Interview: Who Actually Protects AI

Generative AI is finding its way into applications and business processes - creating new requirements for IT security. In this interview, Frank Thias, Senior Principal Solutions Engineer at F5 Networks, explains why traditional security measures alone are not enough, what risks arise from AI agents and new interfaces, and why security should be part of AI initiatives from the outset..

Find out more in Frank Thias' talk "Who Actually Protects AI? AI Attacks: Considerations, Methods and Defences" at the Internet Security Days on Tour on 5 November 2026 in Frankfurt. Register now!

1. Companies are increasingly integrating generative AI into applications and business processes. In your view, what aspects of AI security are currently being underestimated?

In my view, the main issue being underestimated is that AI security is not automatically covered by traditional IT security measures. Many companies understandably focus on the added value of generative AI and its rapid integration into applications and business processes. Security considerations often come later.

In discussions with decision-makers and based on current demand for projects, I have observed that AI-specific risks are often not yet adequately considered. These include prompt injection, the unintentional disclosure of sensitive data, manipulation of AI outputs and inadequate controls when using external models and services.
Furthermore, many organisations are still in an early learning phase. They often lack clear processes, responsibilities and security standards for the secure use of AI. This creates a risk that AI solutions will be introduced faster than the necessary governance and security measures. The good news is that awareness of the issue is growing considerably. Nevertheless, I currently see a significant gap between the pace of AI adoption and the implementation of dedicated AI security solutions.

2. Your talk at the Internet Security Days in Frankfurt is entitled "Who Actually Protects AI?". Why is this question becoming increasingly important for companies?

The question "Who actually protects AI?" is becoming increasingly important for companies because the focus so far has largely been on how AI supports the organisation - for example, by automating processes, analysing data or supporting employees. Far less attention is paid to how the AI systems themselves need to be protected.

Yet AI applications are increasingly becoming business-critical components. They process sensitive information, make decisions or directly influence business processes.
If these systems are manipulated, fed faulty data or misused, companies can face significant risks against a backdrop of rapidly evolving threats.

Attackers are increasingly exploring AI-specific attack methods, while many companies are still gaining experience in operating such systems securely. New attack surfaces are emerging that traditional security approaches alone cannot fully address.
With this talk, I therefore want to draw attention to an often-neglected perspective: how we use AI, alongside how we effectively protect and securely operate AI systems, will be a crucial factor in future success.

3. AI agents increasingly enable systems to access data and carry out actions autonomously. How does this change the risk profile, and what safeguards must companies put in place before granting such systems extensive permissions?

AI agents represent a significant step forward because they no longer merely provide information: they can increasingly access systems and carry out actions autonomously.
This changes the risk profile considerably: a potentially flawed AI output can immediately lead to an incorrect or even harmful action.
Companies must therefore assume that AI agents pose the same risks as human users - in some cases to an even greater extent, as they work faster, can access many systems simultaneously and can implement decisions automatically.

Before granting such systems extensive permissions, companies should establish some basic safeguards.
These include, in particular, the principle of least privilege, a clear separation of roles and responsibilities, the logging of all actions and the option to require human approval for critical operations.
Technical safeguards against manipulation, for example through prompt injection or malicious inputs, are equally important.

Ultimately, an AI agent should have no more permissions than it needs for its specific task.
The key question is not what the agent is technically capable of doing, but what it should actually be permitted to do. This governance question will become increasingly important for companies in the coming years.

4. AI applications communicate with models, databases and other business systems through an increasing number of APIs. Are these interfaces becoming one of the key new attack surfaces, and how can companies keep track of what is connected to what?

Yes, in my view, these interfaces are becoming one of the most important new attack surfaces in the AI environment.
Modern AI applications rarely consist of a single model. In practice, they are connected to databases, cloud services, internal applications, external APIs and, increasingly, AI agents that can carry out actions autonomously.
Every additional connection expands the potential attack surface.

The challenge is that many companies already struggle to gain a complete overview of their existing API landscape. AI applications increase this complexity considerably.
New connections often emerge very quickly, for example through pilot projects or business units that independently integrate AI services. As a result, companies can easily lose track of which systems communicate with one another, what data is exchanged and which permissions are actually in place.

Visibility is therefore becoming a key security factor. Companies need a complete inventory of their AI applications, interfaces, data flows and dependencies. Only by knowing which systems are connected can they assess risks, control access and implement security measures effectively.

Ultimately, a familiar principle of IT security also applies to AI: you can only protect what you know. The greatest danger often lies in a lack of visibility across the overall system and its dependencies, rather than in an individual interface.

5. At the ISD Roadshow, you will discuss how companies can make use of AI's opportunities while managing its risks. What needs to happen to ensure that security enables AI innovation from the outset rather than holding it back?

For security to support innovation, it must be part of AI initiatives from an early stage. In many companies, security teams are only brought in once a solution has been selected or is already in production. This often creates the impression that security is preventing innovation. In fact, the problem is usually that security requirements were considered too late.

Companies should therefore view security as an enabler.
The aim should be to create a secure framework for deploying AI, rather than to prevent AI projects. This includes clear governance structures, defined security requirements, standardised approval processes and practical guidelines for developers and business units.

A risk-based approach is also important. Not every AI application requires the same controls. An internal assistant for general research has different requirements from an AI agent with access to critical business systems. Protective measures must therefore be proportionate to the risk involved. This allows innovation to continue without compromising security.
Ultimately, the companies that succeed will be those that view security as a prerequisite for the sustainable use of AI. By establishing the right safeguards from the outset, they can accelerate innovation rather than hold it back.

In IT security, we have learnt to trust identities, devices and applications. The open question for the coming years is: how do we measure trust in autonomous AI systems - and who decides when that trust is justified?

Register now for the ISD on Tour on 5 November 2026 in Frankfurt!