The Rush to Adopt AI: How to Get it Right & Business Risks • Nick Selby & Sarah Wells • GOTO 2026
In this interview, Sarah Wells and Nick Selby discuss the significant business risks introduced by the current rush to adopt AI. They cover how AI vendors blur security terminology, how the insatiable need for data creates an enormous blast radius for breaches, and provide a framework for responsible AI adoption through threat modeling, cross-disciplinary governance, and a return to IT fundamentals.
The immense pressure on CEOs from boards, investors, and peers to adopt AI is forcing organizations to overlook significant business risks. This rush exacerbates the existing communication gap between executive strategy and engineering reality, creating a landscape where fundamental governance and security practices are often bypassed in the name of competitive agility.
The Illusion of Safety: How AI Vendors Blur Terminology
A subtle but dangerous issue is the co-opting of established security and legal terminology by AI vendors. Drawing on research from the AI Now Institute, Nick Selby points out that terms like “vulnerability management,” “safety,” and “red teaming” are used by AI companies to mean something entirely different from their traditional definitions.
For instance, an organization’s General Counsel might hear “health and safety” and think of product liability, a familiar concept. However, in the context of an AI vendor, it might simply mean their chatbot has been trained not to provide instructions for making a bomb. This linguistic shift deliberately obfuscates the true nature of the risks, leading to a false sense of security among decision-makers who believe they are operating within known paradigms.
The Data Access Problem and the “Unlimited Blast Radius”
The core value proposition of many AI tools hinges on their ability to access and process an organization’s most sensitive data—its “crown jewels.” To be effective, these tools require deep integrations with platforms like Salesforce, Google Workspace, Microsoft 365, and Slack. This creates two major problems:
- Vendor Security Posture: AI companies are also in a “fear of missing out” race to ship products, often leading to a weak internal security posture.
- Insatiable Data Appetite: AI tools are engineered to “suck in data from any place anywhere all the time.” Their primary product requirement is data ingestion.
A simple tool, like a chatbot for scheduling sales meetings, might require access to Salesforce for leads, Google calendars for availability, and HR systems for roles and responsibilities. If that vendor is breached, the attacker gains access to a vast, interconnected web of the company’s most critical data. This is what’s referred to as the blast radius: the total potential damage an incident can cause. In the case of AI tools, this blast radius is often far larger and more difficult to define than with traditional enterprise software.
A Framework for Responsible AI Adoption
To counter these risks, organizations must move beyond viewing AI adoption as a purely technical or security issue and treat it as a core business strategy challenge. This requires a return to fundamentals, applied with greater rigor.
1. Establish Cross-Disciplinary Governance
No single department—not IT, not security, and not the team that owns Salesforce—has the complete picture. Effective governance requires a cross-disciplinary group including representatives from:
- Sales and Revenue
- Product Development
- Engineering
- Information Security and IT
- Legal
This group is responsible for continually balancing the business benefits of a tool against its risks, both before adoption and during an incident.
2. Ask Foundational Questions
Before implementing any tool, this group must work through a series of strategic questions:
- Goals: What do we want this tool to do? Equally important, what do we not want it to do?
- Data: What is the absolute minimum amount of data the tool needs to achieve its defined goal? Where does that data currently live?
- Permissions: How can we reduce the tool’s permissions to the bare minimum required?
3. Define and Monitor the Blast Radius
The process of answering these questions helps define the blast radius. Once defined, the goal is to shrink it. This involves diligent monitoring to ensure configurations don’t drift over time and setting up telemetry to detect anomalous behavior. If the tool starts doing something unexpected, it should trigger immediate alerts.
4. Prepare for Incidents
Organizations must be prepared to respond when a breach occurs. This means knowing in advance:
- How to quickly disable integrations.
- Who needs to be involved in the response.
- What the immediate mitigation steps are.
Practicing this response is crucial, as the first few hours of an incident are critical.
Threat Modeling as a Bridge to the Executive Suite
Threat modeling is a powerful tool for translating technical risks into the language of business. By framing potential issues in terms of likelihood and impact, security teams can have more effective conversations with executives.
The goal isn’t to be 100% correct about every potential threat, but to create a shared context for decision-making. This process helps executives understand that they are the ultimate owners of business risk; the security team’s role is to explain those risks clearly. A successful threat modeling exercise can lead to crucial strategic decisions, such as a business leader concluding that the reward of integrating a tool with a specific dataset is not worth the risk.
Ultimately, navigating the AI landscape requires a systematic return to fundamentals. The attack surface is larger and more exploitable than ever. Organizations must rigorously audit the basic security hygiene of AI tools, define clear policies, and be prepared to adapt them constantly in this rapidly evolving ecosystem.