Artificial Intelligence (AI) is already changing how organisations work, bringing opportunities to improve efficiency, support employees and automate everyday tasks. But alongside the benefits, come questions about cyber security, data protection and how to use AI responsibly.
These were the themes of our recent event – Making Sense of AI: Cyber Security Myths, Risks and Good Governance, hosted in Edinburgh in partnership with Check Point Software.
The morning workshop brought together perspectives from cyber security, technology and banking to discuss how organisations can benefit from AI while understanding the risks and putting appropriate safeguards in place.
Attendees were given an interactive tabletop exercise, practical discussions about cyber security foundations and AI governance, and insights into how a large regulated financial institution has approached AI adoption.
Speakers included:
- Jude McCorry, CEO at The Cyberfraud Centre, who led discussions on cyber security fundamentals and an interactive AI tabletop exercise.
- Jon Gaspirini, NatWest Group, shared a practitioner’s perspective on building foundations for AI at scale within a regulated organisation.
- Ian Porteous, Check Point Software, who explored the importance of security foundations, visibility and consistent safeguards for AI governance.
Five Practical Steps for Organisations
Whether your organisation is already using AI or just beginning to explore its potential, there are some important steps to consider.
- Get the cyber security basics right
AI introduces new considerations, but it doesn’t replace the need for good cyber security. Strong passwords, multi-factor authentication, regular software updates, access controls and staff awareness remain essential.
Check Point highlighted five key areas leaders can focus on to get the basics right:
- Reduce Attack Surface – understand what is connected to the internet – does it need to be? What threats are most prevalent in your industry? How would your business be vulnerable to them?
- Accelerate Patching Process – focus on remediation. Can you use AI to support this? How do you know which patches to focus on?
- Address Legacy Systems – identify outdated software, maintain an inventory and prioritise updates.
- Review, strengthen identity and access controls – review who can access your systems and data, and remove unnecessary permissions.
- Prepare for incidents before they happen – have a response plan in place, know who is responsible and test your procedures.
Before introducing new AI tools, assess your existing cyber security arrangements and identify any gaps.
2. Understand how AI is already being used
Employees may already be using publicly available AI tools to help with everyday tasks, sometimes without their employer’s knowledge or approval. This is often referred to as shadow AI and can introduce risks, particularly when confidential, personal or commercially sensitive information is entered into tools that haven’t’ been approved.
Start by understanding which tools employees are using, what they’re using them for and what information they’re sharing.
3. Establish clear AI policies and responsibilities
Good AI governance doesn’t have to mean complicated processes. Organisations should establish clear guidance on which AI tools are approved, what information can be shared and when human oversight is required.
Make sure employees understand the rules and know who to approach with questions or concerns. Policies should also be reviewed regularly as AI tools, risks and organisational requirements change.
4. Consider the risks before adopting new tools
Not every AI tool will be suitable for every organisation. Before introducing a new system, consider how it handles data, who can access the information and whether its outputs can be trusted.
NatWest explained their governance framework and a checklist every employee must use when using/bringing in new systems/agents into the organisation.
AI-generated information can be misleading, so human oversight is essential, particularly when the results have an impact on financial, legal or business decisions.
5. Make AI awareness training part of staff training
Employees need to understand both the opportunities and risks associated with AI. Training should cover the safe use of AI tools, recognising AI- enabled scams and knowing when to question or verify AI-generated information.
Keep guidance practical and relevant to the tasks delivered by your employees, rather than focusing solely on technical impact.
Making AI work safely
AI offers organisations many opportunities, but responsible adoption requires more than simply introducing new technology. Understand how AI is being used, establishing appropriate safeguards and helping employees make informed decisions are all important parts of managing the risks, as well as the benefits AI implementation can deliver.
Key point – start with good cyber security hygiene, understand your risks and make sure your team know how to use AI safely.
Thank you Check Point Software for your support, and to our brilliant speakers. For more practical cyber security advice, guidance and support, explore how The Cyberfraud Centre can help you with training, testing and joining our membership community. Find out more about how Check Point can help at https://www.checkpoint.com/exposure-management/