Emerging technology represents a category of systemic risk that the ISO must govern with particular urgency and sophistication, because it occupies an unusual position in the risk landscape: it simultaneously expands the organisation’s defensive capability and its attack surface, empowers the security function and its adversaries in equal measure, and introduces governance challenges whose novelty means that established frameworks and historical precedent provide limited guidance. The ISO who waits for emerging technology risks to mature into well-understood governance problems before addressing them will consistently find that adversaries have already operationalised capabilities that the defensive governance framework is not yet equipped to address.
Artificial Intelligence as an Offensive and Defensive Capability #
Artificial intelligence has altered the information security risk landscape more fundamentally than any technology development since the emergence of the internet, and its governance implications for the ISO are both urgent and deeply complex. The ISO must govern AI in the information security context across two dimensions that are developing simultaneously and that interact with each other in ways that make the governance challenge more dynamic than a simple capability assessment suggests.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
