The imperative to prepare for AI-safe data security

The proliferation of AI tools in business is redefining the need for data security and trust. As autonomous, decision-making AI agents move from pilot projects into core business workflows, they are expanding the enterprise attack surface just as fast as they are being adopted.

Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, a jump from less than 5% in 2025. Gartner’s advice to leaders of software organizations is to set their agentic AI strategy or “risk being outpaced by the competition”.

Security is changing. What was once a “simple” focus on encryption and perimeter defense is no longer enough on its own: the rise of AI-driven risk has transformed it into a multi-dimensional challenge built on algorithmic trust, model integrity, and synthetic data exposure. Trust boundaries are shifting, and most companies aren’t yet equipped to handle it.

Yet AI has already been proven unsafe by its very makers, with the Hugging Face breach showing it was a rogue AI agent's fault. The unknown future risk of autonomous agents capable of “emergent” behavior poses huge issues for maintaining security. But this is just one risk of many faced by enterprise cyber security leaders.

In fact, the statistics of cyber security investment highlight that business is vastly underprepared for new threats. While the estimated annual cost of cybercrime is $10.5 trillion globally and predicted to reach $15.63 trillion by 2029, this eclipses Gartner’s information security spend prediction of $244 billion in 2026.

Machine data is exacerbating the data quality issue with garbage in, garbage out. This calls for technology and trust architectures to be redesigned, with internet security embedded into the data lifecycle. Security leaders will need to make considered investments in AI-safe security, transparency, and federated governance to protect their enterprise ecosystems.

The biggest security risks we’re underestimating right now

With many threats now AI-driven, it’s unlikely that a single enterprise has protection against all the necessary risks, which is why it’s incumbent on business leaders to prioritize next-level data security.

Firstly, polymorphic, AI-generated attacks are hitting bigger and faster, beyond any company’s human ability to counter these attacks. Deepfake is one such AI-powered theft and extortion technique that can be generated in minutes, costing a mere $1,000 (if that) to create a malicious bot that can hack into your system and go after your business’ crown jewel data.

Using these methods, hackers can affect AI models by manipulating decision-making itself instead of through direct attacks on the IT infrastructure. Shadow AI and exposure to synthetic data are also growing concerns as employees adopt unsanctioned or non-firewalled AI tools, models and workflows to complete mundane tasks and reporting.

Next is the surge in agentic adoption without control of the risk, especially third-party risk, which is huge. Agentic AI has significantly increased the threat surface, with systems capable of autonomously taking actions. In the rush to implement AI, access is being granted for agents to all kinds of data, even to highly sensitive data, often bypassing traditional enterprise controls. All kinds of blind spots emerge when agents are connected to external systems whose security vulnerabilities aren’t vetted.

Prompt injections are another critical risk, on a similar level to the whole third-party dependency. It's the idea that an organization doesn’t know what is actually making its way into their system. At first appearing benign, it can build up to turn malicious at some point in time. When it hits, the business won't know what hit them.

As if this isn’t enough, we’re counting down to “Q-Day”, when quantum computers become powerful enough to break today’s widely used encryption software standards. This is the stage when attackers will be able to intercept, decrypt, and compromise nearly all global digital communications, financial transactions, and other forms of secure data.

Key considerations for a responsible AI approach

What’s needed is a formal framework for trust-enabled ROI in the age of AI. It needs to be about maintaining data source integrity. In order to trust the data, there are various mechanisms or things that an enterprise needs to take care of such as identity and accountability.

We must know who's acting on the data and have context and control. We must then authorize it contextually, not implicitly and this means constantly validating behavior and intent. This is all while staying compliant against or changing the regulatory landscape and maintaining human oversight across the lifecycle.

Responsible AI requires an overall shaping of an approach that considers the impact on the entire value chain in the ecosystem. Only this ensures that the value is delivered to the people who are putting into the system or that are impacted by the system. The following are essential elements to move this forward:

Accountable humans

The concept of accountability is key. There’s a tendency to say if something bad happens, you blame the machine, you blame the algorithm, you blame the system. There need to be accountable humans that take responsibility. AI is here for the long term, and will have generational impacts, so if we don't understand that and take accountability for it, we're going to make wrong decisions.

Four dimensions of responsible AI

At a high level, the focus should center around transparency, accountability, fairness, and protection. Some key questions should be asked as part of building a framework for successful outcomes, such as:

• How do you make sure that your AI models and data practices are transparent?
• How do you make sure you drive accountability for AI-driven decisions?
• How do you make sure you're fair to the people affected by your AI systems?
• How do you make sure that you provide protection or security across the entire data lifecycle?

Building a trust premium

Amidst this new risk landscape, trust has become a measurable competitive asset for enterprises. Organizations that are moving their cyber security strategy to the next level and investing early in AI governance, cryptographic modernization and security architecture are building a trust premium. PwC research backs this up: across thousands of CEOs surveyed globally for its 25th Annual Global CEO Survey, customer trust explained 31% of the variance in profit margins and 21% in return on assets - a stronger link to financial performance than company size.

Durable trust requires an approach that is built and maintained across the entire operational life-cycle of data. This full-lifecycle view of trust comprises data source integrity, end-to-end data quality, identity and accountability, behavioural monitoring and intent validation, regulatory compliance and effective governance, applying human oversight across the AI lifecycle.

Taking a methodical approach to protection

The changing frontiers of data security demand a fresh approach, which involves building resilient data infrastructures and best practices that can stop threats in their tracks. Future successful enterprise security will depend as much on governing autonomous systems as well as defending networks.

The right approach is to take a step back, think holistically, considering all the building blocks that need to be put in place, and then be more methodical. A methodical approach protects the business, its customers, and it protects a society so that we can all progress.

Doing things right in the right way will have multiple cascading benefits, including guaranteed value for customers and the longevity of the business, both of which links to trust and loyalty.

We've Reviewed, Rated, and Ranked the Best Firewall Software.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit