Over the last several months, our team has been having some (occasionally vigorous) conversations about AI. Not whether to use it, but how to use it well. Through our early experiments with AI, we had proven to ourselves that its use brings significant benefits when combined with cybersecurity expertise. However, AI also introduces new risks that need to be carefully managed. I wanted to share where we’ve landed so far.
We’re a GRC consultancy. We know how to manage risk. In fact, we operate our own mature Information Security Management System (ISMS) and have been ISO27001:2022 certified for many years. All Axenic services, including the use of AI, fall within scope of this ISMS which includes due diligence, training and awareness, ongoing assurance, change and release processes, among other security activities.
We tell clients to assess risk before adopting new technology, so we did exactly that ourselves. Three pieces of internal work now govern our use of AI: a formal AI risk assessment, an AI Responsible Use Policy aligned with ISO/IEC 42001, and a curated list of approved AI use cases. Together they decide which tools we use, what data goes into them, and where the boundaries sit.
Our own risk assessment for AI did not pull punches. Four of its findings and what we are doing to manage these risks matter directly to our customers:
- Transparency – We will explicitly ask for customers to opt-in to the use of AI for deliverables that use our customer’s information; whether that’s a risk assessment incorporating your business and technical context or audit findings drawn from interviews. That opt-in sits in our Statement of Work, plain and visible. Sometimes it’s simpler: we may just ask your permission to record and transcribe a workshop to increase our efficiency. Everything else we treat as standard business tooling; the same way we use Microsoft 365 for document management and conference calls.
- Data handling – AI providers have the ability to retain what is entered into their tools, and in jurisdictions that we cannot influence – just as with many other cloud services. So, Axenic use enterprise agreements with data handling commitments, we configure retention opt-outs and strictly limit what may be entered by our team. Our AI services do not learn from client data, and client data is never used to train any model. We are also building AI service delivery offerings that are hosted and processed in Australia, for customers where jurisdiction matters. It’s the same discipline organisations already apply when choosing where their public cloud data lives.
- AI hallucination – AI can be confidently wrong. But our own use has also shown the flip side: when the person using AI is already an expert in the subject, it significantly improves efficiency and lifts quality too. Expertise is what catches the errors. Our team are required to rigorously review any output from AI tools. We also require them to carefully check all the AI inputs. And every deliverable – whether traditionally produced or produced with AI assistance goes through Axenic’s peer review and quality assurance process. That has always been mandatory, and AI has not changed that.
- Subject Matter Expertise – A risk that is very specific to AI is that people who over-rely on it can gradually lose critical thinking and the ability to work without it. We see this as a risk that every organisation needs to manage very carefully. For us, that means continued consultant professional development in generating our deliverables both with and without AI assistance. Our value as experts is our people’s judgement, and we intend to keep it sharp.
We’re genuinely excited about what this technology can do. But your trust took years to build, and we’re not willing to spend it carelessly.
If you’d like to talk about how we’re approaching AI, or how your own organisation might get in touch. This is precisely the kind of challenge that we enjoy.
Terry Chapman, Managing Director, Axenic