Cybersecurity for the AI Era: Defending AI, and Defending Against It

AI has changed cybersecurity in both directions at once. Attackers use it to scale and sharpen their campaigns, and organisations now have a new, poorly understood attack surface to defend: the AI systems they are rushing into production. Cybersecurity for the AI era means handling both. Treating them as two separate problems, owned by two separate teams, is how organisations fall behind on each.

The stance here is simple. You do not need a second security programme for AI. You need the existing programme extended, with identity at its centre, to cover attackers with new capabilities and assets of a new kind.

The threat side: AI-powered attacks

AI makes the expensive parts of an attack cheap.

• Phishing and social engineering at scale. Messages are personalised, fluent in any language, and free of the clumsy tells that awareness training taught people to spot.
• Deepfake-enabled fraud. Cloned voices and synthetic video are convincing enough to be used in attempts to authorise payments or reset credentials through a help desk.
• Faster reconnaissance and exploit development. Attackers can map an organisation from public sources and work on newly disclosed vulnerabilities more quickly, which shortens the time defenders have to patch.
• Lower skill barriers. Capabilities that once needed an experienced operator are now within reach of less skilled groups.

The defensive answer is maturity, not panic, and three shifts matter most. Stop relying on people to detect fakes: move to phishing-resistant authentication, and make high-value actions such as payment changes, supplier bank detail updates and credential resets depend on a process control, for example a call-back to a known number, a second approver or a waiting period. Shorten patch cycles for internet-facing systems and know exactly what you have exposed. And use AI-assisted detection and triage in the security operations team, so analysts spend their time on judgement and not on sorting alerts.

The new attack surface: securing AI itself

The more novel risk is the AI you deploy. These systems introduce failure modes that traditional security never had to consider.

• Prompt injection. Instructions hidden in an email, web page or document can redirect an assistant that reads it, turning a helpful tool into a channel for data theft or fraud. Filtering helps but is not a complete fix, so design must assume injection will sometimes succeed.
• Data poisoning. Corrupted training data or a tampered knowledge base changes behaviour at the source.
• Data leakage. Assistants connected to file stores with over-broad permissions will surface whatever they can reach, and sensitive material pasted into unapproved public tools leaves your control.
• Supply chain exposure. Models, plug-ins, open-source components and tool connectors come from third parties and deserve the same scrutiny as any other software dependency.
• Agent risk. Autonomous systems hold credentials and can act. One compromise has real consequences: a payment, a deleted record, a message sent in your name.

Securing AI means extending the security programme to models, their data and their agents. In practice that means an inventory of AI systems and the data each can reach, scoped and short-lived credentials for every agent, filtering of inputs and outputs, human approval for consequential actions, logging of prompts and tool calls, and behavioural monitoring that notices when an agent starts doing something unusual.

In the AI era, the identity perimeter has to cover humans, machines and AI agents alike. An organisation that secures only its people has secured a shrinking fraction of its attack surface.

Shadow AI: the risk you cannot see

Staff adopt useful tools faster than policy can follow. Browser extensions, meeting note-takers, personal accounts on public assistants and AI features switched on inside existing SaaS products all move data to places the security team has not assessed.

Blanket bans rarely hold, and they push usage out of sight. A better approach has three parts: provide approved tools good enough that people choose them, publish plain guidance on what data may go where, and monitor for unsanctioned use with the intent of moving teams onto safe alternatives. This is as much an organisational change and AI adoption task as a technical one.

One cybersecurity posture for the AI era, not two

Organisations defending well refuse to separate these problems. A single architecture, with zero trust at its core, handles both. Strong identity and least privilege limit what a phished credential can reach, and the same controls limit what a manipulated agent can do. Segmentation contains a compromised laptop and a compromised model endpoint alike. We set out the approach in zero trust as an operating model.

Governance should be joined up too. AI risk belongs in the same risk register, the same incident response plan and the same board reporting as the rest of cyber risk. Frameworks help here. The NIST AI Risk Management Framework and ISO/IEC 42001 give structure for managing AI systems, and they sit comfortably beside the security standards most organisations already follow. In the EU, NIS2 and DORA raise expectations on cyber resilience for the entities in scope, and the EU AI Act, whose obligations are phasing in over several years, includes requirements on accuracy and cybersecurity for high-risk systems. Our EU AI Act compliance playbook covers the practical steps. Confirm current timelines and your own scope with counsel.

Finally, test it. Conventional penetration testing does not cover prompt injection or agent misuse, so add red teaming of your AI systems to the assurance plan before launch and after every significant change.

Questions to ask your team

• Inventory. Which AI systems are in production or pilot, who owns each, and what data and tools can each reach?
• Agent identity. Does every agent have its own identity with scoped, expiring credentials, or does it borrow a person's access?
• Payment and credential controls. Could a convincing voice or video call alone cause money to move or a password to be reset?
• Untrusted content. Which assistants read emails, web pages or uploaded documents, and what could an injected instruction make them do?
• Incident response. Does the plan include a scenario for a compromised or misbehaving AI system, including how to switch it off?
• Suppliers. Do contracts and due diligence cover how vendors use AI with your data?
• Shadow AI. Do we know which unapproved tools are in use, and have we offered a sanctioned alternative?

If several of these have no clear answer, that is the agenda for the next quarter.

Common questions

How is AI changing cyber attacks?

AI lowers the cost and skill needed for convincing phishing, voice and video impersonation, reconnaissance and exploit development. The techniques are familiar, but they arrive faster, in greater volume and with better quality. Defences that depend on people spotting errors are weakening, so process controls and strong authentication matter more.

What is prompt injection and can it be prevented?

Prompt injection is when text in content an AI system reads is treated as an instruction, causing it to abandon its intended task. Filtering reduces the risk but does not remove it. The dependable defence is to limit what the system can access and do, and to require approval for consequential actions.

Do we need a separate AI security team?

Usually not. Most organisations are better served by extending the existing security function with AI-specific skills and testing, and by giving AI product owners clear security responsibilities. A separate team tends to create gaps between AI risk and the rest of the security programme.

Where Ganexa can help

Ganexa's Cybersecurity for the AI Era service helps organisations modernise towards zero trust, defend against AI-powered threats and secure their own AI systems and agents as one coherent posture. Where controls need to map to regulatory and standards obligations, our AI governance and compliance team works alongside. To review where you stand, book a free consultation.