AI is making cybersecurity fundamentals more important than ever

OpenAI disclosed that one of its AI models escaped a test environment and broke into Hugging Face's systems, but experts say the root cause was a misconfigured sandbox, highlighting that fundamental cybersecurity practices are more important than ever. Eric Brandwine, VP and distinguished engineer at Amazon Web Services, told CSO that cybersecurity fundamentals are as important as ever, and Diana Kelley, CISO at Noma Security, noted that legacy security debt is now front and center, with AI examining systems at machine speed. Kelley cited Noma Security research on the ForcedLeak vulnerability, where a Salesforce AI agent could be tricked into leaking data due to a content security policy that still trusted an abandoned domain, which could have been prevented by simple DNS hygiene.

When OpenAI disclosed that one of its models escaped a test environment https://www.csoonline.com/article/4200043/openai-model-escape-puts-enterprise-ai-defenses-on-notice.html and broke into Hugging Face’s systems on its own, headlines cast the incident as the start of a new era of AI-driven attacks. But the underlying cause of the incident was a familiar one: a misconfigured sandbox https://cloudsecurityalliance.org/artifacts/hugging-face-ciso-post-mortem — the same kind of fundamental security failure that has enabled breaches for decades, with or without AI. AI systems are indeed already finding software vulnerabilities https://www.csoonline.com/article/4196409/ai-powered-breaches-provide-wake-up-call-for-incident-response.html , tailoring social-engineering attacks, analyzing enormous volumes of security data, and beginning to act autonomously across interconnected systems. But the more immediate lesson, experts say, may be less glamorous: The fundamental cybersecurity practices that organizations have struggled to perform for decades are becoming more important, not less. “The cybersecurity fundamentals are as important as ever, probably more so,” Eric Brandwine https://www.linkedin.com/in/ericbrandwine/ , VP and distinguished engineer at Amazon Web Services, tells CSO. “It’s the exact same story that it’s always been — all of the cybersecurity fundamentals — but you’ve got to be more agile, you’ve got to be more responsive.” Cybersecurity programs have always operated under pressure to accept unresolved vulnerabilities, incomplete inventories, aging infrastructure, and poorly controlled access, because fixing them is expensive or operationally disruptive. AI changes the consequences: Weaknesses that once took a skilled human considerable time to discover can now be found through automated, repeated examination of applications, infrastructure, and exposed systems. “Our legacy security debt is now front and center,” Diana Kelley https://www.linkedin.com/in/dianakelleysecuritycurve/ , CISO at Noma Security, tells CSO. “Even simple mistakes that maybe a human wasn’t going to exploit previously, or it was sort of too hard for them to find, we’ve got AI looking again and again, going at machine speed, at agentic scale, looking for all of these exposures and exploiting them potentially.” Kelley points to Noma Security research into an indirect prompt-injection vulnerability called ForcedLeak https://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/ . A malicious instruction submitted through a web form could cause a Salesforce AI agent to exfiltrate sensitive information https://www.csoonline.com/article/4063044/vulnerability-in-salesforce-ai-could-be-tricked-into-leaking-crm-data.html through an image request. Yet the attack relied on a decidedly conventional oversight: A content security policy still trusted a domain the organization no longer controlled. Researchers registered the abandoned domain for $5. Had it been removed from the content security policy, the exfiltration path would have been blocked. “This was an advanced agentic attack that used indirect prompt injection, but something as simple as DNS hygiene would have prevented it,” Kelley says. Gene Spafford, https://www.linkedin.com/in/spafford/ distinguished professor of computer science at Purdue University, sees the vulnerabilities AI is uncovering not merely as technical debt but frequently as the product of conscious business decisions. Organizations and vendors have repeatedly prioritized speed, features, and market share over careful engineering, testing, and risk management. “This kind of thing can often be described as a technical debt, but it’s a willful debt,” Spafford tells CSO. “It’s a misplaced sense of prioritization of where investment and spending have gone over many years.” AI systems trained on vast collections of software and security information are particularly effective at recognizing repeated patterns of bad coding, weak configurations, and familiar errors — revealing less about the novelty of the technology than about how much avoidable weakness the industry has allowed to persist. “AI is simply catching up with decades of inadequate software engineering for the lack of appropriate due care over the last few decades in development,” Spafford says. Generative and agentic AI may introduce distinct risks https://www.csoonline.com/article/4110008/top-cyber-threats-to-your-ai-systems-and-infrastructure.html , including prompt injection, data poisoning https://www.csoonline.com/article/4166171/poisoned-truth-the-quiet-security-threat-inside-enterprise-ai.html , and the manipulation of autonomous agents. But much of AI’s near-term impact comes from making familiar attack