Now think about that in the context of AI. AI agents can increasingly access information, interact with applications and take actions across business systems. That makes identity, access and accountability even more important. There are three simple questions every organisation adopting AI should be able to answer:
If the answer to any of those questions isn’t clear, that should give you pause.
The more connected our environments become, the more important visibility becomes too.
AI doesn’t operate in isolation. It can sit alongside cloud platforms, business applications, company data and third-party services. If you don’t have a clear picture of what’s happening across that environment, spotting something unusual becomes harder.
But detection is only half the story. What you’d really want to know is: if something suspicious happened tonight, how quickly could we understand it, contain it and recover?
The longer a threat goes unnoticed, the more opportunity it has to spread, disrupt operations or expose sensitive data. Having the right visibility and response processes in place means suspicious activity can be investigated quickly, limiting the damage and helping the business get back to normal.
The answer is never simply buying more security technology. Disconnected tools can contribute to fragmented visibility, complexity and alert fatigue.
For all the complexity surrounding AI, the starting point can actually be pretty straightforward.
Know your data. What information could your AI tools and agents access, and how sensitive is it?
Control access: People, applications and AI agents shouldn’t automatically have access to everything simply because it’s convenient.
Understand your connections: Know how AI interacts with your cloud services, applications, APIs and third parties.
Make sure you can respond: Being able to see suspicious activity matters, but someone also needs to be able to act on it quickly.
And finally, give people clear guardrails: Employees need to know which AI tools they can use, what information they can share and where human judgement is still required.
Secure governance, trusted data and security shouldn’t be something we bolt onto an AI project once everything else has been decided. They need to be part of the foundation.
We don’t see cybersecurity as something that should put the brakes on AI adoption. Done properly, it should do the opposite.
Good security gives businesses the confidence to experiment, connect AI to useful information and scale the things that work, knowing there are appropriate controls around them.
Because ultimately, AI can accelerate what’s already there.
If your foundations are fragmented, it can accelerate risk. But if your environment is secure, visible and well managed, it can accelerate opportunity.
So, really, you should be asking what AI could do for your business, but also whether you’re ready for it.
Node4, we bring AI, cloud, data, networking and security together to help organisations build secure foundations for transformation.
Talk to our experts about making your business AI-ready, without giving your security team nightmares.