|
“Plans are of little importance, but planning is essential.”
― Winston Churchill |
AI in a Tight Economy: How Businesses Can Embrace AI Without Creating Tomorrow’s Cyber Crisis For many businesses, the attraction of artificial intelligence is becoming difficult to ignore. Margins are under pressure. Customers expect faster responses. Employees are being asked to achieve more with fewer resources. Management teams are looking for productivity improvements, while Boards want costs controlled without compromising growth.
Against that backdrop, AI can look extremely attractive. A relatively inexpensive AI tool might help an employee produce in minutes what previously took hours. It can assist with research, analyse information, prepare reports, automate administrative work, support customer service and help people make better use of the information already sitting inside the business. The question is therefore rapidly changing from: “Should we allow AI?” to: “How do we take advantage of AI without introducing risks we don't properly understand?” That distinction matters, because while businesses are discovering how AI can make them more productive, cyber criminals are discovering exactly the same thing. And cybersecurity providers are responding with AI of their own. We are entering an environment in which AI is increasingly being used on all three sides of the equation: Businesses are using AI to work more efficiently. Attackers are using AI to attack more effectively. Defenders are using AI to detect and respond more intelligently. That fundamentally changes the cybersecurity conversation. The economic argument for AI is compelling When budgets are tight, telling businesses simply to avoid AI is neither realistic nor necessarily good advice, AI may actually be part of the solution to financial pressure. A small organisation may be able to use AI to improve marketing, analyse contracts, summarise meetings, prepare proposals, interrogate business data, automate repetitive tasks and increase the productivity of existing staff. The problem isn't necessarily AI, the problem is unmanaged AI. An organisation can quite easily reduce operating costs in one area while quietly creating a potentially much larger exposure somewhere else. Consider an employee who discovers an AI tool that saves them three hours every week. From their perspective, that's innovation. But what information are they putting into it?
This is where Shadow AI becomes particularly important. Employees don't necessarily adopt unsanctioned AI tools because they're careless. Often, they do it because they're trying to do their jobs better. That makes AI governance as much a culture and leadership challenge as it is a technology challenge. But what if you didn't choose the AI? There is another AI risk emerging that may prove harder to manage than employees signing up for ChatGPT or another public AI service. AI is increasingly being embedded inside the software businesses already use. Your CRM provider adds an AI assistant, your accounting platform introduces AI-powered analysis, Microsoft, Google and other productivity platforms introduce AI capabilities. Your HR, marketing, customer-service, cybersecurity or project-management software adds AI features through an update. Suddenly an organisation can be using significantly more AI than management realises — without anybody making a conscious decision to introduce another AI platform. This creates a different governance challenge; we might call it Embedded AI Risk. Shadow AI and Embedded AI are not the same problem. Shadow AI generally occurs when employees independently adopt AI tools without formal organisational approval. Embedded AI is different, the underlying software may already be approved, the vendor may already have passed procurement, the organisation may already have a contract and established relationship with the supplier. But the capabilities of the product have changed. That raises an important governance principle: Approving a software provider once should not automatically mean approving every future AI capability that provider introduces. An application that was assessed two years ago as a relatively conventional SaaS platform may now contain generative AI, automated decision-making, AI agents, data-analysis capabilities or connections to third-party AI models that didn't exist when the original risk assessment was completed. The organisation therefore needs to understand not only which applications it uses, but increasingly what AI capabilities now exist inside those applications. This requires a different AI strategy Traditional software governance often focuses heavily on procurement, we assess a supplier, sign a contract, approve the application and move on. AI makes that increasingly inadequate. Organisations may need to move towards continuous technology governance, where significant changes to existing platforms trigger another conversation. That doesn't mean reassessing every software update, it means identifying material changes that could alter the organisation's risk. For example:
Create an AI Capability Register — not simply an AI Tool Register Many organisations considering AI governance start by creating a register of approved AI applications. That's useful, but it may no longer be enough, instead, organisations could maintain an AI Capability Register. Rather than simply recording: “We use Software X.” the organisation records: “Software X contains these AI capabilities, can access these categories of organisational information, performs these functions, has these permissions and is subject to these controls.” That subtle change could provide Boards and management with a much clearer picture of their actual AI exposure. The register doesn't need to become another expensive compliance exercise. For smaller businesses, it could initially be a straightforward spreadsheet covering: Application | Business Owner | AI Capability | Data Access | AI Provider/Model | Business Purpose | Risk Level | Human Oversight | Approved/Restricted/Disabled | Last Reviewed Suddenly the organisation has something extremely valuable: visibility, and you cannot effectively govern something you cannot see. Ask vendors to disclose material AI changes Organisations should also consider changing the questions they ask technology suppliers. Rather than asking once during procurement whether a product uses AI, supplier agreements and reviews could increasingly ask providers to disclose material changes to AI functionality. For example: “Please notify us when material AI capabilities are introduced or materially changed, particularly where those capabilities affect our data, security, privacy, automated decision-making or third-party processing.” For larger or higher-risk suppliers, organisations may want appropriate notification and review provisions reflected in contracts and procurement requirements. This becomes particularly important when AI functionality involves sensitive information or critical business processes. Beware of the 'trusted supplier' assumption There is also a human tendency worth considering, when employees see an AI button inside an application the company already provides, they may reasonably assume: “IT has approved this, so it must be safe.” But that may not necessarily be true, the application may be approved, the new AI capability may never have been assessed. That distinction needs to become part of AI awareness training. Employees shouldn't have to become AI risk specialists. They simply need an easy way to ask: “This application has just introduced an AI feature. Are we okay to use it with company information?” That question should be encouraged rather than treated as an inconvenience. AI governance therefore needs three lines of visibility This changes the AI governance model considerably, businesses increasingly need visibility across three different forms of AI adoption: 1. Approved AI — AI systems deliberately selected, assessed and authorised by the organisation. 2. Shadow AI — AI tools independently adopted by employees or departments without appropriate approval. 3. Embedded AI — AI capabilities introduced into software and platforms the organisation already uses. The third category may eventually become the largest. And because it is largely invisible, it could also become one of the easiest to overlook. The Board question changes again Boards shouldn't therefore ask only: “Which AI tools have we approved?” A much stronger question is: “Where does AI currently exist across our organisation — including inside technology we already owned before it became AI-enabled?” And perhaps the follow-up question is even more important: “Would we know if one of our critical technology suppliers materially changed how AI interacts with our information tomorrow?” If the answer is no, the organisation may have discovered an important gap in its AI governance strategy. Because in the next stage of AI adoption, organisations won't always make a conscious decision to introduce AI. Sometimes AI will simply arrive in the next software update. Good governance therefore needs to evolve from controlling the AI tools people deliberately adopt to maintaining visibility over the AI capabilities continuously emerging throughout the organisation's technology ecosystem.
