"Can we launch something with AI this quarter?"

It's a question I've been hearing more often over the past year.

Whether it's a startup trying to stay ahead of competitors or an established enterprise exploring new opportunities, AI has become part of almost every strategic conversation. Management are asking about it. Executives want to know how it fits into the business. Customers expect smarter products and faster services.

The excitement is understandable. AI has the potential to transform how we build software, serve customers, analyze data, and automate repetitive work.

But as someone working in cybersecurity, I've noticed a pattern that concerns me.

Many organizations are moving so quickly toward AI that security becomes part of the conversation only after the architecture is already in place. By then, addressing security gaps is often more expensive, more disruptive, and sometimes politically difficult.

In my view, the biggest risk isn't adopting AI too slowly.

It's adopting AI without building the right foundation.

AI Is Different from Traditional Software

Traditional software development has always required security considerations, but AI introduces an entirely new set of challenges.

An AI application isn't just code.

It depends on data, machine learning models, prompts, APIs, cloud services, third-party libraries, and increasingly, external AI providers. Every one of those components creates new opportunities for innovation—but also new opportunities for mistakes.

For example, organizations may:

  • Train models using datasets whose origin or quality isn't well understood.
  • Connect AI services directly to production systems without sufficient access controls.
  • Store API keys or credentials insecurely.
  • Integrate open-source models without evaluating their security or licensing implications.
  • Treat prompts as temporary experiments instead of production assets that deserve version control and governance.

None of these decisions are necessarily made because teams ignore security.

More often, they're made because teams are under pressure to deliver quickly.

That's understandable—but it also makes early planning even more important.

A Scenario I Think Every Organization Should Consider

Imagine a company preparing to launch an AI-powered customer support assistant.

To accelerate development, engineers use existing customer conversations as training data. The chatbot performs well during internal demonstrations, so the project moves quickly toward production.

After launch, someone discovers that carefully crafted prompts can cause the model to reveal fragments of information from its training data.

Even if the exposure is limited, the consequences are significant.

The organization must investigate what happened, temporarily disable the service, assess whether customers were affected, communicate with stakeholders, and review its development process.

The technical problem may eventually be solved.

Rebuilding customer trust often takes much longer.

Whether this exact scenario happens or not, it illustrates an important point: addressing security after deployment is almost always more expensive than considering it during design.

Security Doesn't Slow Innovation

One of the most common misconceptions I encounter is that security slows projects down.

Good security does the opposite.

When security teams are involved early, they help identify problems before they become expensive redesigns.

Instead of acting as gatekeepers, they become engineering partners.

Early collaboration can help organizations:

  • Protect sensitive training data.
  • Build privacy requirements into the system architecture.
  • Secure APIs and cloud infrastructure.
  • Define appropriate access controls.
  • Perform threat modeling before deployment.
  • Test AI systems against adversarial prompts and misuse scenarios.
  • Reduce compliance risks before customers are affected.

These aren't obstacles to innovation.

They're investments that make innovation more sustainable.

Image:AI Generated

What Leaders Should Be Asking

Business leaders don't need to become AI security experts.

They do, however, need to ask the right questions.

Here are a few that I believe every executive team should discuss before approving an AI initiative.

QuestionWhy It Matters
Where does our training data come from?Poor-quality or improperly governed data affects both security and business outcomes.
Who owns AI governance?Every AI system should have clear accountability, not shared assumptions.
How are models tested before deployment?Functional testing alone isn't enough. AI systems should also be evaluated for misuse and unexpected behavior.
Are prompts and model changes tracked?AI behavior evolves over time. Version control improves traceability and accountability.
How are credentials and API keys protected?AI applications often connect to sensitive business systems that require strong identity and secrets management.
What third-party AI services are we relying on?External models, datasets, and AI platforms introduce supply-chain risks that deserve proper evaluation.
How will we monitor AI after deployment?AI systems continue to evolve and should be monitored just like any other critical business application.

These conversations don't eliminate risk.

They make risk visible before it becomes expensive.

Why This Matters in South Asia

Across South Asia, organizations are embracing digital transformation at an impressive pace.

Banks are exploring AI-assisted fraud detection.

Hospitals are experimenting with intelligent diagnostic support.

Retailers are improving customer engagement through AI-powered recommendations.

Governments and public institutions are also evaluating how AI can improve service delivery.

This momentum creates tremendous opportunities for innovation.

At the same time, expectations around cybersecurity, privacy, and responsible data management are increasing. Organizations that invest in AI should view security and governance as part of their competitive strategy—not simply as regulatory requirements.

Trust is becoming one of the most valuable business assets.

Protecting it should be a leadership priority.

A Few Resources Worth Exploring

  • OWASP Top 10 for LLM Applications – Practical guidance on common security risks affecting large language model applications.
  • NIST AI Risk Management Framework (AI RMF) – A structured approach to governing and managing AI-related risks.
  • MITRE ATLAS – A knowledge base of adversarial techniques targeting AI systems.
  • OWASP AI Security and Privacy Guide – Practical recommendations for building secure AI solutions.

These frameworks won't answer every question, but they provide an excellent starting point for security teams and technology leaders.

My Take

I don't believe organizations should slow down their AI ambitions.

The opportunities are simply too significant to ignore.

What I do believe is that AI deserves the same engineering discipline we've spent years applying to software development, cloud computing, and cybersecurity.

Security shouldn't appear at the end of an AI project as a final approval step.

It should be present in the earliest conversations—when architectures are being designed, data sources are being selected, and business objectives are still taking shape.

I've seen projects where security was invited in early, and the discussions were straightforward because the right questions were asked before major decisions were made.

I've also seen projects where security arrived just before deployment, when changing the architecture meant delays, budget increases, and difficult compromises.

The difference wasn't the technology.

It was timing.

The AI race isn't simply about who builds the fastest.

In the long run, I think the organizations that succeed will be the ones that build systems people can trust.

And trust is something that has to be designed from the beginning.


References: