Artificial intelligence is at once the largest new security risk and the largest security opportunity most organizations face. Managing it well begins with a systematic view of where the risk actually lives — and for security leaders, it lives in four distinct domains.
Four Domains of Exposure
Model risk is the most discussed. The model itself can hallucinate, producing confident-sounding nonsense; it can be manipulated through prompt injection; it can leak training data or amplify biases present in its training set. The questions that matter are consequential rather than technical: what decisions does the model influence, what is the blast radius of a wrong answer, and does a human verify high-stakes output before it acts on the world?
Data risk follows from the fact that every AI interaction is a data flow. Prompts may carry sensitive information; responses may be logged; fine-tuning exposes training data; retrieval-augmented systems connect models directly to internal repositories. A security leader needs to know what data flows into each model, where output lands, who can read the interaction logs, and what the data-residency posture is.
Supply-chain risk reflects how little of the AI stack most organizations control. Models come from third parties, APIs run on someone else’s infrastructure, and embedding models, vector databases, and orchestration frameworks each add a dependency. The exposures are contractual as much as technical: what happens if the provider changes terms, whether switching is feasible, and whether data-handling protections are written down.
Operational risk is the quietest of the four. AI systems fail differently from traditional software — a model can degrade without throwing an error — and shadow AI proliferates wherever official channels are too slow. Detection of degradation, an incident-response plan that contemplates AI failures, and a current inventory of AI usage across the organization are the minimum controls.
Prioritizing With Limited Resources
Security resources should follow that gradient, not the org chart.
No security team can address everything at once, and the discipline is in the gradient. Each use case can be scored on four dimensions: the sensitivity of the data it touches; the degree to which its output affects customers, employees, or finances; whether it is internal-only or customer-facing; and how reversible the damage would be if something went wrong. A customer-facing chatbot handling financial guidance scores high on every dimension; an internal tool that drafts developer documentation scores low. Security resources should follow that gradient, not the org chart.
Controls That Earn Their Keep
The practical control set is neither exotic nor optional. Inputs should be screened for sensitive data before they reach a model, and outputs checked for personal-information leakage, hallucination markers, and harmful content. Access controls should define who may use which AI capability with which data. A full audit trail of interactions, monitored for anomalies, converts invisible usage into manageable usage. And high-stakes automated decisions should require human approval — not as a formality, but as the control of last resort.
The goal is not to eliminate AI risk, which is impossible, but to manage it in proportion to its consequences while the business captures the value. Security leaders who can show that proportionality — domain by domain, use case by use case — will find AI an easier conversation with boards and regulators alike.