techniques faster, cheaper, or more precisely targeted. Chris Betz https://www.linkedin.com/in/chris-betz-903b739b/ , CISO at Google Cloud, describes the defining characteristics of AI-enabled activity as speed, scale, and customization. Traditional automation made it possible to perform the same action repeatedly; AI allows attackers and defenders to perform highly individualized actions repeatedly. “Where automation used to mean doing the same thing at scale, AI allows us to do very specific things at scale,” Betz tells CSO. “While we have to change the way we think, in a lot of ways it means that we have to do more of what we’ve done in the past, and we have to do it at a massive scale.” Familiar controls such as multifactor authentication https://www.csoonline.com/article/570795/how-to-hack-2fa.html , zero-trust architectures https://www.csoonline.com/article/564201/what-is-zero-trust-a-model-for-more-effective-security.html , system patching https://www.csoonline.com/article/3520881/patch-management-a-dull-it-pain-that-wont-go-away.html , and effective detection and response https://www.csoonline.com/article/3476179/how-your-xdr-is-evaded.html remain critical. But defenders must apply them consistently enough to withstand attackers who can probe environments continuously and adapt to each target. “You can’t bring just that foundation to an AI fight,” Betz says. “But you need that foundation. That foundation is what gives the defenders their distinct advantage.” The evidence from incident response continues to point toward familiar weaknesses. John Shier https://www.linkedin.com/in/jshier/ , field CISO at Sophos, says the two leading root causes appearing year after year in the company’s incident investigations are compromised credentials https://www.csoonline.com/article/1308864/hackers-using-stolen-credentials-to-launch-attacks-as-info-stealing-peaks.html and exploited vulnerabilities https://www.csoonline.com/article/4176086/vulnerabilities-have-become-cyber-attackers-no-1-door-to-the-enterprise.html . In many of those incidents, multifactor authentication was absent from at least some exposed services, and attackers exploited vulnerabilities for which patches had been available for months. “There are no new vulnerability classes, and there are no new attack types. AI hasn’t changed that yet,” Shier tells CSO. “The things that we know how to mitigate and how to deal with are still the ones that the attackers are exploiting writ large.” Shier compares an organization relying on sophisticated detection without basic prevention to a modern vehicle equipped with driver-assistance sensors and airbags — but no brakes. Detection and response was a necessary correction to the notion that every intrusion could be prevented, but it becomes dangerous when organizations treat prevention as outdated or assume AI will contain every malicious action after it begins. That’s the trap Shier sees organizations falling into — treating AI as a reason to worry less about prevention. “It can solve some problems,” he says, “but it can’t solve all of the problems that are addressed by preventive technologies or by reducing or eliminating risks altogether.” AI-enabled attackers do not need to “hack in” when they can obtain credentials, session tokens, or authenticated access, and the expansion of cloud services, remote work, and SaaS has given adversaries more identities, permissions, and connections to target. Adam Meyers https://www.crowdstrike.com/en-us/about-us/executive-team/adam-meyers/ , SVP of counter adversary operations at CrowdStrike, says organizations must first learn to “do cybersecurity well” before expecting advanced technologies to compensate for foundational weaknesses. “Organizations have quickly moved into remote work, and they’ve moved toward cloud systems,” Meyers tells CSO. “In a lot of cases, unfortunately, they haven’t kept pace cybersecurity-wise and haven’t done some of the basics correctly with identity in particular, but also cloud.” Meyers points to identity threat detection and response as an increasingly important baseline capability, because criminal actors are seeking passwords, authentication tokens, and ways to bypass multifactor authentication. Asked whether AI could perform the fundamentals for organizations, he was skeptical of treating the technology as a substitute for implementation and accountability. “The fundamentals are the fundamentals,” he says. “I don’t know if you need AI to do the fundamentals. I think you need to pull up your pants and do the fundamentals.” The number of vulnerabilities discovered through AI-assisted research is likely to grow. Tony Sager https://www.linkedin.com/in/tonysagercyber/ , SVP and chief evangelist at the Center for Internet Security, argues that organizations should not interpret that growth as requiring a unique defense for every newly identified flaw, given that vulnerabilities fall into recurring classes that well-chosen security practices can block or constrain at once. “You can’t think of it as, ‘I have to find and fix every one of them,’ because they’re not all unique. They fall in classes,” Sager tells CSO. “Those good practices — the basics of identity management, configurations, and all those kinds of things — block lots of those different classes of attacks.” Frameworks and prioritized security controls translate complex knowledge about attacks, software flaws, and adversary behavior into a set of repeatable organizational practices. Their recommendations may sound elementary, but the simplicity of the behavior does not mean