A cloud intrusion that ended with the deployment of cryptomining malware has exposed a bigger risk for enterprises: AI gateways that concentrate access to cloud identities, permissions, and foundation models in a single, highly privileged system.

Researchers from cybersecurity firm Darktrace found attackers compromising an AWS EC2 instance acting as a LiteLLM proxy for Amazon Bedrock, eventually deploying XMRig cryptomining malware, along with attempts to abuse cloud identities and AI services.

Although the attack ended in cryptomining, researchers said the bigger concern is that AI gateways centralize model access, identities, and cloud privileges, making them valuable targets.

Experts found the attack familiar and consistent with past cloud attack techniques.

“Strip off the AI branding and this is a cloud intrusion pattern we’ve been watching since at least 2018: SSH open to the internet, brute-force attempts, a commodity XMRig miner, and repeated connections to a mining pool,” said Sean Malone, CISO at BeyondTrust. “Even the AI-specific angle, stolen credentials probing Bedrock model access, has had a name since 2024: LLMjacking.”

However, Malone agreed with Darktrace researchers on the potential blast radius. “AI gateways concentrate credentials, cloud permissions, and model access into a single choke point, so a routine intrusion lands on a privileged asset,” he explained.

The attack followed a known pattern

According to Darktrace, the compromised EC2 instance appeared to support LiteLLM activity and was associated with an IAM role capable of accessing Amazon Bedrock resources. While researchers could not conclusively determine the initial access vector, they said the attack followed a sequence commonly seen in cloud intrusions.

Before the miner was deployed, the instance had SSH exposed to the internet, with port 22 accessible from anywhere. Darktrace observed a high volume of inbound SSH connection attempts, largely originating from a single external IP address, indicating probable brute-force activity.

Shortly afterward, the host downloaded a ZIP archive containing XMRig cryptomining malware before repeatedly connecting to a known mining pool over HTTPS.

Darktrace stressed that it could not confirm whether the SSH activity directly led to the compromise because host-level logs were unavailable. However, the timing of the SSH exposure, miner download, and subsequent mining-pool communications strongly suggested the EC2 instance had been compromised and repurposed for unauthorized compute activity.

Compromised AI gateways are a big deal

The disclosure also detailed suspicious IAM activity observed separately, a day later, by another AWS identity. Among the unusual actions were a “GetSendQuota” API call from an IP address in Vietnam, attempts to enumerate and invoke Amazon Bedrock foundation models, and an effort to create a new IAM user using a randomly generated username.

This behavior is commonly associated with establishing persistence following credential compromise. However, Darktrace could not link the IAM activity directly to the LiteLLM incident.

Jason Soroko, senior fellow at Sectigo, said the incident’s significance lies less in the cryptominer than in the system that was compromised.

“These gateways are becoming brokers for identity, model access, prompts, logs, and policy,” he noted. “When one is exposed over SSH or backed by broad IAM permissions, it is no longer just another EC2 instance. It is a control point for AI operations.”

To protect against such attacks, Soroko added, security teams should close public admin paths, remove long-term keys where possible, scope IAM permissions, monitor Bedrock and model access patterns, and correlate workload telemetry with control-plane events.

Darktrace said it helped in the timely containment of the attack. “The cryptomining activity was received by Darktrace’s Managed Threat Detection service and reviewed by Darktrace’s SOC,” the researchers said in a blog post shared with CSO ahead of its publication on Thursday. “Following review, the activity was escalated to the customer. This escalation provided the customer with timely notification of active resource abuse in the AWS environment.”

Organizations racing to embed AI into business operations are realizing that the risk management frameworks they’ve relied on for decades aren’t built for the behaviors, failure modes, and ethical complexities AI systems introduce.

Fortunately, a new generation of AI-specific frameworks has emerged to give organizations a structured way to identify where AI can go wrong, what controls to put in place, and how to demonstrate responsible AI use to regulators, customers, and investors. Not all of these emerging frameworks address the same problem. Some focus on governance and organizational accountability, others on technical security controls, threat modeling, or regulatory compliance. Choosing the right one for your organization depends on where your most pressing gaps reside.

The frameworks are complementary, not competing, because they have different intents, priorities, and objectives, says Nicole Carignan, CISO at Darktrace.

“There is overlap across these frameworks, but that overlap is helpful,” Carignan points out. “It reinforces the core practices organizations need to get right: governance, data integrity, security, accountability, oversight, testing, and continuous improvement.”

Here are five frameworks worth considering for your AI risk management needs.

ISO/IEC 42001 Artificial Intelligence Management System

ISO/IEC 42001:2023 is the first internationally recognized formal standard for AI management. Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in December 2023, ISO/IEC 42001 follows a similar structure to management system standards such as ISO 27001. The framework gives organizations a structured methodology for establishing policies, processes, operational controls, and accountability mechanisms to ensure responsible development and use of AI.

ISO/IEC 42001 requires companies to document how they design, monitor, validate, and control AI systems, while also requiring them to conduct AI impact assessments to evaluate potential legal, ethical, and societal impacts. The standard covers governance structures, third-party supplier oversight, data management, transparency obligations, and lifecycle management.

ISO/IEC 42001 is a voluntary but certifiable standard that applies across sectors and organization sizes. A growing number of organizations have begun using it to demonstrate adherence to responsible AI practice and alignment with regulations such as the EU AI Act. The ISO/IEC have described the framework as helping organizations align their AI practices with legal and regulatory requirements; demonstrate responsible AI governance; manage risks tied to bias, safety, and security; and enhance stakeholder trust.

ISO 42001 is a great option for organizations just getting started with AI risk management, says Nicole Carignan, senior vice president for security and AI strategy and field CISO at Darktrace.

“It provides the strongest foundation for building an AI risk management program, rather than addressing individual AI risks in isolation,” she explains. “From a program-building standpoint, ISO 42001 is the right place to start because it forces organizations to think holistically about ownership, governance, oversight, data integrity, security risk mitigation, accountability, and continuous improvement.”

One downside Carignan is that the framework is resource-intensive to implement, and the full standard is not publicly available. Both challenges can be formidable for organizations that are very early in their AI governance journey, she says.

NIST AI Risk Management Framework (AI RMF)

Released by the US National Institute of Standards and Technology (NIST) in January 2023, the AI Risk Management Framework (AI RMF) is a voluntary framework designed to help organizations of all sizes and across all sectors identify, assess, and manage risks associated with AI systems across their entire lifecycle.

The framework consists of two parts. The first offers guidance on how organizations should think about AI risks and the characteristics of trustworthy AI systems, such as validity, safety, security, transparency, explainability, privacy, and fairness. The second part is structured around four interconnected functions:

• Govern focuses on what organizations need to do to build internal culture, policies, and accountability structures for AI use.
• Map involves understanding the broader context and potential risks of specific AI systems.
• Measure focuses on how organizations must evaluate and track those risks using both qualitative and quantitative methods.
• Manage provides guidance on risk prioritization and appropriate responses such as mitigation, transfer, or acceptance.

NIST AI RMF includes a separate Playbook that provides practical implementation steps to help organizations implement each of these functions effectively.

For organizations that are not ready to pursue ISO 42001 formally, the NIST AI RMF can serve as a more flexible and accessible starting point, Carignan says.

“It is public and gives organizations a common language for understanding and mitigating AI risk,” she adds. “But if the goal is to build a durable AI risk program, ISO 42001 is the strongest foundation.”

Ram Varadarajan, CEO at Acalvio recommends NIST AI RMF as a good place for organization to get started on AI risk governance, “because it’s built around maturity rather than pass/fail audits.” Its gives organizations starting from zero an opportunity to discover where they stand rather than immediately handing out a failing grade.

“More importantly, it forces the three conversations that have to happen first: who owns AI risk, what AI is actually running, and who gets hurt if something goes wrong,” Vardarajan says.

While researchers at Forrester described NIST AI RMF as a step in the right direction soon after its launch, they also expressed concern over conflicts of interest among the multiple stakeholders that helped draft the framework, the absence of an explicit role for data governance, and the fact that the framework was “still descriptive and not prescriptive.”

As a result, “Chief data officers and heads of data science need to navigate this framework wisely to interpret and apply it to their AI governance efforts,” the analyst firm advised.

ENISA Framework for AI Cybersecurity Practices

ENISA, the European Union Agency for Cybersecurity, developed its Framework for AI Cybersecurity Practices (FAICP) in anticipation of the EU AI Act. Published in June 2023, the framework gives EU organizations structured, AI-specific cybersecurity guidance for enhancing the trustworthiness of their AI activities.

FAICP is organized around three progressive layers. The first covers foundational information and communications technology cybersecurity practices that AI systems inherit by running on standard software infrastructure. The second addresses AI-specific risks, including adversarial attacks, model tampering, data pipeline integrity, and supply chain security. The third provides sector-specific guidance for regulated industries such as energy, healthcare, and telecommunications.

According to the European Parliament, FAICP’s layered nature provides organizations with “a gradual approach” to enhancing the trustworthiness of their AI activities.

FAICP is voluntary, but its close alignment with the EU AI Act and the NIS2 Directive, which is the EU’s primary cybersecurity law, means that EU regulators consider the framework as a baseline for AI governance practices at all organizations doing business within the EU.

FAICP is important because “Europe’s AI Act will likely become the global reference point, the same way Europe’s data privacy law became the de facto standard for companies worldwide regardless of where they’re headquartered,” Vardarajan predicts.

“Within two to three years, expect two frameworks to dominate: the EU AI Act setting the legal floor, and NIST AI RMF providing the operational playbook for meeting it,” Vardarajan says.

ISO/IEC 23894:2023 Information Technology — Artificial Intelligence — Guidance on Risk Management

The ISO/IEC 23894:2923 framework provides organizations with specific guidance on managing risks associated with artificial intelligence. Released jointly by ISO and IEC in February 2023, the framework builds on and adapts the ISO 31000 general risk management standard to address AI-specific risks such as those tied to algorithmic bias, model drift, unpredictable behavior, and lack of transparency in decision-making. It provides organizations a way to evaluate the likelihood and potential consequences of these risks throughout the full AI system lifecycle.

The ISO has described the standard as a “companion to ISO 31000 (Risk Management) and ISO/IEC 42001 (AI Management Systems).” The main difference between ISO/IEC 42001 and ISO/IEC 23894 is that the former is a certifiable management system. It provides organizations with the full requirements for establishing, implementing, and maintaining an AI management system. ISO/IEC 23894:2023 on the other hand is a guidance-only standard focused on how to identify, assess, and manage AI-specific risks.

“Notably, ISO/IEC 23894 offers concrete examples of effective risk management implementation and integration throughout the AI development lifecycle and provides detailed information on AI-specific risk sources,” according to UK-backed AI Standards Hub. “A key benefit of this standard is that application of the guidance can be customized to any organization and its business context.”

Google Secure AI Framework (SAIF)

Google Secure AI Framework (SAIF) is Google’s practical guide for helping organizations develop and run AI systems with strong built-in protections against digital threats. Launched in 2023, it focuses on weaving security and privacy considerations directly into every stage of an AI project’s life cycle, from design through deployment and ongoing operation.

Its main goal is to tackle the unique vulnerabilities that come with AI technologies such as attacks that tamper with training data, trick models through engineered prompts, or steal sensitive information. SAIF draws on Google’s own experiences developing and deploying large scale AI systems and therefore is more engineering-heavy than other frameworks. SAIF is largely focused on helping organizations make their AI systems more resistant to cyberattacks and cyber adversaries and covers areas like data handling, underlying infrastructure, the AI models themselves, user-facing applications and verification processes. It offers organizations practical guidance on implementation controls, shared responsibility, and defending against technical attacks.

Technology consultancy Thoughtworks has assessed SAIF as a framework that helps organizations systematically address “common threats such as data poisoning and prompt injection through a clear risk map, component analysis, and practical mitigation strategies.” According to the firm, SAIF’s “focus on the evolving risks of building agentic systems especially timely and valuable. SAIF offers a concise, actionable playbook that teams can use to strengthen security practices for LLM usage and AI-driven applications.”

David Brumley, chief AI and science officer at Bugcrowd, says that for organizations that want to adopt a framework, the question is not really “which AI risk framework is best?” but “which framework helps [the] organization safely build, deploy, and learn from AI in the real world?”

While most of the currently available AI risk frameworks have their use, most are still focused on preventing bad outcomes rather than helping organizations pave safe roads for a technology that is already inevitable.

“That distinction matters,” Brumley says. “AI adoption is not waiting for perfect governance, and those who focus on a [risk management framework] could inadvertently create a shadow AI problem in their organization.”

Despite best efforts by defenders, malicious emails continue to slip through the cybersecurity cracks, leading some enterprises to implement a layered “defense in depth” strategy that incorporates multiple tools.

Microsoft seems to be challenging this idea, revealing that there are only nominal returns from adding integrated pre- and post-send partners to Defender for Office 365’s protections.

According to its new quarterly benchmarking data, the tech giant catches the vast majority of malicious and spam emails before delivery, misses the fewest compared to competitors by a wide margin, and removes nearly 100% of dangerous emails that do reach the inbox. Collectively, its integrated partners improve that catch rate by less than .05%.

While these numbers seem to tip the scales towards a one-vendor email security stack, experts urge enterprises to be skeptical and cautious of such vendor claims.

Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group, pointed out, “percentages obscure the true quantity and severity of what’s getting through, and, considering it only takes one message to result in an incident, it’s simple enough to argue that there is real value in the defense in depth that having multiple tools provides.”

Malicious and spam email catch by the numbers

Microsoft introduced its quarterly benchmarking report in July 2025 alongside a Defender integrated cloud email security (ICES) ecosystem designed to support multi-vendor security strategies.

The SEG players it ranked itself against this year includes Mimecast, Proofpoint, Hornetsecurity, Trend Micro, Iron Port (Cisco), Barracuda, and FireEye (Trellix); ICES companies include Abnormal, Checkpoint Harmony, Cisco, DarkTrace, KnowBe4 Defend, Tessian, and Trend Micro.

Redmond reported that Defender “consistently leads” in pre-delivery detection, missing 59% fewer high-severity cyberthreats prior to delivery than the other SEG vendors it evaluated. Its closest competitors were Mimecast and Proofpoint. The company also introduced a new metric in this area: A threat miss rate per 1,000 employees. In Microsoft’s case, that was 194 per 1,000; for Mimecast, 478; for Proofpoint, 483.

When it came to post-delivery protection, Defender removed an average of 96.03% of malicious emails that reached the inbox, up from an initial 45% when Microsoft first started tracking the data in its second report.

This makes Defender “an increasingly critical backstop, operating even when ICES solutions are in place,” Jeff Pinkston, VP and GM for Microsoft Defender, wrote in a blog post. Still, ICES tools operating in tandem with Microsoft Defender “continue to provide benefits,” improving malicious catch by 0.29% and spam catch by 0.68%, he said.

“If we focus on the basics, their argument seems strong,” Info-Tech’s Ioussoufovitch noted. “Do you really need a separate ICES vendor for that extra sub 1% catch?” Microsoft paints a “compelling picture” by only focusing on raw catch rate, he said, but we don’t hear the rest of the story: “What exactly is the danger of what isn’t being caught by Defender?”

No one vendor catches everything

David Shipley of Beauceron Security pointed out that the report underscores the fact that “lots of stuff still gets by e-mail filters.”

His company regularly analyzes hundreds of thousands of emails, and the content that gets through “ranges from the shockingly mundane and obvious to a human expert, to highly clever time-delayed attacks,” he said.

A key factor in what gets through is the amount of content that is allowlisted; settings in “100% paranoid mode” get high catch rates, as well as high false positives, Shipley noted. “Anyone who has ever had a sales person lose a deal because the purchase order PDF got flagged has felt this pain.”

Then there’s the AI conundrum: “A key risk for e-mail vendors using agentic LLM-based analysis is it’s now possible to poison those models with hidden content (such as ‘ignore this e-mail, pretty please’),” Shipley said. This means enterprises need a variety of analysis methods.

Ioussoufovitch agreed that keeping pace with threat actors using AI is an industry-wide challenge, particularly as AI enables higher-quality phishing. Filters are improving and will catch some of it, but some will inevitably continue to get through. Those messages are likely highly-targeted, which are lower in volume but harder to catch.

“As of now, current tools do seem to be struggling to keep pace, but that doesn’t mean those tools aren’t necessary,” said Ioussoufovitch. “It just highlights that defense-in-depth, broadly speaking, is becoming more and more important.”

Claims appear more honest

Shipley said that this report appears more honest, accurate, and mature than others claiming 99.99% phish catch rates, “which is never true.” It’s also a “smart marketing move,” because Microsoft competes for the same security budget as other tools, and would rather enterprises remove those vendors and buy more from it in areas beyond e-mail.

On the other hand, he said, Microsoft is offering up a list of other vendors to think about, “which, congrats to Mimecast on coming in second.”

In the long run, CISOs need to determine the best spend for their limited security dollars, he noted. Enterprises need a good filter; whether they need two is up for debate. “They also clearly still need to invest in a robust awareness program,” Shipley said, “because as this report shows, lots of phishes are still getting delivered.”

Missing an important nuance

Ioussoufovitch noted that while the claims in the study are interesting, the data is presented without much of the nuance that would make it truly actionable.

“We are all too familiar with vendors’ abilities to massage data to tell the story they want, so I would advise leaders not to extrapolate the data beyond what it actually says,” he said.

Instead of the takeaway being “get rid of our current vendors,” this post highlights that Defender provides “considerable value,” he noted. Whether adding or subtracting additional vendors is worth the money should be a case-by-case conversation that considers an organization’s risk appetite, and overall security budget and environment.

“I’d treat these claims more as a reminder to assess your own environment and compare detections,” he said. “Come to conclusions based on the data you have, not what a vendor is presenting.”

Despite best efforts by defenders, malicious emails continue to slip through the cybersecurity cracks, leading some enterprises to implement a layered “defense in depth” strategy that incorporates multiple tools.

Microsoft seems to be challenging this idea, revealing that there are only nominal returns from adding integrated pre- and post-send partners to Defender for Office 365’s protections.

According to its new quarterly benchmarking data, the tech giant catches the vast majority of malicious and spam emails before delivery, misses the fewest compared to competitors by a wide margin, and removes nearly 100% of dangerous emails that do reach the inbox. Collectively, its integrated partners improve that catch rate by less than .05%.

While these numbers seem to tip the scales towards a one-vendor email security stack, experts urge enterprises to be skeptical and cautious of such vendor claims.

Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group, pointed out, “percentages obscure the true quantity and severity of what’s getting through, and, considering it only takes one message to result in an incident, it’s simple enough to argue that there is real value in the defense in depth that having multiple tools provides.”

Malicious and spam email catch by the numbers

Microsoft introduced its quarterly benchmarking report in July 2025 alongside a Defender integrated cloud email security (ICES) ecosystem designed to support multi-vendor security strategies.

The SEG players it ranked itself against this year includes Mimecast, Proofpoint, Hornetsecurity, Trend Micro, Iron Port (Cisco), Barracuda, and FireEye (Trellix); ICES companies include Abnormal, Checkpoint Harmony, Cisco, DarkTrace, KnowBe4 Defend, Tessian, and Trend Micro.

Redmond reported that Defender “consistently leads” in pre-delivery detection, missing 59% fewer high-severity cyberthreats prior to delivery than the other SEG vendors it evaluated. Its closest competitors were Mimecast and Proofpoint. The company also introduced a new metric in this area: A threat miss rate per 1,000 employees. In Microsoft’s case, that was 194 per 1,000; for Mimecast, 478; for Proofpoint, 483.

When it came to post-delivery protection, Defender removed an average of 96.03% of malicious emails that reached the inbox, up from an initial 45% when Microsoft first started tracking the data in its second report.

This makes Defender “an increasingly critical backstop, operating even when ICES solutions are in place,” Jeff Pinkston, VP and GM for Microsoft Defender, wrote in a blog post. Still, ICES tools operating in tandem with Microsoft Defender “continue to provide benefits,” improving malicious catch by 0.29% and spam catch by 0.68%, he said.

“If we focus on the basics, their argument seems strong,” Info-Tech’s Ioussoufovitch noted. “Do you really need a separate ICES vendor for that extra sub 1% catch?” Microsoft paints a “compelling picture” by only focusing on raw catch rate, he said, but we don’t hear the rest of the story: “What exactly is the danger of what isn’t being caught by Defender?”

No one vendor catches everything

David Shipley of Beauceron Security pointed out that the report underscores the fact that “lots of stuff still gets by e-mail filters.”

His company regularly analyzes hundreds of thousands of emails, and the content that gets through “ranges from the shockingly mundane and obvious to a human expert, to highly clever time-delayed attacks,” he said.

A key factor in what gets through is the amount of content that is allowlisted; settings in “100% paranoid mode” get high catch rates, as well as high false positives, Shipley noted. “Anyone who has ever had a sales person lose a deal because the purchase order PDF got flagged has felt this pain.”

Then there’s the AI conundrum: “A key risk for e-mail vendors using agentic LLM-based analysis is it’s now possible to poison those models with hidden content (such as ‘ignore this e-mail, pretty please’),” Shipley said. This means enterprises need a variety of analysis methods.

Ioussoufovitch agreed that keeping pace with threat actors using AI is an industry-wide challenge, particularly as AI enables higher-quality phishing. Filters are improving and will catch some of it, but some will inevitably continue to get through. Those messages are likely highly-targeted, which are lower in volume but harder to catch.

“As of now, current tools do seem to be struggling to keep pace, but that doesn’t mean those tools aren’t necessary,” said Ioussoufovitch. “It just highlights that defense-in-depth, broadly speaking, is becoming more and more important.”

Claims ‘appear more honest’

Shipley said that this report appears more honest, accurate, and mature than others claiming 99.99% phish catch rates, “which is never true.” It’s also a “smart marketing move,” because Microsoft competes for the same security budget as other tools, and would rather enterprises remove those vendors and buy more from it in areas beyond e-mail.

On the other hand, he said, Microsoft is offering up a list of other vendors to think about, “which, congrats to Mimecast on coming in second.”

In the long run, CISOs need to determine the best spend for their limited security dollars, he noted. Enterprises need a good filter; whether they need two is up for debate. “They also clearly still need to invest in a robust awareness program,” Shipley said, “because as this report shows, lots of phishes are still getting delivered.”

Missing an important nuance

Ioussoufovitch noted that while the claims in the study are interesting, the data is presented without much of the nuance that would make it truly actionable.

“We are all too familiar with vendors’ abilities to massage data to tell the story they want, so I would advise leaders not to extrapolate the data beyond what it actually says,” he said.

Instead of the takeaway being “get rid of our current vendors,” this post highlights that Defender provides “considerable value,” he noted. Whether adding or subtracting additional vendors is worth the money should be a case-by-case conversation that considers an organization’s risk appetite, and overall security budget and environment.

“I’d treat these claims more as a reminder to assess your own environment and compare detections,” he said. “Come to conclusions based on the data you have, not what a vendor is presenting.”

This article originally appeared on CSOonline.

Despite best efforts by defenders, malicious emails continue to slip through the cybersecurity cracks, leading some enterprises to implement a layered “defense in depth” strategy that incorporates multiple tools.

Microsoft seems to be challenging this idea, revealing that there are only nominal returns from adding integrated pre- and post-send partners to Defender for Office 365’s protections.

According to its new quarterly benchmarking data, the tech giant catches the vast majority of malicious and spam emails before delivery, misses the fewest compared to competitors by a wide margin, and removes nearly 100% of dangerous emails that do reach the inbox. Collectively, its integrated partners improve that catch rate by less than .05%.

While these numbers seem to tip the scales towards a one-vendor email security stack, experts urge enterprises to be skeptical and cautious of such vendor claims.

Seva Ioussoufovitch, senior research analyst at Info-Tech Research Group, pointed out, “percentages obscure the true quantity and severity of what’s getting through, and, considering it only takes one message to result in an incident, it’s simple enough to argue that there is real value in the defense in depth that having multiple tools provides.”

Malicious and spam email catch by the numbers

Microsoft introduced its quarterly benchmarking report in July 2025 alongside a Defender integrated cloud email security (ICES) ecosystem designed to support multi-vendor security strategies.

The SEG players it ranked itself against this year includes Mimecast, Proofpoint, Hornetsecurity, Trend Micro, Iron Port (Cisco), Barracuda, and FireEye (Trellix); ICES companies include Abnormal, Checkpoint Harmony, Cisco, DarkTrace, KnowBe4 Defend, Tessian, and Trend Micro.

Redmond reported that Defender “consistently leads” in pre-delivery detection, missing 59% fewer high-severity cyberthreats prior to delivery than the other SEG vendors it evaluated. Its closest competitors were Mimecast and Proofpoint. The company also introduced a new metric in this area: A threat miss rate per 1,000 employees. In Microsoft’s case, that was 194 per 1,000; for Mimecast, 478; for Proofpoint, 483.

When it came to post-delivery protection, Defender removed an average of 96.03% of malicious emails that reached the inbox, up from an initial 45% when Microsoft first started tracking the data in its second report.

This makes Defender “an increasingly critical backstop, operating even when ICES solutions are in place,” Jeff Pinkston, VP and GM for Microsoft Defender, wrote in a blog post. Still, ICES tools operating in tandem with Microsoft Defender “continue to provide benefits,” improving malicious catch by 0.29% and spam catch by 0.68%, he said.

“If we focus on the basics, their argument seems strong,” Info-Tech’s Ioussoufovitch noted. “Do you really need a separate ICES vendor for that extra sub 1% catch?” Microsoft paints a “compelling picture” by only focusing on raw catch rate, he said, but we don’t hear the rest of the story: “What exactly is the danger of what isn’t being caught by Defender?”

No one vendor catches everything

David Shipley of Beauceron Security pointed out that the report underscores the fact that “lots of stuff still gets by e-mail filters.”

His company regularly analyzes hundreds of thousands of emails, and the content that gets through “ranges from the shockingly mundane and obvious to a human expert, to highly clever time-delayed attacks,” he said.

A key factor in what gets through is the amount of content that is allowlisted; settings in “100% paranoid mode” get high catch rates, as well as high false positives, Shipley noted. “Anyone who has ever had a sales person lose a deal because the purchase order PDF got flagged has felt this pain.”

Then there’s the AI conundrum: “A key risk for e-mail vendors using agentic LLM-based analysis is it’s now possible to poison those models with hidden content (such as ‘ignore this e-mail, pretty please’),” Shipley said. This means enterprises need a variety of analysis methods.

Ioussoufovitch agreed that keeping pace with threat actors using AI is an industry-wide challenge, particularly as AI enables higher-quality phishing. Filters are improving and will catch some of it, but some will inevitably continue to get through. Those messages are likely highly-targeted, which are lower in volume but harder to catch.

“As of now, current tools do seem to be struggling to keep pace, but that doesn’t mean those tools aren’t necessary,” said Ioussoufovitch. “It just highlights that defense-in-depth, broadly speaking, is becoming more and more important.”

Claims ‘appear more honest’

Shipley said that this report appears more honest, accurate, and mature than others claiming 99.99% phish catch rates, “which is never true.” It’s also a “smart marketing move,” because Microsoft competes for the same security budget as other tools, and would rather enterprises remove those vendors and buy more from it in areas beyond e-mail.

On the other hand, he said, Microsoft is offering up a list of other vendors to think about, “which, congrats to Mimecast on coming in second.”

In the long run, CISOs need to determine the best spend for their limited security dollars, he noted. Enterprises need a good filter; whether they need two is up for debate. “They also clearly still need to invest in a robust awareness program,” Shipley said, “because as this report shows, lots of phishes are still getting delivered.”

Missing an important nuance

Ioussoufovitch noted that while the claims in the study are interesting, the data is presented without much of the nuance that would make it truly actionable.

“We are all too familiar with vendors’ abilities to massage data to tell the story they want, so I would advise leaders not to extrapolate the data beyond what it actually says,” he said.

Instead of the takeaway being “get rid of our current vendors,” this post highlights that Defender provides “considerable value,” he noted. Whether adding or subtracting additional vendors is worth the money should be a case-by-case conversation that considers an organization’s risk appetite, and overall security budget and environment.

“I’d treat these claims more as a reminder to assess your own environment and compare detections,” he said. “Come to conclusions based on the data you have, not what a vendor is presenting.”

This article originally appeared on CSOonline.

According to IDC, agentic AI is on track to become mainstream infrastructure. The analyst firm expects 45% of organizations to have autonomous agents operating at scale across critical business functions by 2030. In enterprise SOCs, AI is already reshaping functions like alert triage, enrichment, data correlation, IOC validation and initial containment. It could soon move up the stack to take on more complex tasks like incident investigation, root cause analysis, and response.

“AI acts as a force multiplier in the SOC,” says Nicole Carignan, senior VP, security and AI strategy at Darktrace. But harnessing that promise will require organizations to invest now in reskilling analysts, redesigning processes, building new technical roles, and establishing guardrails and governance frameworks to ensure autonomous AI agents operate safely. “It’s not enough to simply deploy an AI solution. Security practitioners must understand how the underlying machine learning techniques function, what their strengths and limitations are, and how to evaluate their outputs,” Carignan says. “Without explainability and trust, AI risks are exacerbating alert fatigue rather than solving it.”

Here is what security leaders need to know — and do — to prepare their SOCs for the agentic AI era.

Reskill analysts to become AI collaborators and overseers

Increasingly, human roles in the SOC will shift from hands-on execution to supervision, governance, design, and oversight. As AI agents take on more operational tasks, analysts will need to focus on managing AI systems, interpreting outputs, and resolving the nuanced challenges machines cannot handle, says Casey Ellis, founder of Bugcrowd. “Jobs won’t disappear, they’ll adapt. The key is ensuring that SOC professionals are prepared for this shift through ongoing education, training, and tooling.”

Few expect the transition will occur organically or without friction. Many SOC leaders will need to reskill existing staff to manage AI effectively; to interrogate AI reasoning; enrich investigations with contextual insight; and apply informed human analysis to AI-driven outputs.

When acting on an AI tool’s recommendation, analysts must understand what questions the agent asked, which data sources it queried, and what evidence informed its decision, according to Dov Yoran, co-founder and CEO of Command Zero. From there, they need to be able to pivot to additional data sources, pursue new artifacts, and extend the investigative timeline as needed. “Junior analysts who might not know how to start an investigation from scratch can become effective by learning how to extend and refine what the agent produced,” Yoran says. “It’s a different skill set from traditional SOC work, and in many ways, a more accessible one.”

In the SOC of the future, analysts must also act as adversarial reviewers of AI-driven conclusions. That’s because AI systems can introduce hallucinations, training-data bias, and other vulnerabilities while also being vulnerable to adversarial manipulation. Analysts need to recognize these risks to ensure decisions remain grounded and defensible, says Ensar Seker, CISO at SOCRadar. “Analysts need to be trained less as button-pushers and more as adversarial reviewers of AI output. That means understanding how models reason, where they fail, how bias and data gaps surface, and how to interrogate confidence levels and assumptions. The goal isn’t to ‘trust AI faster,’ but to develop the instinct to ask: What would make this conclusion wrong?” Seker says.

Analysts will also play a critical role in enabling organization-specific context into AI-driven workflows. Without that context, agents risk missing threats, amplifying noise, or triggering risky actions based on incomplete information. SOC leaders need to remember that “AI agents are only as smart as the context they have access to,” Yoran says. Analysts must learn to annotate identities, maintain watch lists, document recurring false-positive patterns, and build enrichment layers that strengthen future investigations, he said, “This is knowledge work, not data work.”

Ultimately, the objective is not to outperform AI, but to do better where AI falls short. For example, “accept that autonomous alert triage will become table stakes,” Yoran says. “Your processes need to shift from ‘how do we triage every alert’ to ‘how do we handle escalations from autonomous investigations’.”

Build capabilities for AI governance, content and quality

Upskilling existing analysts alone is not enough. As AI agents begin operating across tools, making decisions and triggering actions with minimal human involvement, the demands on the SOC will extend well beyond traditional analyst capabilities, experts say.

Content engineering, for instance, is one emerging requirement. In an AI-enabled SOC, detection engineers will no longer write only static rules. They must design dynamic content such as questions, prompts and investigation templates that agents can use to reason, enrich data, correlate signals and act autonomously. These content engineers curate the structured inputs that power agents, including telemetry, threat models, and playbooks.

“This is the most underappreciated role in AI-powered security operations,” Yoran notes. “These are people who build and maintain the questions that agents can ask, the investigation plans that guide autonomous work, and the knowledge bases that provide context,”. Organizations need someone who can translate detection logic from their SIEM, import best practices from frameworks like MITRE ATT&CK, and encode institutional knowledge into the platform. “This isn’t traditional security engineering, it’s closer to knowledge management combined with threat intelligence,” he says.

Mature SOCs will also require clear ownership of AI governance and agent oversight. That includes roles that have oversight over model risk evaluation, prompt and policy management, continuous performance validation, and even red teaming the agents themselves, Seker says. “You don’t need a massive new team, but you do need clear accountability for how autonomous decisions are made, tested, and constrained.”

Another emerging need is analysts with deep fluency in data management. An AI-driven SOC will require professionals who understand how information should be classified, protected, normalized, and monitored to ensure reliable conclusions. “With 64% of organizations planning to add AI-powered solutions to their security stack in the next year, it is critical for professionals to cross-skill in AI,” Carignan says. “Cybersecurity professionals must become fluent in AI and data, developing a deeper understanding of data classification, governance, and model behavior.” Cross-skills in data science, machine learning, and cybersecurity enable analysts to critically evaluate AI outputs, tune models for security use cases, and adapt defenses as threats evolve, making them indispensable in an AI-augmented SOC.

Frank Dickson, an analyst at IDC, urged organizations to think of this capability as similar to a data architect role. “The key to getting value from AI is having data located in a place where you can get to it, having it formatted in a homogeneous way so you can do analysis on it, and then manage the data,” he says. “The success of your AI initiative is going to be tied to the effectiveness of your ability to get data. A data architect manages that.”

Dickson also emphasized the need for an “orchestration platform engineer” role responsible for ensuring effective communication and workflow integration across security tools. The SOC of the future will not hinge on a single platform but on an interconnected ecosystem of SIEM, EDR, SOAR, identity, cloud and other systems that must operate in concert to support AI-driven, agentic investigations and automation, Dickson tells. Dedicated orchestration expertise will become essential to maintain reliable data flows and automation logic in such an environment, he noted.

Redesign SOC processes and playbooks where needed

Organizations will need to review and rework SOC processes and playbooks to ensure their AI-augmented SOC is consistent, efficient and continuously learning. Yoran recommends that SOC leaders focus on codifying institutional knowledge into AI agent-accessible questions and plans. Translate playbooks into investigation plans that AI agents can follow on a repeatable basis. In situations where an agent might hit a wall, have processes in place for a smooth handoff to a human analyst and build feedback loops for continuous improvement, Yoran adds.

“Playbooks must shift from step-by-step human procedures to intent-based guardrails,” Seker points out. “Instead of telling analysts how to investigate, define what outcomes are allowed, what actions are prohibited, and when human approval is mandatory.”. The objective is not to micromanage every alert but to assume AI agents operate continuously across tools, with humans only supervising exceptions, edge cases, and strategic decisions.

SOCs also need to rethink metrics, accountability, and documentation within the SOC. Traditional performance indicators, such as ticket closure rates or mean time to resolution, may need to broaden to include model accuracy, escalation quality, and the effectiveness of automated containment actions. “The biggest mistake is optimizing for speed metrics instead of investigation quality,” Yoran says. “I see this constantly: vendors promising 90% faster time to resolution or reduce tier-one workload by 80% or close alerts in seconds instead of hours. These metrics while seductive are dangerous,” he cautions. “Making the same mistake faster benefits no one. An incomplete investigation that closes in two minutes isn’t better than a thorough investigation that takes 30 minutes.”

Auditability too becomes critical. All AI-driven decisions should be traceable, explainable, and reviewable from both an internal governance standpoint and for external compliance requirements.  “If you can’t explain why an AI took an action to an auditor, regulator, or executive, it shouldn’t be allowed to take that action. Explainability isn’t a nice-to-have; it’s a prerequisite for autonomy,” Seker says.

Implement AI guardrails and principles

Formal guardrails and operating principles are going to be critical in SOCs where AI agents influence decisions, initiate responses and help prioritize threats. That means setting defined boundaries around data access and model behavior, having processes to validate responses and making sure humans remain in the loop on all high-impact decisions.

Focus areas should include approval thresholds for autonomous actions, figuring out allowed and disallowed actions for an agent, protecting against prompt injection attacks, testing and red-teaming of agentic workflows and ensuring IR policies are updated for AI-driven actions. “Require transparent decision trails, rate limiting, least-privilege, and instant override,” Seker advises. “Hard limits on action scope, blast radius, and privilege are non-negotiable. Agents should operate under least-privilege identities, with explicit kill-switches, change-control boundaries, and environment awareness. The key is to ensure that AI is never allowed to silently escalate its own authority or modify guardrails without human approval.”

IDC analyst Dickson pointed to identity and access as two other areas to focus on by way of guardrails and policies. “In the past, when we gave humans access, we often over-provisioned by default. That approach does not work with agents. With agentic AI, permissions must start at least privilege, defined precisely from day one.”

The focus should be on ensuring no standing privileges, implementing dynamic authorization and establishing clear role definitions, Dickson says. “Agentic AI is enormously powerful. Constraining access correctly is non-negotiable.”

There’s no playbook for leading through today’s cyber risk — only experience. The CSO Cybersecurity Awards & Conference, May 11-13, brings together CISOs and senior security executives for peer‑driven insight, unfiltered conversations, and practical strategies that drive real business impact. Secure your seat before it fills up.

Organizations have been responding to phishing, business email compromise, and credential theft in essentially the same manner for over ten years. They essentially follow a playbook that involves investing in awareness training, running phishing simulations, and requiring employees to complete annual security modules. The reason behind this is simple and the reasoning behind these efforts is straightforward: if people can better spot malicious emails and recognize malicious activity, incidents will decrease.

Yet, the amount of money lost because of business email compromise keeps rising. Credential harvesting is still successful. Conventional multi-factor authentication is frequently circumvented by adversary-in-the-middle phishing kits. Under duress, senior executives, including seasoned finance leaders, continue to approve fraudulent payments.

A deeper misclassification in enterprise security strategy is shown in this persistence. Although awareness is an educational measure that promotes culture rather than imposes results, it has been viewed as a control. This distinction has important ramifications for how businesses evaluate and control risk.

The core misunderstanding

A true security control prevents, detects, or limits an outcome regardless of what an individual does, knows or does not know. Conditional access rules, for instance, do not depend on an employee having a good day, and network segmentation does not depend on an employee remembering a policy. Likewise, Segregation of duties in finance exists precisely to ensure that no single individual can independently authorize high-risk transactions. These mechanisms are engineered to constrain risk structurally rather than depend on behavioral perfection.

Security awareness has its own purpose to influence behavior through the improvement of human judgment in situations that deal with time pressure and often incomplete information. Although these initiatives can lessen the possibility of poor decisions, they are unable to ensure consistent results for a varied workforce with individual differences working in a variety of environments. Human performance is inherently variable, especially when exposed to different conditions, and training does not eliminate that variability.

When organizations term security awareness as a “layer of defense,” they implicitly place it alongside technical and procedural safeguards, which can distort how risk is understood and assigned. Responsibility for incidents thus shifts subtly toward individuals, especially when an employee clicks a malicious link or authorizes a fraudulent request. The resulting narrative often emphasizes human error rather than examining whether the surrounding system allowed a single, foreseeable mistake to create material impact.

Examining whether the organization’s controls were made to foresee anticipated human mistakes and limit their effects before they cause enterprise-level harm is a more constructive line of inquiry. 

The predictability of human error

Human error is sometimes viewed as an exception in security incident conversations, as if a breach happened because someone made a mistake that should have been prevented. Human error is a constant in complex systems, especially in huge organizations where everyday operations are shaped by scale, pace, and conflicting agendas. The pertinent question is whether the surrounding environment has been constructed with the inevitable occurrence of mistakes in mind, rather than whether mistakes will occur at all.

Modern social engineering campaigns reflect a sophisticated understanding of how organizations function. Attackers study and understand reporting lines, financial processes, vendor relationships, and executive communication styles, sometimes gleaned from previously compromised accounts in similar industries. They time their messages to coincide with legitimate business activity and plan these messages to align with travel schedules, invoice payments and quarter-end reporting pressure. In many business email compromise cases, there is no malware involved and no technical exploit in the traditional sense of it and attacks are successful because it takes advantage of the trust that is ingrained in regular operations blended in seamlessly with established routines.

Under such conditions, expecting flawless human performance is unrealistic. Employees manage high volumes of communication while also combating deadlines and performance expectations. Senior leaders frequently make decisions with incomplete information, balancing urgency against risk to keep the business running. When a request appears in line with organizational standards and past experience, even highly skilled individuals may misunderstand it. These mistakes are a natural result of cognitive load, environmental clues, and institutional dynamics, not necessarily proof of carelessness.

This reality is acknowledged by high-risk industries like aviation and healthcare, which create multi-layered protections to stop a single error from turning into a disaster. Checklists, redundancy, and cross-verification processes are embedded as part of organizational pipelines to ensure that systems remain safe even when individuals are imperfect. On the other hand, the same discipline has not always been used in enterprise cybersecurity. A single compromised credential or a single configuration error, exemplified in the CrowdStrike outrage,  can still result in serious operational or financial harm in many settings. When that degree of fragility is present, the system’s authority distribution and error-absorbing capabilities become more pertinent than individual behavior.

Awareness cannot function as a primary safeguard

There are structural limitations that prevent awareness from serving as a dependable control. First, cognitive load and decision fatigue are unavoidable in complex organizations. Even experienced professionals make mistakes due to reduced scrutiny when under pressure and awareness training does not eliminate this human reality. Awareness training may increase general suspicion, but it cannot eliminate the reality that individuals must constantly triage information under time pressure and occasional lapses in judgment are statistically inevitable as a result.

Secondly, organizational dynamics further complicate the picture, especially in traditional societies where this is strongly upheld. Hierarchy and perceived authority are exploited in many successful business email compromise incidents as a result. Requests that seem to come from senior executives are implicitly urgent and significant for the organization. Employees are frequently trained to support executive instructions rather than impede them, particularly when it comes to urgent financial concerns, which could slow down business processes.

Lastly, the widespread adoption of multi-factor authentication has also contributed to an inflated sense of security. While MFA greatly improves security over password-only settings, not all implementations are impervious to modern attack methods. Push fatigue attacks take advantage of routine approval patterns, adversary-in-the-middle frameworks can steal and replay session tokens, and device code / OAuth consent phishing can provide continuous access without the need for conventional credential theft. In these cases, there is a likelihood employees comply with established security procedures and still be compromised because the architectural design allows it.

When combined, these reasons show why awareness is not a reliable main protection. It can strengthen best practices and lower risk at the edges, but it cannot make up for shoddy identity architecture, brittle finance procedures, or inadequate monitoring.

Treating human risk as a design constraint

A more pruned approach reframes human risk as an engineering consideration as opposed to a behavioral flaw. Security leaders should assess which decisions entail a disproportionate amount of risk when carried out in isolation, rather than asking how to train staff to recognize every potential phishing variant.

Salient questions in this regard include:

• Should a single email request ever be sufficient to initiate a high-value transfer?
• Are payment instruction changes subject to enforced out-of-band verification?
• Does identity infrastructure continuously validate session integrity?
• Are anomalous financial behaviors detected in real time?

This shift moves the focus from persuading individuals to behave perfectly toward building systems that remain resilient when they do not.

What structural controls should look like

An enterprise strategy that effectively tackles human-centric threats includes defenses that function without constant monitoring. Device-bound passkeys and hardware-backed credentials are examples of phishing-resistant authentication techniques that lessen vulnerability to push-based manipulation and token interception. Compared to static MFA prompts alone, conditional access policies that also assess device health and onboarding status, geolocation anomalies, and behavioral risk signals offer greater assurance.

In the same vein, financial workflows should embed separation of duties and enforced verification. Secondary validation should be required through separate channels for high-value transactions, vendor banking changes, and urgent payment requests. Systems for tracking transactions should also be able to spot anomalous payment amounts or departures from historical trends.

Particular consideration should also be given to identity telemetry. Persistence tactics frequently employed in business email compromise campaigns can be found by keeping an eye on mailbox rules, atypical travel, OAuth grants, privileged role assignments, and session oddities. Using Privileged Identity Management solutions, privileged access should be time-bound and approval-based to reduce the blast radius of credential misuse. Although human error cannot be eliminated, these precautions greatly lessen the chance that a single error will result in severe material loss.

From blame game to architecture

It makes sense that organizations would choose to gravitate towards awareness-raising campaigns. They are visible, often reasonably priced when bundled as part of existing security tooling and quantifiable. On the other hand, more funding and cross-functional cooperation are needed for architectural redesign, identity modernization, and workflow reorganization.

Threat actors, however, are becoming more adept at taking advantage of human behavior patterns that are predictable in current corporate procedures. They only require people to be human because they comprehend the urgency, trust, and operational complexity that frequently accompany working in time-sensitive professions, high-pressure conditions, and the ensuing complacency.

The rational response is to assume imperfection and build accordingly.

A more honest assessment of systemic risk

Security awareness remains an important component of organizational culture. Employees should understand common attack patterns and feel empowered to report suspicious activity. However, awareness should be viewed as a supporting measure rather than a primary safeguard.

When a single decision can still trigger substantial financial or operational damage, the organization’s exposure is rooted in design. Resilient enterprises acknowledge that human error is inevitable and ensure that their identity architecture, financial controls, and monitoring capabilities are robust enough to absorb it.

Reframing awareness in this way does not diminish its value. It places it in the correct category and forces a more honest assessment of systemic risk. Until that shift occurs, many organizations will continue to invest heavily in training while leaving structural weaknesses intact, and attackers will continue to exploit the gap between education and engineering.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Obwohl CISOs im Allgemeinen eher selten mit dem gesamten Spektrum der Gesundheits- und Arbeitssicherheitsbelange betraut sind, spielen sie diesbezüglich doch eine wichtige, strategische Rolle – insbesondere, wenn es um physische Sicherheitssysteme mit IT-Anbindung und den direkten Zugang zu IT-Assets geht. Die wesentlichen limitierenden Faktoren für CISOs sind dabei in aller Regel:

• das Budget sowie

• nicht eindeutige Verantwortlichkeiten.

In diesem Artikel stellen wir Ihnen zehn essenzielle Maßnahmen für (mehr) physische Sicherheit vor, die CISOs auf dem Zettel haben sollten. Zunächst werfen wir jedoch einen kurzen Blick darauf, wie sich physische Security definiert – und warum sie von entscheidender Bedeutung für Unternehmen ist.

Warum physische Security wichtig ist

Der Begriff der physischen Sicherheit umfasst per Definition den Schutz von Personen, Eigentum und physischen Assets vor unberechtigtem Zugriff, Diebstahl und sonstigen Handlungen die zu Schaden oder Verlust führen. Dieser Bereich wird allzu oft zugunsten der Cybersicherheit vernachlässigt.

Für CISOs ist der Bereich vor allem deshalb so wichtig, weil die allermeisten modernen, physischen Sicherheitssysteme respektive -kontrollen auf irgendeine Art und Weise mit der IT verknüpft sind – von Badges und Keycards bis hin zur Videoüberwachung. Kommt es zu einem unberechtigten (physischen) Zugriff, können daraus in der Folge zudem auch Cyberangriffe und Data Breaches erwachsen. Es sollte deshalb im Interesse eines jeden Sicherheitsentscheiders liegen, entsprechende Vorkehrungen zu treffen, um den Zugriff auf diese Assets zu kontrollieren.

Das soll (und kann) nicht heißen, CISOs mit sämtlichen Tasks physischer Security zu betrauen. Zwar funktioniert es im Fall einiger kleinerer Unternehmen, die Rolle des CISO und des CSO zusammenzulegen – für viele große Unternehmen ist das jedoch keine Option, wie Max Shier, ehemals CISO beim Cyberrisk-Spezialisten Optiv, erklärt: “Wenn behördliche Auflagen bestehen oder es um größere Unternehmen geht, ergibt es unter Umständen keinen Sinn, die Bereiche Cybersecurity und physische Sicherheit zusammenzulegen. Die resultierenden Verantwortlichkeiten – etwa, sich um einen Wachdienst für Produktionsanlagen oder Bodyguards für Führungskräfte zu kümmern -, könnten Cybersecurity-Teams je nach Auslastung und Kapazität schnell überfordern.”

Sollte diese Option auch für Sie entfallen, weiß Howard Taylor, CISO beim Security-Dienstleister Radware, was zu tun ist: “Dann ist die Kommunikation und Koordination mit den physischen Sicherheitsteams für CISOs entscheidend, um ihre Ziele zu erreichen. Diese sollten in die Planungsprozesse für Business Continuity, Disaster Recovery sowie physische Anlagen und Einrichtungen einbezogen werden. Zusätzlich muss auch sichergestellt sein, dass die resultierenden, physischen Maßnahmen aus rechtlicher Sicht einwandfrei sind – etwa, dass Aufnahmen von Überwachungskameras keine Datenschutzregularien verletzen.”

Die Top Ten physischer Sicherheitsmaßnahmen

Ganz unabhängig von der jeweiligen Organisationsstruktur sollten CISOs mit allen Stakeholdern im Bereich physische Sicherheit kollaborieren. Folgende zehn Maßnahmen sollten Sie diesbezüglich vor allem auf dem Schirm haben.

1. IT-Einrichtungen und Rechenzentren härten

Rechenzentren, sensible IT-Einrichtungen und Computerräume in Mehrzweckbüros sind offensichtliche Bereiche, auf die CISOs ihr Augenmerk legen sollten, um die Kontrolle über den physischen Zugang zu gewährleisten. David Ortiz, CISO beim Konsumgüter-Unternehmen Church & Dwight, spezifiziert: “Sicherheitsentscheider sollten dafür Sorge tragen, dass der Zugang zu sämtlichen Räumen mit technischem Equipment auf die Personen beschränkt wird, die ihn benötigen. Zudem sollten Auftragnehmer ausschließlich in Begleitung Zugang zu solchen Räumlichkeiten erhalten. Idealerweise wird der Zugang protokolliert und täglich überprüft.”

Natürlich sollten die zu ergreifenden Maßnahmen je nach Einrichtung und ihrer Risikolage variiert und angepasst werden, empfiehlt Justin Fier, Senior Vice President of Red Team Operations beim Sicherheitsanbieter Darktrace: “Sämtliche Einrichtungen, die kritische Informationen beherbergen, sollten strengere Sicherheitskontrollen aufweisen, als solche die für weniger sensible Assets genutzt werden. CISOs müssen deshalb in erster Linie wissen, welche Daten und Ressourcen wo gespeichert und genutzt werden, das Risiko bestimmen, das im Fall eines unberechtigten Eindringens ensteht – und anschließend die physischen Sicherheitsmaßnahmen bei Bedarf entsprechend verstärken.”

2. Risiken im Büroalltag erkennen

Um sich Zugang zu Unternehmensnetzwerken zu verschaffen, nehmen kriminelle Angreifer auch ganz alltägliche Office-Settings ins Visier. Jeder Netzwerkanschluss könne so zu einem potenziellen Einfallstor in die IT-Umgebung werden, warnt Will Bass, Vice President Cybersecurity beim Rechenzentrumsspezialisten Flexential. Sein Rat an CISOs: “Setzen Sie sich intensiv mit der physischen Sicherheitsarchitektur und den Standards für alle Einrichtungen auseinander – unabhängig davon, ob es sich um sensible Facilities handelt oder nicht. Nur so können Sie sicherstellen, die richtigen Defense-in-Depth-Maßnahmen einzusetzen und unbefugten, physischen Zugriff zu verhindern.”

Optiv-CISO Shier ergänzt, dass das auch in Zeiten von Remote- und Hybrid Work relevant sei: “Trotzdem die Büros in vielen Fällen inzwischen weniger frequentiert sind, müssen Sicherheitsentscheider gewährleisten, dass Bürogebäude mit angemessenen physischen Sicherheitskontrollen ausgestattet sind. Drahtlose Zugangspunkte, Zugangskontrollen mit Ausweisen und Videoüberwachung sind weiterhin relevant und sollten keinesfalls unter den Tisch fallen.”

3. Laterale Bewegungen in physischen Räumen ausschließen

Wenn es darum geht, den Zugang zu Unternehmen physisch abzusichern, sollten CISOs außerdem ein Augenmerk darauf legen, ob sich Angreifer lateral durch physische Sperrzonen bewegen können. Alethe Denis, Senior Security Consultant beim Sicherheitsanbieter Bishop Fox, erklärt: “Hat sich ein Angreifer erst einmal Zugang zu Sperrbereichen verschafft, sinkt die Wahrscheinlichkeit aufzufliegen, drastisch. Schließlich gehen die allermeisten Menschen davon aus, dass Personen, die sich in Sperrbereichen aufhalten, zuvor eine Zugangskontrolle durchlaufen und bestanden haben.”

Ebenso wie Unternehmen Netzwerksegmentierung und Zero-Trust-Prinzipien einsetzten, um Netzwerkressourcen zu schützen, sollten sie auch im Bereich physische Security vorgehen, fordert die Sicherheitsexpertin: “Im Idealfall verhindern Treppenhäuser und Aufzüge mit Authentifizierungserfordernis sowie aufmerksame Mitarbeiter, dass es zu ‘Tailgaiting’ und einem möglichen Schaden für das Unternehmen kommt.”

4. Assets in Colocation- und Cloud-Umgebungen schützen

Das Adlerauge der Sicherheitsentscheider ist aber nicht nur gefragt, wenn es um unternehmenseigene Lokalitäten geht. Auch Colocation-Facilities oder -Rechenzentren sollten diesbezüglich berücksichtigt werden, fordert Shier: “Sollten Sie zum Beispiel ein Rechenzentrum mit anderen Unternehmen teilen, tun Sie gut daran, auch einzelne Serverracks abzusichern – etwa mit integrierten Ausweislesegeräten. Zudem ist es essenziell, Rechenzentren mit Kameras, Wachpersonal und weiteren Kontrollmaßnahmen auszustatten.”

