By Andy Syrewicze, Principal MSP Advocate & Security Evangelist, Proofpoint’s MSP Platform. Proofpoint’s MSP Platform won ‘Best SaaS Product for Cybersecurity’ at the 2026 SaaS Awards.

Artificial intelligence is reshaping the security perimeter in ways that traditional cybersecurity strategies were never designed to address.

For years, security teams have focused on protecting users, devices, applications, and data. Those priorities remain important, but AI is changing how they connect. An AI assistant may read an email, retrieve information from a knowledge base, summarize a document, or recommend an action. AI agents go further by interacting with business applications, accessing enterprise data, and automating workflows.This changes the central security question. It is no longer enough to ask whether an AI model is secure. Organizations also need to understand what authority AI has and what could happen if that authority is manipulated.

The resulting risk falls into three connected areas: attacks against AI systems, attacks enabled by AI, and governance risks created by the way organizations adopt AI. Looking at AI through this broader lens is becoming essential as generative AI and autonomous agents move from isolated tools into everyday business operations.

AI is Turning Trusted Business Content into a New Attack Surface

One of the most significant changes is that AI systems increasingly consume information that was never created with AI in mind. An email, PDF, Teams message, webpage, or knowledge base article can contain instructions that an AI system later interprets as part of its task. This creates the possibility of indirect prompt injection, where attackers never interact directly with the model. Instead, they manipulate the content the model is asked to process.

The consequences extend well beyond the AI itself. A misleading response from a standalone chatbot may simply be inconvenient. A manipulated instruction processed by an AI system connected to enterprise applications could disclose sensitive information, make an incorrect decision, or trigger an unauthorized action.

The challenge is not simply that an AI system can be fooled, but that it can be fooled while possessing the authority to act.

This is why AI security increasingly overlaps with identity and access management. The principle of least privilege, traditionally applied to users and service accounts, now applies to AI identities as well. AI systems should have only the permissions they require. Connected tools should be limited, credentials should be tightly scoped, and higher-risk activities should require approval before they are carried out. The more autonomous AI becomes, the more important these controls become.

Data Governance May Matter More Than Model Security

AI adoption also exposes a less obvious but potentially more significant challenge. Many organizations still lack complete visibility into their own data.

Generative AI creates new pathways to sensitive information. Employees may enter confidential data into an unapproved AI service. An AI application may retrieve information that users should never have been able to access. Third-party AI services may retain or process information in ways that are not fully understood.

These problems rarely originate in the AI model itself. More often, AI exposes weaknesses that already exist. Poor data classification, excessive permissions, inconsistent governance, and limited visibility become much harder to ignore once AI begins interacting with enterprise information at scale.

This represents an important shift in thinking. AI governance should not sit apart from cybersecurity. It should extend the broader information security strategy into a new context by asking who can reach sensitive information, what they are allowed to do with it, and whether those controls still make sense when an automated system is involved.

These questions become even more important as organizations connect AI to collaboration platforms and Microsoft 365 workloads, where vast amounts of business-critical information already reside.

AI is Amplifying Familiar Attacks

Discussions about AI-enabled cybercrime often focus on futuristic threats, but the immediate risk is more practical: familiar attacks are becoming faster, more convincing, and easier to scale.

Generative AI allows attackers to create highly tailored phishing emails, automate reconnaissance, and refine social engineering campaigns with remarkable speed. Business email compromise, invoice fraud, credential theft, impersonation, and QR-code phishing all become more effective without requiring entirely new attack techniques.

For defenders, this means AI security cannot sit apart from the rest of the security program.

Email remains a critical attack vector, but attacks increasingly move across collaboration platforms, browsers, SaaS applications, and identity services. A phishing email may simply become the first step in a much broader attack chain. Security controls therefore need to follow the way people work rather than stopping at traditional security boundaries.

The same principle applies to AI-generated deepfakes. Voice cloning and synthetic video can make fraudulent requests appear highly credible at precisely the moment someone is expected to act. Technical detection alone may not always be enough. Independent verification, such as callbacks, secondary approvals, and out-of-band confirmation, remains one of the most effective defenses because it does not rely on trusting a single digital interaction. Ongoing cyber awareness training plays a critical role here.

Shadow AI is a Governance Challenge

Employees will adopt AI tools that help them work more efficiently, whether security teams are ready or not. Shadow AI is simply the latest evolution of shadow IT.

When approved tools fail to meet business needs, people naturally seek alternatives. Blanket bans rarely eliminate the problem. More often, they drive AI adoption out of sight.

A more sustainable approach is risk-based governance. Not every AI use case presents the same level of risk. An employee using an approved AI assistant to summarize public information presents a very different challenge from an autonomous application that can access confidential customer records or initiate external communications.

Rather than trying to create a universal list of approved AI applications, organizations need a clear view of their AI estate. They should know who owns each solution, what information it processes, which systems it can access, whether it can modify data or trigger business processes, and which third parties are involved. Those answers provide a stronger foundation than attempting to prohibit AI outright.

Security Teams Need to Govern Actions, Not Just Access

Traditional access controls answer a relatively straightforward question: can this user access this resource?

AI introduces another question that may prove even more important: what is this system allowed to do with the information it can access?

As AI agents become more capable, that distinction becomes critical. An agent may legitimately retrieve information without needing permission to send external emails. It may update a record without being authorized to approve a payment. It may access one repository without needing visibility across an entire enterprise.

Strong AI governance therefore needs both access controls and action controls. High-impact activities such as payments, privilege changes, mass communications, external data sharing, and destructive operations should include safeguards, even when AI is technically capable of completing them autonomously.

This is not an argument against autonomous AI. It is an argument for bounded autonomy: allowing AI to operate independently where risks are limited while introducing checkpoints where mistakes or manipulation could create significant business impact.

The New AI Security Perimeter is Defined by Authority

One of the biggest misconceptions surrounding AI security is the idea that a single control can solve the problem. Organizations need layered protections because AI introduces risk across identities, applications, collaboration platforms, data, governance, and recovery.

A resilient AI security strategy should combine visibility into AI use, least-privilege access, data governance, user awareness, approval processes for high-risk activities, human oversight where appropriate, and tested recovery capabilities. Prevention can never eliminate every threat, but layered controls can reduce both the likelihood and impact of an incident.

Resilience does not assume attacks or mistakes will never happen. It focuses on limiting the consequences when they do. For AI, that means ensuring manipulation does not automatically become authorization, monitoring AI interactions with enterprise data, and preparing recovery processes before they are needed.

The security perimeter is no longer defined solely by where data is stored or where users connect from. Increasingly, it is defined by what AI systems are trusted to know and, more importantly, what they are trusted to do.

That makes AI security inseparable from governance. Organizations need to know which AI systems are operating, what they can reach, which identities and applications they can interact with, and which actions should remain under human control.

Organizations that succeed will not be those that delay AI adoption until every possible threat has been eliminated. They will be the ones that understand where AI introduces new dependencies and build governance around the areas that matter most.

Organizations do not need to fear AI. They need to understand it, govern it, and build security around the authority they choose to give it. As AI becomes more deeply embedded in everyday business operations, that authority becomes the new perimeter security teams must manage.

That is the new AI security perimeter.