Topic starter
02/09/2026 1:29 pm
TL;DR: Boards are asking the right questions about AI risk, but the failure mode is solutioneering, or jumping to a fix before defining the problem, according to Expel. The article splits the issue into three domains: attackers using AI, employees using AI without review, and attacks against AI systems, while stressing that defensible answers need live controls, telemetry, and a named framework.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Five questions your board will ask about AI risk”.
Key questions
Q: What should boards ask first when assessing AI risk?
A: Boards should ask which AI risk domain they are dealing with before discussing fixes.
Q: Why do AI risk conversations often go wrong in the boardroom?
A: They go wrong when teams answer with a solution before defining the problem.
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Practitioner guidance
- Define the AI risk domain before selecting a control Separate board questions into attacker use of AI, employee use of AI, and attacks on AI systems so each question maps to evidence, owner, and response path.
- Correlate SSO and network telemetry for AI tool usage Use identity and network signals together to identify sanctioned and unsanctioned AI tools, then document where sensitive data is flowing in those sessions.
- Inventory AI agent permissions as non-human access List what AI agents can read, write, or invoke, and review the access grants that give them those permissions, including ticketing and data systems.
Bottom line: The article’s core warning is that AI risk governance fails when organisations jump from board questions to product choices without first defining the problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/09/2026 1:30 pm
AI risk governance fails first at the question level, not the control level. Expel’s argument is that boards often receive a tool-shaped answer to a problem-shaped question, and that mismatch obscures the real exposure. The right governance sequence is problem definition, evidence, then control choice. Practitioner conclusion: if the question is not separated into threat, usage, and system risk, the answer will not be auditable.
A question worth separating out:
Q: How do teams prove AI-related detection is actually in place?
A: They should show the telemetry, the behaviours being watched, and the framework mapping behind the claim. A credible answer names the specific AI activity covered today and the gap that still remains, rather than implying that existing EDR or SIEM visibility is enough.
👉 Read our full editorial: AI risk boards are asking the wrong question first
This post was modified 2 days ago by NHI Mgmt Group