Frauds perpetrated by imposters, deep fakes, leaking of proprietary information, sophisticated phishing emails, and even the generation of malware codes - these are just some of the ways attackers can exploit generative artificial intelligence (AI) to target businesses at an unprecedented scale. As generative AI rapidly gains traction, organizations also face privacy, legal, financial, and reputation risks of unparalleled proportions. It is crucial to address these security risks, as generative AI moves beyond being a mere novelty. For instance, it has seen widespread adoption in various enterprise teams, including marketing, sales, customer service, operations, business automation, and training. Moreover, software development is another area where organizations hope to harness the power of generative AI. In such cases, it is imperative for enterprises to adopt a measured approach to deploying generative AI. According to a recent Salesforce study, a majority (67%) of senior IT leaders prioritize the use of generative AI in their businesses, as part of their technology roadmaps for the present and near future. However, 33% of the respondents expressed concerns about the associated security risks and bias. These concerns are valid, especially considering recent incidents involving targeted attacks, exposure of sensitive business information, and even hallucinations associated with generative AI. Notably, one example of the weaponization of generative AI is its use in advanced spear-phishing attacks. In the past, it was possible to differentiate between spear-phishing emails generated by a human or an AI-based system. However, this is no longer the case. Attackers can now create highly personalized and convincing phishing content at a large volume and scale, making it challenging for recipients to distinguish a genuine email from a fraudulent one. As generative AI creates entirely new attack surfaces, businesses must reassess their existing risk management strategies. This involves addressing risks at multiple levels, including processes, governance, technology, and ethics. Ensuring regulatory compliance in the workplace when using generative AI and large language models like GPT-4 poses a challenge. Companies must adopt a comprehensive approach that combines technological solutions, robust policy frameworks, and extensive awareness programs to maintain compliance and navigate the complexities associated with generative AI. Simultaneously, enterprises must be able to harness the enormous potential offered by generative AI. An illustrative case study highlighting the risks associated with generative AI is the generation of incorrect or compromised outputs from AI models. In industries like cybersecurity or healthcare, inaccurate results can have severe consequences. Safeguarding the integrity of training data is essential from a security perspective. Adversaries can exploit generative AI to create and disseminate convincing phishing threats on a massive scale. To counter such threats, organizations need to adopt AI-powered threat detection mechanisms capable of identifying and neutralizing attacks at scale. Mitigating risks associated with generative AI-based business applications requires substantial investments in time and effort. An example worth mentioning is the successful integration of GPT-4 by the education technology company, Duolingo.

Duolingo and OpenAI teams collaborated extensively to improve the initial prototype, with a significant portion of the effort devoted to generating and labeling large datasets for refining the prompts. The data collected during this process was instrumental in enhancing the GPT-4 model. User testing revealed the importance of ensuring ideal conversational outcomes. This phase enabled the teams to utilize appropriate AI routines and models to maintain the desired user interactions. Policy measures play a vital role in establishing responsible usage of generative AI. These policies can take the form of AI ethics guidelines and contractual agreements. The first step is to develop a comprehensive internal policy that outlines permissible and non-permissible uses of AI. Educating and raising awareness among employees about the safe use of generative AI tools is crucial for effective risk management. Regular training sessions should address the latest risks associated with AI. Establishing an internal committee responsible for the ethical use of AI can help promote best practices. The committee should comprise stakeholders from various business areas who champion the policy and actively encourage its adoption within their respective teams. By fostering cross-functional collaboration, this committee can help cultivate a culture of responsibility, accountability, and ethical AI practices. Existing defense mechanisms such as traffic-monitoring tools, firewall restrictions, security gateways, and data loss prevention solutions can be leveraged to enforce generative AI usage policies. Additionally, integrating AI with security products will be a game-changer in the future. Next-generation AI-powered security tools are valuable for governing the usage of generative AI. Coupled with techniques like API-based secure access to generative AI tools, these solutions can effectively ensure compliance. For example, access monitoring and control tools are useful when businesses utilize existing language models to create internal generative AI chatbots. These tools can mitigate issues such as information leakage or the use of AI-generated source code in internal repositories while preventing the transmission of shared information back to the language model. Modern traffic monitoring technology can screen outgoing data for personally identifiable information, sensitive data, or corporate secrets. Overall, generative AI is here to stay, and the promises it holds for businesses outweigh the associated risks. CXOs and technology leaders who embrace this reality will reap substantial rewards. Enterprises now have the responsibility to develop risk management strategies that allow for optimal use of generative AI. The efforts and investments required to address these challenges are a necessary driver of growth. Through well-crafted usage policies, robust processes, and the right technology controls, businesses can harness the full potential of generative AI while mitigating risks.