AI is accelerating cybersecurity threats. Learn how data minimization, incident response, data mapping, and vendor governance can help reduce risk.
Recent reports involving leading artificial intelligence (AI) developers have heightened concern about whether AI agents can operate beyond their intended boundaries and/or be used by cyber criminals to perpetuate attacks that are more difficult to prevent and contain. For organizations adopting AI across business functions, the issue is larger than any single model or incident: AI may allow threat actors to identify vulnerabilities, develop exploits, and move through connected systems at a speed that outpaces traditional defenses.
That does not make existing safeguards obsolete. Multifactor authentication, endpoint detection and response, encryption and other controls remain essential. But organizations may need to reassess what constitutes “reasonable safeguards” in an environment where attacks can become faster, more adaptive, and more difficult to contain.
Co-leaders of Jackson Lewis’ Privacy, Data & Cybersecurity group, Joe Lazzarotti and Damon Silver, recently discussed how legal, privacy, and security teams can respond. Their central message: prevention remains critical, but organizations also need to reduce the data and access available to an intruder and prepare to respond when controls are overcome.
Key Takeaways
- AI may enable threat actors to discover and exploit vulnerabilities faster than organizations can remediate them.
- Technical controls alone are unlikely to provide a complete legal or operational risk-management strategy.
- Data minimization, accurate data maps, access restrictions, and network segmentation can help limit the scope of an incident.
- De-identification should be tested against current re-identification capabilities rather than treated as a complete solution.
- Vendor diligence should address AI use, downstream providers, incident obligations, and meaningful contractual protections.
How Is AI Changing the Cybersecurity Threat Landscape?
Many security programs were designed around the speed and methods of human attackers. AI can change that equation. A malicious actor may use AI to identify a vulnerability, adapt code, and build an exploit on a compressed timeline, potentially before a patch or other defensive measure is available.
The practical implication is not that organizations should abandon their existing security investments. Rather, leaders should evaluate whether controls are configured, monitored, and updated for AI-enabled threats—and whether the organization can identify, contain and recover from an intrusion that succeeds.
Should Organizations Shift Their Focus From Prevention to Preparedness?
Organizations need both. Prevention supports compliance and reduces the likelihood of an incident, while preparedness reduces the business, legal, and reputational consequences when prevention fails. The familiar assumption that a breach is a matter of “when,” not “if,” is becoming more important as AI accelerates—and tips the balance, unfavorably, in—the contest between attackers and defenders.
Incident response plans should address decision-making authority, internal escalation, preservation of evidence, business continuity, communications, and potential notification obligations. Tabletop exercises can reveal whether the plan works under pressure and whether legal, privacy, security, HR, communications, and business leaders understand their roles.
“Prevention remains critical, but preparedness determines how effectively an organization can contain disruption and meet its obligations when controls fail.”
How Can Data Minimization Reduce AI-Related Exposure?
AI makes it easier to extract value from large datasets, creating a powerful incentive to collect and retain more information. That same footprint increases exposure. If an attacker gains access, a larger and more connected data environment can increase the number of affected individuals, the sensitivity of compromised information, operational disruption, and downstream litigation or regulatory risk.
Organizations should define what data they need, why they need it, and how long it should remain in active systems. Information that has a valid business or legal purpose may be archived more securely, redacted, or otherwise restricted; information without a continuing purpose may be eligible for defensible deletion.
The goal is not deletion for its own sake. It is aligning the organization’s data footprint with legitimate operational, legal and compliance needs.
“The larger and more connected the data footprint, the more an intruder may be able to access—and the greater the potential legal and operational impact.”
Can Organizations Continue to Rely on De-Identified Data?
De-identification and aggregation remain useful tools, but they should not be treated as automatic safe harbors. Even before generative AI, removing a name did not necessarily prevent a person from being identified through other data points. AI can make that reconstruction faster and more effective.
Organizations should document the standard used to de-identify data, assess the likelihood of re-identification using current capabilities, and restrict attempts to re-identify information. Vendor agreements should define de-identification rather than relying on an undefined promise that data will be “aggregated” or “de-identified.”
Why Are Data Mapping and Access Controls More Important Now?
AI tools increasingly connect with email, documents, collaboration platforms, and other business applications. Those integrations can improve productivity, but they may also allow a compromised account or agent to reach multiple repositories and move laterally through the environment.
Current data maps can help an organization determine which systems contain personal, health, employment, financial, confidential, or proprietary information; how those systems interact; who can access them; and where backups are maintained. Without that visibility, the early stages of incident response can become a costly search for what the organization is actually responding to.
Access should be limited according to job responsibilities, with heightened controls for privileged and administrative accounts. Network segmentation and restrictions between connected applications can further reduce the ability of an intruder to turn one compromised system into an enterprise-wide event.
What Should Organizations Ask Their AI Vendors?
A vendor’s size, reputation, or security budget does not eliminate risk. Organizations should “trust but verify” by conducting diligence proportionate to the sensitivity of the data, the tool’s integrations, and the potential operational consequences of an incident.
The review should address what information the vendor receives, whether it may use the information to train models or develop products, how long it retains the information, where it is processed, and which downstream service providers can access it. Contracts should address appropriate security measures, incident notification and cooperation, data usage restrictions, data return or deletion, audit or assurance rights, indemnification (where feasible), and responsibility for subprocessors.
Because visibility may diminish farther down the vendor chain, organizations should at least understand how the primary vendor evaluates, contracts with, and monitors its own providers. Consistent documentation of the review can help demonstrate a reasoned process if an incident or regulatory inquiry occurs.
What Should Legal, Privacy, and Security Leaders Do Next?
Cybersecurity is not solely an IT responsibility. When an organization must explain its conduct to a regulator, court, customer, or business partner, a list of technical tools will rarely tell the entire story. A stronger position combines appropriately configured safeguards with evidence of governance, preparation, and risk-based decision-making.
A Practical AI Cybersecurity Checklist
- Reassess cybersecurity risk to account for AI-enabled attack speed and system connectivity.
- Update and rehearse your incident response plan, including legal, regulatory, operational, and communications workflows.
- Refresh data maps as AI pilots and integrations are introduced or expanded.
- Apply collection, use, retention, archival, and deletion rules to personal and confidential information.
- Review privileged access, application permissions, and network segmentation.
- Evaluate whether de-identification methods remain effective against current re-identification capabilities.
- Strengthen AI vendor diligence, contract protections and oversight of downstream providers.
Takeaway
AI may make cyber incidents more frequent, faster, and more harmful and disruptive, but organizations have multiple levers available to manage the risk. The most resilient programs will not rely on a single technology or policy. They will combine prevention with practiced response, minimize the data and access available to an intruder, maintain visibility into connected systems, and manage downstream risk.
Organizations evaluating or deploying AI should coordinate legal, privacy, security, HR, procurement, and business stakeholders before risks become incidents. A focused review of data flows, access, retention, vendor relationships, and incident response readiness can identify practical improvements and help build a defensible record of risk-based decision-making.