AI governance is the missing security control

COMMENTARY: Artificial intelligence is changing enterprise security, but not in the way many organizations expected. Much of today's discussion focuses on securing AI models, defending against prompt injection, or evaluating emerging threats. Those are important topics. They deserve attention. 

In my experience, however, organizations are overlooking something more fundamental. They are treating AI governance as a compliance exercise instead of recognizing it as an essential security capability. 

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

Throughout my career, I've found that organizations rarely struggle because they lack technology. More often, they struggle because governance has not kept pace with the technology they've adopted. Artificial intelligence is the latest example. 

Today's information security programs do an excellent job protecting networks, endpoints, identities, applications, and data. Those controls remain essential. But many of the risks associated with AI are introduced long before traditional cybersecurity controls become relevant. The decision to allow employees to use public generative AI. The selection of a third-party AI provider. The approval of an AI-enabled business application. The information made available to an AI model. The accountability for decisions influenced by AI.

None of these are technical control decisions. They are governance decisions. That distinction matters because governance influences risk before technology reaches production. 

Related reading:

For years, security professionals have categorized controls as preventive, detective, or corrective. I believe AI governance deserves to be viewed in exactly the same way.

When governance is effective, organizations understand where AI is being used, who owns the associated business risks, how AI systems are evaluated before deployment, and how they are monitored as they evolve. When governance is weak, security teams inherit risks that technical controls were never designed to solve. Fortunately, most organizations do not need an entirely new AI governance program. 

In my experience, the better approach is to build upon existing governance processes that already exist. Architecture review boards. Enterprise risk management. Vendor risk management. Secure development practices. Operational resilience. Internal audit. These disciplines already help organizations evaluate technology risk. AI simply requires expanding the questions we ask. 

Instead of reviewing only authentication, encryption, and logging, organizations should also consider, for example: 

These questions belong in governance discussions before implementation — not during incident response. Another area that deserves greater attention is visibility. 

Many organizations maintain excellent inventories of hardware, software, cloud services, and third-party vendors. Far fewer understand how AI is actually being used throughout the enterprise. Developers and Traders use coding assistants. Business users summarize confidential documents. Marketing creates content. Customer service relies on conversational AI. Vendors continue adding AI capabilities to products organizations already own. 

AI is becoming embedded in everyday business operations, often without the same level of visibility that organizations expect for other technologies. Security managers cannot govern technology they do not know exists. That makes visibility one of the first responsibilities of AI governance. I also believe governance should never become an obstacle to innovation. 

Good governance enables innovation because it establishes accountability before problems occur. Business leaders gain assurance to move forward. Developers and Traders understand expectations. Security teams know where AI is deployed. Executives receive meaningful information instead of surprises. Organizations make better decisions because responsibilities have been clearly defined. That has always been the purpose of effective governance. Artificial intelligence simply reinforces its importance.

Every major technology shift has required organizations to rethink how they manage risk. Cloud computing changed identity. Mobile computing changed endpoint security. Digital transformation expanded third-party risk. Artificial intelligence is changing the governance paradigm. 

The organizations that succeed over the next decade will not necessarily be those that deploy the most AI. They will be those that integrate AI into existing governance, security, and enterprise risk management processes while preserving accountability, resilience, and trust. In my view, that is where today's CISO can make the greatest contribution.

Governance is no longer simply supporting security. It is becoming one of the ways security is delivered.