Selbst wenn die physische Handhabung von Systemen vollständig von der Organisation abstrahiert sei – wie bei Public-Cloud- oder SaaS-Ressourcen – müssten CISOs dennoch darauf achten, wie diese Systeme physisch kontrolliert werden, ist Mike Pedrick, Vice President of Cybersecurity Consulting beim Managed-Service-Provider Nuspire, überzeugt: “Solche Offerings entbinden CISOs nicht von ihrer Verantwortung. Wenn überhaupt, setzt es sie zusätzlich unter Druck, die Bedeutung von Verträgen und Service Level Agreements sowie den Wert eines erfolgreichen Audits durch Dritte zu schätzen.”

5. Physische Cyber-Verbindungen analysieren

CISOs, die in Kritis-Organisationen tätig sind, sollten sich nicht nur Gedanken darüber machen, wie sich physische Handlungen auf die Cyberumgebung auswirken können. Sie müssen auch dazu in der Lage sein, einzuschätzen, wie sich Aktivitäten im Cyberraum auf physische Umgebungen auswirken könnten.

“Cyberangriffe auf industrielle Umgebungen können eine erhebliche Bedrohung für die physische Sicherheit darstellen”, konstatiert Almog Apirion, Mitbegründer des Remote-Access-Anbieters Cyolo. Angesichts der heutigen Konvergenz von IT- und OT-Umgebungen sollten CISOs jedoch generell – also auch wenn sie nicht im Kritis-Bereich tätig sind – sämtliche Verbindungspunkte zwischen dem physischen und dem Cyberraum im Blick haben. So fielen zum Beispiel auch physische Industrieanlagen in den Bereich des CISO, wenn diese remote gesteuert respektive gemanagt werden könnten, gibt Apirion zu bedenken.

6. IoT-Gerätschaften berücksichtigen

Ein weiterer Aspekt der physischen Security steht mit IoT-Devices in Zusammenhang. Flexential-Manager Bass erklärt: “IoT-Geräte befinden sich oft in frei zugänglichen Bereichen – wie etwa Überwachungskameras an der Außenseite eines Gebäudes. Der physische Zugang zu einem solchen Device ist ein potenzieller Einstiegspunkt. Zu verhindern, dass es dazu kommt, erfordert spezifische Schutzmaßnahmen und kann zur Herausforderung gereichen.”

Radware-CISO Taylor weist darauf hin, dass IoT-Gerätschaften wie OT-Systeme unter Umständen essenzielle Funktionen im physischen Raum steuern: “IoT-Systeme stellen eine Brücke zwischen Information und Aktion dar. Das macht sie im Rahmen physischer Angriffe zu einem attraktiven Ziel.” Der Sicherheitsentscheider appelliert deshalb, bei solchen Devices auf integrierte Monitoring-Funktionalitäten zu achten, um unbefugte Manipulationen von Software oder Malware-Befall zu verhindern. Er ergänzt: “Für den Fall, dass jemand das IoT-Gerät zerstört, sollte zudem ein Notfallplan existieren.”

7. Remote-Devices sperren

Der Netzwerkrand hat sich im Laufe der Zeit verändert. Für CISOs bedeutet das: Sie müssen auf Bedrohungsmodelle und Kontrollmaßnahmen setzen, die im jeweiligen Kontext ihres Unternehmens Sinn ergeben und ein akzeptables Risikolevel realisieren. Dazu sollten Security Stakeholder und Supply-Chain-Partner zusammenarbeiten, um die Integrität der Hardware sicherzustellen und der Belegschaft Security Best Practices an die Hand zu geben.

Die neue Arbeitswelt hat dabei das Problem der verteilten Gerätschaften weiter verstärkt, wie Darktrace-Sicherheitsexperte Fier erklärt: “Wegen der Popularität von Remote und Hybrid Work wird es für CISOs zunehmend herausfordernder, physische IT-Ressourcen abzusichern. Schließlich nutzen die Mitarbeiter ihre Geräte an vielen verschiedenen Orten, was grundsätzlich das Risiko von Verlust, Diebstahl und Missbrauch erhöht. Das Homeoffice hilft an dieser Stelle auch nicht – in diesem Fall müssen CISOs sich auch damit befassen, wie etwa Router im Homeoffice abgesichert sind.”

Laut Fier nehmen kriminelle Hacker zunehmend solche Devices ins Visier. Sein Tipp, um Abhilfe zu schaffen: “Erwägen Sie, Personen, die für Angreifer von besonderem Interesse sein könnten – etwa Führungskräfte und Administratoren – mit speziell abgesicherter Hardware auszustatten.”

8. Auf integrierte Access Control setzen

Facility Teams sind für die alltäglichen Administrationsaufgaben in Zusammenhang mit physischen Zugangskontrollen – und der Gebäudesicherheit im Allgemeinen – zuständig. Diesbezüglich empfiehlt es sich allerdings, Sicherheitsentscheider einzubeziehen, wie Church & Dwight CISO Ortiz vorschlägt: “Ein CISO sollte mit den Teams für physische Sicherheit zusammenarbeiten, um die Risikolage physischer Zugangskontrollen zu durchdringen. Das beinhaltet zum Beispiel zu wissen, ob der Zugang zu einer Einrichtung durch einen Empfangsbereich gesichert wird, per Badge erfolgt oder ob Videoüberwachungssysteme im Einsatz sind. Zudem sollten die Zugangssysteme auf verdächtige Aktivitäten überprüft werden.”

Der Manager ist davon überzeugt, dass CISOs auch einen Beitrag dazu leisten sollten, die Access-Control-Maßnahmen mitzugestalten und in logische Zugangskontrollen zu integrieren. “Physische und logische Zugangskontrollen müssen Hand in Hand gehen. Das gilt insbesondere, wenn Zugangsdaten verlorengehen oder Mitarbeiter entlassen werden”, hält Ortiz fest.

9. Überwachungssysteme (und deren Daten) absichern

Videoüberwachungssysteme zu monitoren, fällt ebenfalls nicht ins native Zuständigkeitsgebiet von CISOs. Trotzdem sollten Sicherheitsentscheider ein Interesse daran haben, mitzureden, wenn es darum geht, diese Systeme zu designen und abzusichern. Schließlich sind sie in der Regel die Spezialisten, wenn es um Datenschutz und Compliance geht.

“In Anbetracht der unterschiedlichen Datenschutzbedenken, der gesetzlichen Verpflichtungen und anderer Aspekte, die mit einer Videoüberwachung einhergehen, sollten CISOs eine tragende Rolle einnehmen, wenn es darum geht, diese Systeme zu managen”, bestätigt Darktrace-Manager Fier und fügt hinzu: “Dazu müssen sie eng mit den relevanten Teams, beispielsweise der Rechtsabteilung, zusammenarbeiten und sicherstellen, dass die jeweils geltenden Gesetze und Datenschutzvorschriften eingehalten werden.”

Davon abgesehen seien moderne CCTV-Systeme auch Teil der IT-Umgebung – vergrößerten also die Cyberangriffsfläche von Unternehmen, erklärt Jonathan Sword, Director der Security-Beratung Agility Cyber: “Es ist üblich, dass die Überwachungskameras von Bürogebäuden mit dem Hauptnetzwerk des Unternehmens verbunden sind. Sie sind also für andere Benutzer im Netzwerk einsehbar – und damit potenziell auch für Bedrohungsakteurre, die sich Zugang verschafft haben.”

10. Überwachungsdaten bereithalten

Essenziell ist für CISOs und ihre Incident-Response-Teams schließlich auch, jederzeit auf den Output dieser Überwachungssysteme zugreifen zu können. Das Ziel ist dabei, mit Hilfe der Überwachungsaufnahmen Aktivitäten in physischen Räumen schnell und einfach mit Aktionen logischer Systeme zu verknüpfen.

Bishop-Fox-Security-Expertin Denis erklärt: “Wenn es zu einem Angriff kommt, bei dem Daten gefährdet sein könnten und das Überwachungsmaterial Erkenntnisse zum Status der Attacke geben kann, sollte das IT-Sicherheitsteam auch auf diese Daten zugreifen können.” (fm)

A new critical vulnerability that is similar to the widely-exploited CitrixBleed and CitrixBleed2 holes should be patched in NetScaler devices immediately, say experts.

The hole, CVE-2026-3055, is an out-of-bounds read vulnerability in customer-managed NetScaler ADC and NetScaler Gateway devices configured as SAML IDP for approving identity and authentication. It’s rated at 9.3 in severity on the CVSS scale,

“The implications of leaving it unpatched are serious,” Ryan Emmons, staff security researcher at Rapid7, told CSO in an email, because the hole allows an unauthenticated remote attacker to leak potentially sensitive information from the appliance’s memory.

“This vulnerability is one that threat actors and researchers alike are paying attention to,” he said.

The vulnerability carries similar ramifications to 2023’s CitrixBleed and 2025’s CitrixBleed2 memory leak vulnerabilities, Emmons added. Then, unauthenticated attackers with no existing level of access were able to steal credentials from business-critical Citrix NetScaler systems exposed to the public internet.

CitrixBleed2 enabled attackers to leak sensitive memory content by sending specially crafted HTTP requests to a vulnerable Citrix endpoint. When it was discovered last year, researchers at Imperva quickly saw threat actors trying to exploit the hole, detecting over 11.5 million attacks.

One that was successful involved the China-based group known to researchers as Salt Typhoon, which, according to Darktrace, got past defenses at an unnamed European telecom provider by exploiting CitrixBleed2 and installed a backdoor.

“We expect that’s also what exploitation of this vulnerability facilitates,” he said “Initial access. With so much to potentially gain, it’s overwhelmingly likely that threat actors are actively working on developing an exploit for CVE-2026-3055, and we believe that exploitation in the wild is imminent.”

Affected are NetScaler ADC and NetScaler Gateway version 14.1 before 14.1-66.59; NetScaler ADC and NetScaler Gateway version 13.1 before 13.1-62.23; and NetScaler ADC FIPS and NDcPP before 13.1-37.262

In its notice to customers, Citrix “strongly urges affected customers” to install the relevant updated versions as soon as possible.

In the same notice, Citrix alerted admins to CVE-2026-4368, a race condition leading to user session mixup, rated at 7.7 on the CVSS scale, that applies to NetScaler ADC and NetScaler Gateway 14.1-66.54 devices.

Prime targets

NetScaler ADCs are application delivery controllers that optimize the delivery of web and traditional applications through load balancing and traffic management, while NetScaler Gateways are VPN solutions.

As categories, ADCs and VPNs are prime targets for threat actors because they are internet-facing. “Anything that organizations tend to heavily rely on and expose at the network edge makes for a juicy target in the eyes of attackers,” said Emmons. “That doesn’t mean these products are of poor quality, it just means that threat actors are spending a significant amount of time and energy finding and exploiting subtle flaws in them.”

Citrix says in its advisory that CVE-2026-3055 was found through product security testing, he pointed out, “which means they’re taking a proactive approach to find these bugs before threat actors do. That’s a great thing to see. Citrix products are incredibly popular and widely used, and they are routinely exposed to the public internet, so it’s of the utmost importance that the vendor is prioritizing security in this manner.”

Emmons said the best things defenders can do to protect ADCs and VPNs are to reduce their exposed attack surface, ensure vulnerability intelligence is available and effectively distributed, and prioritize patching the systems that matter most.

“Systems that don’t need to be exposed to the internet shouldn’t be,” he said. “Reducing public-facing attack surface is key, where possible. When that’s already in place, it’s vital to have early and accurate intelligence on vulnerabilities affecting products the organization relies on. A focus should be placed on ensuring important security advisories are highly visible to defending teams on the day of publication for triage.”

A finance manager joins a video call with familiar faces — the company’s CFO and her colleagues. They’ve been summoned via email for a confidential “M&A discussion” requiring bank transfers before the close of business. While the meeting isn’t outside the realm of possibility, the reality was just that: everyone aside from the manager was an AI-generated deepfake. Their voices, gestures and likenesses were synthesized from publicly available videos. The email and its provenance evaded system-wide detection.

This isn’t far-fetched; it was a real-life scenario for engineering company Arup in 2024, when deepfake impersonation cost the firm $25 million.

The availability of platforms that enable deepfakes-as-a-service demands that organizations adopt an AI-aware security posture. One that assumes AI-enhanced techniques are attempting to bypass traditional security systems and test the nature of human trust, escalating the AI arms race.

The result is creating a paradox for organizations with no clear long-term gains and a short-lived homefield advantage. The race is accelerating exponentially in both velocity and sophistication to the point that soon no human will be able to follow nor track AI attack/defense response cycles.

The threat of AI is here

At the start of this year, approximately two-thirds of global companies surveyed by the World Economic Forum stated that they anticipate that AI will have the “most significant impact” on cybersecurity.

Even as AI revolutionizes enterprise cybersecurity defenses, threats continue to evolve with sophistication and complexity. Unlike traditional malware, which may find its way into networks through a compromised software update or downloads, AI-powered threats utilize machine learning to analyze how employees authenticate themselves to access networks, including when they log in, from which devices, typing patterns and even mouse movements. The AI learns to mimic legitimate behavior while collecting login credentials and is ultimately deployed to evade basic detection.

The ante is raised with the deployment of text-to-video apps that can manipulate video streams, generate AI-videos and clone voices and human likeness. Real-world incidents highlight a critical gap: Building more resilient security requires additional layers to tilt the field in the direction of defenses. Ideally the additional layer is:

• Additive and based on a completely different approach (little overlap).
• Bypasses AI’s strengths, such as learning, manipulating, emulating, etc.
• Extremely efficient, fast, computationally cheap, authoritative.

Fortunately, such a mechanism already exists. Unfortunately, it is often overlooked or misunderstood. My thesis is that authentication, especially one based on open standards and tied to fundamental internet infrastructure, is a proven and effective defensive layer that helps address the AI challenge.

The changing battlefield: Hyperrealism by the numbers

The AI threat is already materializing. One only needs to try out OpenAI’s Sora2 to grasp the coming wave of hyper realistic spoofs that are making it nearly impossible to distinguish the real from the fake.

In the first five months of 2025 alone, there’s been a 1,265% jump in AI-powered phishing attacks, according to DeepStrike. Microsoft’s 2025 Digital Defense Report indicates that AI-powered phishing emails achieved a 54% click-through rate, compared to 12% for traditional phishing. Deepfakes, like voice cloning and video impersonation, are doubling in frequency every six months. In a recent Darktrace survey, 78% of CISOs now see AI-powered cyberthreats significantly affect their organizations.

Beyond the statistics, AI’s effectiveness is driven by its exponentially improving abilities to social engineer humans — replicating writing style, voice cadence, facial expressions or speech with subtle nuance and adding realistic context by scanning social media and other publicly available references.

The data is striking and reflects the crucial need for a multi-layer approach to help sidestep the exponentially escalating ability for AI to trick humans. 

Here’s how a layered authentication strategy can change the outcome of an AI-powered attack:

• At the infrastructure level, DNS-based protocols verify that communications are actually coming from legitimate sources, operating on cryptographic principles rather than pattern recognition. Critically, this side steps hyperrealistic AI attacks.
• At the access level, security tokens, combined with biometric confirmation, create physical barriers.
• AI-powered behavioral analytics flag anomalies, like unusual location, access time or device.

Machine learning cannot forge DNS records for domains it doesn’t control, summon physical tokens or replicate fingerprints — at least not yet.

Authentication: A critical defense layer

As adversaries leverage AI for advanced phishing campaigns, deepfake attacks and automated vulnerability exploitation, various forms of authentication have evolved from best practices to strategic imperatives.

The numbers tell a compelling story: more than 99.9% of compromised accounts lack multi-factor authentication. When MFA is enabled, 96% of bulk phishing attempts and 76% of targeted attacks are deterred.

Yet despite authentication’s effectiveness, Okta’s global workforce data indicates approximately two-thirds of organizations worldwide deploy MFA, but just 35% of global SMBs and 27% to 34% of businesses with fewer than 100 employees use MFA, according to a Cyber Readiness Institute report. Moreover, Okta also found that government organizations had a 55% MFA adoption rate. The adoption gaps create significant supply chain vulnerabilities that attackers can exploit on a large scale.

Authentication vendors need to make deployment of their services easier, more intuitive, user-friendly and seamless. And MFA needs to be a requirement across the board, especially for executives, since they are the most targeted and can cause the most damage when breached.

But support must come from the top. When board and CEO-level executives actively champion MFA education and adoption, they give CIO/CISO/InfoSec teams the authority and organizational momentum needed to enforce it successfully.

Today, most organizations that roll out MFA broadly rely on established methods, adding verification layers to traditional password-based authentication:

• Time-based one-time passwords (TOTPs), which are generated through authenticator apps like Google Authenticator or Microsoft Authenticator and expire every 30 seconds. Software-generated codes eliminate the vulnerabilities of static credentials while remaining cost-effective and easy to deploy across large user bases.
• Biometric authentication, like facial recognition, one-touch fingerprint scanning or voice recognition, provides unique identifiers tied to individuals. Multi-modal biometric approaches offer stronger protection, particularly against AI-generated deepfakes. Passkeys can be used with biometrics, adding several additional layers of AI-resistant security.
• Push notifications send approval requests to registered devices, allowing users to confirm or deny authentication attempts with a single tap. While this method offers better usability than typing codes, it can be vulnerable to look-alike “prompt bombing” attacks aiming to overwhelm the target with requests.
• SMS-based codes, though similar in delivery to notifications, remain common despite known vulnerabilities such as SIM swapping and SMS interception.

By providing multiple fast and frictionless authentication layers that exist outside the digital realm where AI operates, networks become more resistant to phishing, session hijacking and man-in-the-middle attacks.

The next generation of MFA

Passkeys are emerging as the next critical evolution of defense. Passkeys are built on the mature FIDO2 and WebAuthn standards, which address a critical gap in current authentication methods.

Just as DNS-based protocols like DMARC establish trusted identity at the infrastructure level, FIDO2-based passkeys establish cryptographic trust at the user authentication level. By making the authentication mechanism itself incapable of working with fraudulent domains, passkeys offer a fundamental shift in authentication security. Passkey use can also be authenticated itself via biometrics (i.e., touch or face ID on Apple devices or Google’s face or fingerprint unlock for Android devices).

Cryptographic protection complements biometric authentication, which verifies “Is this the right person?” at the device level, while passkeys are used to verify “Is this the right website or service?” at the network level. Multi-modal biometrics, such as facial recognition plus fingerprint scanning or biometrics plus behavioral patterns, further strengthen this approach.

As AI-powered attacks make credential theft and impersonation attacks more sophisticated, the only sustainable line of defense is a form of authentication that cannot be tricked or must be cryptographically verified. With major platforms including Apple, Google, Microsoft and GitHub already supporting passkeys, this technology is quickly evolving from emerging to essential.

Balancing AI innovation with authentication modernization

The real opportunity is not choosing between AI-powered defenses and robust authentication; it is recognizing that non-AI authentication can fundamentally shift the security equation in favor of defenders. With average breach costs at $4.44 million, according to IBM’s 2025 Cost of a Data Breach Report, the path forward requires balancing both imperatives.

Success belongs to enterprises that recognize these technologies have fundamentally different roles. AI for detection, adaptation and response speed and non-AI authentication for definitive access control that cannot be algorithmically defeated.

But to truly change the equation, organizations must prioritize authentication modernization methods that are grounded in non-AI principles and open standards, even as they embrace AI-driven security innovations.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

조직의 사이버 보안 성숙도와 회복탄력성에 있어 보안 임원진과 실무진 사이에 뚜렷한 인식 차이가 존재하는 것으로 나타났다.

비트디펜더(BitDefender)의 최근 보고서에 따르면 조직의 공격 표면이 확대되고 있지만, CISO는 중간 관리자급보다 리스크를 관리할 수 있는 역량에 대해 더 자신감을 보였다. CISO의 45%가 자신감을 보인 반면, 중간 관리자급은 이 비율이 19%에 그쳤다. 다크트레이스(Darktrace)의 ‘AI 사이버보안 현황’ 보고서 역시 AI 기반 위협에 대응할 조직의 역량에 대해 보안 실무진이 보안 임원보다 신뢰도가 낮다(49% 대 62%)고 분석했다.

다크트레이스 보고서는 “신뢰도의 차이는 리더와 현장 실무진 간의 단절을 보여주는 증거”라며 “일선에서 AI 기반 공격자와 매일 맞서고 있는 실무진은 현재 솔루션이 어떤 한계를 드러내고 있는지 누구보다 잘 알고 있다”라고 설명했다.

침투 테스트 전문 기업 코발트(Cobalt)의 CTO 귄터 올만은 “이 같은 단절은 보안 조직에서 흔히 나타나는 현상이며, 보안 우선순위를 정렬하는 데 어려움을 초래할 수 있다”라고 말했다.

올만은 “매일 다양한 공격 유형을 직접 마주하는 ‘현장 최전선’의 실무진과, 그로부터 거리가 있는 임원진 사이에는 오래전부터 인식의 단절이 존재해 왔다. 현장 보안 인력은 끊임없는 경보 피로와 결코 끝나지 않는 일상적 스트레스에 시달리며, 이런 환경은 전체적인 보안 전략을 조망하기 어렵게 한다”라고 지적했다.

한편 사이버보안 교육 플랫폼 시큐어플래그(SecureFlag)의 기술 전문가 니코렛 클라킨은 “보안 임원진이 일상적인 사이버 보안 업무와 동떨어져 있다 보니 현장에서 발생하는 문제들이 간과될 수 있다”라고 말했다.

클라킨은 “임원진은 주로 요약된 보고서나 대시보드 지표에 의존하는 반면, 실무진은 커버리지의 한계, 낡은 시스템, 경보 피로 등 일상적인 문제를 직면한다. 이런 문제는 이사회 회의에서 거의 논의되지 않기 때문에 리더십에 잘못된 보안 인식을 심어주고, 보안 개발, 위협 모델링, 기술 역량과 같은 핵심 영역에 대한 과소투자로 이어질 수 있다”라고 분석했다.

반면 원 아이덴티티(One Identity)의 글로벌 IAM 전략 수석부사장 래리 친스키는 “중간 관리자들은 보안 프레임워크를 구성하는 실제 도구들을 직접 다루기 때문에 조직의 보안 상태에 대해 항상 더 많이 우려한다”라고 진단했다.

CISO와 현장 보안 실무진 간의 격차는 준비 상태 인식 수준과 실제 대응 역량 사이의 간극을 만들 수 있다. 이는 흔히 다음과 같은 문제로 이어진다.

• 우선순위 왜곡: 사이버보안 기업 아크로니스(Acronis TRU)의 수석 보안 연구원 산티아고 폰티롤리는 “보안 투자가 종종 탐지 엔지니어링, 사고 대응, 위협 억제와 같은 핵심 역량보다 가시성 확보나 규제 준수에 우선순위를 둘 수 있다”라고 말했다.
• 대응 지연: 폰티롤리에 따르면 AI 기반 위협은 더 빠르고 지능적인 방어 체계를 요구하지만, 리스크를 과소 평가하다 보니 행동 기반 분석이나 자동화 같은 핵심 업그레이드가 자주 연기되고 있다.
• 효력 없는 구현: 보안 도구가 적절한 통합이나 교육 없이 배포되면 그 효력이 제한되고 운영상의 혼란을 가중시킬 수 있다.

네트워크 보안 관리 기업 파이어몬(FireMon)의 국제사업 수석부사장 데이비드 브라운은 “보안 임원은 최근 사고가 없었다는 이유만으로 정책과 통제 체계가 잘 작동한다고 가정하는 경향이 있지만, 실무진은 그 이면을 더 잘 알고 있다. 실제로는 시간이 지날수록 기술 부채, 정책 난립, 설정 불일치가 누적되는 현실을 실무진은 명확히 인식하고 있다”라고 말했다.

종종 오해되는 AI 기반 위협

임원진은 주로 고차원의 컴플라이언스 지표나 벤더의 보장에 근거해 보안에 대한 자신감을 갖는다. 반면 보안 엔지니어와 분석가 등 현장 실무진은 AI 기반 위협의 복잡하고 빠르게 진화하는 실체를 직접 목격하고 있다.

사이버 리스크 관리 기업 놈사이버(NormCyber)의 CTO 폴 크래그는 “다크트레이스의 최근 연구는 이러한 인식 차이를 부각시킨다. 고위 리더들은 조직의 대비 태세를 과대평가하는 경향이 있는 반면, 현장 실무진은 훨씬 더 신중하게 평가한다”라고 말했다.

실제로 AI의 발전은 기존에 시간과 비용이 많이 들었던 공격 작업을 자동화할 수 있게 하며, 공격의 진입 장벽을 낮추고 성공 가능성을 높이고 있다.

크라우드소싱 기반 사이버보안 기업 인티그리티(Intigriti)의 최고 해커 책임자 인티 드 쾨켈레어는 “현장 실무진은 일반적으로 이런 변화를 가장 먼저 인식한다. 애초에 임원진도 공격 가능성에 대한 평가를 실무진에 의존하고 있기 때문”이라고 말했다.

공격자들은 이미 생성형 AI를 활용해 피싱, 사칭, 랜섬웨어 전술을 대규모로 전개하고 있다. 동시에 직원의 3분의 1 이상이 보안 통제나 정책, 가시성 없이 AI 도구를 비공식적으로 사용하고 있다.

아이반티(Ivanti) 네트워크 보안 그룹의 수석부사장 마이크 리머는 “이른바 ‘섀도우 AI’는 관리되지 않는 도구와 데이터 흐름을 조직 내부로 유입시켜 위협 범위를 급격히 확장시킨다”라며 “특히 노후화되거나 고립된 보안 통제 시스템과 결합될 경우 기존 보안 체계를 쉽게 우회하게 만든다”라고 지적했다.

AI 기반 위협의 진화 속도가 너무 빨라 보안 현장에서는 기존의 정책과 리스크 평가 체계로는 대응이 어려운 상황이다. 브라운은 “리더들은 정기적인 업데이트에 안심할 수 있지만, 실무진은 실시간 대응이 요구되는 끊임없이 변화하는 위협 환경을 체감하고 있다”라고 설명했다.

AI 관련 위협에 대한 인식 격차는 조직 내 보이지 않는 사각지대를 만들고, 그 안에서 리스크가 잠재적으로 늘어나게 된다. 리더십이 보안 태세를 실제보다 낙관할 경우, 필수적인 투자가 지연되거나 잘못된 방향으로 이뤄질 수 있다.

브라운은 “조직은 꼭 필요한 권한만 부여하는 방식으로 보안 아키텍처를 재설계하고, 정책 집행을 자동화하며 통제 체계를 지속적으로 검증해야 한다. 이미 수작업으로 관리하기 어려운 정책이라면 AI 기반 위협은 그 체계를 완전히 무력화시킬 수 있다”라고 경고했다.

가시성과 맥락의 중요성

포스카우트(Forescout)의 보안 인텔리전스 부사장 릭 퍼거슨은 “이 같은 인식 괴리의 상당 부분은 가시성과 맥락이라는 측면에서 비롯된다. 조직 내 역할에 따라 보안 태세를 해석하는 방식이 다르기 때문”이라고 언급했다.

퍼거슨은 “예를 들어 SOC 분석가는 한 종류의 데이터를, 보안 관리자는 다른 데이터를, CISO는 또 다른 데이터를 본다. 이 데이터는 각자의 역할과 책임, 사용하는 도구, 조직 내 우선순위에 따라 달라진다. 전달 과정에서 데이터는 요약되거나 재구성되고, 중요도나 시간 압박에 따라 선별적으로 강조되면서 메시지가 왜곡될 수 있다”라고 설명했다.

이런 과정은 결국 동일한 데이터에 대한 서로 다른 해석으로 이어지며, 조직의 실제 보안 성숙도나 리스크 노출 수준에 대한 오해와 보안 우선순위의 불일치를 낳을 수 있다.

또한 GRC 인터내셔널 그룹(GRC International Group)의 정보보안 관리자 아담 시먼스는 CISO의 조직 내 위상이 높아지고 비즈니스 리더십 역할로 재편되면서 이런 단절이 더 심화되고 있을 수 있다고 지적했다.

시먼스는 “많은 CISO가 기술 책임자에서 비즈니스 리더로 역할을 전환해 왔다. 문제는 이 과정에서 운영 현장의 세부 사항과 점점 멀어지게 된다는 점”이라고 말했다. 그는 “이로 인해 경영진이 인식하는 보안 상황과 현장에서 실제로 벌어지는 일 사이에 일종의 ‘해석 격차’가 생긴다”라고 설명했다.

공통된 지표의 부재

리스크와 보안 태세에 대한 공통된 인식이 없으면 전략이 분산되고, 그 결과 의사결정 속도가 느려지거나 특정 영역에 과잉 또는 과소 투자로 이어질 수 있다. 이는 결국 공격자가 파고들 수 있는 사각지대를 만든다.

포스카우트의 퍼거슨은 “이 격차를 해소하려면 보안 데이터를 전달하고 맥락화하는 방식을 개선하는 일부터 시작해야 한다. 보안 도구는 필터링된 정보를 상위 단계로 전달하는 대신 동일한 기초 데이터를 각 역할에 맞게 제시할 수 있어야 한다”라고 말했다.

가령 SOC 분석가는 기술 세부 정보를 필요로 하지만, CISO는 비즈니스 영향 수준과 관련된 맥락을 요구할 수 있다. 퍼거슨은 “도구가 의미를 훼손하지 않으면서 각 역할에 맞는 맥락을 제공할 수 있다면 왜곡을 줄이고 공동의 이해를 높이는 데 유용할 것”이라고 설명했다.

일부 전문가는 도구 고도화와 내부 소통 개선이 맞물리면서 보안 인식 격차가 점차 좁혀지고 있다고 봤다.

원 아이덴티티의 친스키는 “CISO는 팀과 더 긴밀히 협력하고, 정기적으로 소통하며 최신 기술을 적극적으로 활용해 보안 태세의 취약 지점을 함께 파악해야 한다”라고 조언했다. 또한 그는 “최근 기업의 공격 표면이 크게 확장되면서 CISO의 현장 개입이 훨씬 깊어지고 있다. 이들이 보안 태세 강화를 위해 새로운 도구를 도입함에 따라 인식 격차가 크게 줄어들 가능성이 있다”라고 전망했다.
dl-ciokorea@foundryco.com

Women are severely underrepresented in top leadership roles across the business world. Only 10.4% of the Fortune 500 companies have women CEOs. In an AP survey of S&P 500 companies, only 25 of 341 CEOs were women.

That disparity extends into the technology sector. The Women in Tech organization reports that 17% of tech companies have a woman CEO, and only 25% of all C-suite jobs are held by women.

But there are a number of groundbreaking women who have been highly successful in networking, and we’re highlighting 20 of them (in alphabetical order). We’ve found no clear pattern or career path—some have stayed with the same company their entire career; others have bounced from one place to another. Several went out and started their own company. Some have technical backgrounds; others have business or management degrees. Two traits they share are a commitment to diversity and inclusion and active participation in organizations and programs championing women in tech.

1. Kimberly Anstett

• Title: CIO, Trellix
• Education: Bachelor of Science, Electrical Engineering, Tufts University
• Why she’s here: Anstett joined Trellix (a rebranding following the merger of McAfee Enterprise and FireEye) in 2022. She previously worked at Iron Mountain, where she was Executive Vice President and CTO. At Trellix, which is positioning itself as a leader in extended detection and response (XDR), she heads the Enterprise Technology and Operations group. Anstett said at her appointment: “My number one priority as CIO is to deliver insights to our business to serve our customers. Second is furthering diversity, equity, inclusion, and development for my teams.”
• In her own words: “The best learning comes from the toughest times. We’re all going to stub our toe, we’re all going to get bruises, but it’s actually going to make us much better. Just don’t let it get you down. You’re not learning if you’re not making mistakes. And if you can punch through that, it’s quite extraordinary,” she said on a podcast interview with eChannelNews.
• Fun fact: She also said during the podcast that virtually everyone in her family is an engineer. When she was growing up, her parents didn’t ask if she wanted to be an engineer, they just wanted to know what type.>

2. Alvina Antar

• Title: Chief Digital Officer, F5
• Education: Bachelor of Science, Computer Science, University of Houston>
• Why she’s here: Antar worked at Dell for 17 years, starting as a software engineer and eventually leading the company’s acquisitions efforts, where she mastered the art of integrating technology, people, and business models. With that broad experience, Antar set her sights on becoming a CIO. She joined Zuora, a startup that provides billing and subscription management software, scaling it from $30M to $300M in revenue and taking it public in 2018. She joined Okta as CIO in 2020, and left Okta for her current role at F5 in January 2025, where she is tasked with building a data- and AI-first enterprise. When joining F5, she reflected on her career and said, “F5’s evolution from hardware to software and SaaS mirrors my own professional journey and passion for transformation.” >
• In her own words: “Be fearless in all that you do, and ultimately don’t look around and hold back because you may be the only girl in the room. Be confident in what differentiates you,” she said in an article about driving diversity in tech.
• Fun fact: Co-founded the Silicon Valley CIO Women’s Network and is a member of the Girls in Tech Board of Directors.

3. >Liz Centoni

• Title: Executive Vice President and Chief Customer Experience Officer, Cisco
• Education: Bachelor of Science in Chemistry, the University of Mumbai; Master of Business Administration, the University of San Francisco
• Why she’s here: Centoni joined Cisco in 2000 after working for five years in sales and marketing for a packaged goods company. Looking back at that time, she said: “When I came into Cisco, I came in with a business background and the advice I was given was, ‘You’re never going to succeed at engineering, which requires domain knowledge of computer science. So, it’s good that you’re giving this a try, but I suggest you look at what a Plan B looks like.’” She started out as senior director of engineering and climbed the ranks to excel at numerous positions, including senior vice president and general manager of Cisco’s Cloud, Compute, and IoT business, chief strategy officer, and general manager of applications. Earlier this year, CEO Chuck Robbins revamped Cisco’s top management and promoted Centoni to EVP and chief customer experience officer. In her new role, Centoni will lead a team of 20,000 employees focused on helping customers transform their businesses through Cisco products and services.
• In her own words: “Throughout my career, there have been days when I’ve been scared and days I haven’t had time to think about whether I was scared or not. I think if you don’t have that fear, you’re going to ask yourself if you’re stretching yourself. In fact, if I look back, what I fear is the opportunities I didn’t take,” she said.
• Fun fact: Centoni is Cisco’s Executive Sponsor for the Women in Science and Engineering (WISE) program.

4. Eva Chen

• Title: Co-founder and CEO, Trend Micro
• Education: Bachelor of Philosophy, National Chengchi University; Master of Business Administration and Master of Management Information Systems, University of Texas
• Why she’s here: No job hopping for Chen. She co-founded Trend Micro in 1988 and has been leading the company ever since; first as executive vice president, CTO in 1996, and CEO since 2005. During her tenure, the company successfully made the transition from simple anti-virus software to a broad, AI-driven cybersecurity platform that protects endpoints, cloud, and enterprise resources. Not many security vendors from the 1980s are still around, but Trend Micro is a survivor. In its latest earnings report, the company announced 13% year-over-year net sales growth and annual revenues in the $1.8 billion range.
• In her own words: “As a woman in Asia, when I became the CEO, I tried to imitate all the male CEOs. I didn’t wear a skirt and I didn’t wear earrings. But it’s not right. People can see that you are not yourself. I started to realize that the only way you can express yourself is to let people connect with you without the mask. Be yourself,” she said during an interview with CNBC.
• Fun fact: Chen co-founded the company with her sister Jenny and brother-in-law Steve Chang.

