From Harvard Business Review · HBR Editors · · 4m
How companies can defend against AI-powered cyber threats
Speed, scale and new attack surfaces are changing cybersecurity, but the fundamentals still matter. Leaders across all functions need to think about protection and resilience together.
In brief
Speed, scale and new attack surfaces are changing cybersecurity, but the fundamentals still matter. Leaders across all functions need to think about protection and resilience together. AI is accelerating cyber threats through speed and scale, but basic security practices remain critical. Companies must combine…
AI tools create new risks
The same tools that help spot threats faster are also creating new risks. Recent high-profile hacks show companies cannot be complacent about cybersecurity in an AI-driven world.
Speed of attacks has surged
Over the past year, cybersecurity vulnerabilities have come across at incredible speed. Incident response firms are turning away work from non-retainer clients because there are so many incidents to handle.
Fundamentals have not changed
The speed, scale and consequences have changed, but the basics remain the same. Attacks still exploit attack surfaces, misconfigured systems and mismanaged identity, just faster and at larger scale.
Three security buckets to manage
Think about cybersecurity, AI security, and AI agent security separately. Traditional systems need protection. AI models add probabilistic risks. Agents that take autonomous action create new governance challenges around identity and permissions.
Hugging Face attack was governance failure
The Hugging Face attack was not rogue agents acting on their own. Developers trained agents to find vulnerabilities but failed to put proper governance protocols in place to contain them securely.
PHP2Shell showed collective defense
PHP2Shell was a vulnerability in seventy percent or more of websites. It was not as easily exploitable as first thought, giving the cybersecurity community a narrow window to patch and develop defenses together.
AI builds on traditional systems
AI systems build on traditional cybersecurity systems. If basic hygiene is not in place, the same vulnerabilities get exploited in AI environments, maybe faster and with broader scope.
New attack surfaces in AI
Defense in depth and confidentiality, integrity and accessibility remain important. But AI adds new attack surfaces like model manipulation, prompt injection and data poisoning that need rethinking in cybersecurity models.
Protection and resilience work together
You need both protection and resilience. Identify which risks are acceptable to take on and which are unacceptable. Defend against unacceptable risks and build resilience to accept the ones you cannot block.
Resilience means planning to recover
Resilience assumes attackers might get in. Design processes and organizations so damage is minimal and recovery is quick. Most organizations spend eighty percent of resources on identifying and protecting, less on responding and recovering.
Practice your response plans
Have critical communication plans and tabletop exercises so people know what to do during an attack. One company had a brilliant recovery plan stored only on computers that were locked down during the incident.
Plan, prepare and practice
You cannot go faster than machine speed. What you can do is plan, prepare and practice. That is the key to meeting the threat of ever faster malicious activity on your network.
Build a culture of cybersecurity
People are both a weak link and your strongest component. Identify values, attitudes and beliefs that drive cyber-secure behaviors. When leadership prioritizes security, it trickles down through the organization.
Measure security across the company
Ask how you are measuring security and resilience. Include cybersecurity culture in executive scorecards. Make all executives responsible for role-appropriate cybersecurity behavior, not just technical teams.
Use a balanced scorecard for risk
For each major business component like operations, finance or technology, create a scorecard showing biggest cybersecurity risks and mitigation strategies. Risk is impact times likelihood. This is a business discussion, not just technology.
Start with the basics for small firms
For resource-constrained organizations, focus on two-factor authentication and password managers first. Be brilliant at the basics. Leverage free tools from Google, Microsoft and other vendors already in your systems.
Three priorities for small organizations
First, control access and protect critical data by securing identities and managing credentials. Second, establish guardrails for how agents access systems. Third, build ability to detect, respond and recover from incidents.
Time and motivation matter most
You do not need to be a cyber expert. Many resources are available for small and medium enterprises. It is a management decision about allocating time and energy to get basics in place.
Increase the cost of attacking you
Malicious actors are resource-constrained like businesses. They make trade-offs about which targets to attack. Do the basics to ensure you are not the cheapest company to attack for these cyber attackers.
The one thing
AI is accelerating cyber threats through speed and scale, but basic security practices remain critical. Companies must combine protection with resilience planning and involve all leadership, not just IT.
