Rise in AI-Based Attacks: A New Security Challenge
Security Leaders Reveal: One in four organizations has already been attacked by AI
In an era where Artificial Intelligence (AI) is becoming an essential tool in all areas of business activity, significant new security challenges are emerging. According to a new report by the cybersecurity firm Team8, one in four Chief Information Security Officers (CISOs) has experienced an AI-generated attack on their company network within the past year. Furthermore, AI risks are now at the top of their priority list, surpassing issues such as vulnerability management, data loss prevention (DLP), and third-party risks.
The report notes that the true number of organizations affected by AI-based attacks may be higher, as most AI-driven threats mimic human activity and are difficult to detect without advanced metrics.
The CISO’s Double Dilemma: Securing AI vs. Organizational Integration
The need to enable AI adoption while minimizing inherent risks
Artificial intelligence presents CISOs with a variety of new cyber challenges, ranging from highly effective attacks to vulnerable technology platforms. The primary concerns for CISOs involve the security of AI agents (cited by 37%) and ensuring that employee use of AI tools complies with security and privacy policies (36%).
Beyond AI-based phishing and malware attacks, security managers are also concerned about the unintended security consequences of internal AI use within the organization. Senior management is pushing for aggressive AI adoption across the enterprise, and security experts are required to enable this transition rather than block it. This puts CISOs in a complex position: they must mitigate risks in a technological field that is not yet sufficiently understood, is evolving rapidly, and lacks established controls.
From Controlled AI Adoption to SOC Role Replacement: The Promise and the Challenge
Security leaders fluctuate between the fear of “Shadow AI” and hopes for process optimization through automation
Nearly half of companies still require employee approval to use specific AI tools—an approach that creates friction with senior executives seeking to expand AI usage. There is an urgent need for effective controls, as security teams contend with unmonitored AI use (“Shadow AI”).
On the other hand, CISOs are eager to integrate AI into their operations: nearly eight out of ten CISOs anticipate that Security Operations Center (SOC) roles will be the first to be replaced by AI, with nearly half of them citing workforce reduction as a primary factor for piloting these initiatives. Additionally, they expect AI to replace humans in areas such as penetration testing, third-party risk assessments, user access request reviews, and proactive security planning (threat modeling). An interesting finding is that over two-thirds of companies using or testing AI agents are developing them in-house.
Recommendations from IPV Security Information Security Experts:
- Securing AI Agents: Prioritize the protection of the AI agents you develop or integrate, ensuring they do not serve as a new entry point for attackers into the organization.
- Formulating Organizational AI Policy: Define clear rules for using AI tools, with an emphasis on privacy and security, and ensure that defensive controls are enabled by default.
- AI Risk Assessment: Conduct structured risk assessments for every project involving AI integration, including internal applications, to identify and mitigate risks as early as possible.
- Monitoring and Detection of AI Threats: Develop detection and monitoring capabilities capable of identifying AI-powered attacks, particularly those that simulate human behavior.
- Addressing “Shadow AI”: Remain vigilant regarding unauthorized use of AI tools by employees and address it through a combination of policy, training, and technical controls.
In Conclusion:
The rise in AI-based attacks presents CISOs with a dual strategic challenge: enabling the AI adoption essential for organizational growth while managing unprecedented risks in a new and evolving field. Addressing this requires a deep understanding of new vulnerabilities and the adoption of a holistic approach that combines clear policy, advanced technical controls, and the wise integration of AI into security operations themselves.
For more information: https://www.cybersecuritydive.com/news/ai-security-risks-agents-report/753345/
**