0 Comments
Your IT Provider Says You're Secure. But Is That Even the Right Question? I regularly ask business owners and senior executives about cybersecurity. A response I still hear surprisingly often is:
“We’re comfortable. Our IT provider looks after that.” Or: “Our MSP has cybersecurity covered.” There was a time when my immediate response would have been: “But who independently checked?” I still believe independent assurance matters enormously, but increasingly, I think we need to challenge the premise of the question itself. Because if we are asking whether the IT provider, MSP or MSSP has made the organisation secure, are we still treating cyber as an IT problem? And if we are, perhaps that is the bigger risk. Cyber Has Left the IT Department Cybersecurity has changed, so has the use of AI. Both now reach into almost every part of an organisation.
“Is IT keeping us secure?” Perhaps the better question is: “Is the organisation governing cyber and AI risk effectively?” That is a very different conversation. Your MSP May Be Doing an Excellent Job! This is not an argument against MSPs or MSSPs. Quite the opposite, a strong technology partner can be enormously valuable. They may manage your infrastructure, monitor threats, maintain security tools, manage identities, protect endpoints, maintain backups and help respond to incidents. They may know your technology environment better than almost anyone. But there is an important distinction: Knowing your technology environment is not the same as governing your organisation. And nor should we expect it to be. Your MSP cannot determine your organisation's risk appetite; it cannot decide what level of business disruption your Board is prepared to tolerate. It cannot create your organisational culture, nor can it ensure that every executive understands their responsibilities during a crisis. It cannot determine how comfortable employees feel reporting mistakes or near misses, nor can it decide where your organisation draws the line on acceptable AI use or own the Board's accountability for organisational resilience. Those responsibilities belong inside the organisation. So Perhaps We've Been Asking Our Providers the Wrong Question Imagine asking your MSP: “Are we secure?” What exactly are we asking them to assess?
The Problem Isn't the MSP. It's the Governance Model. This distinction matters. If an organisation has effectively handed responsibility for cybersecurity to its technology provider, I don't think we should automatically blame the provider. We should examine the governance model. Somewhere along the way, many organisations appear to have confused outsourcing cybersecurity services with outsourcing responsibility for cyber risk. They aren't the same thing. You can outsource technology, monitoring, specialist security capability, penetration testing and incident response expertise. But there are things you cannot meaningfully outsource.
This Is Why Cyber and AI Belong in the Boardroom Over the course of developing the Cyberplanz Boardroom Guide to Cyber & AI Governance, one theme has become increasingly clear to me: Cyber resilience is an organisational capability, not an IT product. The same is rapidly becoming true of AI governance. Technology remains critically important, but technology is only part of the picture. I believe Boards need to consider resilience through five interconnected areas. LEAD
ENGAGE
The objective shouldn't simply be: “Let's check whether our MSP is doing its job.” That is too narrow, the MSP should certainly be part of the picture, but independent assurance should examine the organisation.
There Is Still a Role for Independent Challenge Independence nevertheless remains important. Your MSP may genuinely believe you are well protected. Your internal IT team may genuinely believe your controls are appropriate. Your executives may genuinely believe employees know what to do. And the Board may genuinely believe the organisation could manage a major incident. Everyone can be acting professionally and in good faith, and everyone can still be wrong.
“How do you know?” A Different Boardroom Conversation So perhaps the next time someone around the Board table says: “Our IT provider tells us we're secure,” the response shouldn't immediately be: “Has anyone independently checked them?” Perhaps it should be: “What exactly do we mean by secure?” Then:
Trust Your MSP. Govern Your Organisation. Your MSP can be an excellent partner, your MSSP can provide outstanding security capability. Your internal IT team can be highly competent. None of those things removes the need for governance and none of them transfers accountability away from leadership. Perhaps, therefore, the future conversation about cybersecurity shouldn't begin with: “Is our IT provider keeping us secure?”, it should begin with: “Are we building an organisation capable of understanding, governing, responding to and learning from cyber and AI risk?” Then ask: “What evidence proves it?” Because ultimately, cybersecurity isn't something your IT provider does to your organisation. Resilience is something your organisation builds together. The Future of Human-Centric Cybersecurity |
AuthorPatrick – Founder of Cyberplanz | Business Strategist | Cyber Governance Advocate Archives
September 2026
Categories |
RSS Feed
