Matthew Rosenquist says cybersecurity teams need to shift from blocking AI to enabling it safely. Security must discover all AI systems across the company, set clear policies for approved usage, and enforce guardrails on access and ethics. This lets developers experiment without friction while protecting privacy and compliance.
Chapters
Cybersecurity predictions for 2026. Prediction number 9: AI governance takes center stage. Organizations will focus on securing shadow AI and establishing guardrails for ethics, privacy, accuracy, safety, and compliance. With organizations rapidly adopting various forms and functions of AI, cybersecurity is tasked with the unenviable position of supporting the pursuit of business innovation and revenue while maintaining maintaining rational security, safety, privacy, and trust. This requires three basic capabilities. First, discovering an understanding of AI systems that are permeating the enterprise and supply chain. There is already a growing amount of shadow AI, and security cannot manage risk with hidden elements in the environment. Second, a build-out of policies is required to set an approved, common, consistent, and manageable process to sustain the awareness and implementation of AI tools and usage. It must be clear and well-known what is required and allowed. Without such expectations, workers will continually push in directions until something breaks. And lastly, the establishment of proper guardrails to govern the use, access, oversight, ethics, privacy, and safety of AI systems. These are the hard boundaries of what is allowed and where technical controls will, at a minimum, inhibit and monitor for non-compliance and exploitation. The combination of these three layers creates a cybersecurity manageable playing field where developers can be creative, users can play and explore, and new use cases can be developed without overly stringent friction from cybersecurity. The goal is for cybersecurity to be seen as a rational partner and not an inhibitor to innovation. The cybersecurity organization must support the rapid adoption of AI technologies for the betterment of the business. By establishing an environment that allows flexibility without unintentionally undermining the security, privacy, safety, or the trust that is expected.
