The AI Security Crisis: How to Govern Generative AI in the Workplace

Generative AI (GenAI) is expanding at an unprecedented rate, with 88% of companies already incorporating it into at least one business function. However, this rapid adoption has created a security crisis, with Chief Information Security Officers (CISOs) struggling to track its impact and prevent data breaches.

The Main Issue: Lack of Governance

The main issue with GenAI is the speed at which companies have latched onto it without developing good security and governance. CISOs are facing a growing data-security crisis, one that their legacy systems were not built to manage. This is because GenAI was designed in a time when the framework for taking these new concerns into consideration didn’t even exist yet.

The New AI Concern

CISO concerns are not hypothetical. The reality is that companies and organizations are adopting GenAI at such a staggering rate that, according to recent industry analytics, 88% of them have already incorporated generative AI into at least one business function. Such a rapid integration shows how enthusiastic these companies are about AI’s potential, but it also highlights how responsible GenAI enablement needs to be a priority.

One study found that only 24% of Chief Information Officers (CIOs) and CISOs felt that the necessary governance policies were even in place to properly manage their current AI-related risks. As a result, the real test for security leaders is how to build the practical guardrails they need to moderate correctly, as well as how to modernize the current oversight so AI adoption doesn’t sacrifice security and data protection to greater AI-driven productivity goals.

Re-Architecting in the Age of AI

Currently, data security architecture leans into perimeter defense and endpoint controls. Unfortunately, that is proving increasingly insufficient in an environment where data is being moved, summarized, consumed, and regurgitated by sophisticated, and often third-party, AI services. These older models operated under the assumption that the data flow would always be predictable and manageable at all endpoints. GenAI breaks this pattern by creating new, and even hidden, pathways for data to pass through the pipeline.

Captain Compliance reports that “ChatGPT and related OpenAI products triggered a wave of GDPR [General Data Protection Regulation] enforcement proceedings beginning in 2023.” This and other investigations have led to several new Information Privacy Acts to try to combat the new threat. When employees use a publicly available LLM, they are effectively uploading corporate data to an environment that exists outside the direct control of the organization’s security team.

The Three Pillars of Security

To more fully contain the new AI-saturated ecosystem, CISOs need to focus on three important pillars:

1. Visibility: You can’t govern what you can’t see. Organizations need tools that can monitor the data flow going in and out of AI services. This includes not only identifying which AI tools are being used, but also what data is moving around, which will require next-gen data security platforms that can track data lineage across cloud services and other environments.
2. Policy: Old generic acceptable use policies are no longer adequate. Security teams need to collaborate with their legal and compliance department to better design practical rules for GenAI use. This includes classifying data according to its sensitivity and then setting specific rules for how each classification can interact with different AI models.
3. Enforcement: Traditional controls need to be turned into data security management solutions that can enforce policies in real-time. This way, they can empower employees to use GenAI productively while also offering guardrails to prevent accidental or even malicious data exposure. Basically, using AI to secure AI by having the machine learn to identify data usage patterns and classify data sensitivity automatically.

The Battle Ahead

For modern CISOs, the coming battle is less about keeping AI out of the businesses and organizations they monitor, because that AI ship has already sailed, and more about just integrating it responsibly. There needs to be a focus shift from blanket restrictions to intelligent enablement so the necessary security and governance foundations can be built to withstand the rapid expansion of generative AI.

The time for a reactive approach is long past. The growing complexity of GenAI demands proactive security architecture and leaders capable of building it.