AI helps attackers and defenders, so CISOs need to focus on the risks that could hurt their business most.
The good news? AI gives cyber defenders some of the best discovery tooling they’ve ever had.
The bad news? It gives attackers the same capability.
This duality has left CISOs managing AI on two simultaneous fronts. Outside the organization, attackers are using AI to make phishing more convincing, automate reconnaissance and compress the time between vulnerability disclosure and exploitation. The OpenAI/Hugging Face and JADEPUFFER incidents exposed the risk of autonomous agents carrying out end-to-end attacks without human direction. Inside the organization, employees are adopting AI tools faster than security teams can govern them, and sensitive data is flowing into consumer AI platforms where it is not protected.
As a CISO myself, I’m noticing that when it comes to AI, the temptation is to try to secure everything, everywhere, all at once. That’s impossible. The CISOs who will pull ahead take a “Risk-First” approach, treating AI the same way they treat every other security challenge: as a business risk.
The risk you already own
You’ve likely seen the headlines about AI helping threat actors strengthen their attacks. And that’s certainly true: AI is helping attackers scale social engineering, accelerate research and rapidly develop exploits and malicious tools. Those capabilities will continue to improve. But your exposure may be greater from your business’s own adoption.
We know employees are already using generative AI at work, but it’s problematic when done through personal accounts that operate outside enterprise controls. According to Verizon’s latest DBIR, the share of employees who are regular AI users on corporate devices tripled to 45% last year, up from 15%. Further, roughly two-thirds of AI users on corporate devices used personal accounts outside of enterprise controls. That increases the risk that sensitive information is being uploaded to unsecured LLMs, unbeknownst to security teams.
Furthermore, employees’ own AI agents are beginning to execute tasks with minimal human oversight. In April 2026 at the SaaS company PocketOS, a well-known AI coding agent hit a credential mismatch during a routine task and decided to fix it by deleting a cloud storage volume. It went looking for an API token, found one in an unrelated file whose permissions weren’t scoped to that action, and deleted the production database and all volume-level backups in a single API call.
Another concern is shared agentic systems, which many companies have deployed for productivity. By their nature, internal assistants and copilots need broad reach across systems and data to be useful, which means the platform wrapping the model becomes a high-value target.
Even if a CISO feels confident in their data privacy controls and agent actions, there is a commonly overlooked but simple risk: usage-based billing. As token-based pricing for AI tools becomes standard, API keys and credentials tied to billing accounts become vulnerable. The Resilience Risk Operations Center (ROC) has already observed stolen API tokens being abused to run up AI bills for extremely significant losses. This puts a premium on basic cost-control measures to counter the emerging threat.
External risk from threat actors
The OpenAI/Hugging Face incident brought AI-native and agentic attacks to the top of the news cycle. The attack, carried out by AI models that escaped an isolated testing environment, alerted the security world to the reality of agent-driven attacks, even if the telling carried some marketing puffery. Resilience’s claims data shows that AI-native attacks aren’t leading to financial losses yet, but security teams should prepare for a future of attacks carried out largely by AI, especially as open-weight models catch up.
This spring, Google’s Threat Intelligence Group (GTIG) reported the first zero-day it believes was developed with AI: a two-factor-authentication bypass for a widely used open-source admin tool, written in Python, that a known cybercrime group planned to use in a mass-exploitation run. The incident illustrated the acceleration and enhancement of threats with the help of AI.
Even more concerning is the extensive use of Agentic AI to conduct cyber operations instead of just aiding with specific tasks. Agentic penetration-testing tools are proliferating on the defensive side; AWS even released its own this year, a step toward commoditization. I believe these are a necessary investment for security teams to continuously and proactively identify flaws, because the same capability is already being pointed at real targets. During a recent offensive engagement, researchers from CodeWall deployed an autonomous agent against McKinsey’s proprietary AI ecosystem. Within two hours, the agent successfully leveraged a SQL-injection vulnerability via unsecured APIs to gain full read-write privileges over the production environment. While the consultancy quickly remediated the flaw and reported no signs of data exfiltration, the incident underscores the speed of agent-driven exploitation.
Threat actors are applying the same types of automations with less noble aims. JADEPUFFER automated a small-scale ransomware operation against a database, and we’re starting to see broader automated campaigns: one exploiting government systems in three countries using Claude Code for execution and DeepSeek-v4-pro for reasoning, and another running the Hermes AI agent unattended against Thailand’s Ministry of Finance.
To be clear, AI won’t make attackers invincible. But CISOs should expect compressed, and even negative windows for vulnerability and misconfiguration exploitation. Proactively identifying and addressing these risks with the highest business impact will become even more crucial in 2026.
Focus on the risks that matter most
Trying to solve every problem usually means solving nothing particularly well, and it is no different with AI. Risk-First CISOs identify the risks that are most critical to their business and address them first.
The first step in addressing AI risk is understanding where it is already being used across the business, and where it is most likely to affect the business. Identify which teams are relying on which tools, what data those tools access, and which AI agents are capable of taking autonomous actions. From an external perspective, it’s never been more critical to understand internet-facing services.
From there, CISOs should concentrate on the controls that reduce the greatest business risk. To hedge against actions taken by internal or client-facing tools, role-based access control and identity management should be prioritized, so an account or an agent only reaches what their job requires. Sensitive data should be classified so organizations understand what AI systems are, and aren’t, allowed to access. Prioritize continuous testing and vulnerability identification for IT infrastructure, any software or APIs being offered to clients, and any weaknesses in the software supply chains.
For organizations building software with AI, automated code review and dependency management become even more important as AI increases development speed. Faster code generation can also mean faster introduction of vulnerabilities if review processes don’t evolve alongside it.
Finally, prepare your organization for failure. Tabletop exercises should include scenarios involving compromised AI agents or a key tool or model being disrupted. These exercises help security leaders understand where operational gaps exist before they’re tested during a real incident. At the ground level, now is the time to revisit your social engineering testing and training to ensure it’s both relevant to AI threats and difficult enough to mimic attackers armed with these tools.
AI risk will keep changing faster than any of us can write about it. The answer isn’t to chase every headline or set up a control for every new threat actor technique. Rather, the strategy must be ranking risks by the harm they might do to a business, simulating to confirm and consistently revisiting the ranking as the landscape develops. That’s what will separate Risk-First CISOs from the rest.