The AI Security Gap: Risks and Innovation at GITEX | Jack Hidary on CNBC

Well, Dan, very good to see you. We're live here from the floor of GITEX in Dubai. More than 200,000 people will be visiting this week, this conference. So a lot of good energy the last two days, but also concern, as you just mentioned in your opening notes. AI is transforming lots of industries, but also creating a bigger attack surface for cyber hackers. And so while AI does help in many areas, it also exposes vulnerabilities in the companies using it. As you mentioned in our SandboxAQ survey, wide adoption of AI — more than 80% of large enterprises now have adopted it — but it's also the number one concern of more than 75% of CISOs and security leaders, the concern about how do they secure the use of AI and also defend against AI attacks. So this is a big concern. We're actually sitting in a part of GITEX now with many of the cyber companies around, and it's definitely on people's minds as they look to the future.

Sure. So in the days before AI, we knew about an attack called SQL injection. And what that means is if you're accessing a database in a big company and maybe you have access to it from a website so that you can look up information, you can inject hacking information into the database by putting something in that search box. Well, now fast forward to the prompt box that we're all familiar with with the large language models, and we now have a new attack called a prompt injection. And so an attacker can use that prompt box that we're all familiar with and put nefarious malware through that prompt box into the large language model. That's one kind of attack. A second kind of attack exposes the information of the company to others. And so if you don't have the right guardrails around the use of AI in your company, if you're using an AI that, say, is using that data for training for everyone else to use, that means your proprietary info, your trade secrets in your company, will now be accessible by the entire world. That was a real world case, Dan, in the case of Samsung, where early on — when we say early, we mean a year and a half ago, two years ago — Samsung engineers put some information in as a prompt, but it revealed some proprietary information from the company. And so security leaders across the global 1000 are really concerned about these kinds of attacks. AI, very helpful tool, but exposing new vulnerabilities in large companies.

Well, the thing to do is, one, to make sure that if you're using one of the paid-for models, be it OpenAI or Google Gemini or Anthropic, that you make sure you have the enterprise edition that cordons off your information away from the training dataset. Number two, another way to go, for example, Bank of America and others decided to use an open source version of large language models, download it locally and run it locally in their own data centers to ensure that they had a good firewall around that. So there's different approaches, but the key is that only 6% of large enterprises even have a plan, Dan, as to how they're going to protect themselves from these new vulnerabilities. What we're also seeing, Dan, at GITEX is an increased focus on NVIDIA, on other chip manufacturers and how they're transforming what will be the next wave of AI.