AI-First Cybersecurity Still Depends on Getting the Fundamentals Right

Why the Fundamentals of Security Matter Even More as AI Accelerates the Business 

AI-first has become a common phrase as organizations look for ways to modernize, increase efficiency, and move faster. I support that direction, but I think the phrase needs an important qualifier. AI first should not mean AI at any cost, and it certainly should not mean AI only.

For me, an AI-first strategy is about looking at new requirements, initiatives, and business problems and asking where AI can help. Sometimes the answer will be a sophisticated AI capability. Other times, the exercise may reveal that automation or a better use of existing technology can solve the problem. The value is in challenging ourselves to find a more streamlined way to achieve the business outcome, not in forcing AI into every use case.

This matters for CISOs because the attention surrounding AI can easily overshadow the security work that still has to happen every day. Endpoint protection, vulnerability management, identity, third-party risk, data protection, resilience, and recovery have not become less important. In many cases, AI is making them more important.

AI Makes the Fundamentals More Important

One of the most useful ways I have found to keep foundational security relevant is to connect it directly to what the business wants to accomplish with AI. If an organization wants to build AI agents, identity and role-based access controls have to support them. If it wants to build an MCP server or use enterprise data in new AI workflows, the underlying data needs to be understood, protected, and appropriately governed. If AI becomes critical to a business process, resilience and recovery expectations must reflect that dependency.

This changes the security conversation. Instead of asking the business to invest in a foundational control because security says it is important, we can show why that control is necessary to enable the AI capability the business already wants. AI can actually create an opportunity to secure investment in areas that historically have been difficult to prioritize.

Vulnerability management is a good example. It has always mattered, but AI-enabled threats can compress exploitation timelines dramatically. That changes the urgency around patching and remediation. Controls and service-level expectations that may once have operated on a timeline of weeks increasingly need to move toward days or even hours. AI is not replacing the fundamental, it is changing the speed at which the fundamental has to work.

Efficiency Can Create Dependency

There is another side to AI efficiency that organizations need to consider. As people become more productive with AI, they can also become dependent on it. I have already seen situations where users quickly begin to describe an AI capability as something they cannot do their job without. That should get a leader's attention.

If an AI service becomes essential to a workflow, it needs to be treated accordingly. Organizations should understand whether the capability has become a critical service, what happens when it is unavailable, and whether employees still know how to perform the underlying process without it. The more we automate, the more important it becomes to understand the manual fallback when that automation fails.

This is not an argument against automation. It is an argument for recognizing the operational consequences of successful adoption. AI systems will fail, vendors will experience outages, models will change, and capabilities will evolve. If the organization has quietly eliminated the human knowledge or manual process needed to operate through a disruption, an efficiency gain can become a resilience problem.

Speed Should Force Security to Get Better

AI absolutely creates pressure to move faster, but I see an opportunity in that pressure. It forces security teams to become more structured, more efficient, and more deliberate about where deep review is actually required.

One approach is to create clear swim lanes for AI initiatives. A lower-risk use case may move through a fast, low-touch review. A more complex initiative may require involvement from an AI center of excellence or additional security and privacy stakeholders. The highest-risk use cases may require executive review. Not every initiative needs to travel through the same process, and treating them all the same can turn security into the bottleneck everyone is trying to avoid.

Starting small also matters. A lower-risk environment can provide a place to test how quickly a team can build with AI, how effectively security telemetry can be integrated, and what controls are actually needed before the approach is expanded. Small wins build trust, give security teams practical experience, and create evidence that can be used to scale safely.

AI Is Exposing Problems We Already Had

I do not believe AI is creating an entirely new universe of security problems. It is creating some new challenges, particularly around identity, agents, governance, and talent, but in many cases it is amplifying weaknesses that already existed.

Organizations that entered the AI era with unresolved identity issues, fragmented data, slow vulnerability management, limited third-party visibility, or immature recovery processes still have those problems. The difference is that AI can increase the speed, scale, and consequences associated with them. The list of security priorities did not disappear when generative AI arrived, the clock simply started moving faster.

That creates a talent challenge as well. Organizations increasingly need people who understand AI governance and AI-related security, yet the market cannot provide professionals with years of experience in disciplines that are evolving this quickly. Teams are learning while the technology changes beneath them. Security leaders have to account for that reality, including the risk of burnout as people attempt to keep pace.

Governance Has to Continue After Approval

Many organizations have invested heavily in the front end of AI governance. They have intake processes, security reviews, stakeholder approvals, and committees that decide whether a new capability can move forward. Those steps matter, but approval cannot be the end of governance.

The harder question is what happens after a technology has been approved. AI vendors are changing rapidly with features being added, policies evolving, models changing, and users enabling new capabilities that were not part of the original review. A point-in-time assessment cannot provide enough assurance in an environment that changes continuously.

That is why I believe security programs need to become more adaptive. Identity can serve as an important control plane, supported by stronger context about users, agents, data, behavior, and risk. Rather than relying exclusively on static approval gates, we should be moving toward controls that can respond as conditions change. The objective is to give people room to innovate while continuously adjusting security based on the risk we can observe.

AI Cannot Become a Distraction

AI now drives a significant portion of executive and board-level technology conversations, and that attention can be valuable. It gives CISOs an opportunity to discuss governance, data privacy, resilience, investment, and risk with an audience that is highly engaged. It can also give security a stronger seat at the table because leaders increasingly understand that AI initiatives cannot move forward responsibly without security involvement.

The danger is allowing AI to consume the entire agenda. Security leaders still need to educate the business about other emerging issues and continue making progress on risks that may not be receiving the same level of attention. Post-quantum readiness is one example. It may not have the immediacy or excitement of AI for many executives today, but waiting until it becomes urgent would put organizations in a reactive position.

AI will eventually become embedded in technology in much the same way other once-distinct technology trends became part of normal business operations. We should prepare for that future by integrating AI security into the broader security and enterprise risk strategy rather than building a completely separate universe around it.

Security Has an Opportunity to Become the Enabler

The most important lesson for me is that an AI security strategy has to remain tightly connected to the business strategy and enterprise risk. Security cannot operate as a parallel function that reviews AI after the business has already decided what it wants to do.

This is an opportunity to move beyond the old perception of security as the office of no. Security teams already know how to build detailed workflows, conduct risk reviews, evaluate third parties, manage controls, and create accountability. Those capabilities can become part of the infrastructure that helps the broader organization adopt AI faster and more responsibly.

The fundamentals still matter, and CISOs have to keep chipping away at them even when the newest technology dominates the conversation. The difference is that we can now connect those fundamentals directly to modernization. If the business wants AI, security can help show what has to be true for that AI to work safely, reliably, and at scale.

AI first should therefore be viewed as an opportunity, not a replacement strategy. It can push security teams to improve outdated processes, accelerate controls that were moving too slowly, and become more adaptive to change. The organizations that get this right will not be the ones that simply deploy the most AI. They will be the ones that use AI to move faster while strengthening the foundation that makes that speed sustainable.