risk management

In the AI Era, CISOs Worry About Data Leaks and Doubt Tech Will Solve Skills Gaps

/ , ,

CISOs recognize the need for AI but express concerns about risks, particularly data leaks and skills gaps. Despite AI's adoption in security, only mixed results are reported, with many affirming the technology won't resolve workforce shortages. Key worries include AI model hallucinations and regulatory challenges. Splunk's report recommends CISOs focus on clear AI governance and collaboration to integrate security into business strategy.

https://www.cybersecuritydive.com/news/in-the-ai-era-cisos-worry-about-data-leaks-and-doubt-tech-will-solve-skill/812964/

AI Won’t Break Microsoft 365. Your Security Backlog Will

/ , , , ,

TLDR: AI attackers exploit existing configuration backlogs in Microsoft 365, targeting long-neglected security settings rather than zero-day vulnerabilities. With rapid deployment of AI technologies and common misconfigurations across tenants, risks escalate while defenders struggle to keep up, emphasizing the need for immediate action on known security gaps.

https://thehackernews.com/expert-insights/2026/02/ai-wont-break-microsoft-365-your.html

The 2026 KPMG Global Third-Party Risk Management Survey

/ ,

KPMG's 2026 Global Third-Party Risk Management Survey reveals organizations face challenges in regulatory compliance and cyber threats, emphasizing the need for better integration of third-party risk management (TPRM) with enterprise risk management (ERM). Key findings include slow TPRM integration, the rising role of AI and managed services, and low confidence in data quality. The survey suggests that enhancing TPRM strategies is crucial for resilience amid evolving risks.

https://kpmg.com/lv/en/insights/2026/02/the-2026-kpmg-global-third-party-risk-management-survey.html

Data Minimization Is Still an Underrated Security Control

/ , ,

Data minimization is an underrated security control that reduces the volume of sensitive data, thereby decreasing the impact of breaches and improving security operations. Despite organizations claiming to practice data minimization, the sheer volume of data often outpaces governance capabilities, thereby increasing risk. To effectively implement data minimization, organizations must challenge the “speculative” analytics mindset, audit data propagation, and automate retention processes.

https://www.databreachtoday.com/blogs/data-minimization-still-underrated-security-control-p-4049

From Innovation to Regulation: How Internal Audit Must Respond to the EU AI Act

/ , , , , ,

The EU AI Act, a global standard for AI regulation, requires organizations worldwide to address AI risks through governance, controls, and accountability. Internal auditors must adapt to this shift, auditing AI governance, risk classification, data quality, human oversight, and third-party AI risk to ensure compliance.

https://www.wolterskluwer.com/en/expert-insights/innovation-regulation-how-internal-audit-must-respond-eu-ai-act

Living Risk Registers Help Security Leaders Prioritize Real Risk Over Compliance Theater

/ ,

Living risk registers prioritize real cyber resilience by integrating compliance into risk management. Ann Dunkin advocates for a quarterly review process quantifying non-compliance consequences, aligning security with daily decision-making. Compliance traps often arise from structural flaws in funding and mandate authority. Effective cybersecurity requires collaboration between CIOs and CISOs, focusing on a team's culture and flexible incident response. As AI advancements create more complex risks, organizations must adapt strategies to safeguard against evolving threats.

https://www.thesecuritydigest.com/news/living-risk-register-compliance-ann-dunkin-georgia-tech

The Shadow AI Workforce: When Employees Go Rogue With Tech

/ , , ,

Employees are using AI tools without official sanction, creating a “shadow AI workforce” that poses risks in data security and compliance. This trend emerged alongside the rise of generative AI tools, reflecting employees' desire for efficiency. HR must address this issue proactively by establishing clear AI policies, promoting safe usage, and fostering open communication about AI use. Ignoring or punishing this behavior can stifle innovation; instead, organizations should leverage it for strategic advantage by providing proper guidelines and training.

https://www.hrkatha.com/features/hr-pops-features/the-shadow-ai-workforce-when-employees-go-rogue-with-technology/

TPRM Governance: How Companies Strategically Manage Third-party Risks

/ , ,

KPMG discusses third-party risk management (TPRM) governance as essential for navigating challenges like geopolitical tensions, cyber threats, and regulatory pressures. Effective TPRM evolves from mere compliance into a strategic tool for resilience and business value. Companies struggle with outdated structures and fragmented approaches, necessitating clear governance to define roles, responsibilities, and risk categories. Successful TPRM requires centralized oversight for transparency, with roles well-defined to ensure consistent risk management. Future insights will address technological advancements in TPRM.

https://kpmg.com/de/en/services/audit/regulatory-advisory/tprm-governance-how-companies-strategically-manage-third-party-risks.html

Scroll to Top