Report claims AI is recommending risky security moves — so maybe you shouldn’t hand over full control of your systems just yet | Daily Reports Online
- Report says AI is being given too much authority and autonomy to handle business-critical security decisions
- 70% of organizations delegate decisions to AI that would have been made by a human 12 months ago
- A “control gap” exists between the authority given to AI and an organization’s ability to audit it
Delegating complicated decisions to AI is leading organizations to place relatively new technology in charge of user permissions, in control of sensitive data, and risk security issues, new research has claimed.
A study by Illumio looked into how organizations are handing decision recently performed by humans to AI, without apparently taking into account the potential for serious issues to arise.
It found the majority (70%) of organizations are delegating previously human-made decisions to AI, but only around half (49%) can see what action is taken by an AI agent an audit it.
Latest Videos FromTechRadar
AI recommendations
The nature of AI agents makes this a particularly risky strategy, and the research has found that an incredible 56% of organizations are willing to accept greater cyber risks than 12 months ago. Almost half of that group (47%) have admitted to permitting AI actions in production environments.
Allowing AI agents to have free run of enterprise data, applications, and infrastructure is leading to wholly avoidable situations. Illumio’s research found that a control gap between the rules that organizations believe AI agents are operating within and what the technology is actually capable of.
Some 76% of organizations have experienced one or more security issues thanks to AI in the past year, with 35% revealing that following AI recommendations would result in a security risk. Meanwhile, 26% reported AI agents or tools had connected to other systems without the necessary approval.
More worrying is the 24% of organizations reporting AI’s drive to access data it shouldn’t be able to see, and another 24% stating it has triggered (or produced) an unauthorized action.
Strict limits
Of course, AI is already used within cybersecurity, and has proved successful with multiple vendors rolling out AI-enhanced solutions. But while 67% of organizations are using AI cybersecurity tools, 32% let AI conduct investigations without human oversight and 29% permit the software to deploy code changes completely unsupervised.
“The biggest AI risk may not be a system that breaks its rules. It may be one that was never given meaningful limits in the first place,” noted Raghu Nandakumara, VP of Industry Strategy at Illumio.
Unleashing AI agents without constraints has left businesses struggling to control the software.
As Nandakumara observes, AI agents are persistent, and attempting to outwit their next move is pointless. Instead, “businesses must set strict limits on what they can access and do, then enforce those limits within the application and across the underlying infrastructure. That is how you contain unexpected behavior before it causes real damage.”
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
