AI security is now a boardroom emergency
Executives can no longer hand cyber security responsibility to the IT crowd, writes Peter Proud
Artificial intelligence has changed the economics of cybercrime. An attacker no longer needs a large team, specialist knowledge or months of preparation. AI tools can scan thousands of websites, identify weaknesses, write malicious code and launch attacks faster than any person could. Work that was once difficult, costly, and slow can now be automated.
This is already happening. During an internal evaluation in Australia, an OpenAI agent gained unauthorised access to non-public files on a government Medicare statistics portal. No patient records were reportedly accessed, but the episode showed what an autonomous system can do: probe infrastructure, learn from failure and simply keep trying.
Denmark provides a different warning. Attackers reportedly misused a company’s legitimate access to the national CPR register. Names, addresses and personal identification numbers linked to about 8.8 million people were exposed. This was not reported as an AI attack, but it shows how trusted access and an overlooked weakness can expose data on a huge scale. AI makes such openings easier to find and faster to exploit.
IT systems are vulnerable because they often rely on a jumble of open-source software, plugins, third-party services, old code and forgotten connections. One unpatched component, exposed interface or dormant account may be enough. AI can search for these gaps around the clock. It can also create convincing phishing emails, copy trusted brands, rewrite malware and help inexperienced criminals target vulnerable systems.
There is a precedent for the response now required. In 2002, Microsoft acknowledged that software built for standalone PCs and offline servers, were not secure enough for an internet-connected world. Through its Trustworthy Computing initiative, teams paused development, reviewed existing products, retrained engineers, and put security at the centre of the development process. This was more than a round of patches. Microsoft changed the way it built software.
AI calls for a similar reset across business and government. Every organisation should review every existing system against AI-enabled threats. Websites, software, data, suppliers and access rights must all be reconsidered against threats that learn and adapt in real time. A system designed before autonomous AI should not be assumed safe.
This belongs in the boardroom. It cannot be handed to the IT department and forgotten. Directors decide how much risk to accept, where to invest and how resilient the organisation should be. They should know which systems are critical, who can access them, when they were last tested, how quickly a breach could be contained and which executive is accountable. If the answers are vague, the organisation is not ready.
A yearly compliance exercise is no longer enough. Boards need continuous oversight, rapid fixes, and tighter control over critical systems. At Forrit, our philosophy is that security, governance, resilience and auditability must be designed into the platform, not added later. That means limiting plugin sprawl, controlling integrations and removing unnecessary routes into a system. Simpler technology is often safer, but boards must still demand proof that the safeguards work.
AI will help defenders spot unusual behaviour and respond more quickly. Attackers, however, have access to much of the same technology and every incentive to exploit delay. Trust takes years to earn and minutes to lose. The question is not whether AI-enabled attackers will test an organisation’s systems. They will. The real question is whether its board acted early enough. After a breach, saying “we left it to IT” will satisfy neither customers nor regulators.
Peter Proud, CEO and Founder of Forrit
Comments
Want to join the conversation? Please or to comment on this article.