Opinion | Security
The industry is buying AI security one tool at a time – Attackers see one building and until operators do the same, the gaps will be where the next breach happens.
Last week Fortinet and Equinix announced a new way to govern AI traffic; It can inspect prompts and responses, apply policies to AI interactions, and show how both approved and unapproved AI is being used. It runs on a hub that connects AI agents, models, data and compute across different clouds. It’s a good product for a real problem, it is also a perfect example of what worries us. We keep buying security one box at a time, for one layer at a time, while the thing we are protecting has become a single, connected environment that stretches from the front gate to the AI prompt.
Attackers don’t respect your org chart
For years, physical security and cyber security have lived in different teams, with different budgets – is that separation officially out of date now?
In March, Amazon said two of its UAE facilities were directly struck by drones, and a facility in Bahrain lost power. In October, Yandex said a data centre near Vladimir shut down after a drone attack. Thankfully, most operators will never face a drone or a missile, but the lesson travels: a cyber intrusion can now disrupt the power and cooling that keep the building alive and operators who guard the front door and the data separately are protecting two halves of one problem.
The layer nobody talks about
Underneath every AI model is hardware, and underneath the hardware is the code that starts it up. In October, a serious flaw in that code was disclosed, rated 9.5 out of 10 for severity, in software most hardware makers use to build server firmware. It lets an attacker run their own code before the server’s security protections have even started and only works while a machine boots over the network and it can be switched off if you don’t need that. But a week later, most hardware makers had not yet released fixes.
The point is not this one flaw. It’s that AI security which trusts what’s underneath without checking is built on hope.
A workforce nobody hired
AI agents log in, use tools and take actions – in effect, they are a new workforce with no HR file and, often, no manager. A survey of 285 professionals by the Cloud Security Alliance and Strata found that 92% were not confident their existing identity systems could manage AI and machine identity risks, and 78% had no documented policy for creating or removing AI agent identities.
Nobody would hire a human with that little oversight and software moves way faster than any human can.
Shared AI means shared risk
Last month Cloudflare disclosed that 155 responses from one hosted AI model contained data from other customers, with no evidence of deliberate exploitation. The cause was an ordinary slip: the system was set up to accept longer requests than its memory could safely hold, a mismatch the company says it knew about before launch, combined with a software bug. Cloudflare deserves some credit for explaining it openly, but the lesson for everyone sharing AI infrastructure is uncomfortable; The wall between you and other customers is software, and software can be misconfigured.
Regulators are heading the same way
In the UK, the Cyber Security and Resilience Bill would regulate data centres as essential services. It passed the Lords on 2 November and returns to the Commons, and is not yet law. The proposals include an initial incident notification within 24 hours. That is hard to meet if no one person can see across the physical, digital and AI sides of the estate.
Our position
Tools like FortiAIGate address mainly the data and visibility layers – the industry should welcome them and be honest about the rest. The security model for AI infrastructure has to protect the whole operating environment, in practice, three questions should have one owner and one answer:
- Who or what is in the building? People, contractors, systems and the power and cooling behind them.
- What is running on the hardware? Is it what you think it is, and can you trust it?
- What are your agents allowed to do? And who is responsible for each one?
Operator takeaway: If you can’t say who or what, whether human, machine or agent, touched your AI estate between the front door and the prompt, then you haven’t secured it.
