All news with #ai governance tag

🚀 PayPal completed a multi-year, large-scale migration of more than 300 petabytes of analytics data into BigQuery on Google Cloud to create a unified data foundation for generative AI. The initiative consolidated disparate platforms — including Teradata, Hadoop, Redshift, and Snowflake — and reduced vendor complexity. PayPal automated migration tasks, used live dashboards, and integrated FinOps to maintain zero business downtime while enabling faster queries and much fresher data for AI model training.

🔐 This practical Q&A guide helps leaders translate evolving threats into actionable resilience measures. It highlights why national cyber security urgency has increased as adversaries shift from theft to persistent, disruptive positioning that can affect fuel, hospitals, elections, markets, and public trust. The brief recommends adoption of NIST frameworks, Zero Trust principles, and AI governance to mitigate cloud, OT, and supply chain risks. Leaders receive concise operational steps to align policy, technology, and cross‑sector coordination.

🔍 DTEX's Cost of Insider Risks 2026 report, produced with the Ponemon Institute, finds employee negligence — driven in part by shadow AI — caused 53% of the average $19.5m loss per organization. Malicious incidents accounted for $4.7m and phishing-related 'outsmarted' employees $4.5m. The study warns undocumented AI, personal webmail and file sharing create exposure and urges behavioral intelligence, identity-centric controls and AI governance to reduce incidents.

⚖️ Bruce Schneier contends that AI is reshaping democratic engagement by creating widespread, domain-specific arms races—from academic publishing and courts to media, hiring, and public comment systems. These dynamics advantage well-resourced corporate actors while pressuring governments to adopt automated tools to manage scale. Schneier urges both tactical citizen use of AI and stronger regulatory responses to prevent concentrated power and preserve civic voice.

🔐 EC-Council launched the Enterprise AI Credential Suite, introducing four role-based AI certifications alongside an updated Certified CISO v4 to strengthen executive readiness. The programs target a growing skills gap—cited as $5.5 trillion in unmanaged AI exposure and a 700,000-person U.S. reskilling shortfall—and align with U.S. AI workforce priorities. The suite maps to an Adopt. Defend. Govern. framework and includes Artificial Intelligence Essentials, CAIPM, COASP, and CRAGE to operationalize secure, responsible AI.

🧭 NIST has launched the AI Agent Standards Initiative via the Center for AI Standards and Innovation (CAISI) to create a roadmap for developing interoperable, trustworthy autonomous AI agents. The effort will gather public input through an RFI (responses due March 9) and sector-specific listening sessions in April, and emphasizes industry-led standards, open-source work, and international engagement. Critics caution the process may be too slow to keep pace with agentic AI adoption and emerging threats.

🔒 Cybersecurity has shifted from a technical issue to a board-level business and financial risk, yet many directors remain underprepared to govern it. The 2025 Cybersecurity Skills Gap Global Research Report shows 96% of organizations call cybersecurity a business priority, but only 49% of leaders believe boards fully understand the risks, particularly as AI reshapes threats. Persistent skills and awareness gaps correlate with higher breach frequency and costs, and training programs are often reactive rather than embedded as continuous governance.

🧭In 2026 cybersecurity shifts from episodic defense to continuous operational resilience. Regulation, geopolitics and AI now shape architecture and controls, forcing cryptographic agility, continuous Zero Trust decisioning and lifecycle security across cloud and supply chains. Organizations must make attacker intelligence unreliable through deception, Automated Moving Target Defense and Continuous Threat Exposure Management while embedding AI into detection, response and governance.

🔒 Searchlight Cyber's report found a 30% year-on-year increase in ransomware victims listed on extortion sites in 2025, recording 7,458 incidents split virtually 50:50 across the year. The number of active groups reached a record 124, with 73 newly observed, and the firm warned that AI is lowering the barrier to entry by aiding social engineering, data analysis and malware refinement. The report urged organizations to address insider risk, patching, MFA and compromised accounts to reduce exposure.

🔍 A majority of enterprise CISOs now report their roles are 'no longer fully manageable' as responsibilities expand without commensurate resources, the 2026 State of the CISO Benchmark Report found. Beyond traditional security functions, many CISOs oversee business risk, IT operations, third-party management, and emerging domains like AI governance, creating a mismatch between accountability and authority. Experts call for structural change: redesigning the role, distributing ownership, and granting board-level authority so CISOs act as risk executives rather than operational catch-alls. Without such shifts, organizations risk delayed initiatives, eroded resilience, and executive burnout.