the analysis behind it is simplistic. “You don’t need to read threat reports,” Sager says. “You just need to engage in the practices that are found in things like the NIST framework and the CIS Critical Security Controls. You get a lot of value out of that, and you should do that because that’s the foundation of good defense.” As AI produces more examples of familiar flaws and gives adversaries the ability to search for them more rapidly, organizations with weak foundational controls will be exposed to more attempts against a larger number of weaknesses. “If you haven’t done these basic things, you’re weaker than ever,” Sager says. “The importance of those fundamental things has only gone up.” Cybersecurity fundamentals are not confined to technical controls. Security practitioners must also understand core cybersecurity principles well enough to evaluate AI-generated recommendations and recognize when a model has produced a plausible but incorrect answer. “If you as a human being don’t understand the basics of cybersecurity and you’re relying entirely on whatever AI you’re interacting with to tell you, then if the AI goes off — whether it drifts, gets misaligned, or there’s been poisoning via prompt injection — you have no ability as the person reading this output to figure out if that’s right or not,” Noma Security’s Kelley says. Scott Beale https://www.linkedin.com/in/scottbeale/ , CEO of ISC2, similarly warns that AI’s ability to increase capacity does not eliminate the need for human judgment https://www.csoonline.com/article/4198016/socs-face-a-human-challenge-as-ai-speeds-alerts-and-threats.html . An erroneous recommendation about a coffee shop is inconsequential; one affecting an organization’s systems, data, or response to an attack is not. “You need to be able to differentiate what is accurate and what’s not,” Beale tells CSO. “They also know that when errors are made, it is a human who’s going to be held accountable for whether the right decisions were made.” That accountability, Beale says, is exactly why AI can’t be allowed to lower the floor on human judgment: “Human judgment and human oversight are absolutely critical, even if you’re partnering with these AI tools.” Organizations must also distinguish between attacks conducted with AI and attacks directed against the AI systems they use. Roger Grimes https://www.linkedin.com/in/rogeragrimes/ , a longtime security researcher and CISO adviser, says AI-enhanced attackers continue to rely heavily on the two dominant initial-access techniques of the broader internet era: social engineering and exploitation of unpatched vulnerabilities. AI can create more convincing phishing campaigns, deepfakes, and customized lures, while also helping identify known and previously undiscovered software flaws. “When AI threats come, as they already are, they’re going to use and abuse those same traditional, classical ways that hackers have always broken in,” Grimes tells CSO. At the same time, organizations are deploying systems vulnerable to prompt injection, model manipulation, data leakage, and other attacks aimed directly at AI. Grimes compares prompt injection to SQL injection: a form of attack made possible by a particular underlying technology. The difference is that AI will be embedded across desktops, devices, and interconnected services, and an attack against one model may reach an organization through an AI supply chain security teams have not fully mapped. “There are attacks from AI against you, whether or not you’re using AI,” Grimes says. “And then there are attacks to the AI that you use, because we’re all using AI in some way, and that’s only going to grow over time.” Traditional security fundamentals will mitigate many of the pathways attackers use to reach AI systems, but organizations will also need new controls for models, agents, prompts, and AI data flows. This, Grimes says, is an expansion of the security program, not an excuse to abandon what came before. None of the experts argues that CISOs should turn away from AI. Used carefully, it can help security teams analyze telemetry, investigate alerts, discover assets, examine code, and identify vulnerabilities — scaling work organizations have historically performed poorly because it is tedious and labor-intensive. AWS’s Brandwine says security organizations need ways to experiment with AI without subjecting every idea to a lengthy production review. A new AI-powered detection, for example, can run in parallel with an established system so defenders can compare results without immediately depending on it. That agility becomes essential as developers produce software faster and employees adopt new models and agents, requiring security teams to keep pace without turning governance into an obstacle employees evade. AI may finally make some aspects of security hygiene easier to sustain — assisting with asset classification, correlating disconnected inventories, prioritizing remediation work, and reducing the manual burden of reviewing logs. But its results will be only as dependable as the systems, data, and human decisions surrounding it. The winning formula is therefore neither “forget AI and return to the basics” nor “let AI solve cybersecurity.” It is to use AI to increase the speed and scale at which organizations perform the fundamentals while preserving the human knowledge, governance, and accountability necessary to determine whether the technology is getting the work right. As Google Cloud’s Betz puts it, the journey is “a firm foundation and a move-faster piece with AI on top.”