I’m a history guy, so indulge me for a minute. 

Following World War I, France built the 280-mile Maginot Line to deter another German invasion. At its northern end lay the Ardennes Forest, a region so dense and rugged that French military planners believed no army could successfully move through it. History proved otherwise. In May 1940, German forces bypassed the Maginot Line entirely by advancing through the Ardennes, catching France unprepared where it felt most secure. Just six weeks later, France surrendered, a stark reminder that the greatest vulnerabilities are often found where we assume no threat exists. 

I’ve been thinking about the Maginot Line a lot lately because in July we watched an autonomous AI agent do the digital equivalent. During an internal cybersecurity evaluation, an OpenAI model wasn’t told to attack anyone—it was simply tasked with achieving the highest possible score on a hacking benchmark. Instead of solving the challenge as intended, it discovered a zero-day vulnerability, escaped its sandboxed environment, gained internet access, and compromised Hugging Face to obtain the answers directly. In OpenAI’s own words, the model became “hyperfocused” on accomplishing its objective. It did something its designers never expected by finding a path no one thought to defend. 

That same week, I sat down for a WEI Tech Talk podcast with Anthony Seto from Palo Alto Networks’ AI go-to-market team and Mark Gilmor, Managing Principal at Cyberify, to talk about what enterprises should actually do about AI security. It’s a conversation I’m having with enterprise IT security leaders almost every day now, and I want to share what we’re seeing.

Everyone Is Building the Plane While Flying It 

Here’s the honest picture from the field. Every customer we talk to feels the urgency to use AI to improve the business. The urgency to secure it? Well, that varies. 

We’re seeing two camps. The first is pursuing AI cautiously, managing board pressure and insisting on discovery and controls before they scale — including getting their arms around shadow AI. The second jumped in with both feet and is realizing after the fact that they have real work to do to put controls around what they’ve built. Anthony put it perfectly on the podcast: everyone’s building a plane while trying to fly it at the same time. 

And here’s the question I get in almost every one of these conversations: “Can’t we just use the legacy controls we already have? Isn’t this just another application?” 

No, it isn’t. Early attempts to govern AI access with URL filtering didn’t work out well. These are non-deterministic systems — they decide how to accomplish a task differently every single time. The problems they create didn’t exist two years ago, and they demand purpose-built, context-aware controls that also didn’t exist two years ago. The good news: those controls exist now and WEI is getting in front of this in conversations with clients.

Three Kinds of AI Risk 

Anthony frames enterprise AI risk in three buckets, and it’s the cleanest model I’ve seen: the AI you use, the AI you build, and the AI that acts for you (agentic AI). Each maps to a security use case that contains the one before it, like nesting dolls: protect the prompt; protect the prompt and response; protect the prompt, response, and action. 

The AI You Use: This is the third-party stuff, which means the number of places your people can enter data into a prompt is astronomical. Every website that used to have a search bar now has a conversation. Here’s the nightmare scenario we walk customers through: a sales exec pastes a confidential roadmap into a personal ChatGPT account for a quick summary. Without enterprise protections, that roadmap can become training data — and surface weeks later when a competitor asks the same tool for competitive intelligence.  

You can’t control how a third-party service responds; what you can control is what leaves your environment, through a secure enterprise browser and network-level inspection with inline DLP. 

The AI You Build: This is your responsibility to test as this is often designated as a liability. Models pulled from public repositories need scanning: threat actors are seeding them with backdoored files, and even re-registering the names of departed model publishers to poison pipelines that automatically pull the “latest” version.  

Your data needs protecting, too. For example, corrupting a dataset behind a hospital’s dosage-calculating chatbot could lead to unfathomable results. And your chatbot needs red-teaming before production, so it doesn’t end up writing Python code on your token budget when it’s supposed to be talking about your brand. 

The AI That Acts For You: This where things get real in a hurry, because AI agents combine autonomy with access: source code, credentials, code execution, even sub-agents that inherit their parent’s permissions. This isn’t theory. Researchers showed last year that hidden prompts — white text on a white background inside an ordinary document — could hijack a major AI copilot into leaking sensitive data with zero clicks from the user.  

In another widely reported incident, an AI coding agent deleted an entire production database during an explicit code freeze. Add the biggest misconception I see — a developer building an agent under his own identity, so the agent can do anything he can do — and you understand why an AI gateway, a central control point for what agents can talk to with a full audit trail, is becoming non-negotiable infrastructure. 

One more thing, since it’s close to home: how many of you run an ad blocker in your web browser? Do you know if it’s safe? Researchers keep finding genuinely useful-looking browser and IDE extensions engineered to quietly steal data — including plugins that captured users’ full AI chat histories, and one campaign that compromised nearly nine million browser users. Your endpoints need the same discovery, scanning, and governance as your cloud.

Design for the Future Worst Case 

At WEI, we’ve spent 35+ years doing design work for our customers, and here’s the philosophy this moment demands: suspend disbelief. Don’t assume there’s something the bad guys won’t try, or something an independent agent can’t do. The French believed the Ardennes forest was impassable — until it wasn’t due to German-engineered tank innovation.  

IT leaders must design today for the future worst case, with the fundamentals that have always mattered: zero trust and defense in depth, now extended to non-human identities.

Where to Start: Discovery 

If you take one thing from this article take this. When Mark asked us the one thing listeners should do first, Anthony and I gave the same answer independently: execute a discovery. 

Most organizations honestly don’t know what AI they have running. Business units are going their own direction, maturity is all over the map, and things are being “secured by committee.” You can’t put boundaries on something until you can quantify it. Do a discovery. Build an inventory. Find out what you have running. Step one. From there, every conversation about governance, policy, and tooling gets dramatically more informed. The worst mistake you can make right now is analysis paralysis, which spending so much time figuring out what to do that you end up doing nothing. 

These are exactly the conversations WEI is having with enterprise security leaders every week, and alongside leading cyber partners. We’re helping customers move from discovery to governance to purpose-built controls every day. 

Want to go deeper? Listen to the full WEI Tech Talk episode with Anthony Seto and Mark Gilmor and contact our experts directly.