5. Tam Dell’Oro

• Title: Founder and CEO, Dell’Oro Group
• Education: Bachelor of Science, International Business, Santa Clara University; Master of Business Administration, Strategy and Marketing, the University of Chicago
• Why she’s here: In a world of mega research and analyst groups like IDC, Gartner, and Forrester, Dell’Oro Group has carved out a successful niche focusing exclusively on networking, telecommunications, data center infrastructure, and network security. In addition to delivering the latest market share numbers, Dell’Oro Group provides consulting in business planning and strategic competitive analysis. Dell’Oro herself has had a long career in networking, going back to SynOptics in the 1990s, where she developed a competitive analysis program to evaluate the strategic performance of key companies in the networking industry.
• In her own words: “I often sort out key assumptions on my forecast when I am out riding my mountain bike, zooming along the single track at Russian Ridge overlooking the Pacific Ocean,” she said.
• Fun fact: As a child, she spent time living in Saudi Arabia, where her father Walter, a geologist, was working for a state-owned oil company exploring potential drilling sites.

6. Jae Evans

• Title: Global Chief Information Officer and Executive Vice President, Oracle
• Education: Bachelor of Science, UC Santa Barbara; Master of Business Administration, Golden Gate University
• Why she’s here: With more than 20 years of experience leading global teams and managing critical production services, Evans now oversees Oracle IT’s cloud transformation and provides IT services to Oracle’s 160,000 employees and developers. Her team manages Oracle Cloud Infrastructure (OCI) Platform Services to ensure top-tier security, compliance, and support. Evans is passionate about bringing diversity and inclusion into the workplace, and she is the executive sponsor for D&I, a member of Oracle’s Executive D&I Council, and an active participant in and champion of various Oracle Professional Asian Leadership and Women in Tech Events.
• In her own words: On the topic of building trust, she said: “Leading a team can be challenging, especially when you’re new to it or when there are a lot of changes taking place and things are moving at a fast pace. And that’s when it’s actually the most critical time. You won’t learn how to effectively manage a team just by reading a book, but one key element for you to learn is you can’t lead if people won’t follow, and the key element to that is building trust.”
• Fun fact: Upon joining Oracle, Evans established a mentoring circle of high-performing female leaders and said in an Oracle blog post: “We’re having these honest conversations here at Oracle, and I’m using that information to initiate discussion with my peers along the lines of sponsorship, advocacy, and action to develop and retain great talent.”

7. Adaire Fox-Martin

• Title: CEO and President, Equinix
• Education: Bachelor of Arts, Trinity College, Dublin
• Why she’s here: Fox-Martin was named CEO and president of Equinix in June 2024, after a stellar career at tech powerhouses Oracle, SAP, and Google, where she led global teams encompassing sales, professional services, partner ecosystem, and customer success. At Equinix, where she has been a member of the Board of Directors since 2020, she is responsible for leading the overall strategy and direction of the business.
• In her own words: “Regardless of whether you’re tech or not, whatever you do, whatever you make, innovation is the lifeblood of your company, and you only become innovative when you can bring together individuals who have a diverse and different frame of reference,” she said on a podcast.
• Fun fact: Fox-Martin began her career as a schoolteacher, which she described this way in an article: “It’s the only job where on your first day, you’re CEO of 32-plus people and you need to find a way to engage them and maintain that level of engagement.”

8. Rupal Hollenbeck

• Title: President, Check Point Software
• Education: Bachelor of Science, Finance and International Studies, Boston College; Master of Business Administration, International Management, the Thunderbird School of Global Management at Arizona State University
• Why she’s here: Hollenbeck enjoyed a 23-year career at Intel, where she held senior leadership positions, including Corporate Vice President and General Manager of Global Data Center Sales, and Vice President and General Manager of Intel China. Hollenbeck then held key jobs at Oracle and AI startup Cerebras Systems before joining Check Point in 2022 as chief commercial officer. She was recently promoted to Check Point President, where she is in charge of all commercial and go-to-market functions for the company. She is also an Adjunct Professor at California State University East Bay, teaching a Women in Leadership course in the College of Business & Economics.
• In her own words: “I’m hugely passionate about the notion of equity and inclusion. It’s important to me as a human being. And I take it with me in everything that I do,” she said in a Check Point Software blog post.
• Fun fact: She is a Founding Member of Neythri, an organization dedicated to the professional advancement of South Asian women, and a Founding Limited Partner in the Neythri Futures Fund.

9. Kate Johnson

• Title: President and CEO, Lumen Technologies
• Education: Bachelor of Science, Electrical Engineering, Lehigh University; Master of Business Administration, the University of Pennsylvania’s Wharton School
• Why she’s here: Johnson spent six years as a management consultant, where she got hooked on business transformations. Her resume includes stints at Deloitte Consulting, USB Investment Bank, Red Hat, Oracle, GE Digital, and Microsoft. Johnson was named president and CEO of Lumen (formerly CenturyLink) in 2022. Saddled with $20 billion in debt from a variety of acquisitions, Lumen needed a shot in the arm and Johnson delivered. She said about a culture of empathy in an article, “I’m a change lover. I love transformation. And this was a company that needed to be transformed fundamentally, and also needed a giant hug.” Johnson restructured the debt load, reorganized the company, changed the culture, re-focused the business, and is betting on the AI revolution to drive new business in high-speed connectivity.
• In her own words: “You can’t just peel out and get a better job every time something is not going your way. I think the notion of resilience is super important, how to deal with it, that’s important for the longevity of your career but also to develop empathy for people that you start to manage. All of this requires a growth mindset. You have to be in the game to learn and apply those learnings as a takeaway,” she said on a podcast of how to deal with bad bosses.
• Fun fact: The Denver resident is an avid skier.

10. Praniti Lakhwara

• Title: CIO, Zscaler
• Education: Bachelor of Science, Aeronautical Engineering, Arizona State University
• Why she’s here: Lakhwara came to the U.S. from India with the goal of becoming a pilot but switched to aerospace engineering instead. “I was solving problems, and it had its own mini adrenaline rush,” she said in an article about her career path. Aerospace engineering with a focus on computational modeling led to programming, which led to a long career running IT operations. Her path has included stints at Align Technology, Nimble Storage, and Conga, where she was CIO from 2017-2021. She was senior vice president of information technology and applications at Zscaler from 2021-2022, then assumed her current CIO role.
• In her own words: She discussed in an article her take on keys to success: 1. “I truly, to this day, feel like I arrived at the perfect role for me. So, passion is a big driver.” 2. “Not all careers are by design. It may or may not be a direct, straight route. Life is going to get in the way.” (When she landed her first role as head of IT, she had five-month-old twins.) “It was quite a juggle. But I like high-pressure situations, and I took it as a challenge.” 
• Fun fact: She is a licensed English-as-a-Second Language teacher.

11. Mindy Lieberman

• Title: CIO, MongoDB
• Education: Bachelor of Science, Mechanical Engineering, The Cooper Union; Doctorate, Mechanical Engineering, the University of California, Berkeley
• Why she’s here: Lieberman is responsible for business system delivery, data engineering and analytics, corporate infrastructure, collaboration tools, and IT operations at MongoDB. Her resume includes serving on IT executive teams at Peloton, Okta, Zendesk, and Salesforce. Her career has also included stints at startups, working in public sector scientific computer research, and, like many in the industry, she worked at Cisco early in her career. Known for building talented, collaborative teams, she prides herself on a people-first approach to leadership.
• In her own words: On advice she would give her younger self: “I’d give myself two pieces of advice. The first is don’t worry so much about career growth; worry about making sure that you are part of the team that is tackling the thorniest, ickiest, hairballiest problems in your organization—because the more you are seen to be doing that repeatedly, the more your career growth is naturally going to take care of itself. The second thing is, speak up when it’s uncomfortable to do so, and especially when it’s uncomfortable to do so, because you have to train yourself to be part of the conversation, as opposed to an onlooker,” she said in a recent interview with The Stack. 
• Fun fact: She was a post-doctoral research assistant at Lawrence Livermore National Lab, working on fluid flow simulations.

12. Sharon Mandell

• Title: CIO, Juniper Networks
• Education: Bachelor of Arts, Computer Science, Temple University; Master of Computer Science, Georgia Institute of Technology; Master of Business Administration, University of Chicago
• Why she’s here: Mandell’s route to Juniper, where she leads the team that provides ongoing enhancement of the company’s IT infrastructure and applications architectures, has included lots of zigs and zags. She has worked in media, communications, and networking industries. She started as a programmer, co-founded a startup, and held titles of CIO and CTO at various stops along the way. Prior to Juniper, she was CIO at TIBCO Software. Throughout her career, she developed a level of expertise in cybersecurity and compliance, enterprise architecture and road mapping, data, and analytics.
• In her own words: On the topic of IT leadership, growth, and being open to new ideas, she said: “I’ve had a long career in technology, but stepping into the classroom has probably taught me at least as much as I’ve been able to share with my students. Along with my role as CIO of Juniper Networks, I teach a class every year at the University of San Francisco, and it’s shown me just how much power lies in having a beginner’s mindset, along with a willingness to make mistakes, be humbled, and continuously learn and evolve.”
• Fun fact: She wanted to be a ballet dancer and, at one point, she was in the apprentice program at the Pennsylvania Ballet, while also attending Temple University, where she was introduced to computer science.

13. Jill Popelka

• Title: CEO, Darktrace
• Education: Bachelor of Arts, International/Global Studies, Texas A&M University
• Why she’s here: Popelka joined Darktrace, which specializes in AI-powered network monitoring, in January 2024 as a director on the company’s board. In June, she became COO, and in September became CEO, when founder and former CEO Poppy Gustafsson stepped aside following the company’s $5.3 billion takeover by private equity powerhouse Thoma Bravo. In her new role, Popelka will lead the company in its transition from a public company to part of the Thoma Bravo portfolio. Prior to Darktrace, she spent two years as head of enterprise services at Snap, and was a longtime employee at SAP, where she led the SAP SuccessFactors business unit.
• In her own words: On the topic of prioritizing the employee experience, she said: “Technology should strengthen human connection—not weaken it. Don’t be a ‘tech-first’ company; be a ‘people-first’ company.”
• Fun fact: She wrote a book called, Experience, Inc.: Why Companies That Uncover Purpose, Create Connection, and Celebrate Their People Will Triumph, a business leader’s guide to creating a winning employee experience for your organization and your people.

14. Kate Prouty

• Title: Senior Vice President and CIO, Akamai
• Education: Bachelor of Science, Business Administration, Keene State College; graduate of the Greater Boston Executive Program, MIT Sloan School of Management
• Why she’s here: Prouty oversees Akamai’s IT organization, responsible for business transformation, including global strategy, development, and operation of applications and IT infrastructure. Prouty joined Akamai in 1999 and has been instrumental in developing systems that have been foundational to the company’s growth, including ERP and supply chain. Prior to joining Akamai, she held a variety of technology positions including in network administration, system administration, database administration, and software implementation at Fleet Financial and Digitas.
• In her own words: She offered advice in three areas: 1. “Unfortunately, there’s pressure on people to present in a way that they think everyone wants them to, as opposed to just being comfortable in your own skin. Be yourself.” 2. “There’s nothing that’s going to replace hard work. There’s no silver bullet. There’s no easy answer. At the end of the day, it’s about hard work.” 3. “You need to challenge yourself. You need to raise your hand and take on the things that you aren’t 100% sure you can actually do, she said in a leadership spotlight series at Akamai.
• Fun fact: Prouty co-chairs the Executive Women’s Network at Akamai and is a member of the board of directors of Delta Projects, which supports people with intellectual challenges.

15. Meerah Rajavel

• Title: CIO, Palo Alto Networks
• Education: Bachelor of Science, Computer Science and Engineering, the Thiagarajar College of Engineering at Anna University in Chennai, India; Master of Business Administration, the Leavey School of Business, Santa Clara University, California
• Why she’s here: Rajavel oversees the 1,000-member team at Palo Alto Networks responsible for the technology and business infrastructure that runs the company. Her journey to Palo Alto included stops at Lotus Infotech, Infosys, Cisco, McAfee, and Forcepoint. Prior to joining Palo Alto, she was CIO at Citrix. Rajavel was married at age 20 and her marital status didn’t go over well with prospective employers back in the ’90s. She recalled: “There was prejudice. I would pass all rounds and in the final one, someone would say, ‘Oh! You are married? Will your husband have a job transfer? Are you planning to have children? And then, they would reject.’ My husband was very supportive and would always tell me that it was their loss, not mine.”
• In her own words: On the topic of risk-taking, she said: “It’s okay to fall if you know how to get up. But practice on getting up, and not falling. Again, if you are not falling, you are playing safe.”
• Fun fact: A technologist at heart, she started programming when she was in the 10^th grade.

16. Fidelma Russo

• Title: Executive Vice President and General Manager, Cloud Business Unit, and CTO, HPE
• Education: Bachelor of Engineering, Electrical Engineering, University College Cork; Master of Computer Science, Boston University; completed the Internet of Things Executive Education program at MIT’s Sloan School of Management
• Why she’s here: Russo wears two hats; She leads a 5,500-person global organization responsible for driving the strategic direction, development, and execution of HPE’s GreenLake platform, storage, private cloud, and SaaS solutions. And she is in charge of driving innovation through the Office of the CTO. She joined Hewlett Packard Enterprise in September 2021 as CTO, where she led the creation, development, and delivery of GreenLake. In 2023, CEO Antonio Neri established a Hybrid Cloud business unit containing all GreenLake activities and put Russo in charge. Prior to joining HPE, she had stints at VMware, Iron Mountain, EMC, Sun Microsystems, and Dell.
• In her own words: On the topic of advice that she’s grateful for, Russo said: “I got a piece of advice. I didn’t appreciate it at the time, and I am immensely thankful for it. And it is the following: ‘You always bring yourself with you.’ And so sometimes when you are having challenges and difficulties, you really have to look in the mirror and think about, is it you? Is it how you react? And really own that yourself. It kind of clarifies things for you. And I’ve always appreciated that piece of advice, which I got many, many years ago.”
• Fun fact: She worked at HPE once before. She was vice-president of adaptive infrastructure at what was then HP in 2006-2007.

17. Dr. Lisa Su

• Title: CEO and Chair, Advanced Micro Devices (AMD)
• Education: Bachelor of Science, Electrical Engineering, Master of Science and Doctor of Philosophy, Electrical Engineering, MIT
• Why she’s here: Su designed semiconductors at Texas Instruments, helped design chips at IBM, and was CTO at Freescale Semiconductor before being tasked to turn around a struggling AMD. She was named CEO in 2014 and successfully revitalized the company with a strategy that focused on designing (but not manufacturing) high-performance chips for AI and graphics-heavy use cases. In 2015, AMD was a $4 billion company that reported a net loss of $660 million. In 2023, AMD reported full-year revenue of $23 billion, with $854 million in net income. The company is gaining traction in enterprise data centers with its GPUs and is poised to capitalize on the rush to build high-performance systems for AI and generative AI.
• In her own words: On her decision to focus on electrical engineering at MIT, Su said: “I was always around math and science, my parents were always saying, ‘You have to do the hard things.’ When I went to MIT, at that time, it was a decision between electrical engineering and computer science. Computer science, you could just write software programs, whereas electrical engineering, you had to build things. I wanted to build things.”
• Fun fact: Jensen Huang, CEO at competitor Nvidia, is a distant cousin.

18. Jayshree Ullal

• Title: President and CEO, Arista Networks
• Education: Bachelor of Science, Electrical Engineering, San Francisco State University; Master of Science, Engineering Management, Santa Clara University
• Why she’s here: There’s bold. There’s brave. There’s brash. Then there’s leaving Cisco after 15 years in upper management to join a startup that challenged Cisco in its core network switch business. That’s what Jayshree Ullal did in 2008, when she became CEO of upstart Arista Networks. The results have been impressive. Arista racked up nearly $6 billion in revenue in 2023. The company actually surpassed Cisco in the data center switch market share in Q4 2023 (according to Dell’Oro Group.) In the early days, when Cisco had the enterprise pretty much locked up, Arista went after the cloud service providers. That strategy has paid dividends; 43% of the company’s total revenue comes from the hyperscalers.
• In her own words: On the topic of her guiding principles, Ullal said: “As human beings, we all want to do a good job, be acknowledged, and crave that appreciation. Treat your peers and team respectfully, cultivate their inner strengths, and harness their full potential.”
• Fun fact: She created (with her husband) the SITA Foundation for Women, which works to fund women internationally in pursuing education. SITA also funds cancer research.

19. Joanne Wright

• Title: Senior Vice President, Transformation and Operations, IBM
• Education: Bachelor of Arts, Business, Management, and Marketing, Glasgow Caledonian University
• Why she’s here: Probably no major U.S. company has undergone the type of upheaval that IBM has over the past 25 years. The transitions from hardware to software to services to cloud to AI under multiple management teams have been anything but smooth. Wright has seen it all and has seen her star steadily rise from 1998, when she joined the company, to today, where she is Senior Vice President, Transformation and Operations. In this role, she is responsible for delivering productivity across IBM through the application of AI on the hybrid cloud and to unleash innovation and growth. In her 25-year career at IBM, she has held key leadership roles across procurement, manufacturing, supply chain, real estate, client support, and operations.
• In her own words: “Early on in my career, I recognized the importance of these three tips. Tip one: Plan ahead, schedule. Make sure you have the right amount of time to spend on the most important things you need to cover every day. Tip two: Unplug: Each evening if I’m in town, we have dinner as a family. None of us are on electronics; the TV is off. Tip three: Have fun: Make sure you have time for every aspect of your life, and that includes ‘me’ time. Relax, take a hot bath, have that mindful moment,” she said on the topic of work/life balance.
• Fun fact: She is the head of the Women at IBM Community and started the company’s Women’s Business Resource Group. 

