Unsupervised: the three faces of AI risk in cybersecurity

What it is about

Jorge Litvin, founder and CEO of Safe-U, presented at the Fourth Annual Risk Conference (September 17, 2026) the three faces of artificial intelligence risk in cybersecurity: the threat the attacker uses, the risk that arises inside the organization itself and the opportunity to use it to defend.

The 38 visible slides (three hidden ones are not included) first explain why AI risk is different: opacity, autonomy, shared responsibility, scale and speed, and probabilistic results. From the attacker side, AI lowers the barrier to entry, boosts experts and multiplies attack capacity, and the criminal does not wait for the policy, the budget or the approval of the organization. The second face is the internal one: with zero attackers, zero malware and zero exploits, an AI with incorrect context, excessive access or authority, ambiguous instructions, persistent memory or chains of agents can harm the company by doing exactly what it was allowed to do. The presentation proposes seeing AI as a system that knows, decides and acts, and looks at Shadow AI not as a risk but as the condition that enables several.

The third part uses AI for good: a five-stage maturity scale for AI-based security, the advice not to spend on AI controls without knowing which risk is to be managed, the AI.uda method (discover, understand, decide, enable, observe and adjust), an example inventory of uses, the governance frameworks (GDPR, OECD principles, EU AI Act, NIST AI RMF and ISO/IEC 42001) and the shift from human oversight to the human being the loop. It ends with the idea that cybersecurity is not a technology challenge but a human and leadership one.

Objectives

• Explain why AI risk is different (opacity, autonomy, scale and probabilistic results) and how attackers take advantage of it.
• Show the internal risk: AI systems that, without any attacker, do what they were allowed to do and cause harm, and Shadow AI as the condition that enables it.
• Give a method to govern and mature AI-based security, with reference frameworks and an inventory of uses.

Key takeaways

1. For the attacker, AI lowers the barrier to entry, boosts the skills of experts and multiplies attack capacity: segmenting victims, finding vulnerable systems, phishing, malware and impersonation of faces and voices.
2. Risk grows when autonomy and privileges increase at the same time; a chatbot is not the same as an autonomous agent with access to several systems.
3. According to the presentation, one in five organizations that suffered breaches originated them from Shadow AI, the use of AI outside formal governance mechanisms.
4. Maturity of AI-based security has five stages, from ad hoc to optimizing and adaptive, and it is not advisable to spend on AI controls without knowing which risk is to be managed.
5. The frameworks mentioned are GDPR, the OECD principles, the EU AI Act, the NIST AI RMF and the ISO/IEC 42001 standard, together with reviewing each use every 90 days or when permissions or the model change.