AI Cybersecurity Risks: Practical Guidance for Leaders

Frontier artificial intelligence (AI) models, such as Anthropic’s Mythos model family, have drawn attention for their reported ability to find software vulnerabilities, develop exploits, and complete multistep tasks with limited human direction. While the precise extent of those capabilities may be difficult to determine, the direction is apparent: advanced AI can reduce the time and technical skill required to identify and exploit weaknesses. National and international bodies now describe this openly. The European Commission has noted that advanced AI can be misused to identify vulnerabilities, automate attacks, and increase the scale and speed of cyber incidents.1 The National Institute of Standards and Technology (NIST) makes a similar point, framing AI-enabled cyberthreats as a core concern for enterprise risk management.2

The operating conditions for cybersecurity are changing rapidly, placing more pressure on organizations to apply a defense-in-depth strategy.

As businesses integrate AI tools into software development, customer service, financial processes, and internal operations, the stakes are high. Some systems retrieve sensitive information, connect to critical business systems, and act through an employee’s or AI agent’s permissions. Organizations also may become dependent on AI models whose availability is controlled by an outside provider or affected by government action.3

Business leaders now face two corresponding questions regarding external and internal risks:

How will AI change threats directed at the organization?
What new exposure will the organization create by embedding AI inside its own operations?

Vulnerability Discovery Is Getting Faster

AI technology didn’t invent software vulnerabilities or zero-day attacks. Researchers and threat actors have long looked for weaknesses in operating systems, browsers, applications, and infrastructure. What frontier models can escalate is the speed and scale of that work. The European Commission observes that frontier capabilities, once concentrated in a few systems, are becoming more accessible as open-source models improve, including to criminal actors who can leverage these models to execute more complex attacks than they could perform on their own.4

This creates an imbalance between attackers and defenders. Attackers can move quickly after finding a weakness. Defenders need to validate patches, account for business dependencies, and deploy changes without disrupting operations. The imbalance exposes technical debt that organizations may have carried for years. Unsupported software, incomplete asset inventories, excessive administrative access, and delayed remediation become harder to permit when adversaries can scan more targets, identify more escalation paths, and execute faster attacks.

The lesson here is that organizations shouldn’t wait for public exploit code before fixing a weakness.

“AI doesn’t make cybersecurity and defense-in-depth fundamentals obsolete. It makes inconsistent policies and procedures harder to absorb.”

Defense in Depth Still Matters

A single tool or platform can’t eliminate the possibility of an AI-assisted attack. A more durable approach uses multiple controls so that one weakness doesn’t lead directly to a material incident.

The first step is knowing what technology the organization relies on, including its systems, applications, accounts, and external providers. Leaders need an accurate view of internet-facing assets, internal applications, software dependencies, privileged accounts, and critical third parties. Vulnerability management should reflect business exposure rather than depend only on a severity score. NIST advises reassessing the relative importance of data assets and updating inventories as AI adoption spreads.5

Testing should become more frequent. Periodic penetration tests offer useful insight, but this approach captures conditions at a single point in time. Continuous validation, or continuous penetration as a service, can help secure development practices. In addition, AI-assisted testing can help identify weaknesses between formal assessments.

Further, identity controls remain critical. Multifactor authentication, least privilege access, approval requirements, and monitoring for unusual changes can help limit what happens after an initial compromise. Segmentation and egress controls can limit an attacker’s ability to move through the environment or send information outside of it.

Detection and response can help round out a more durable and structured approach. The objective is to help prevent one compromised application, identity, or device from giving unrestricted access to the organization.

Agentic AI Creates Another Attack Surface

The focus on AI-assisted hacking can obscure a second concern. AI tools are becoming active players in enterprise workflows. An AI agent may retrieve records, analyze documents, draft communications, call an application programming interface (API), or change a configuration. Its authority may come from a user account, service account, API key, or delegated permission.

