The security community — along with its collaborators in fields such as risk, audit and governance — is actively grappling with the implications of generative artificial intelligence (AI). A recent ISACA survey on AI found that the majority of organizations do not provide training on the authorized use of generative AI, and three out of 10 organizations have established policies governing the use of AI technology. It is undeniable that AI poses substantive risks to enterprises, including security and privacy risks, but it is important to understand which threats are most serious and which are likely drawing too much attention. This will help enterprise leaders decide which measures can be implemented to guide their organizations to responsibly navigate this rapidly evolving landscape.

As someone who was part of the healthcare industry during a time when the idea of transitioning to cloud platforms caused significant apprehension, I can draw parallels to the current concerns surrounding AI adoption in the corporate world. Looking back, many of the anxieties related to the cloud turned out to be somewhat overstated. At a high level, the concerns regarding cloud computing were security, data privacy, compliance, access and legal issues. Today, cloud platforms are a common fixture across the corporate landscape, demonstrating their effectiveness and security. Just as the shift from traditional on-premises security to cloud-based security necessitated security professionals to adapt their expertise, the rapid adoption of generative AI presents a great opportunity for security professionals to pivot. By investing in AI training and providing teams with the necessary tools, security professionals can harness the power of AI to enhance their capabilities and address the associated risks effectively.