Security has faced significant challenges in the past year, with exploits and numerous zero-day attacks keeping security teams on their toes. On the regulatory front, the U. S. SEC has implemented strict incident reporting requirements, while EU government bodies have proposed frameworks like the Artificial Intelligence Act to address the growing threats posed by AI. These challenges are further compounded by the rise of novel AI threats, which have added complexity to the security industry. Organizations are now under pressure not only to defend against these advanced threats but also to leverage the power of AI for their own security programs. AI has become deeply ingrained in organizational systems, blurring the lines of responsibility and ownership within companies, much like the early days of cloud and SaaS. This has prompted calls for a unified and collaborative approach to security, recognizing that collective effort is needed to protect against evolving threats. However, the speed at which AI evolves and grows surpasses what we have seen with cloud-based technologies. This necessitates security leaders to think and act faster to stay ahead of threats in this brave new world of AI. There is much that is still unknown about AI, with some describing it as an "alien-like technology. " While many security practitioners believe in the overall positive impact of AI, it remains incredibly challenging to comprehend.

There are three main risks that we face today with AI security. Moving forward, building bridges between departments will require a stronger effort due to the complexity and omnipresence of AI. Organizations will need different owners for various AI risks, keeping in mind that some risks extend beyond security, affecting other aspects of the business. Responsibilities and hierarchy will differ across organizations and will naturally evolve over time. However, in the short-term, I see the following roles and responsibilities: - The CISO will be accountable for data loss prevention, ensuring data integrity, and guarding against data manipulation. Working closely with the CLO, the CISO will ensure compliance with regulations such as GDPR or HIPAA. - The CLO will own copyright issues and manage liabilities arising from the use of AI externally. For example, if AI-powered software misclassifies images and leads to legal scrutiny, the CLO will handle it. - The CPO or CTO will oversee threats related to prompt injection and malicious content, ensuring AI systems are not only secure but also function correctly in the presence of potentially harmful inputs. To take action, we need to adopt AI technology thoughtfully and in the right way. Security teams that resist this trend will be left behind. Collaboration, transparency from vendors, and staying updated on community resources are crucial steps that security teams should take to better protect their organizations against emerging AI threats.