Security in times of AI: what is different, and how to start safely

Where we stand today

AI has arrived in companies, often faster than the rules for it. In the Allianz Risk Barometer 2026, AI risks entered the Swiss ranking for the first time, straight at number two, right after cyber attacks. Figures from practice show why:

• 86 percent of organisations worldwide had an AI-related security incident in the past year. Only 4 percent are considered truly prepared (Cisco, 2025).
• 13 percent of the organisations IBM studied had a breach involving their own AI models or applications. 97 percent of those lacked basic AI access controls.
• One in five breaches involved shadow AI, meaning tools used without approval. These breaches cost around USD 670,000 more on average (IBM, 2025).

Hardly anyone wants to do without AI in private life anymore, nor at work. Where a tool really helps, caution is quickly forgotten.

Why AI needs different security measures

Classic software follows fixed rules. AI behaves fundamentally differently:

Classic software	AI
Follows predefined rules	Learns from data and partly decides on its own
Processes structured data	Processes texts, images and documents of all kinds
Gives the same result for the same input	Works with probabilities; results can vary
Stays unchanged without updates	Changes with new data and models
Understands context only if programmed	Understands language and context, including hidden instructions

AI behaves like a knowledgeable but inexperienced employee. It needs clear rules, limited permissions and supervision.

Where the weaknesses are

Most gaps are organisational, not technical.

In leadership: nobody clearly owns AI risk. Speed comes before control. Budgets and benefits are unclear; legal uncertainty and fragmented standards slow things down. Know-how is often missing, and dependence on vendors is underestimated. Not infrequently, management leaves the topic to employees or puts it off.

Among employees: shadow AI, meaning private or unapproved tools used with company data. Little knowledge of AI-specific risks. No policy and no training to guide them.

The risks today and in three to five years

Today	In three to five years
AI-powered phishing and deepfake fraud	Coordinated attacks by autonomous AI agents
Prompt injection: hidden instructions in documents, emails or web pages manipulate chatbots and assistants	Deepfake fraud at scale
Data leakage through AI knowledge bases	AI-driven attacks on physical systems (robots, IoT)
AI tools and agents with excessive permissions	Unmonitored internal models and agents
Stolen API keys and compromised supply chains	Manipulated open-source models
Manipulated training or knowledge data	Breaches of new AI regulation

How real deepfakes already are is shown by the case of the engineering firm Arup: in 2024 an employee in Hong Kong transferred around USD 25 million after a video call with the supposed CFO and colleagues. Every participant had been generated with AI.

The security community sees the same priorities: in OWASP’s Top 10 security risks for language model applications, prompt injection and sensitive information disclosure rank first and second, and excessive agency of AI systems ranks sixth.

Protect not only the data, but also the output

Many companies secure access to data, but not what the AI does with it. Proven protective layers, called guardrails, now exist for this:

• Content filters that detect harmful or inadmissible answers
• Prompt injection detection to catch manipulation attempts
• Grounding checks so that answers rely on approved documents
• Rules for the whole flow, from input through data retrieval to output

The major providers and open-source projects offer such building blocks. What matters is to plan them in deliberately rather than bolt them on later.

The building blocks of secure AI use

Area	Goal	Key measures
Governance	Clear ownership and boundaries	Named owner, AI policy, risk register
Secure design	Prevent misuse and leakage	Least privilege, separation of data and models
Data protection	Safeguard sensitive information	Classify and encrypt data, clean it before prompting
People and culture	Turn users into a line of defence	Training, clear do’s and don’ts, alternatives to shadow AI
Vendors and tools	A trusted ecosystem	Vet vendors, AI clauses in contracts
Monitoring and testing	Detect issues early	Log usage, test regularly, incident playbooks
Future readiness	Prepared for what comes next	Track regulation, review regularly

Five first steps

1. Assign ownership. One person owns AI risk, supported by a small team from IT, business and data protection.
2. Adopt basic rules. A short AI policy defines which tools are allowed and for what.
3. Protect your data. Determine which data is sensitive, and what must never enter an AI tool.
4. Choose trusted tools. Enterprise versions with clear contractual terms on data use instead of private accounts.
5. Train and monitor. Employees know the risks, usage is logged, anomalies are detected early.

And when you bring in external specialists for AI initiatives: make sure they address security from the start and can extend your existing security framework to the AI-specific points. Security must be baked in, not bolted on.