Even as AI has become the predominant technology topic this year, the recent TrendAI Spark conference exposed that cybersecurity is still a major concern.

If anything, AI has driven cybersecurity and the challenges it portends even further to the forefront. Bilal Baig, the VP solution engineer for AMEA, began by highlighting what has become increasingly apparent this year - that AI is rapidly reshaping the world around us.

What is less obvious is that AI is reshaping how software is developed. He noted that last year, developers using GitHub made about 1 billion code commits (in software development, a code commit is a snapshot of changes made to the source code of a project, that enables developers to revert back to previous states, and collaborate). This year, that number has increased to a whopping 14 billion.

''That increase does not mean there are 14 times more developers; it means AI is generating far more code now and also that AI is not a temporary trend but here to stay,'' he explained.

Baig continued that additionally, trillions of dollars are being invested in the technology, with it bringing changes, and indeed, welcome innovation across a multitude of sectors, every single day.

He continued that a natural outgrowth is that AI is now evolving considerably faster that most organisations can adapt to and absorb.

Safety last?

The problem, he noted, is that decisions made around AI at the outset are not based on safety, but on speed: on how quickly something can be built and moved into production.

The stark question that every organisations if being confronted with though, is whether they are ready for it from a cybersecurity perspective.

''The world has changed so quickly that our playbooks have not kept pace, because as innovation increases so does risk,'' he noted.

But that is not the only complication, with AI demanding a completely different way of looking at vulnerabilities.

Baig stressed that organisations must move beyond reactive defense. This is complicated by the fact that for organisations who aren't already proactive, need to contend with attackers - many of which are deploying AI for their own ends - already performing malicious attacks.

Danger in the shadows

And then there is the issue of shadow AI. Like Shadow IT, where employees use IT solutions on their own without their IT department's go-ahead, Shadow AI entails employees using their personal AI accounts on corporate tasks, and developers are using AI generated code that doesn't have the benefit of a security review.

A part of the reason why is because of the demand from manageent, who now expect faster decisions, innovation velocity and new business insights that can afford the business competitive advantage.

The question becomes then,  how can organisations take advantage of the benefits that AI brings without falling foul to greater risk to their cybersecurity and a rapidly expanding attack surface?

To this end, Baig stressed the importance of data/AI governance, noting that ironically, rather than slowing down or impeding AI adoption, governance actually enables it.

''Businesses need to greater observability and understanding of what AI is doing in their organisation, and how, so that they have a well-defined chain of accountability,'' he stressed.  

Ultimately, responsibility matters. When something goes wrong, organizations need a clear process for tracing decisions and determining accountability.

Staying on the right tracks

Ironically, he noted that the fastest-moving organizations today are not avoiding governance; they are deliberately building AI governance frameworks. He pointed out the common misconception that governance means more red tape and approvals. In an agentic AI environment, however, doing governance well actually makes organizations faster, because speed requires control.

 He explained that this starts with visibility: knowing what AI agents are doing and how they interact. The next pillar is observability, which means understanding the context in which AI operates and why it takes certain actions. The final pillar is action: having the ability to make informed decisions based on that context.

‘’Governance does not slow AI down; the absence of governance does,’’ he stressed.

 Furthermore, he explained that clear ownership enables faster decisions, while visibility into shadow AI reduces surprises, and accountability creates confidence.

Deus Ex machina

But, as is increasingly becoming an important question on all matters concerning AI, where do humans fit in?

Baig stressed that humans should remain in the loop when autonomous agents perform tasks, especially for critical decisions. ‘’When AI produces an outcome, people must judge whether that result could disrupt a process, system, or organization in ways AI may not understand. For now, humans remain essential to critical decision-making, even though that may change over time,’’ he noted.

 He offered a series of questions that organisations can pose to themselves, to assess their own guardrails, and before scaling their AI initiatives:

What AI is running in your organization, and what data does it access? He noted that many organisations may have strong visibility into their networks, with firewalls that can identify managed and unmanaged devices. But when it comes to AI tools, many organizations still lack that same visibility, especially as employees find ways to use unsanctioned tools.

Secondly, how will you respond to the new classes of vulnerabilities emerging from frontier AI models? Terms such as “vulnerability avalanche” and “patch megadon” reflect the scale of the challenge. However, the fact remains that organizations must be ready to manage a growing wave of vulnerabilities, especially as cybercrime syndicates are employing AI to launch threats at a far greater scale.

Thirdly, is your security function prepared for this pace of change? Can it adapt as quickly as innovation is moving?

And finally, do you have an agentic AI governance framework that lets you understand, monitor, and manage what AI agents are doing?

It seemed to me that the crux of Baig’s position on AI and cybersecurity is that organisations should not deny either one, but rather manage their security, and how they deploy and use AI better.

That way, it seems, is where the real benefits of AI can be most securely, and quickly, realized.