This raises a different question: What happens if the agent is manipulated while using legitimate access? Prompt injection provides a clear example. IBM describes it as an attack where malicious content disguised as benign input overrides an application’s system instructions, turning the app into an attacker’s tool.6 IBM also notes that agents introduce a unique risk because they can operate autonomously and often interact with external systems, where over-permissioning and manipulated inputs can lead to cascading effects.7 However, prompt injection is just one example among several. The Open Web Application Security Project’s (OWASP) “Top 10 for LLM Applications” also catalogs excessive agency and insecure output handling, both closely tied to how an over-permissioned agent can turn a manipulated input into a real-world, disruptive action.8

Traditional application security remains relevant but likely will not be sufficient on its own. For each higher-impact AI tool or agent, leaders should be able to answer:

Who owns the agent and the business process it supports?
Which data, applications, and tools can it access?
What identity and credentials does it use?
Which actions can it take without human approval?
How is its activity recorded and reviewed?
Can the organization pause it, revoke access, or reverse its actions?

Human oversight should mean more than a notification after the fact. If an AI agent has already sent data or changed a system setting, the person reviewing it isn’t preventing the action. For higher-risk actions, a person with appropriate knowledge and authority should review and approve the step first.

Model Access Is a Continuity Issue

The availability of AI models and tools may be affected by more than technology outages. In one recent case, a leading provider suspended access to an advanced model under a government directive. Due to the novel nature of the model, it wasn’t widely used in production systems. If it was, it would have been a lesson exploring the relationship of AI and business continuity.9 While the government restriction was lifted, the significance is broader.

This action taken by the federal government highlights that a model may become unavailable because of government action, a frontier provider decision, geographic restrictions, capacity limits, or a security concern. Organizations should identify which critical workflows depend on a particular model, provider, or hosting platform, and address what happens if access changes with little notice. In Europe, the Cyber Resilience Act is turning this resilience concern into concrete obligations, with mandatory cybersecurity requirements across the lifecycle of digital products and reporting obligations beginning later this year.10

AI model substitution can help, but replacing one model with another isn’t the same as switching to a backup system. Models interpret instructions differently, apply different safety controls, and produce different results. A replacement should pass defined performance, security, and governance tests before supporting critical functions.

Third-Party Review Needs to Follow the Full AI Chain

Vendor review should extend beyond the company providing the model. An AI workflow may depend on an orchestration platform, retrieval system, data store, connector, external API, and several business applications. Each component affects what information the system receives and what actions it can take.

Organizations should understand which models and third-party vendors are involved, whether customer information may be retained or used for training, how security testing is performed, and how material changes are communicated. Traditional evidence still matters. Recent penetration testing, source-code review, vulnerability management, access controls, and incident-notification practices remain important. An AI-specific review correlated to the risk level of the system should supplement those checks, not replace them.

Actions to Consider Now

As AI becomes part of more business and security workflows, leaders can take several steps to help reduce exposure and improve resilience, including:

Inventory AI-enabled workflows. Record the owner, model, impact assessments, provider, connected data, identity, and permissions for each system.
Identify technical debt. Focus on unsupported assets, internet-facing systems, and excessive privileges.
Review AI agent authority. Limit permissions to the intended purpose and require approval before high-impact actions.
Expand security testing. Include prompt manipulation, untrusted retrieved content, tool use, and sensitive data exposure.
Update incident procedures. Define how teams capture and retain prompts, retrieved content, tool-call logs, approvals, and system change records.
Plan for AI model disruption. Identify critical dependencies, define a manual fallback, and test approved alternatives before an outage or disruption occurs.
Test containment. Confirm cybersecurity teams can pause an AI agent, revoke credentials, block connected tools, and recover from unintended actions.

How Forvis Mazars Can Help

Business leaders should resist organizing their AI cybersecurity strategy around one model or one announcement. AI is making the offensive work faster while also becoming embedded in the systems that organizations need to protect. That combination raises the cost of a weak defense-in-depth strategy and expands the scope of AI governance. Organizations may be better positioned when they understand technology dependencies, constrain the authority given to AI tools, and maintain controls that remain effective as individual technologies change. AI cybersecurity strategy and governance will not remove uncertainty, but they can help make incidents less disruptive.

To discuss how these practices may apply to your environment, connect with IT Risk & Compliance professionals from Forvis Mazars today.