Paranormal Inactivity: Ghost Controls Are Haunting Security Dashboards
3 days ago | Andy Ward
Every CISO has a good ghost story, and usually it involves a dashboard that told them everything was fine, lulling them into a false sense of security right before the lights go out.
Enterprises run an average of 83 security tools, yet endpoint security controls fail a fifth of the time, according to Absolute Security’s Resilience Risk Index. As CISOs push autonomous security, adding AI tools to devices and working with faulty security controls will only make businesses more fragile.
The Lights Are on but Nobody Is Home
Just because a device has a security control installed doesn’t mean it’s protected. These tools can crash after updates, clash with other software, get switched off by users or fall out of patch, all without notifying the central security team.
Taking the patch point alone, CISOs estimate that one-third of devices in their businesses are out of patch, so the central dashboard is showing everything is working, while the door remains open for hackers.
Knowing where the gaps are in cyber defences at least gives security leaders the opportunity to fix them before a major attack happens. Whereas a dashboard that looks healthy brings false confidence and results in businesses paying for protection that isn’t working.
AI Is Making Businesses More Fragile
Every AI tool, agent and assistant adds greater risk to the business, complicating security for the 83 tools which are already competing. Each one is another opportunity for an existing control to break.
Adoption continues to outpace governance as boards push for fast AI rollouts, but security teams don’t always have the time to sufficiently test them. Integrating an AI agent that could interact with 83 security tools and act autonomously, which in itself adds unpredictability, isn’t a quick task when CISOs are aiming to maximise security.
At the same time, employees are part of the push, and in some instances aren’t waiting for approval before using AI tools or even building their own. AI has made building agents accessible for anyone, but staff building their own agents don’t have cybersecurity top of mind. That adds software and data flows that security teams can’t always see, and potentially on devices where controls are already failing.
Businesses are still pushing AI adoption, but without the proper guardrails and governance, it’s actually making them more fragile.
Possessed by Bad Data
AI agents work on permissions and act on the data they’re provided. They’re focused on completing the task they were set, so they don’t question the foundation they’re working from.
For example, when an autonomous security agent is tasked with triaging potential software failures or breaches, if it comes across a device reporting that controls are working, the agent will trust it and move on. It won’t investigate, isolate, or patch the issue.
CISOs are aware of the problem, with a third stating they lack confidence that the data feeding their autonomous systems can be trusted, but their business is still pushing ahead without fixing the foundations.
With threats coming at machine speed, there’s less time for humans to act. If a human gets a decision wrong or misses a failed control, it impacts a single device at a time. But if an AI system gets it wrong, it can repeat the mistake across the entire device fleet if it’s acting on bad data.
Attackers Are Coming for the Agents
A total of 38% of CISOs have seen attackers target their organisation’s own AI systems or agents in the past year, and four in 10 now rank attackers compromising autonomous systems as their biggest concern.
Devices with a dead control are an easier route in for attackers, and once breached, they can manipulate agents and access the wider network. A major breach could be happening, but the dashboard wouldn’t know if the security controls are failing.
Most organisations take over a week to patch a critical vulnerability across their devices. That response time is nowhere near fast enough with AI helping attackers to launch attacks faster than ever.
Who You Gonna Call?
Machine speed attacks require machine speed cyber defences, which is why businesses are moving to autonomous security to protect themselves.
It’s difficult for CISOs to trust an agent to perform cybersecurity tasks without human supervision, but they don’t need to hand over everything immediately. Agents can act to block known threats, restart a failed control or automate patch management. While higher risk actions, such as changing access permissions or taking a critical system offline, should rely on a human. It’ll be a balancing act as security teams learn to trust autonomous security, but the speed of cyber-attacks has changed how CISOs must think about defence.
For autonomous security to be effective, businesses must have the foundations in place, from data quality to continuous monitoring for the health of security controls. Without that, AI will just automate and scale the blind spot.
Cybersecurity has moved well beyond how many tools you have, and with AI making businesses more fragile, CISOs are facing a tough task to prove their investment is working. That starts with ensuring the foundations are AI-ready and shining a light on ghost controls.
