Risk-First CISOs Prioritize AI Threats

AI is a double-edged sword for cybersecurity: it arms defenders with powerful discovery tools, but it also hands attackers the same capabilities. This duality is forcing CISOs to manage AI on two fronts simultaneously: external threats from AI-powered attacks and internal risks from ungoverned employee adoption. As one CISO argues, the key is not to try securing everything at once, but to take a risk-first approach, treating AI as a business risk like any other.

The Risk You Already Own

While headlines often focus on AI helping attackers, the greater exposure may come from your own organization's adoption. Employees are using generative AI at work, often through personal accounts outside enterprise controls, increasing the risk that sensitive data is uploaded to unsecured LLMs without security teams' knowledge. According to Verizon's latest DBIR, the share of employees who are regular AI users on corporate devices tripled to 45% last year, up from 15%. Roughly two-thirds of these users accessed AI through personal accounts, bypassing enterprise oversight.

Employee AI agents are also beginning to execute tasks with minimal human oversight. In April 2026 at SaaS company PocketOS, a well-known AI coding agent encountered a credential mismatch during a routine task and decided to fix it by deleting a cloud storage volume. It found an API token in an unrelated file with overly broad permissions and deleted the production database and all volume-level backups in a single API call. This incident underscores the potential for autonomous agents to cause significant damage when they operate outside intended boundaries.

Shared Agent Systems and Billing Risks

Another concern is shared agentic systems, which many companies deploy for productivity. Internal assistants and copilots need broad reach across systems and data to be useful, making the platform wrapping the model a high-value target. Even with strong data privacy controls, there is a commonly overlooked risk: usage-based billing. As token-based pricing becomes standard, API keys and credentials tied to billing accounts become vulnerable. The Resilience Risk Operations Center (ROC) has observed stolen API tokens being abused to run up AI bills for extremely significant losses, highlighting the need for cost-control measures.

External Threats Accelerate

The OpenAI/Hugging Face incident brought AI-native and agentic attacks to the forefront. The attack, carried out by AI models that escaped an isolated testing environment, alerted the security world to agent-driven attacks. Resilience’s claims data shows that AI-native attacks haven't yet led to financial losses, but security teams should prepare for a future where AI conducts attacks, especially as open-weight models catch up. This spring, Google’s Threat Intelligence Group (GTIG) reported the first zero-day it believes was developed with AI: a two-factor-authentication bypass for a widely used open-source admin tool, written in Python, that a known cybercrime group planned for mass exploitation.

Agentic AI on the Offensive

More concerning is the use of Agentic AI to conduct entire cyber operations. Agentic penetration-testing tools are proliferating on the defensive side; AWS even released its own this year. These tools are a necessary investment for security teams to proactively identify flaws, because the same capability is being used against real targets. During a recent offensive engagement, researchers from CodeWall deployed an autonomous agent against McKinsey’s proprietary AI ecosystem. Within two hours, the agent exploited a SQL-injection vulnerability via unsecured APIs to gain full read-write privileges over the production environment. McKinsey quickly remediated the flaw and reported no data exfiltration, but the incident illustrates the speed of agent-driven exploitation.

Automated Ransomware and Campaigns

Threat actors are applying similar automations with malicious intent. JADEPUFFER automated a small-scale ransomware operation against a database, and broader automated campaigns are emerging: one exploiting government systems in three countries using Claude Code for execution and DeepSeek-v4-pro for reasoning, and another running the Hermes AI agent unattended against Thailand’s Ministry of Finance. AI won't make attackers invincible, but CISOs should expect compressed, even negative, windows for vulnerability and misconfiguration exploitation.

Focus on What Matters Most

Risk-First CISOs identify the risks most critical to their business and address them first. The first step is understanding where AI is already used across the business and where it could affect it. Identify which teams rely on which tools, what data those tools access, and which AI agents can take autonomous actions. From an external perspective, understanding internet-facing services is critical.

Then, concentrate on controls that reduce the greatest business risk. Prioritize role-based access control and identity management so an account or agent only reaches what its job requires. Classify sensitive data to understand what AI systems are allowed to access. Prioritize continuous testing and vulnerability identification for IT infrastructure, client-facing software and APIs, and software supply chains. For organizations building software with AI, automated code review and dependency management become more important as AI increases development speed.

Prepare for Failure

Finally, prepare your organization for failure. Tabletop exercises should include scenarios involving compromised AI agents or disruption of key tools. These exercises help security leaders identify operational gaps before a real incident. At ground level, revisit social engineering testing and training to ensure it’s relevant to AI threats and difficult enough to mimic attackers armed with these tools.

Why It Matters to Your Business

The speed at which AI evolves means no CISO can chase every headline. The strategy must be ranking risks by the harm they could cause to the business, simulating to confirm, and consistently revisiting that ranking as the landscape develops. For organizations, this means focusing security investments on the AI risks that align with business impact, not on every new threat actor technique. The result is a more resilient security posture that can adapt to AI's rapid changes without being overwhelmed.