Your AI Can Be a Traitor: How Zero Trust Can Save Your Company

Forget MGM and Colonial Pipeline. Those breaches were just a warm-up act. The terrifying truth is companies are already drowning in the wake of cyberattacks, taking weeks and months to claw their way back to digital life. And with AI handing the keys to the kingdom to hackers and attackers, it's about to get much worse.

This is why Zero Trust and AI aren't just a security fling — they're the shotgun wedding nobody saw coming, the foundation of survival in a world gone AI-mad.

Backups under attack

"Nine out of 10 times, attackers go straight for the jugular — your backups," says Chee Wai Yeong, area vice-president for Asia Pacific and Japan at Rubrik. "No backups, no recovery. Game over. Pay the ransom."

This chilling reality exposes a gaping hole in our defenses: backup infrastructure itself is often a sitting duck, ripe for attack.

The numbers are brutal. According to Yeong, 73% of organizations under attack see their backups hijacked, wiped out, or corrupted. It's enough to give any CISO a full-blown panic attack, especially as they race to inject AI into every corner of their enterprise.

But the real nightmare scenario is more than backups: While companies are busy mainlining AI models for everything from productivity boosts to customer service chatbots, they're unwittingly spreading the attack surface.

Think about it: every AI model trained on your precious corporate data becomes a potential leak, a ticking time bomb. Those innocent-looking Large language models (LLMs) could be spitting out sensitive secrets with the right nudge.

The threat landscape: A shapeshifting beast

The enemy isn't just at the gates; it's morphing into forms we never anticipated. Take Microsoft's Copilot, for example. It promises to mine intelligence from your M365 data – SharePoint, OneDrive, Exchange — a productivity dream, right?

Wrong. For security pros, it's a potential catastrophe. Without a Zero Trust lockdown, these AI systems become the ultimate insider threat, siphoning off data right under the noses of traditional data loss prevention (DLP) controls with seemingly harmless queries. Imagine Copilot casually revealing confidential client data in response to a cleverly worded prompt.

"Machines can only do so much," Yeong warns. "Attackers will always find the weak link, and that's usually us — humans." This becomes even more terrifying as GenAI weaponizes phishing attacks. Forget Nigerian princes; we're talking AI-powered social engineering that crafts perfectly personalized spear-phishing emails tailor-made to exploit our deepest vulnerabilities and fears.

But the same AI that's fueling these attacks is also becoming our only hope for defense. Private LLMs are being deployed to dissect backup data for encryption attacks while natural language processing engines hunt for sensitive data patterns across the enterprise.

But here's where the old guard falls apart: the traditional security stack, obsessed with infrastructure, is missing the forest for the trees. While security teams are busy chasing firewall logs and endpoint anomalies, the real vulnerability lies in data security posture management — especially in the age of AI.

Zero Trust: The walls are closing in

Picture this: Your AI model, trained on supposedly sanitized data, has been quietly stashing sensitive info in its knowledge base. Months later, a seemingly harmless employee query coughs up confidential medical records or financial data. Your Zero Trust fortress might have held the line, but the AI within has betrayed you.

"AI is only as good as the data it feeds on," Yeong emphasizes. This highlights the collision of infrastructure security and data security. We need to think beyond traditional Zero Trust boundaries in a world drowning in AI.

The challenge gets even hairier with intermittent encryption attacks — a favorite tactic of elite ransomware attackers. These attacks nibble away at your data, encrypting small chunks flying under the radar of traditional defenses. But AI models trained on time-series backup data can sniff out these anomalies, spotting patterns that would make a human analyst's head spin.

Even with Zero Trust and AI-powered security tools, we're facing a new enemy within — our developers. Traditionally allergic to security constraints, they now wield AI coding assistants that could inadvertently spill secrets through code generation.

A new mindset for a new reality

The solution? It starts with a radical shift in our thinking. Infrastructure security alone is no longer enough. We need a full-body scan, a comprehensive data security posture management strategy that tracks and controls sensitive data across every human and AI system.

The future is a tidal wave of AI; as Yeong puts it, it will be "everywhere." Maintaining Zero Trust in this AI-soaked world is the ultimate high-wire act. Success won't be about who has the biggest hardware or the most data; it'll be about who can tame the data exposure beast.

The message to CISOs and data engineers is clear: Zero Trust isn't just about locking the doors anymore; it's about creating a secure playground for AI, a space where innovation can flourish without sacrificing security.

In this new world order, one thing is sure: the future of cybersecurity isn't just about keeping the bad guys out; it's about making sure our AI creations don't turn against us. And in this high-stakes game, Zero Trust might be our only hope.

Image credit: iStockphoto/shironosov