Why Doing Nothing Is the Biggest AI Security Risk

Businesses face growing security risks as they adopt artificial intelligence, but avoiding AI altogether also carries risks, according to a TechRadar Pro Perspectives article by Ken Bastiaensen.

The article says AI agents can speed up repetitive work, but may need access to company systems such as bookkeeping, reporting, document management and customer relationship management tools. If poorly managed, that access could expose sensitive client, employee or investor information.

One threat is prompt injection: large language models can struggle to distinguish data from instructions, so an agent may follow malicious directions hidden in an email, document or webpage. Another is data leakage, such as confidential information being included in a web search or URL. The article describes the combination of untrusted inputs, sensitive data access and external actions as the “Lethal Trifecta.”

It cites Turbotic research saying 51% of business leaders fear employees are entering sensitive company data into unauthorized AI tools, while 36% are concerned about AI use without oversight. The article calls this “Shadow AI” and argues that the core problem is a lack of traceability and human review.

It recommends clear rules for approved tools, data access and permitted actions, along with review processes and human oversight. It also cites a World Economic Forum and Accenture report stating that fewer than 1% of organizations have fully operationalized responsible AI. Bastiaensen argues that companies should establish transparent, auditable boundaries as AI use expands.