Teaching People to Use AI Without Security Is Half a Lesson

Introduction Third-party involvement in data breaches doubled from 15 percent to 30 percent in a single year, the largest one-year shift ever recorded in the Verizon 2025 Data Breach Investigations Report. That is not a gradual trend line, it is a structural shift in how attackers reach their targets. Rather than breaching a company directly, they go after the vendor, the software dependency, or the service provider sitting quietly inside that company's trust boundary. As Indonesia's leading cybersecurity company, ITSEC Asia works with organizations across finance, healthcare, and technology who are only now realizing that their own defenses were never the whole picture, because a breach can start three vendors away and still land squarely on their desk. Source: Supply Chain Attack Statistics 2026, Stingrai Research · Supply Chain Attack Statistics for 2026, Swif The Numbers Behind the Shift A supply chain compromise now costs an average of 4.91 million US dollars and takes 267 days to identify and contain, the longest lifecycle of any breach vector tracked in IBM's Cost

An AI assistant connected to internal data starts returning information it shouldn’t reveal. What does the incident responder collect first? Traditional evidence still matters, but the investigation may also require prompts, model outputs, retrieval sources, system instructions, access permissions and records of actions taken through connected tools. Disabling an endpoint won’t necessarily answer what the model accessed or what information it produced. Recent workforce data suggests many teams haven’t rehearsed that situation. ISACA’s 2026 State of Cybersecurity research, based on more than 1,800 cybersecurity professionals globally, found that only 8% of organizations regularly conduct AI specific response exercises. The same research found that 45% see LLM SecOps as a skills gap, up 12 percentage points from 2025 and 21 points from 2024. ISACA [https://www.isaca.org/about-us/newsroom/press-releases/2026/only-8-percent-of-organizations-global-enterprises-conduct-regular-ai-specific-response-exercises?utm_source=chatgpt.com] AI security is becoming operational work rather quickly. AI CHANGES THE EVIDENCE NIST convened an AI Incident Management Workshop in May because a new class of incidents is emerging as AI systems become embedded in critical infrastructure, cybersecurity and other operational environments. Its work covers incident definitions, lifecycles, taxonomies, existing playbooks

Artificial intelligence is transforming cybersecurity. From threat detection and vulnerability management to attack simulations and security operations, AI is enabling organizations to process information faster and automate tasks that once required significant manual effort. As AI adoption accelerates, a common question continues to emerge: Will AI replace cybersecurity professionals? The short answer is no. In reality, the future of offensive security is not about humans competing against machines. It is about combining the strengths of both to create a more effective and sustainable approach to cybersecurity. WHY OFFENSIVE SECURITY IS BECOMING MORE CHALLENGING Modern environments are more complex than ever. Organizations are embracing cloud computing, APIs, remote work and AI-driven applications. At the same time, threat actors are leveraging automation and AI to identify and exploit vulnerabilities faster. Security teams face several challenges: * Expanding attack surfaces. * Increasing volumes of vulnerabilities. * Limited cybersecurity resources. * Alert fatigue. * Time-consuming manual processes. * Growing compliance requirements. As environments continue to evolve, relying exclusively on traditional approaches becomes increasingly difficult. This is where