Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The EU just pushed back its AI Act enforcement by 16 months. The US is deregulating. China is governing through infrastructure. And the UK is doing nothing and hoping for the best. Welcome to Razorwire, the podcast where we share our take on the world of cybersecurity with direct, practical advice for professionals and business owners alike. I'm Jim and in this episode, I'm joined by Richard Cassidy, Field CISO at Rubrik, and Jonathan Care, Head of the AI Practice at KuppingerCole.

The AI governance crisis is already here, with innovation moving faster than regulation, oversight and accountability. The real problem is no longer only what AI can do, but who governs it when these systems start reshaping security, business and public life.

AI regulation is failing faster than AI itself, leaving accountability, security and control dangerously behind the pace of adoption. This episode explores AI governance, encryption, singularity, super AI and why the future may belong to whoever controls the most powerful models first.

Defence in depth changed forever with cloud security because the old perimeter gave way to platforms, suppliers and connected services outside direct control. That means modern attackers often reach the target through weaker vendors, cloud services or supply chain links instead of attacking the business head on.

Alert fatigue is becoming an AI attack strategy because attackers now have the scale to flood defenders with noise and bury the real intrusion. Instead of one distraction, offensive AI supports constant false signals that overload analysts, stretch the SOC and reduce the chance of seeing what matters.

A prompt injection attack through server logs becomes possible when hidden instructions are processed later by an AI log analysis tool. That turns normal logging into a possible data exfiltration path and gives attackers a new way to abuse LLM workflows without touching the main application logic.

AI agents are creating a new penetration testing risk when they act beyond the tester’s intent and leave messy accountability behind. Once an agent touches email, tickets or workflows in a user’s name, legal, forensic and control problems start stacking up fast.

Human in the loop AI security is failing because analysts are asked to review machine-speed output at human speed. AI now produces too many alerts, findings and decisions for manual review to remain the main safety control in modern cyber defence.

Shadow AI is already inside many companies through unapproved AI tools, local LLMs and public AI apps used without oversight. That creates data security, governance and compliance risk because the business often has no clear view of what is being used or where sensitive information is going.

Third party risk management is breaking because AI writes the questionnaire and AI writes the answer. That leaves security teams with polished vendor responses, less proof, and far less confidence that supplier controls, governance and cyber risk are being measured honestly.