[ITmedia Enterprise] For IT departments who have been told to “do AI security” Don’t aim for 100 points, start by “seeing”

What I feel strongly about when talking to customers recently is that in many cases AI security initiatives are ``dropping down from above.'' An incident is reported. Your company may be implementing AI, or your employees may already be experimenting with it without getting approval from your security department. Once management realized this, they decided that they could not afford to fall behind and issued instructions. The instructions may be as simple as "Please do something."

However, while such instructions may be translated into principles of how AI security should be or the names of standards and frameworks to be followed, they are rarely translated into actual implementation. Even if the IT department understands the direction, they are having a hard time deciding what to implement, how to configure it, and how to proceed.

I feel a sense of déjà vu about this situation. About 10 years ago, management told me to move to the cloud and ensure its security, but I didn't know where to start. At that time, I had many discussions with people in the IT department. Similar to then, there is a huge gap between what management envisions and what IT departments can actually achieve.

Is it okay to say "I'll take action if a major accident occurs"?

In the field, we often hear people say, ``If a large-scale incident occurs, countermeasures will be taken all at once.'' In fact, the series of large-scale ransomware attacks in Japan have caused many companies to reconsider their countermeasures. I think there is a high possibility that the same trend will occur with AI agents, where countermeasures are taken all at once after major damage occurs.

However, it is by no means healthy to wait for some domestic company to suffer damage before acting. Because that company might be your own company.

Furthermore, agent failures are different from human failures. Agents create procedures that don't exist, act on incomplete information, or follow instructions planted by an attacker. They may move beyond the given range or perform operations one after another that humans would not do. If you confront this behavior for the first time after an accident, it may be difficult to pinpoint the cause.

Don't ask for "100-point measures" from the beginning

A comprehensive AI security foundation already exists that centralizes visibility, data protection, and access control across AI apps, models, and agents. So should you implement such a comprehensive solution now? My answer is "no."

I feel like Japanese companies have a tendency to aim for the perfect, most comprehensive framework from day one, especially when the instructions come from above. However, aiming for perfection requires a heavier planning process, which delays initiatives and implementation itself. In the meantime, AI risks continue to change at a rapid pace. In my experience, the most effective implementation is gradual. This allows you to be more agile as the risk landscape changes.

The important thing is to decide on the direction but not to limit the content to 100 points. Decide on a realistic first step, start small, and modify as things change. It will be easier to demonstrate cost-effectiveness if explanations to management are centered around ``how far we can see so far and what we should do next'' rather than ``perfect countermeasures''.

The first step is "visualization"

So what is that first step? The author, without hesitation, thinks that it is "visualization." What is being used and what is being done? As was the case with the cloud, you can't protect what you can't see.

The starting point is understanding ``shadow AI,'' where employees use generated AI that the IT department is not aware of. Who in which department is passing what data to which AI service? If you can't see this, you can't evaluate the magnitude of the risk.

Beyond that are AI agents and AI models that employees and departments independently introduce, so-called "shadow agents" and "shadow models." At first glance, autonomously moving agents may seem difficult to understand. However, agents often access cloud resources and AI services. If we can capture that communication, we can observe its behavior. The next step is how to control things that move autonomously.

When visualizing, you want to understand at least the following four points.

Which AI services and agents are used internally?

Whose (which) ID is each operating under?

What data and systems can you access?

What kind of decisions and operations are allowed?

Without this inventory, no matter how sophisticated the measures are, it will not be possible to determine what to protect. On the other hand, if you can see this, you can naturally identify points that should be prioritized, such as agents whose access range is too wide.

Review your current infrastructure before buying new

You don't necessarily have to introduce a new product from scratch to gain visibility. Many companies already have systems in place to manage cloud usage, control web access, and implement endpoint measures. First, check to see if the platform has a visualization function for AI usage, or if it can be enabled additionally.

In fact, as far as I can see, there are currently not many companies that are introducing systems from scratch just for AI countermeasures. It is realistic to start where you can by extending your existing security infrastructure.

Visualization is just the starting point. Once agents begin to take on full-fledged duties, unexpected behavior and accidents are inevitable. At that time, can you explain to management what happened? Next time, we will consider what records and systems should be in place to prepare for accidents, and how AI agents can change the organization of IT departments.