Are your AI and web applications secure? Key lessons from our Cyber Byte

05.10.26

Blog, General

Web applications and AI tools are now a part of everyday business. From customer portals, booking systems and chatbots, organisations are using them to make services quicker and easier to access.

But every new application can also introduce vulnerabilities.

During our latest Cyber Byte webinar, our cyber security specialist, Thais Ramdani looked at some of the common weaknesses they find when testing web applications and AI systems, and the practical steps organisations can take to reduce their risk.

One of the clearest messages from the session was that security shouldn’t be considered only once an application has been built. The earlier security is considered, the easier it is to identify and address potential weaknesses.

If you’re developing a new website, customer portal, app or AI tool, think about security throughout the development process. Testing before launch can identify problems before customers – or criminals – have an opportunity to find them.

And don’t assume that an applicant that was secure when launched will remain secure. Systems change, new features are added and new vulnerabilities are discovered.

Sometimes the problem isn’t sophisticated hacking. It’s simply that an application gives someone access to something they shouldn’t be able to see.

During the webinar, the team discussed the importance of accessing controls: making sure users can only access the information and functions appropriate to them.

This becomes particularly important where an application holds customer information, personal data or commercially sensitive information.

A website might look relatively simple to the person using it, but behind it can sit databases, APIs, third-party services, login systems and other applications.

Attackers will look for weaknesses across that wider environment.

The same principle applies to applications developed by external suppliers. Outsourcing development doesn’t outsource your responsibility for understanding how your information is being protected.

AI applications can introduce risks that traditional web applications don’t necessarily face.

For example, organisations need to consider what information is being supplied to an AI system, what information it can access and whether users could manipulate it into revealing information or behaving in ways it wasn’t intended to.

The discussions also highlighted the importance of understanding where information goes when using third-party AI tools.

Before entering information into an AI system, organisations should understand how that information will be handled and whether it could contain confidential, personal or commercially sensitive data.

AI can help developers work more quickly, but code produced with the help of AI shouldn’t automatically be assumed to be secure.

AI-generated code can still contain vulnerabilities or introduce security problems if it is implemented without appropriate review and testing.

Human oversight remains important.

Security testing isn’t simply about ticking a compliance box. A good penetration test looks at how an application could be attacked in practice and identifies weaknesses before a criminal can exploit them.

This might be particularly useful when you’re:

The aim isn’t just to produce a list of technical findings, but to understand which weaknesses matter most and what should be fixed first.

You don’t need to be a cyber security specialist to start asking useful questions:

If you don’t know the answer, that’s a good place to start. The Cyber and Fraud Centre – Scotland’s AI and Web Application Security Assessment helps organisations identify vulnerabilities in web applications and AI-enabled systems and understand the practical steps they can take to address them.

Find out more about our AI and Web App Security Assessment here.