AI‑Driven Security Decisions Raise Control Gap, Study Finds

Summary

A recent Illumio study reveals that 70 % of organisations now hand critical security decisions to AI that would have been made by humans a year ago. Yet only 49 % can audit the AI’s actions, creating a widening control gap.

Key Findings

• Delegation of Authority – 70 % of firms delegate decisions previously made by humans to AI.
• Auditability Gap – Just 49 % can see or audit the AI’s actions.
• Risk Appetite Rising – 56 % accept higher cyber‑risk than a year ago; 47 % allow AI in production.
• Security Incidents – 76 % experienced AI‑related security issues; 35 % admit AI recommendations caused risk.
• Unauthorized Access – 24 % report AI accessing data it shouldn’t; another 24 % triggered unauthorized actions.
• Unsupervised Operations – 32 % let AI investigate without human oversight; 29 % permit unsupervised code deployment.

Practical Implications

• Set Clear Limits – Define what data and actions AI can perform.
• Enforce Constraints – Embed limits within applications and infrastructure.
• Continuous Monitoring – Regularly audit AI decisions to close the control gap.
• Human‑in‑the‑Loop – Maintain oversight for high‑impact decisions.

How to Verify

1. Audit Trails – Check if your system logs AI decisions.
2. Policy Review – Ensure AI policies match organisational risk appetite.
3. Third‑Party Assessments – Engage security experts to evaluate AI controls.

Bottom Line

While AI can enhance cybersecurity, unchecked autonomy can expose organisations to avoidable risks. Tightening controls and maintaining human oversight are essential to prevent a “control gap” that could jeopardise sensitive data and systems.