How are companies protecting AI?

Security professionals Lenny Zeltser (레니 젤서) and Sounil Yu (수닐 유) released the AI Security Decisions Report, which contains results from a survey of about 300 security practitioners.

Zeltser said there are 4 notable findings in the report.

The first is that companies most often use security tools they already have to protect AI.

Respondents most frequently used existing general-purpose security tools and procedures. Next were security features in products from AI and cloud providers and in-house controls. The share using products dedicated to AI security was the smallest.

On this, Zeltser said, "It is natural to start by using existing capabilities. But you need to check whether these tools cover all the types of AI assets your organization needs. If you are a company selling AI security products, you should be ready to explain what more you can provide beyond what buyers already have."

The second is that fewer organizations apply separate security measures to assets that are essential for AI agents to operate.

Agents make decisions based on AI models and select their own work steps and tools. The assets that make this possible are the orchestration layer connecting models with tools and data, runtime data such as prompts, search results and memory, and credentials used when an agent exercises authority, or agent identity.

Respondents were most concerned about runtime data and agent identity. Zeltser said, "You first need to distinguish what can be blocked with existing tools and what needs dedicated controls. Even for areas that need dedicated controls, check whether the tools you already use can handle them before looking for new tools."

The third is that accountability for AI security has not yet been clearly defined. The largest share said the CISO or a central security organization bears primary responsibility, but that share was below half. One in 8 respondents said multiple leaders share responsibility but there is no primary owner. The same share said they have not yet designated a responsible party.

Among organizations that had not designated a responsible party, the share saying there were no dedicated controls for AI assets was about twice as high as in organizations where the CISO is responsible.

Zeltser said, "These organizations appear not to have properly decided yet how they will protect AI. Organizations that have set a direction also have security measures. If responsibility is shared among several people, you need to ensure that 'everyone's responsibility' does not become 'no one's responsibility'."

The fourth is that fewer than half had dedicated controls even though AI-generated code is the most common AI asset. Almost no respondents picked AI-generated code as the asset they worry about most.

Zeltser said, "Code is code, whether written by a person or by AI. But in the era of vibe coding, employees who are not developers also create code with AI. They often work outside the development pipeline where existing code security tools are installed. You may need to identify even these apps and add external library security checks and detection of password and API key exposure to the code-creation tools employees already use."