20. Michelle Zatlyn

• Title: Co-founder and president, Cloudflare
• Education: Bachelor of Arts/Science, McGill University; Master of Business Administration, Harvard Business School
• Why she’s here: Zatlyn and two of her Harvard Business School friends (Matthew Prince and Lee Holloway) co-founded Cloudflare in 2009. (Cloudflare acts as a reverse proxy service that provides content delivery, security, and application performance optimization for Internet traffic.) Zatlyn admits she didn’t know a lot about technology when the company was founded, but she learned fast. She was chief operating officer through the company’s wildly successful IPO in 2019, and in 2020 became company president. At the time, Prince said: “Had it just been me and Lee, we’d still be in a small office over the nail salon in Palo Alto. Her leadership within Cloudflare has been a big part of how we have been able to thrive, taking care of our employees, our customers, and our business.” Today, the company has $1.6 billion in annualized revenue and is growing 30% year-over-year. Cloudflare is now valued at more than $28 billion.
• In her own words: On pitching Cloudflare to investors, Zatlyn said:: “It was bold then and not everyone thought it was a good idea. Some people looked at us like we’re crazy, but I’d like to say that when people look at you like you’re crazy, you’re probably onto something big,” she said on pitching Cloudflare to investors.
• Fun fact: In high school, she was captain of the girls’ basketball team.

Artificial intelligence (AI)-enabled systems are driving a new era of business transformation, revolutionizing industries through prescriptive analytics, personalized customer experiences and process automation. From manufacturing to healthcare and finance to defense, AI enhances efficiency, decision-making and operational agility, providing organizations a competitive edge in an increasingly data-driven world. Its processing of vast datasets enables supply chain precision, life-saving diagnostics and hyper-personalized consumer interactions, fostering scalability and innovation. 

However, as AI adoption accelerates, organizations face rising threats from adversarial attacks, data poisoning, algorithmic bias and regulatory uncertainties. Without robust security and governance frameworks, unsecured AI systems can erode stakeholder trust, disrupt operations and expose businesses to compliance and reputational risks. 

Senior executives are challenged with securing AI, aligning initiatives with governance frameworks and fortifying business resilience. Organizations can unlock AI’s full potential by proactively addressing security, ethics and operational challenges while ensuring transparency, reliability and long-term sustainability. 

The risks of unsecured AI 

Unlike traditional IT systems, AI is uniquely susceptible to novel attack vectors such as:  

• Adversarial attacks. Subtle input data manipulations can cause AI systems to make incorrect decisions, jeopardizing their reliability.  
• Data poisoning. Compromised datasets used in training AI models can degrade system accuracy.  
• Generative AI risks. Issues like hallucinations and malicious prompt injections threaten enterprises reliant on AI-generated content.  

Ethics and governance in AI  

AI also challenges organizations to address algorithmic bias, transparency and accountability issues. Regulatory frameworks like the EU AI Act and NIST AI Risk Management Framework are shaping expectations around responsible AI deployment.   

Balancing security, ethics and strategic investments 

Securing AI systems requires a balanced approach that integrates technical rigor with strategic foresight: 

• Invest in AI-specific security. Tools like adversarial training and robust data validation can prevent common attack vectors.  
• Adopt ethical AI frameworks. Promoting fairness and inclusivity in AI systems builds trust and mitigates reputational risks.  
• Future-proof AI systems. Continuous monitoring, adaptive governance and upskilling talent ensure resilience against evolving challenges.  

Key AI security concepts 

Review critical AI security terms, their definitions, relevance and interrelationships around AI governance and resilience. Understanding these foundational concepts helps organizations build secure, ethical and scalable AI that aligns with business goals and regulatory requirements.  

The following provides a quick overview of interrelationships among these terms and an overall ecosystem impact: 

• Dependencies. Adversarial attacks, data poisoning and generative AI risks exploit data governance and security gaps.    
• Complementary solutions. Explainable AI and federated learning address transparency and privacy concerns.  
• Audits. Bias audits and adversarial training improve reliability.  
• Holistic approach. Establishes the foundation for secure, ethical and scalable AI systems, enabling organizations to mitigate risks.  

Addressing these key areas can help organizations create resilient AI frameworks that balance security, ethics and efficiency.  

Drivers, challenges and strategic importance   

AI has become a fundamental driver of business transformation, allowing organizations to enhance efficiency, refine decision-making and create personalized customer experiences. However, AI adoption also presents complex challenges, including security vulnerabilities, ethical concerns and regulatory compliance. Understanding these drivers, challenges and the strategic importance of AI security is essential for organizations aiming to maximize AI’s potential while mitigating risks. 

Drivers   

Organizations across industries are using AI to drive business innovation and operational efficiency. Several key factors contribute to the widespread adoption of AI: 

• Business transformation. AI improves workflows, enhances decision-making and delivers hyper-personalized customer experience.  
  • Healthcare. AI-driven diagnostics improve accuracy and early disease detection.  
  • Finance. AI-powered fraud detection prevents financial losses in real-time.  
  • Retail. Recommendation engines personalize shopping experiences, boosting sales.  
• Regulatory compliance. Governments are mandating stricter AI governance to ensure transparency and fairness.  
  • EU AI Act. Requires explainability and imposes penalties for non-compliance.  
  • US NIST AI Framework. Defines security best practices for AI deployment.  
• Stakeholder trust. Ethical AI adoption fosters customer, employee and partner trust.  
  • Transparent AI models reassure stakeholders about fairness in decision-making.  
  • Inclusive AI reduces bias, promoting fair access to services.  

Challenges   

Despite its benefits, AI adoption introduces a range of challenges that require initiative-taking risk management:  

• Cybersecurity threats. AI systems are uniquely vulnerable to advanced cyberattacks. 
  • Adversarial attacks. Attackers manipulate AI inputs to produce incorrect outputs. 
  • Model theft. AI intellectual property can be stolen and exploited. 
• Data governance gaps. Poor data management can lead to compromised AI integrity.  
  • Data poisoning. Corrupt training data leads to inaccurate AI predictions.  
  • Lack of data lineage. Inconsistent data tracking hinders compliance. 
• Algorithmic bias. Biased training datasets can perpetuate systemic discrimination. 
• Operational inefficiencies. AI models still require ongoing maintenance to be effective. 
  • Model drift. AI models lose accuracy over time due to changing data patterns. 
  • Generative AI hallucinations. AI-generated outputs can become unreliable.  
• Shadow AI. Unauthorized AI deployments outside IT governance create security and compliance risks.  

Strategic importance 

To maximize AI’s potential while mitigating risks, organizations must integrate AI security and governance into their long-term strategies:  

• Protecting operational integrity. Proactively addressing AI vulnerabilities ensures uninterrupted business operations and safeguards performance.  
• Ensuring ethical practices. Adopting fairness, accountability and transparency in AI systems builds stakeholder confidence and regulatory alignment.  
• Fostering innovation. Effectively managing AI risks allows organizations to use AI as a competitive advantage while driving sustainable growth.  

By addressing these drivers and challenges, organizations can strategically position themselves to unlock AI’s full potential, ensure long-term resilience and foster a secure and ethical AI ecosystem.  

Fortifying AI frontiers across the lifecycle 

Securing AI requires a lifecycle approach that addresses risks from data collection to deployment and ongoing monitoring. Without robust security, governance and risk mitigation, AI systems can be exploited through adversarial attacks, data manipulation and ethical breaches. To ensure secure, transparent and compliant AI, organizations should adopt three foundational strategies: 

• Governance. Implement AI-specific risk frameworks such as the NIST AI Risk Management Framework and enhance transparency with Explainable AI (XAI) for regulatory compliance.  
• Continuous monitoring. Deploy real-time threat detection and model drift monitoring to proactively manage vulnerabilities and prevent AI degradation.  
• Collaborative ecosystems. Align IT, compliance, cybersecurity and business teams to enforce AI governance and ensure security and ethical integrity.  

By securing AI at every stage of its lifecycle, organizations can fortify AI innovation while mitigating security risks, supporting compliance and sustaining business trust. The following table provides a quick overview of artificial intelligence lifecycle stages:  

4 critical AI security strategies 

1. Adversarial training: Strengthening AI against manipulations  

Adversarial training fortifies AI models by exposing them to simulated attacks, making them more resilient against data manipulation, cyber threats and fraud. A global logistics firm implemented adversarial training in its route optimization AI, reducing disruptions from data tampering by 25%. This method enhances AI’s ability to detect malicious inputs and prevent exploitation in fraud detection, image recognition and autonomous decision-making.  

2. Explainable AI (XAI): Enhancing transparency and trust  

XAI clarifies AI-driven decision-making, helping businesses build trust, reduce bias and meet regulatory requirements. A healthcare provider leveraged XAI tools to make its AI-driven diagnostic recommendations more transparent, improving physician confidence by 30%. In regulated industries like finance, healthcare and insurance, XAI supports auditability, compliance and ethical AI. 

3. Secure data pipelines: Protecting AI from data tampering  

Ensuring data integrity is critical for AI reliability. Secure data pipelines safeguard AI models from data poisoning, unauthorized access and compliance violations through encryption, access controls and anomaly detection. Businesses can maintain accuracy and regulatory compliance by ensuring that only confirmed, unbiased and tamper-proof data is fed into AI models. 

4. Real-time monitoring: Detecting and mitigating AI risks  

AI systems require continuous oversight to detect anomalies, performance drift and emerging cyber threats. A financial institution implemented real-time AI monitoring for its credit scoring system, reducing fraud-related losses by 20% and ensuring ongoing model accuracy. Continuous monitoring solutions help find vulnerabilities 85% faster, ensuring that AI stays stable, secure and aligned with business aims.  

The path forward 

 Organizations must integrate adversarial defense, explainability, secure data management and real-time risk monitoring into their AI strategies to fortify AI security. These measures safeguard AI integrity, enhance compliance and build stakeholder trust. Proactively addressing AI risks through strategic governance and security frameworks allows businesses to drive innovation while ensuring ethical responsibility and long-term sustainability. By adopting these strategies, organizations can strengthen AI security, support transparency and uphold compliance while refining efficiency and reinforcing stakeholder confidence. 

The competitive AI landscape 

The rapid adoption of AI has created a thriving ecosystem of vendors offering innovative solutions for securing AI systems, managing governance and ensuring ethical compliance. Understanding these players’ strengths and limitations is essential for informed decision-making in technology investments. 

Microsoft Azure AI 

Microsoft Azure AI provides a robust AI ecosystem that integrates Microsoft’s cloud and enterprise solutions. Prebuilt security frameworks like Azure AI Defender and Azure Sentinel are ideal for regulated industries such as finance and healthcare. While scalable and compliant, its prohibitive cost and complexity can hinder smaller organizations. Gartner ranks Azure AI among the top three enterprise AI security solutions.  

Google Cloud AI  

Google Cloud AI specializes in AI governance, security and explainability (XAI), making it an excellent choice for enterprises requiring transparent and compliant AI. Its XAI tools support regulatory adherence in healthcare and finance, though limited customization and premium pricing may be drawbacks.   

AWS AI  

Amazon Web Services (AWS) AI offers comprehensive AI security and scalability, with AWS Sage Maker widely used for secure model training and deployment. Its global infrastructure supports large-scale enterprises, but excessive costs and third-party integration challenges may hinder smaller firms.   

Darktrace  

Darktrace is a leader in AI-powered cybersecurity, offering real-time anomaly detection and autonomous threat mitigation. Its self-learning AI models adapt to evolving threats, making it essential for enterprises requiring continuous security monitoring. However, inflated costs and complex deployment may limit adoption for smaller businesses.   

These vendors shape AI security’s future, offering specialized solutions in threat detection, explainability and data integrity. As AI adoption accelerates, their technologies will be key to ensuring secure, compliant and ethical AI deployment.  

Market trends and strategic implications  

The AI security market is experiencing rapid growth and is projected to expand at a 28% CAGR, reaching $50 billion by 2030. North America currently leads with a 45% market share, followed by Europe and the Asia-Pacific region, reflecting a global emphasis on AI security. This growth is driven by increasing regulatory compliance mandates, the evolving sophistication of AI-related threats and a rising focus on ethical AI practices. Organizations across industries recognize the need to implement robust security frameworks that address adversarial attacks, data governance challenges and algorithmic bias to ensure AI systems stay secure and trustworthy.  

Future focus  

AI security is evolving rapidly, with innovative technologies and frameworks shaping the future landscape. Organizations must expect emerging trends to still be competitive and resilient.  

• AI-driven threat intelligence transforms cybersecurity by enabling real-time detection and mitigation of sophisticated threats. AI-powered systems analyze vast data streams to find anomalies, predict cyberattacks and neutralize risks before they escalate. Darktrace employs AI for anomaly detection, reducing breach risks by 40% and reinforcing AI’s role in initiative-taking security management. 
• Regulatory frameworks for AI governance are becoming increasingly stringent. The EU AI Act mandates transparency and accountability, with substantial penalties for non-compliance. Organizations that invest early in compliance frameworks gain a competitive advantage, regulatory readiness and stronger stakeholder trust, ensuring AI deployments stay ethical, secure and aligned with legal requirements.  

Conclusion  

AI systems are driving unparalleled innovation and operational efficiency across industries. However, securing these systems against technical, ethical and regulatory challenges requires a holistic, forward-looking approach. Organizations can adopt the right strategies to ensure their AI frontiers, foster stakeholder trust and sustain growth in an increasingly AI-powered world.  

Vipin Jain, founder and chief architect of Transformation Enablers Inc., brings over 30 years of experience crafting execution-ready IT strategies and transformation roadmaps aligned with business goals while leveraging emerging technologies like AI. He has held executive roles at AIG, Merrill Lynch and Citicorp, where he led business and IT portfolio transformations. Vipin also led consulting practices at Accenture, Microsoft and HPE, advising Fortune 100 firms and U.S. federal agencies. He is currently a senior advisor at WVE. 

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects. 

Artificial intelligence (AI)-enabled systems are driving a new era of business transformation, revolutionizing industries through prescriptive analytics, personalized customer experiences and process automation. From manufacturing to healthcare and finance to defense, AI enhances efficiency, decision-making and operational agility, providing organizations a competitive edge in an increasingly data-driven world. Its processing of vast datasets enables supply chain precision, life-saving diagnostics and hyper-personalized consumer interactions, fostering scalability and innovation. 

However, as AI adoption accelerates, organizations face rising threats from adversarial attacks, data poisoning, algorithmic bias and regulatory uncertainties. Without robust security and governance frameworks, unsecured AI systems can erode stakeholder trust, disrupt operations and expose businesses to compliance and reputational risks. 

Senior executives are challenged with securing AI, aligning initiatives with governance frameworks and fortifying business resilience. Organizations can unlock AI’s full potential by proactively addressing security, ethics and operational challenges while ensuring transparency, reliability and long-term sustainability. 

The risks of unsecured AI 

Unlike traditional IT systems, AI is uniquely susceptible to novel attack vectors such as:  

• Adversarial attacks. Subtle input data manipulations can cause AI systems to make incorrect decisions, jeopardizing their reliability.  
• Data poisoning. Compromised datasets used in training AI models can degrade system accuracy.  
• Generative AI risks. Issues like hallucinations and malicious prompt injections threaten enterprises reliant on AI-generated content.  

Ethics and governance in AI  

AI also challenges organizations to address algorithmic bias, transparency and accountability issues. Regulatory frameworks like the EU AI Act and NIST AI Risk Management Framework are shaping expectations around responsible AI deployment.   

Balancing security, ethics and strategic investments 

Securing AI systems requires a balanced approach that integrates technical rigor with strategic foresight: 

• Invest in AI-specific security. Tools like adversarial training and robust data validation can prevent common attack vectors.  
• Adopt ethical AI frameworks. Promoting fairness and inclusivity in AI systems builds trust and mitigates reputational risks.  
• Future-proof AI systems. Continuous monitoring, adaptive governance and upskilling talent ensure resilience against evolving challenges.  

Key AI security concepts 

Review critical AI security terms, their definitions, relevance and interrelationships around AI governance and resilience. Understanding these foundational concepts helps organizations build secure, ethical and scalable AI that aligns with business goals and regulatory requirements.  

The following provides a quick overview of interrelationships among these terms and an overall ecosystem impact: 

• Dependencies. Adversarial attacks, data poisoning and generative AI risks exploit data governance and security gaps.    
• Complementary solutions. Explainable AI and federated learning address transparency and privacy concerns.  
• Audits. Bias audits and adversarial training improve reliability.  
• Holistic approach. Establishes the foundation for secure, ethical and scalable AI systems, enabling organizations to mitigate risks.  

Addressing these key areas can help organizations create resilient AI frameworks that balance security, ethics and efficiency.  

Drivers, challenges and strategic importance   

AI has become a fundamental driver of business transformation, allowing organizations to enhance efficiency, refine decision-making and create personalized customer experiences. However, AI adoption also presents complex challenges, including security vulnerabilities, ethical concerns and regulatory compliance. Understanding these drivers, challenges and the strategic importance of AI security is essential for organizations aiming to maximize AI’s potential while mitigating risks. 

Drivers   

Organizations across industries are using AI to drive business innovation and operational efficiency. Several key factors contribute to the widespread adoption of AI: 

• Business transformation. AI improves workflows, enhances decision-making and delivers hyper-personalized customer experience.  
  • Healthcare. AI-driven diagnostics improve accuracy and early disease detection.  
  • Finance. AI-powered fraud detection prevents financial losses in real-time.  
  • Retail. Recommendation engines personalize shopping experiences, boosting sales.  
• Regulatory compliance. Governments are mandating stricter AI governance to ensure transparency and fairness.  
  • EU AI Act. Requires explainability and imposes penalties for non-compliance.  
  • US NIST AI Framework. Defines security best practices for AI deployment.  
• Stakeholder trust. Ethical AI adoption fosters customer, employee and partner trust.  
  • Transparent AI models reassure stakeholders about fairness in decision-making.  
  • Inclusive AI reduces bias, promoting fair access to services.  

Challenges   

Despite its benefits, AI adoption introduces a range of challenges that require initiative-taking risk management:  

• Cybersecurity threats. AI systems are uniquely vulnerable to advanced cyberattacks. 
  • Adversarial attacks. Attackers manipulate AI inputs to produce incorrect outputs. 
  • Model theft. AI intellectual property can be stolen and exploited. 
• Data governance gaps. Poor data management can lead to compromised AI integrity.  
  • Data poisoning. Corrupt training data leads to inaccurate AI predictions.  
  • Lack of data lineage. Inconsistent data tracking hinders compliance. 
• Algorithmic bias. Biased training datasets can perpetuate systemic discrimination. 
• Operational inefficiencies. AI models still require ongoing maintenance to be effective. 
  • Model drift. AI models lose accuracy over time due to changing data patterns. 
  • Generative AI hallucinations. AI-generated outputs can become unreliable.  
• Shadow AI. Unauthorized AI deployments outside IT governance create security and compliance risks.  