🔒 Kiro is now available in AWS GovCloud (US-East) and AWS GovCloud (US-West), enabling agentic AI development for compliance-sensitive workloads. The platform combines an integrated development environment (IDE) and a command-line interface (CLI) to support spec-driven workflows that turn prompts into specs, working code, documentation, and tests. Native Model Context Protocol (MCP) support lets Kiro connect to documentation, databases, APIs, and other enterprise resources while integrating with AWS IAM Identity Center for enterprise authentication.

🔒 In the 100th episode of the Threat Vector podcast, Nikesh Arora warns that the biggest risk from AI is organizational: teams rush to deploy models and treat security as an afterthought. He describes leaders jerry-rigging controls while massive infrastructure and energy spend accelerates adoption. Arora urges building security in from day one with platform-level visibility and real-time detection rather than bolting it on later.

🛡️ This week at the Munich Security Conference, Google Cloud released a whitepaper, "Staying Ahead of the Shadows: Digital Resilience in the Era of AI," that outlines current digital threats and recommends a unified, full‑stack defense to help democracies. It highlights supply‑chain targeting, employee‑focused manipulation, and sustained China‑nexus espionage. The paper prescribes a five‑layer resilience model — Infrastructure, Architecture, Models, Applications, and Security — supported by technologies such as Gemini, Workspace, CodeMender, SAIF, and post‑quantum cryptography.

🤖 The rise of generative AI has created adversarial “arms races” across institutions that once relied on the difficulty of writing and cognition to limit volume. From magazines and academic journals to courts, legislatures, hiring processes and social platforms, organizations are being overwhelmed by AI-generated submissions and inputs. Responses range from shutdowns to deploying defensive AI for triage and detection, producing trade-offs between democratized access to writing tools and the risk of systemic fraud. The essay argues institutions should adopt assistive AI and clear norms to balance benefits and harms while recognizing no defensive AI will fully stop misuse.

⚠️ Agentic AI is shifting from assistance to autonomous action, creating new risk vectors that can exponentially multiply the impact of errors or breaches. Organizations must adopt governance by design—defining approved use cases, data access, mandatory controls, and clear accountability—so agents operate within known limits. IT teams should lead deployment, policy, and third‑party oversight, while investing in targeted training and resilience planning to protect both systems and staff.

🔒 The Buyer’s Guide for AI Usage Control warns that AI adoption has far outpaced visibility and governance, producing a widening gap as AI is embedded across SaaS, browsers, copilots, extensions and shadow tools. It reframes the problem as an interaction issue rather than solely a data or app problem, and positions AI Usage Control (AUC) as a distinct governance layer that must discover and enforce policy at the moment of interaction. The guide outlines four operational stages—Discovery, Interaction Awareness, Identity & Context, and Real-Time Control—and stresses that architectural fit, operational overhead, and user experience are decisive factors when selecting a solution.

⚠️ Gravitee reports that roughly half of an estimated three million AI agents running in US and UK enterprises are unmonitored and potentially "going rogue." A December 2025 Opinion Matters survey of 750 IT executives found a mean of 36.9 agents per large organization and that 88% suspected an agent-related security or privacy incident in the prior year. Experts warn deployment is outpacing governance and call for continuous runtime oversight, tiered access controls, and stricter credential management.

🔒 A BlackFog survey reports that 49% of workers use AI tools at work without employer approval, often relying on free versions that may retain and use corporate data. Senior leaders appear surprisingly tolerant—69% of presidents and C-suite members and 66% of directors and senior VPs prioritize speed and efficiency over privacy. The study highlights risks to intellectual property and sensitive employee and financial data when unsanctioned tools are connected to corporate systems. It recommends audits, clear policies, vendor verification, and employee education to regain visibility and control.

🛡️ NIST is moving from high-level AI risk principles toward operational cybersecurity expectations, focusing especially on AI agent systems that take autonomous actions. The agency’s CAISI center has issued a formal RFI on secure practices for AI agents and is adapting the Cybersecurity Framework into a Cyber AI Profile. NIST’s work—spanning the AI RMF, Dioptra testing, an adversarial ML taxonomy, and SSDF guidance for generative models—signals that CISOs must treat AI as a near-term security priority rather than “just software.”

🛡️ AI agents are being embedded into regulated workflows and are forcing a rethink of controls designed for human actors, including SOX, GDPR, PCI DSS, and HIPAA. Because agents act, adapt, and drift, controls that once relied on predictable human behavior can silently fail, collapsing segregation of duties and exposing sensitive data. CISOs should treat agents as non-human identities with least‑privilege access, strong credential management, continuous monitoring, and robust logging and change governance to keep regulated workflows auditable and defensible.