AI security for business: what needs to change.
AI makes it easier to find weaknesses. Connected agents also create new paths into your systems. Leaders need a clear view of exposure, authority and recovery, with someone accountable for each.
Faster attacks. More connected software acting for you.
There are two security decisions on the AI roadmap. First, how your existing business responds when attackers can investigate and exploit weaknesses faster. Second, how you protect the AI systems your own teams introduce.
Google’s September 2026 vulnerability research documents changes in discovery and exploitation, including the weaponization of known flaws. The operating question is how quickly your team can identify a relevant exposure, reach its owner, deploy a tested fix and verify the result.
An agent adds a different boundary. It can read a document, interpret instructions and call a tool that changes a business system. An attacker may try to steer that sequence through the material the agent reads. OpenAI’s prompt-injection research explains why defenses need to constrain the effect of manipulation as well as detect it.
Ask for five things your team can show.
Bring the business owner, IT or security lead, and relevant service provider into the same review. Work through the systems that matter to revenue, customers and continuity.
| Decision | Ask to see | Who owns the next action |
|---|---|---|
| What needs to be reachable? | An inventory of internet-facing services, their owners, vendor support and business purpose. | IT and the service owner remove unnecessary exposure or replace unsupported services. |
| Which weakness gets fixed first? | A queue that combines exposure, exploit evidence and business impact, with tested fixes and open exceptions. | Security sets the priority; the system owner delivers and verifies remediation. |
| Who and what can reach critical systems? | Accounts, agent identities, permissions and a demonstrated way to revoke access. | Identity and system owners narrow access to the approved job. |
| Which AI tools already handle company data? | Approved tools, discovered employee usage, connected services and the data each receives. | IT and business leaders provide a usable approved route and resolve gaps. |
| How does work continue during an incident? | A tested restore, a manual fallback and a clear incident contact and decision path. | Security coordinates containment; business owners rehearse continuity. |
These priorities align with Australian government guidance for medium-sized businesses: reduce unnecessary exposure, patch promptly, limit privilege, examine logs and practice recovery. AI can help the team investigate and prepare fixes; production changes still need a controlled release and verification.
Agree the job, then enforce its boundaries.
- Give it an identity and an owner. Record its purpose, accountable business owner and technical maintainer. Make its activity distinguishable from a person’s.
- Scope both reading and acting. Specify the records it can retrieve, the tools it can call and the changes it may make. Enforce those permissions in the connected systems.
- Make consequential actions explicit. Decide who can approve payments, account changes, external messages or other commitments. Show that person the exact proposed action and supporting evidence.
- Test the boundary under pressure. Include a restricted record, a misleading document, an unavailable approver and a failed tool call. Check the attempted action and the system’s response.
- Make stopping and recovery routine. Revoke credentials, stop queued work, preserve logs and return the team to its fallback. Repeat the checks after material model, tool or permission changes.
NIST’s agent identity design tenets emphasize separating reasoning from access decisions, human-review triggers and continuing monitoring. Our governance guide maps those decisions across reading, drafting, approving and acting.
An invoice assistant should have a very small job.
Suppose a services company uses an agent to compare supplier invoices with approved purchase orders. Finance wants exceptions prepared for review. The agent needs selected records and a place to draft its findings.
An incoming document includes a request to use new bank details. The agent can flag the discrepancy and attach the source. Finance verifies the change through its established independent process. Payment approval and supplier-bank changes stay with the authorized people and systems.
Before launch, test the same workflow with a restricted invoice, conflicting records, a broken connection and an embedded instruction asking the agent to send data elsewhere. The acceptance record should show which request was blocked, who reviewed the exception and whether the status accurately reflects the outcome.
That last detail matters. In our local permission-and-delivery implementation lesson, access was blocked while a status still suggested delivery. Testing the permission and testing the reported result belong in the same release review. See how to evaluate and monitor the workflow.
Trace where a real request goes.
For one representative task, follow the source record through retrieval, model processing, tools, logs and the final destination. Include any external model provider and subprocessors. Confirm retention, training use, administrative access and deletion against the service and contract you will actually use.
Hosted, on-premises and hybrid deployments offer different control points. Local document storage can coexist with passages sent to an external model. Put those flows on the diagram before deciding which architecture fits. Our company AI infrastructure offer and shared infrastructure guide explain the implementation choices.
Give employees an approved way to do useful work, with clear data rules and a route to request new tools. Review usage as workflows change. A policy becomes practical when people can complete the job inside its boundaries.
Make the next decision easy to assign.
The executive sponsor funds the priority and resolves tradeoffs. Security and IT own security requirements and incident handling. The workflow owner accepts the operating result. The implementation lead connects those decisions to the build, release and ongoing maintenance. Name the implementation owners before expanding access.
Review unresolved exposures, remediation time, rejected unauthorized actions, review effort and recovery tests. Look at the underlying cases as well as the totals. A rise in blocked requests may mean better detection, more attacks or a workflow that needs redesign; investigate before calling it progress.
For your next review, leave with four things: the system and data-flow map, the named owners, the launch tests and their results, and a prioritized fix list with dates. Use them to decide what can launch, what needs a narrower scope and what must be resolved first.
Go deeper on the next decision: review an agent before production, create an approved path for employee AI use, or check an AI vendor’s evidence.
Measured Intuition works with your business and IT or security team to define the workflow, build the required controls, test the handoffs and establish ongoing ownership.