Why CISOs must cultivate a cyber-secure workforce in the age of AI

Threat evaluation must be supported by an effective operational system that can evolve to cope with what are essentially “living” AI solutions and data sets by ensuring continuous data verification, classification and scoping, including tagging sensitivity and data criticality. Some companies have as little as 20% of their data tagged or classified, our research has found. Realistically, companies should prioritize tagging and verification for their most critical and sensitive data to ensure they have the right safeguards for issues like identity, access management, data flow, data access and lineage.

Threat modeling and access are critical to implementing an effective cybersecurity governance model, but organizations must be cognizant of the risk of falling into old and ineffective response mechanisms. One approach is to place an AI expert on the board for a six-month rotation with the power to devise a new governance model, including a focus on education and training. Accountability is also required to ensure responsibility for AI governance is apportioned appropriately covering custody, ownership and use.

For AI, a cyber-informed workforce to combat employee error

While exotic AI hacking attempts like deepfake CFO bank transfer requests dominate the headlines, employee error remains the most prominent vulnerability for most organizations. AI and cybersecurity are a new threat vector, requiring controls that prevent unauthorized personnel from intentionally or unintentionally acquiring sensitive information that they may not previously have had access to or interaction with. Indeed, the entire promise of AI is giving employees the chance to query and extract value from more data than before. That can only be delivered if cyber guidance is equally easy for them to obtain.

One common trait of the successful companies analyzed in our 2023 Global Cybersecurity Leadership Insights Study, dubbed “Secure Creators,” was the integration of cybersecurity to all levels of the organization, from the C-suite to the workforce at large. Only half of cybersecurity leaders overall said their cyber training is effective. Can AI itself deliver more effective cyber communication approaches and give employees the support they seek?

More sophisticated and intuitive chatbots, for example, could advise on employee questions about sensitive or restricted data, in turn reducing the burnout on cyber teams attending to queries and the frustration of employees wading through lengthy and complex policy documents. Implementing control mechanisms and easy querying can reduce shadow IT risks like dropping sensitive data, IP, or restricted material into AI models.

For instance, Chief Data Officers (CDOs) have tended to focus on harnessing data for business value, with less integration to the technology function and even weaker intersection with the cyber unit and CISOs. That needs to change in the AI era, when a cybersecurity lens is needed through the data management life cycle as more data becomes usable in the business. CDOs must focus more on data governance, quality and privacy and a broader range of skills is now required in the cybersecurity executive team as a whole.

The breadth of skills needed in today’s function is expanding in several directions at once. Here, we outline some of the many cybersecurity executive profiles that have emerged in recent years. The best approach is to build a team that balances a combination of broad disciplines, with the understanding that each has its own strengths and weaknesses.

At the institutional level, Centers of Excellence (CoEs) may become a requirement to coordinate AI adoption across business units and teams. These have a long precedent in the technology sector and are becoming more common in risk-aware industries like financial services. They can streamline and simplify governance requirements, mitigating the shadow IT phenomenon. “Design patterning” could further encourage secure and responsible AI by streamlining processes, architectures and data flows to permit faster deployment with minimal, though not zero, friction.

Key takeaways for CISOs:

• The workforce is anxious about cyber risk in the AI era and needs greater support.
  The most cyber-secure companies achieve a high degree of integration across the enterprise. AI itself could improve the quality and relevance of training and advice. Further, it could make cybersecurity policies and procedures easier to understand and access, such as via intuitive chatbots for querying cyber policies, or gamified learning. It can also support the development of more sophisticated control mechanisms, reducing the shadow IT phenomena. CISOs will now play a crucial role in engaging senior leadership before the shadow AI risk grows unmanageable.

• Threat modeling and evaluation must be comprehensive and continuous.
  In the AI era, the threat landscape is widening to include the many third and fourth-party AI services in the supply chain. Organizations must identify AI solutions and assets to understand risk and compliance exposures. Companies need to evaluate architecture, services and integrations/APIs to quantify and spot risks and guide the development of controls to manage widespread AI usage. They must also invest in robust data classification to ensure AI models do not access and process restricted data and sensitive intellectual property. This modeling needs to be continuous as AI solutions continually target new and under-utilized data sets.

• Centers of Excellence can provide strategic oversight and institutional coordination for the secure deployment of AI.
  CoEs can play an important role in upholding good governance and best practices for AI-inclined organizations, including through skill sharing and the development of consistent protocols. They enable centralized governance and monitoring and support a consistent approach to AI use, offering better contextualization of AI use cases and improved understanding of enterprise data assets. More broadly, companies should consider organizational re-design, new reporting lines and adapted processes to allow reasonable levels of adoption without cyber risk becoming an issue to be worked through on a case-by-case basis.