Artificial intelligence can be a useful tool. However, guardrails must be in place. Here are 10 things to know about using AI.
10. Since AI use is inevitable, use it deliberately with clear rules of engagement and ownership, monitor and conduct regular reviews. Draft an internal AI usage policy for employees to avoid leaking sensitive data and cost overruns.
9. The biggest risk is not just employees using AI without authorization and IT oversight, it’s the company’s struggle to adopt AI before it can firmly establish governance.
8. Decide what data the AI tool can access, what limits to impose on the actions it can take, and how much of its activities can be reviewed. An application that only needs to summarize a document should not be able to also delete files, send messages, or log into accounts.
7. Most major providers (ChatGPT, Claude) bill based on the exact amount of text the AI processes. If your business exceeds capped limits, you will be charged extra fees for the additional usage. One client of mine was charged $23k in overage.
6. Guardrails suggested by the AI vendor make promises on model behavior and can be bypassed or changed. What matters is how deep the AI can reach into your systems, its powerful capability, and how to respond should something unexpected happen.
5. AI tools purchased for exclusive company use will be easier to manage than the subscriptions employees buy for their own use. Central control will improve visibility, access management, and data ownership.
4. Try to limit the storage of important company data from personal devices. If business files are reachable from there, then personal AI tools can create risk.
3. Treat newly introduced AI tools like you would a new employee hire. Start by limiting access, supervise closely, then gradually allow for more responsibility.
2. Begin with a slow rollout and do it in stages. Start with a user policy and a small pilot program. Trian users on its hazards, run a vulnerability scan, then gradually expand use when you know the tool is safe, useful and supportable.
1. Cybersecurity is an ongoing process, and everyone needs to do their part in keeping the organization safe.
Janelle Drolet is vice president of sales and operations for Towerwall, a cybersecurity consulting firm based in Framingham.
