The Need to Secure AI Use Is Real. Are Organizations Prepared?

By Rob Lefferts, Vice President, the Threat Protection organization at Microsoft

Just over a year into its new era, generative AI (GenAI) is already making waves across industries, with many organizations actively engaging or experimenting with this transformative technology. A May 2023 internal Microsoft study indicates that 93% of businesses are either implementing or developing an AI strategy. But there is a blend of excitement and anxiety as the technological advances that drive GenAI innovation and opportunities also bring new security and governance concerns.

The road to AI adoption has leaders feeling uncertain as they navigate through uncharted territory with concerns about sensitive data leakage, harmful or biased outputs, uncertainty of regulations, and challenges protecting custom-built GenAI apps.

Following are some key considerations in developing a strategic approach for embracing AI securely and responsibly.

Block or Adopt AI?

In response to these concerns, a significant portion of security leaders anticipate continued restrictions on AI usage within the workplace. Many security leaders might prefer to delay the use of GenAI, as every new technology they must secure and manage keeps them up at night. But this wave of change will be hard to resist, and it's a mistake to stifle the innovation and productivity that GenAI is bringing.

Inevitably, if we fail to address GenAI security concerns effectively and simply try to ban it in the workplace, users will seek alternative, less secure methods to access and use GenAI apps. For example, users might use GenAI apps through unmanaged devices, over unsecured networks, or by logging in with personal credentials while handling sensitive data.

Instead of trying to block the use of AI, organizations can take a more proactive approach to mitigate and manage risks by gaining visibility into AI use within their environments and implementing corresponding controls. It is about finding the sweet spot of leveraging AI's potential while implementing security and compliance controls to enable secure and responsible adoption.

Securing GenAI Usage: A Multifaceted Approach

While some GenAI apps such as Copilot for Microsoft 365 are designed with built-in controls to adhere to existing privacy, security, and compliance commitments, such as the General Data Protection Regulation (GDPR), it is beneficial for organizations to deploy additional capabilities to further strengthen security and governance for the use of GenAI apps. Specifically, organizations should adopt a strategic approach that addresses three key aspects of securing and governing the use of AI:

By adopting a holistic approach to discover, protect, and govern the use of AI, organizations can benefit from the advantages of this transformative technology, including heightened productivity, enhanced creativity, and increased opportunities, all while effectively managing the associated security and compliance risks. It is about striking that delicate balance between innovation and security.

About the Author

Rob Lefferts is corporate vice president of The Threat Protection organization at Microsoft. He leads the team responsible for Microsoft Defender XDR and Microsoft Sentinel products which provide end-to end comprehensive and cohesive Microsoft security experiences and technology for all of our customers. Lefferts holds a BS and MS from Carnegie Mellon in Pittsburgh, PA.