Dive Brief:
-
Companies are failing to close critical cybersecurity gaps related to shadow AI, even as they spend more money on security, security vendor DNSFilter said in a report published on Tuesday.
-
Large shares of IT and cybersecurity workers reported a lack of faith in their security governance.
-
The survey underscores the need for centralized management of companies’ security platforms — a challenge at a time when teams are rushing to buy and install defensive tools.
Dive Insight:
Companies aren’t blind to cybersecurity threats. They know they need to spend more money on firewalls, intrusion-detection systems, identity-management platforms and other technologies. Three-quarters of the 400 IT and cybersecurity workers interviewed by DNSFilter said they’d increased their budgets over the past 12 months. Roughly one-fifth of respondents said their budgets had grown by more than 10%.
As AI creates new security challenges and magnifies old ones, security professionals are responding. Four in 10 respondents said their next dollar would go to AI security and governance, far surpassing the second most-cited priority, cloud security, cited by one-quarter of respondents.
But spending priorities don’t automatically secure networks, DNSFilter warned. Instead, leaders need to pair increased spending with stricter policies, in both the technical and human contexts. Currently, many organizations have lax AI policies, letting security weaknesses slip unseen into corporate networks.
Nearly half of IT and cybersecurity workers said they were confident that unapproved AI apps were connected to their companies’ systems, and one-fifth of respondents said an unapproved AI integration had led to a cybersecurity incident.
“The proliferation of AI has caused organizations to move faster than they might be ready for,” DNSFilter said in the report. “While the budgets have increased, the policies and governance haven’t necessarily kept pace.”
More than one-third of respondents told DNSFilter that they only find out about employees connecting AI apps to their work accounts after the fact, and another 7% said they don’t require employees to notify their IT departments about AI app connections at all.
“The decision to connect an AI tool to corporate data is made by someone who does not own the risk,” DNSFilter said.
Companies are also finding it difficult to manage their security tools. Nearly two-thirds of respondents said they weren’t sure that all their tools were properly configured, and a similar number couldn’t confirm that all of their tools were actively monitored.
“Governance spending is not the same as governance,” DNSFilter warned. “The budget bought you a policy, but the tools are still getting connected to your environment — and you can’t see them.”
