AI Has Changed the Game - But Not All the Rules - Old Threats, New Risks, Real Consequences

Lester Godsey, CISO at Arizona State University, opens by arguing that AI has not rewritten the basic rules of security. In his view it mainly makes attacks cheaper, quicker and larger in scope, and many enterprise concerns are familiar problems in new clothing. He frames the talk around separating real new problems from overblown fears, and notes that banning AI is unrealistic because shadow AI already exists inside most organizations.

The middle of the talk covers where AI does create new difficulty. Nondeterministic outputs are hard to audit against controls built for repeatable results, and vibe-coded software often skips the code review and lifecycle discipline that traditional development relies on. Prompt injection is compared with classic injection flaws, and existing threats are shown to be amplified, including polished phishing, deepfake impersonation during identity resets, and malware built in days. He also covers agentic systems that need monitoring and least privilege, unmanaged API dependencies, and the risk of third-party models trained on unknown data.

For practitioners, the takeaways are to adapt existing controls such as data classification, DLP, vendor risk reviews and identity management, and to assess how AI is built and governed rather than trying to validate every output. His governance steps are to inventory AI use, define allowed, restricted and prohibited uses, assign business owners to set risk thresholds, and fold AI risk into enterprise risk management. He closes by saying that governance failures matter more than model failures, and that documented, responsible decisions are more useful than perfect answers.