Cybersecurity Awareness: The Importance of Getting the Basics Right

Recent reports of AI systems acting beyond their intended scope are a timely reminder to get the basics right. We wouldn't give a new contractor access to every file with no supervision, yet that is effectively what happens when AI is introduced on top of unclassified data and broad permissions. We onboard contractors properly, and the same discipline is what lets us use AI with confidence.

The lesson isn't that AI is too risky to adopt. It's that the technology is only part of the picture. What matters is the data beneath it, who is accountable for it, and how well governance keeps pace with experimentation. The good news is that it's fixable.

Start with your data. In my client conversations, AI adoption is often outpacing governance. When data isn't classified and access is too broad, AI can surface information people were never meant to see. Before anything else, organisations need to know where their data is stored, who can access it and how it's classified. It isn't glamorous, but it's the core of the problem.

Plan for accountability. Access controls are only half the picture. If an AI agent does something unintended, who is responsible, and how quickly would you know? Directors should be asking that question. Answering it takes clear ownership, active alerting, a tested incident response plan, and agreed breach notification timelines with vendors. These are often overlooked until something goes wrong.

Size changes the safeguards, not the risk. Organisations under APRA or critical infrastructure obligations tend to move cautiously, because they know AI isn't as simple as flipping a switch. Smaller businesses face the same risks with fewer safeguards, and are often more ambitious about experimenting with AI. That's understandable, but it's where I'd urge the most care.

Be proportionate. Scale the depth of your risk assessment to the risk. A large organisation may need a formal gap analysis, while a small business may need a simple check of what data the AI can reach and what it can do. If you're considering a privately hosted or tenant-isolated AI service, check the access controls, retention terms and data residency. Hosting alone isn't enough: limiting what any AI can reach and do matters wherever it's hosted.

The ASD Essential Eight provides a valuable cybersecurity baseline for organisations of any size, although it should sit alongside AI-specific governance, privacy and risk-management controls.

Govern the cost too. Unmonitored AI usage can also run up unexpected charges, and unusual spikes can signal misuse or compromised credentials. Set spending limits and usage alerts from day one. Treat identity, data, cloud and governance as one connected problem rather than separate tools, and plan how you would recover and keep operating if an AI agent or supplier fails. The practical way forward is to assess where you stand today, build a roadmap that fits your budget, and work with a reputable partner who can help you implement and monitor the controls over time.

AI shouldn't be a leap of faith. With the right foundations, security is what lets organisations adopt it with confidence.