What do you consider to be the biggest success factors for adopting AI-enabled security solutions?

Since AI is such a big topic, my goal is to respond to this question from a comprehensive perspective.

Success factors for adoption of AI-enabled security solutions include the following:

1) Measurable Return on Investment (ROI)

2) Usability: In addition to ease of technical implementation, AI-enabled solutions should make your users' lives more productive, rather than more challenging. In other words, users should be able to access the information that they require via AI, but responses should be tailored based upon their level of data access, a concept referred to as "AI safeguards." (AI can be prime territory for user work-around actions, when users can't access the information they require, quickly and securely).

3) Sensitive Data Protection: If you perform a casual review of recent technology news, you can find examples of companies facing potential lawsuits or accusations of data privacy violations, all because they haven't adequately protected sensitive data like PII from being trained by LLMs. Any AI-enabled security solution should maintain the same level of sensitive content protection as your company was accustomed to in the pre-AI world. From my perspective, this requirement is non-negotiable.

4) Commitment to Rapid Technological Advancement: Based on my experience, this is where many AI-enabled security solutions fall short. You need a solution that can keep pace with AI's technological growth and advancement, not only for today, but for one or two years down the road. As such, you need to work with a provider who demonstrates commitment to addressing AI issues that extend beyond today's commonplace issues, and is willing to show specific roadmap plans about future focus areas.

5) Executive Support: Although this element is provided by your organization instead of the AI solutions provider, it is imperative to have executive support of AI-related initiatives. Following such an approach will allay executives' AI fear and misunderstanding, demonstrate how secure AI can maximize users' productivity while protecting the company's valuable data, along with helping to prioritize budgetary approval of your AI initiatives.

Finally, all of these success factors should be utilized in conjunction with a responsible AI usage policy for your organization, which needs to be updated on a regular basis. The usage policy should include the AI solutions that are formally blessed by your company and best practices that users need to follow on an everyday basis.

I look forward to seeing additional recommendations, in future responses to this question!

Several success factors stand out for adopting AI in security. Foremost is the security of the AI itself, including supply chain checks, policies for LLM usage, secret redaction, and prompt hardening. These considerations are top of mind for our team when evaluating or moving away from secure AI products. We also assess the lifecycle of these products, including operational ownership, whether there is a product owner within the SOC or VM, or if it is vendor-driven. Data readiness is another critical factor, encompassing data cleanliness, prompt engineering, and the fidelity of telemetry. Identity management and reliability of data sources are also important. Additionally, we monitor quality measurements such as override rates, SLA adherence, and the precision of false positive and true positive rates. These are among the primary factors we consider when evaluating the success of adopting an AI security tool.

The issue extends beyond security to include compliance and regulatory considerations. It is crucial to understand how AI is using data, what level of data is being fed into the system, and whether that data remains within the organization’s ecosystem. Once data leaves the organization, it cannot be retrieved, so it is essential to evaluate the impact on the organization’s data set. Success requires a combination of security and other industry pillars to ensure the right guardrails and protections are in place.

A key success factor is ensuring that the adoption of AI-enabled security solutions is led and supported by the security team itself, rather than being driven by other departments such as HR or marketing. It is important that security has the primary role in evaluating and implementing these tools, rather than having them introduced or partially implemented by other teams before security has had the opportunity to assess them.

Personally, beyond the classic ROI—always a reliable metric—I would evaluate the main success case in terms of the solution’s ability to adapt to future risks. The question I want to answer is: how well can my security system adapt to new threats thanks to AI?