Three focus areas to improve security for AI projects in 2025

1. Insist on AI governance

There’s no overstating the importance of formalizing an AI governance framework. It’s foundational work for any organization that intends to responsibly use generative AI.

Good governance not only helps ensure the right security, privacy and regulatory controls, but also helps cut through the noise of ideas to determine how the company can get immediate value from AI technology.

Kyndryl has established a cross-functional governance committee that evaluates and approves use cases, ensuring they align with regulatory requirements and the organization’s risk tolerance. The group includes representatives from the cybersecurity team, the CTO office, corporate strategy, legal and other functions.

Through the governance process, a set of low-risk use cases has been prioritized, evaluated and approved. If a team brings forward a proposed use that fits in one of those boxes, it’s a quick approval. You know it’s non-sensitive data. It’s not regulated. It doesn’t create unwanted exposure. At the same time, if a proposed use comes through but doesn’t fit within the scope of what’s already been approved, it has to go through the evaluation rigor.

So many organizations are trying to figure out how to use generative AI. Business teams feel pressure to adopt it, while security teams must ensure it’s done safely and protects privacy. The formality of good governance isn’t to quash innovation. It’s to help balance speed to market and return on investment with ensuring it’s done responsibly.

3. Consider a zero trust architecture

Also known as deny by default or never trust, always verify, zero trust models consider all traffic as untrusted. That’s not a bad posture in an environment where deepfakes and other sophisticated threats are becoming more prevalent.

Part of the strength of a zero trust model is in the many layers of security it encompasses — from the identity of the user and the device they use to the network, application and data they try to access.

This model employs a progressive validation process to prevent malicious activities, even if initial defenses like voice recognition are compromised.

U.S. government agencies are already mandated to adopt a zero-trust architecture. McKinsey suggests that adoption rates for this security framework will continue to increase for companies of all sizes.

Zero trust is not a turnkey solution. It’s a process, an approach to fortify an organization’s cybersecurity posture. But like formalizing governance and customizing training, moving to a zero trust model can help move the needle on readiness for the next wave of generative AI.