Companies spend more on cybersecurity but still struggle with AI oversight

Dive Brief:

• Companies are failing to close critical cybersecurity gaps related to shadow AI, even as they're spending more money on security, the security vendor DNSFilter said in a report published on Tuesday.

• Large shares of IT and cybersecurity workers reported a lack of faith in their security governance.

• The survey findings underscore the need for centralized management of companies' security platforms — a challenge at a time when teams are rushing to buy and install defensive tools.

Dive Insight:

Companies aren't blind to the cybersecurity threats they face. They know they need to spend more money on firewalls, intrusion-detection systems, identity-management platforms and other technologies. Three-quarters of the 400 IT and cybersecurity workers interviewed for DNSFilter's report said they'd increased their budgets over the past 12 months. Roughly one-fifth of respondents said their budgets had grown by more than 10%.

As AI creates new security challenges and magnifies old ones, security professionals are responding. Four in 10 survey respondents said their next dollar would go to AI security and governance, far surpassing the second most-cited priority, cloud security (25%).

But spending priorities don't automatically secure networks, DNSFilter warned. Instead, leaders need to pare increased spending with stricter policies, in both the technical and human contexts. Currently, many organizations have lax AI policies, letting security weaknesses slip unseen into corporate networks.

Nearly half (46%) of IT and cybersecurity workers said they were confident that unapproved AI apps were connected to their companies' systems, and one-fifth of respondents said an unapproved AI integration had led to a cybersecurity incident.

"The proliferation of AI has caused organizations to move faster than they might be ready for," DNSFilter said in its report, "and while the budgets have increased[,] the policies and governance haven't necessarily kept pace."

Thirty-seven percent of respondents told DNSFilter that they only find out about employees connecting AI apps to their work accounts after the fact, and another seven percent don't require employees to notify their IT departments about AI app connections at all.

"That is [44%] of organizations where the decision to connect an AI tool to corporate data is made by someone who does not own the risk," DNSFilter said.

Companies are also finding it difficult to manage their security tools. Sixty-two percent of respondents said they weren't sure that all their tools were properly configured, and the same percentage couldn't say that all of their tools were even actively monitored.

"Governance spending is not the same as governance," DNSFilter warned in its report. "The budget bought you a policy, but the tools are still getting connected to your environment — and you can't see them."