Strategic importance 

To maximize AI’s potential while mitigating risks, organizations must integrate AI security and governance into their long-term strategies:  

• Protecting operational integrity. Proactively addressing AI vulnerabilities ensures uninterrupted business operations and safeguards performance.  
• Ensuring ethical practices. Adopting fairness, accountability and transparency in AI systems builds stakeholder confidence and regulatory alignment.  
• Fostering innovation. Effectively managing AI risks allows organizations to use AI as a competitive advantage while driving sustainable growth.  

By addressing these drivers and challenges, organizations can strategically position themselves to unlock AI’s full potential, ensure long-term resilience and foster a secure and ethical AI ecosystem.  

Fortifying AI frontiers across the lifecycle 

Securing AI requires a lifecycle approach that addresses risks from data collection to deployment and ongoing monitoring. Without robust security, governance and risk mitigation, AI systems can be exploited through adversarial attacks, data manipulation and ethical breaches. To ensure secure, transparent and compliant AI, organizations should adopt three foundational strategies: 

• Governance. Implement AI-specific risk frameworks such as the NIST AI Risk Management Framework and enhance transparency with Explainable AI (XAI) for regulatory compliance.  
• Continuous monitoring. Deploy real-time threat detection and model drift monitoring to proactively manage vulnerabilities and prevent AI degradation.  
• Collaborative ecosystems. Align IT, compliance, cybersecurity and business teams to enforce AI governance and ensure security and ethical integrity.  

By securing AI at every stage of its lifecycle, organizations can fortify AI innovation while mitigating security risks, supporting compliance and sustaining business trust. The following table provides a quick overview of artificial intelligence lifecycle stages:  

4 critical AI security strategies 

1. Adversarial training: Strengthening AI against manipulations  

Adversarial training fortifies AI models by exposing them to simulated attacks, making them more resilient against data manipulation, cyber threats and fraud. A global logistics firm implemented adversarial training in its route optimization AI, reducing disruptions from data tampering by 25%. This method enhances AI’s ability to detect malicious inputs and prevent exploitation in fraud detection, image recognition and autonomous decision-making.  

2. Explainable AI (XAI): Enhancing transparency and trust  

XAI clarifies AI-driven decision-making, helping businesses build trust, reduce bias and meet regulatory requirements. A healthcare provider leveraged XAI tools to make its AI-driven diagnostic recommendations more transparent, improving physician confidence by 30%. In regulated industries like finance, healthcare and insurance, XAI supports auditability, compliance and ethical AI. 

3. Secure data pipelines: Protecting AI from data tampering  

Ensuring data integrity is critical for AI reliability. Secure data pipelines safeguard AI models from data poisoning, unauthorized access and compliance violations through encryption, access controls and anomaly detection. Businesses can maintain accuracy and regulatory compliance by ensuring that only confirmed, unbiased and tamper-proof data is fed into AI models. 

4. Real-time monitoring: Detecting and mitigating AI risks  

AI systems require continuous oversight to detect anomalies, performance drift and emerging cyber threats. A financial institution implemented real-time AI monitoring for its credit scoring system, reducing fraud-related losses by 20% and ensuring ongoing model accuracy. Continuous monitoring solutions help find vulnerabilities 85% faster, ensuring that AI stays stable, secure and aligned with business aims.  

The path forward 

 Organizations must integrate adversarial defense, explainability, secure data management and real-time risk monitoring into their AI strategies to fortify AI security. These measures safeguard AI integrity, enhance compliance and build stakeholder trust. Proactively addressing AI risks through strategic governance and security frameworks allows businesses to drive innovation while ensuring ethical responsibility and long-term sustainability. By adopting these strategies, organizations can strengthen AI security, support transparency and uphold compliance while refining efficiency and reinforcing stakeholder confidence. 

The competitive AI landscape 

The rapid adoption of AI has created a thriving ecosystem of vendors offering innovative solutions for securing AI systems, managing governance and ensuring ethical compliance. Understanding these players’ strengths and limitations is essential for informed decision-making in technology investments. 

Microsoft Azure AI 

Microsoft Azure AI provides a robust AI ecosystem that integrates Microsoft’s cloud and enterprise solutions. Prebuilt security frameworks like Azure AI Defender and Azure Sentinel are ideal for regulated industries such as finance and healthcare. While scalable and compliant, its prohibitive cost and complexity can hinder smaller organizations. Gartner ranks Azure AI among the top three enterprise AI security solutions.  

Google Cloud AI  

Google Cloud AI specializes in AI governance, security and explainability (XAI), making it an excellent choice for enterprises requiring transparent and compliant AI. Its XAI tools support regulatory adherence in healthcare and finance, though limited customization and premium pricing may be drawbacks.   

AWS AI  

Amazon Web Services (AWS) AI offers comprehensive AI security and scalability, with AWS Sage Maker widely used for secure model training and deployment. Its global infrastructure supports large-scale enterprises, but excessive costs and third-party integration challenges may hinder smaller firms.   

Darktrace  

Darktrace is a leader in AI-powered cybersecurity, offering real-time anomaly detection and autonomous threat mitigation. Its self-learning AI models adapt to evolving threats, making it essential for enterprises requiring continuous security monitoring. However, inflated costs and complex deployment may limit adoption for smaller businesses.   

These vendors shape AI security’s future, offering specialized solutions in threat detection, explainability and data integrity. As AI adoption accelerates, their technologies will be key to ensuring secure, compliant and ethical AI deployment.  

Market trends and strategic implications  

The AI security market is experiencing rapid growth and is projected to expand at a 28% CAGR, reaching $50 billion by 2030. North America currently leads with a 45% market share, followed by Europe and the Asia-Pacific region, reflecting a global emphasis on AI security. This growth is driven by increasing regulatory compliance mandates, the evolving sophistication of AI-related threats and a rising focus on ethical AI practices. Organizations across industries recognize the need to implement robust security frameworks that address adversarial attacks, data governance challenges and algorithmic bias to ensure AI systems stay secure and trustworthy.  

Future focus  

AI security is evolving rapidly, with innovative technologies and frameworks shaping the future landscape. Organizations must expect emerging trends to still be competitive and resilient.  

• AI-driven threat intelligence transforms cybersecurity by enabling real-time detection and mitigation of sophisticated threats. AI-powered systems analyze vast data streams to find anomalies, predict cyberattacks and neutralize risks before they escalate. Darktrace employs AI for anomaly detection, reducing breach risks by 40% and reinforcing AI’s role in initiative-taking security management. 
• Regulatory frameworks for AI governance are becoming increasingly stringent. The EU AI Act mandates transparency and accountability, with substantial penalties for non-compliance. Organizations that invest early in compliance frameworks gain a competitive advantage, regulatory readiness and stronger stakeholder trust, ensuring AI deployments stay ethical, secure and aligned with legal requirements.  

Conclusion  

AI systems are driving unparalleled innovation and operational efficiency across industries. However, securing these systems against technical, ethical and regulatory challenges requires a holistic, forward-looking approach. Organizations can adopt the right strategies to ensure their AI frontiers, foster stakeholder trust and sustain growth in an increasingly AI-powered world.  

Vipin Jain, founder and chief architect of Transformation Enablers Inc., brings over 30 years of experience crafting execution-ready IT strategies and transformation roadmaps aligned with business goals while leveraging emerging technologies like AI. He has held executive roles at AIG, Merrill Lynch and Citicorp, where he led business and IT portfolio transformations. Vipin also led consulting practices at Accenture, Microsoft and HPE, advising Fortune 100 firms and U.S. federal agencies. He is currently a senior advisor at WVE. 

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects. 

In the ever-changing landscape of digital threats, artificial intelligence (AI) has emerged as both a formidable ally and a dangerous adversary. As we navigate the complexities of our interconnected world, it’s becoming increasingly clear that AI is not just a tool, but a force that’s reshaping the very nature of cybersecurity.  

The cybersecurity world has changed dramatically. Gone are the days when simple firewalls and antivirus software could keep our digital assets safe. Today, we’re dealing with sophisticated threat actors who are leveraging AI to launch attacks at unprecedented scale and speed. For instance, in 2024, a troubling trend emerged where hackers used AI-powered tools to create highly convincing deepfakes, impersonating CEOs and other C-suite executives in 75% of such attacks.  

At Synechron, we are prioritizing diligence through our payment process to ensure that we have appropriate approval authority including out of band validation of mid-large money transfers. As a secondary measure, we are now evaluating a few deepfake detection tools that can be integrated into our business productivity apps, in particular for Zoom or Teams, to continuously detect deepfakes. 

Using AI in cybersecurity is like trying to play chess against a supercomputer — the game is familiar, but the opponent’s capabilities are on a whole new level. Luckily, we also have access to the supercomputer. 

The AI advantage 

How exactly is AI tipping the scales in favor of cybersecurity professionals? For starters, it’s revolutionizing threat detection and response. AI systems can analyze vast amounts of data in real time, identifying potential threats with speed and accuracy. Companies like CrowdStrike have documented that their AI-driven systems can detect threats in under one second.  

But AI’s capabilities don’t stop at detection. When it comes to incident response, AI is proving to be a game-changer. Imagine a security system that doesn’t just alert you to a threat but takes immediate action to neutralize it. That’s the potential of AI-driven automated incident response. From isolating compromised systems to blocking malicious IP addresses, AI can execute these critical tasks swiftly and without human input, dramatically reducing response times and minimizing potential damage. 

Perhaps one of the most anticipated applications of AI in cybersecurity is in the realm of behavioral analytics and predictive analysis. By leveraging machine learning algorithms, AI can analyze user behavior and network traffic patterns, identifying anomalies that might indicate insider threats or other malicious activities. These AI-driven insider threat behavioral analytics systems have been shown to detect 60% of malicious insiders under a 0.1% investigation budget and achieve full detection within a 5% budget in certain cases.  

The dark side of AI  

However, as with any powerful tool, AI is a double-edged sword. While it’s enhancing our defensive capabilities, it’s also being weaponized by cybercriminals to launch more sophisticated attacks. These AI-powered cyber-attacks are no longer a potential threat — they’re a very real and present danger. 

For example, attackers recently used AI to pose as representatives of an insurance company. The email informed the recipient about benefits enrollment and included a form that needed to be completed urgently to avoid losing coverage and attempting to fool the receiver. AI can craft phishing emails like these, which are so convincing that even the most security-conscious user might fall for it. It can even create custom malware that can adapt and evolve to evade detection. These are the kinds of attacks that AI-enabled cybercriminals are now capable of producing. We’ve ended up in a cat-and-mouse game where both sides are constantly upping the ante. 

The challenges don’t end there. As we increasingly rely on AI for our cybersecurity needs, we open these new AI tools to new vulnerabilities. Data poisoning and model manipulation are emerging as serious concerns for those of us in cybersecurity. Attackers can potentially tamper with the data used to train AI models, causing them to malfunction or make erroneous decisions.  

There’s also the risk of over-reliance on the new systems. While AI is undoubtedly powerful, it’s not infallible. Becoming too dependent on AI for cybersecurity could lead to complacency and a false sense of security. We must remember that AI is a tool to augment human expertise, not replace it entirely. 

The human factor  

AI is not just changing the skill set required for cybersecurity professionals, it’s augmenting it for the better. The ability to work alongside AI systems, interpret their outputs, and make strategic decisions based on AI-generated insights will be paramount for both users and experts.  While AI is improving at its cybersecurity capabilities, a human paired with an AI tool will outperform AI by itself ten-fold.  

Our cyber team at Synechron plans to build and deploy our own AI accelerators as well as leverage Microsoft’s security co-pilot capabilities to augment our detection and security investigation of possible threats. However, this approach also requires human interaction to validate any findings or recommendations from AI to prioritize the remediations or responses that are required based on the criticality of the asset. In other words, humans are still required to interpret any business contextual information that AI might miss. This miss should not be understated as any discrepancy or incorrect analysis from AI could lead to detrimental loss or compromise. In addition, humans can also adapt to business contexts, and interpret changes or perceptions of potential loss or impact better than AI as AI is specifically programmed to achieve programmed outcomes. 

As AI becomes more prevalent across organizations, there’s a growing need for a better understanding of data dependencies and asset management. Cybersecurity teams will need to reevaluate the relative importance of data assets, update inventories, and account for new threats and risks these AI systems might bring to their organizations.  

The promise AI brings  

Despite these challenges, the potential of AI in cybersecurity is truly exciting. Unlike traditional security solutions that can only rely on predefined rules, AI can learn from its environment and evolve its security protocols accordingly. And it’s this adaptability that will be crucial in a landscape where new threats are constantly emerging due to the very tools that are helping prevent them. 

Looking ahead, the integration of AI with other emerging technologies like quantum computing or blockchain could lead to even more comprehensive security solutions. Picture a cybersecurity system that combines the processing power of quantum computing, the immutability of blockchain, and the adaptive intelligence of AI. This combination can create a highly robust defense system the likes of which we have not seen before.  

The road ahead 

As we look toward the future, it’s clear that AI will continue to play an increasingly central role in cybersecurity. In fact, 87% of IT professionals anticipate AI-generated threats will continue to impact their organizations for years to come, underscoring the need for continued innovation and vigilance. The key with AI will be striking the right balance — leveraging its strengths while mitigating the risks and limitations. It’s a challenge, certainly, but also an opportunity to build a safer, more secure digital world.    

We need to invest in developing more robust and secure AI systems, ones that are resistant to manipulation and capable of explaining their decision-making processes. At the same time, we must continue to nurture human expertise, fostering a symbiotic relationship between human intuition and machine intelligence. 

As we stand at this technological crossroads, one thing is clear: In the ongoing battle against cyber threats, AI is not just a tool — it’s the future of the entire battlefield.  

As the Global CISO at Synechron, a leading global digital transformation consulting firm, Aaron Momin is accountable and responsible for cyber risk management, information security, crisis management and business continuity planning. Aaron has 30 years of experience in managing cyber and technology risk, improving security maturity and integrating privacy for global organizations. He is a certified CISO, CISM and CRISC. 

OpenAI is setting up a new governance body to oversee the safety and security of its AI models, as it embarks on the development of a successor to GPT-4.

The first task for the OpenAI Board’s new Safety and Security Committee will be to evaluate the processes and safeguards around how the company develops future models.

As an aside, the company said in the blog post announcing the committee’s creation that it “has recently begun training its next frontier model”  and that it anticipates that the resulting systems will “bring us to the next level of capabilities on our path to AGI,” or artificial general intelligence — an AI system whose capabilities match or exceed the human brain in a wide range of tasks.

OpenAI’s creation of a new safety committee at board level follows a string of departures and bad publicity around the company’s attitude to safety, including the dispersal of a “superalignment” team focused on long-term risks led by ex-chief-scientist Ilya Sutskever, who left the company two weeks ago. Sutskever’s departure was followed by that of Jan Leike, who co-led the superalignment team.

The committee will be led by OpenAI CEO Sam Altman, OpenAI chairman Bret Taylor, and fellow board members Adam D’Angelo, Nicole Seligman. Other members will include the OpenAI Head of Preparedness Aleksander Madry, Head of Safety Systems Lilian Weng, Head of Alignment Science John Schulman, Head of Security Matt Knight, and Sutskever’s successor as chief scientist, Jakub Pachocki.

Its first task will be to evaluate how the company is handling AI risks in its development of AI models. In 90 days, it will share its recommendations with the full board of directors. The company said it may later reveal any adopted recommendations “in a manner that is consistent with safety and security.”

With the committee, OpenAI signals that it recognizes the continued concerns the industry and the general public have about AI, and is taking steps internally to monitor itself even as it aims to stay ahead of competitors.

“While we are proud to build and release models that are industry-leading on both capabilities and safety, we welcome a robust debate at this important moment,” it said in the blog post.

Pressure mounts on OpenAI

OpenAI’s unveiling of progress on its next version of GPT is a natural progression for the company as it aims to protect its market lead even as competition heat ups. xAI, the company founded by Tesla leader Elon Musk, recently announced a $6 billion fundraising effort with a $24 billion valuation as Musk aims to challenge the startup he once championed on AI and AGI. Meanwhile, Musk and OpenAI remain embroiled in a heated legal dispute.

OpenAI also faced controversy recently when it released a virtual assistant with a voice that some said sounded eerily similar to that of Hollywood actress Scarlett Johannson, even though she did not consent to the company using her voice when asked for her permission several times. Johannson famously voiced an AI system with whom a character played by Joaquim Phoenix falls in love in the 2013 film “Her.”

“As the usage of generative AI increases, associated risks, and security concerns are emerging,” observed Pareekh Jain, CEO of EIIRTrend & Pareekh Consulting. “The Scarlett Johansson incident has heightened OpenAI’s awareness of these risks.”

Securing AI can bolster its adoption

AI security also remains a priority for AI stakeholders at large, with various initiatives being formed at both the government and corporate levels to try to set guidelines for the future development of the technology before it evolves beyond human control.

Just last week, 16 big users and creators of AI, including OpenAI as well as its top competitors Google, Amazon, Meta and xAI as well as frenemy Microsoft, signed up to the Frontier AI Safety Commitments, a new set of safety guidelines and development outcomes for the technology.

Demonstrating that AI is secure is essential to companies like OpenAI whose business depend on its widespread adoption. That’s because one of the largest challenges in enterprise and consumer perception of AGI relates to security, according to Jain. This perception “is often influenced by scenarios depicted in science fiction movies,” he said. “Therefore, it is essential to integrate security measures, risk management, and ethical considerations from the design stage, rather than as an afterthought.”

He’s not alone in that believe. Nicole Carignan, vice president of strategic cyber AI at cybersecurity firm Darktrace, said, “The risk AI poses is often in the way it is adopted,” and it’s important to encourage AI leaders to promote its responsible, safe, and secure use. “Broader commitments to AI safety will allow us to move even faster to realize the many opportunities and benefits of AI,” she said.