Report claims AI recommends risky security measures, so maybe you shouldn’t give up full control of your systems just yet
follow us
Add us as a preferred source on Google
- Report Says AI Is Being Given Too Much Authority and Autonomy to Handle Business-Critical Security Decisions
- 70% of organizations delegate decisions to AI that a human would have made 12 months ago
- There is a “control gap” between the authority given to AI and an organization’s ability to audit it.
Delegating complicated decisions to AI is leading organizations to put relatively new technology in charge of user permissions, control of sensitive data and the risk of security issues, new research claims.
An Illumio study looked at how organizations are transferring decisions recently made by humans to AI, apparently without taking into account the possibility of serious problems arising.
It found that the majority (70%) of organizations are delegating decisions previously made by humans to AI, but only about half (49%) can see what actions an AI agent takes and audit them.
Latest videos ofTechnologyRadar
AI recommendations
The nature of AI agents makes this a particularly risky strategy, and research has found that an incredible 56% of organizations are willing to accept greater cyber risks than 12 months ago. Nearly half of that group (47%) have admitted to enabling AI actions in production environments.
Allowing AI agents to have free access to data, applications and business infrastructure is creating completely avoidable situations. Illumio’s research found that a control gap exists between the rules under which organizations believe AI agents operate and what the technology is actually capable of doing.
About 76% of organizations have experienced one or more security issues thanks to AI in the last year, and 35% revealed that following AI recommendations would result in a security risk. Meanwhile, 26% reported that AI agents or tools had been connected to other systems without the necessary approval.
More worrying are 24% of organizations reporting that AI is trying to access data it should not be able to see, and another 24% saying it has triggered (or produced) an unauthorized action.
Strict limits
Of course, AI is already used in cybersecurity and has proven successful with multiple vendors implementing AI-enhanced solutions. But while 67% of organizations use AI cybersecurity tools, 32% allow AI to conduct investigations without human supervision and 29% allow software to implement code changes without any supervision.
“The biggest risk from AI may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place,” said Raghu Nandakumara, vice president of industrial strategy at Illumio.
Releasing AI agents unfettered has left companies scrambling to control the software.
As Nandakumara observes, AI agents are persistent and trying to outwit their next move is futile. Instead, “enterprises should set strict limits on what they can access and do, and then enforce those limits within the application and across the underlying infrastructure. This is how unexpected behavior can be contained before it causes real damage.”
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment