Article AI Security Readiness: The Hidden Risks Leaders Can't Afford to Ignore

More security vulnerabilities are expected to be found in the next six months than in the last 30 years. Most security teams are not set up to respond to the speed and volume of these threats brought on with advancements in technology. This presents a challenge for leadership looking for the balance between innovation and security. AI is compressing the cyber response window. What once could have taken months can now happen in just hours. Traditional monthly patching cycles and vulnerability scoring are no longer enough, as the focus shifts from just identifying threats to how quickly the business can respond to them.

Leaders are trying to enable innovation without increasing exposure. But AI adoption is already happening in most organisations, whether there is a formal strategy in place or not. Employees are experimenting with AI tools to work faster, and many are doing so outside approved environments. Shadow AI has become the new shadow IT, exposing organisations to risks around compliance, data sharing, visibility, and control. This concern is not unfounded. According to recent Insight-led research, 60% of leaders are willing to delegate more to AI than their governance frameworks currently allow, suggesting that AI adoption is advancing faster than many organisations’ ability to govern it effectively.

This puts Chief Security Officers (CISOs) and business leaders under pressure to answer a more complex question as to what process, ownership, and controls are needed to make AI use safe and scalable. The hesitation from most businesses and security teams is not resistance to innovation, but uncertainty on how to manage risk as AI tools and agents are multiplying faster than their governance models can keep up.

At the same time, leaders need a view of how AI systems access organisational data, whether that data is used to train models, and how privacy is protected.

The next wave of threats

The next wave of threats is not simply about more attacks. It is about the speed and scale at which risk can now be discovered, prioritised, and exploited. Frontier AI models such as Anthropic's Claude Mythos are a clear signal of this shift, demonstrating an ability to identify software vulnerabilities across operating systems, browsers, and software dependencies at a level that would have been difficult to sustain manually

The risk is no longer that more weaknesses are being found, but that the gap between what is identified and what is remediated becomes harder to manage. As discovery accelerates, organisations need to understand exposure quickly, prioritise what matters, and act before vulnerabilities are weaponised. Released in limited access through Project Glasswing, Anthropic’s Claude Mythos demonstrated that AI can autonomously collapse the potential weaponisation window from 30 to 90 days down to hours, and in some cases even minutes.¹

The challenge is that AI risk is not static. As organisations progress from experimentation to autonomous systems, the nature of exposure changes significantly. The risk looks different depending on where an organisation is on its AI journey. AI security readiness generally falls across three broad stages, each creating a different point of exposure.

• Cautious organisations are still determining where to begin. AI may already be present through employee experimentation, but leaders often have limited visibility into which tools are being used, what data is being shared, or whererisks are emerging.
• AI adopters may be accelerating their efforts across the organisation, but governance is often still catching up. Use cases can expand faster than organisational policies, identity controls, ownership models, and security requirements. This is where shadow AI exists with unclear approval pathways and inconsistent safeguards thatcreate exposure.
• Frontier or AI-native organisations may have more mature governance and a clearer view of approved AI use. But they also face a more advanced threat landscape. As agents begin to access data, connect systems and automate workflows, the risk shifts from tool usage to agent behaviour. Threats such as prompt injection, agent manipulation, data leakage, and emerging agentic attack techniques show why even mature organisations need continuous controls, not just a one-time AI policy.

The more AI-native an organisation becomes, the more its security model must evolve from protecting applications and users to governing agents, identities, permissions, and autonomous actions.

Cyber risk is now moving at machine speed

AI has evolved from a tool to an operator. A few years ago, AI was largely associated with chatbots that generated content, answered questions, and supported productivity. Today, agents can connect systems, access data, make decisions, and take action across workflows.

That shift is compressing the cyber response window. Attackers can use AI to find and exploit vulnerabilities faster, while defenders are expected to assess, prioritise, and respond in near real time. The issue is no longer just whether organisations can detect threats, but whether they can decide, escalate, and act quickly enough once AI is involved.

Securing AI transformation is a readiness issue, not just a technology one. There are more vulnerabilities emerging than security teams can assess manually, and the fundamentals need to adapt to AI ways of working. It's no longer about simply monitoring which tools employees use but how the business governs what AI agents can access and what action they take.

Shadow AI is the new shadow IT

Employees often experiment with public AI tools before formal approval processes are in place. Without visibility into the platforms used or information shared, sensitive data can leave controlled environments, established access controls can be bypassed, and compliance risks can emerge outside the organisation’s security inventory.

Avoiding AI use is not a viable strategy. Competitors will continue to adopt it, and employees will turn to unapproved tools if secure alternatives are not available. The goal is to make responsible AI use easier than unsafe workarounds.

That means providing approved AI pathways, clear usage policies, strong identity controls, and guidance on which data can be shared. The objective is not to slow adoption, but to bring it into an environment where risk can be understood and managed.

More AI tools do not equal better security

As AI threats accelerate, deploying more AI tools may appear to be the fastest route to stronger cyber defence. Jeremy Nelson, Insight’s CISO for North America, noted that defending against AI-powered attacks increasingly requires organisations to operate at machine speed, using AI as part of the security response. However, AI amplifies the operating environment into which it was introduced. By documenting governance, accountability, and escalation paths, it can help teams prioritise signals and respond faster. If foundations are weak, this can compound uncertainty and increase risk.

Leaders should assess operational readiness before pursuing greater automation. As you would an employee, the role of AI should be defined in the business. This includes outlining what AI can access, which actions it may take, and when human approval is required. It also means testing response playbooks, assigning clear ownership, and maintaining human oversight for high-impact decisions. AI should strengthen expert judgement, not replace it. The goal should be resilience, not automation for its own sake.

Cybersecurity has become a leadership issue, not just a technology one

AI has moved cybersecurity further into the remit of boards and executive teams. Leaders do not need deep technical expertise, but they do need enough cybersecurity literacy to understand how AI changes organisational exposure, who is accountable for its use, what is captured in the risk register, and whether the business can respond effectively under pressure. Cyber risk can no longer be delegated on the assumption that technical teams and tools will manage it alone.

For security leaders, there are two connected priorities: using AI to strengthen cyber defence, and securing AI tools and agents already being used across the business.

The organisations best positioned to benefit from AI will be those that treat security readiness as a business capability, not simply a technology investment. They pair visibility and governance with human judgement, clear accountability, and the ability to respond at the speed AI now demands.