OPINION
Every Australian board should be able to answer three questions before it approves its next AI initiative.
Most cannot: where is our most sensitive data, who or what can reach it, and what are they actually doing with it?
The bigger risk is not the external attacker using AI to break in. It is the agent already inside your environment, with access you gave it, acting on data you may not fully see.
For decades, organisations answered those questions with frameworks. Data classification policies. Access matrices. Quarterly reviews. A folder of permissions and controls that satisfied the auditor and reassured the board.
It was never a perfect picture, but it was good enough, because the gap between what the policy said and what was really happening moved at human speed.
A misconfigured permission might sit undiscovered for months. A human with too much access could only do so much damage in a working day.
That tolerance has just evaporated
The country's most senior cyber authorities have made the point in language they rarely use.
Australia and its Five Eyes partners have issued a joint statement warning that AI is rapidly increasing cyber risk and urging leaders to act now rather than wait.
The Australian Signals Directorate's Australian Cyber Security Centre has cautioned that frontier models could amplify cyber risk, with attackers using AI to find long-standing weaknesses and chain smaller vulnerabilities together at speed.
The Australian Securities and Investments Commission (ASIC) has gone further, telling licensees that frontier AI could expose security vulnerabilities at unprecedented speed, scale and sophistication – and that they should not wait for advanced tooling to mature before lifting their fundamentals.
The common thread across these warnings is not the sophistication of the attack but the collapse of the time we used to have.
Policy implementation was always a snapshot. Agents act in real time
An AI agent does not read your access policy.
It inherits the permissions that exist, including the ones nobody remembers granting.
It does not act once a quarter. It acts continuously, at machine speed, across systems that were never designed to be touched by a non-human identity making its own decisions about what to read, update, modify or delete.
The Five Eyes guidance on agentic AI is unusually candid.
It warns that every component in an agentic system widens the attack surface, and that compromised behaviour in one part can cascade across an entire workflow.
An agent with legitimate access to a finance system, a customer database and an email account is not three separate risks.
It is a single identity that can read sensitive records, change them, and act on them in sequence, faster than any human could notice, let alone intervene.
Automated system logins are not new, and they have been governed for years.
But they follow a script.
An agent reasons, adapts and acts on its own. The controls built for predictable automation were never designed for that.
If you do not know precisely where your sensitive data sits, who and what can reach it, and what is happening to it, you have not deployed an assistant.
You have deployed an actor with the keys, no supervisor, and no log of what it touched.
Three questions that policy can no longer answer
Most organisations scaling AI adoption still cannot answer basic questions about their own data.
The first is location. Sensitive data is rarely where the policy says it is.
It lives in spreadsheets nobody tracks, collaboration tools that cross borders, test environments that never got decommissioned, and increasingly, the models themselves.
You cannot govern access to data you cannot locate.
Then, access. Not who is supposed to have access, but who and what does.
The number of non-human identities in a typical enterprise now dwarfs the number of staff.
Each AI agent, integration and service account is a door.
Most organisations have no current map of those doors, and the access matrix in the policy binder describes a building that no longer exists.
The third, and most neglected, is interaction.
Access only tells you what an identity can reach. Interaction tells you what it is actually doing.
Reading is one risk profile. Updating, modifying and deleting are entirely another.
Without visibility into those actions, not just the permissions, an organisation cannot tell the difference between an agent doing its job and an agent, or an attacker who has captured it, misusing or exfiltrating business-critical data.
Resilience is the foundation, not the afterthought
None of this is an argument against adopting AI. It is an argument against adopting it blind.
Before the next agent is given access, an organisation needs clear answers to all three questions.
Governance should be enforced at the data source, not layered on at the agent, because you cannot control what you cannot see, and you certainly cannot govern an agent you did not know was there.
And when something goes wrong, recovery must be fast, clean and precise, restoring only what was affected from a clean, tested copy that cannot be altered.
In an environment where an agent can modify or delete data at machine speed, the ability to recover cleanly and quickly determines whether disruption stays contained.
In February, ASIC secured a $2.5 million penalty against a financial services organisation after governance failures exposed the data of 18,000 clients.
That case involved conventional threats at human speed. The regulators have given the warning and the timeline – it is now.
For most organisations deploying AI, the old controls will fail. The question is how visible the damage is when they do.
The controls that have passed every audit for a decade are about to be tested at a speed they were never designed for.
