Cyber Insight urges businesses to test what happens when AI-enabled security gets a decision wrong

The cybersecurity consultancy says confidence in AI should be built on clear permissions, tested response procedures and accountable human oversight.

Cape Town, South Africa 

Cyber Insight is encouraging South African organisations to look beyond detection speed when evaluating AI-enabled cybersecurity and ask a more practical question: what protects the business when an assessment is wrong?

The company believes this should become a standard part of security planning as businesses decide how much responsibility to give AI-assisted tools and automated workflows.

An AI-generated recommendation, a configured automatic response and a decision taken by a security analyst are different things. Cyber Insight says organisations should be able to identify which is involved at each stage of an incident.

"Businesses should expect AI to help their security teams work faster," says Deon Smal, CEO of Cyber Insight. "They should also expect a clear answer when they ask what happens if the assessment is wrong. That answer needs to be part of the design, not something worked out during an incident."

Understand what the system is allowed to do

Cyber Insight recommends reviewing the actions connected to a security system's findings, rather than assessing its analytical capabilities in isolation.

A tool that helps prepare an investigation summary has a different role from one connected to a workflow that can restrict access to business systems.

The company says enterprises should establish which actions are permitted automatically, what evidence is required, which circumstances need escalation and who can intervene.

Access should also be reassessed when a system's responsibilities change. Microsoft's guidance for securing AI agents recommends granting only the permissions needed for a task and reviewing those permissions as the agent evolves.

Prepare for both an incorrect alert and a missed threat

Cyber Insight advises businesses to examine two possibilities: a legitimate activity being flagged as suspicious, and a real threat not being recognised immediately.

The first raises questions about unnecessary disruption and safe restoration. The second tests whether access controls and other safeguards can limit what an attacker does next.

Consider a hypothetical account used to approve supplier payments. Restricting that account during a suspected compromise may be justified, but the business should already understand who can make that decision and how essential work will continue.

The aim is not to avoid decisive action. It is to make those decisions with an understanding of the systems and operations affected.

"Human oversight has to mean more than having someone available to click approve," says Smal. "That person needs the evidence, the business context and the authority to make a useful decision."

Start with one critical business process

Rather than beginning with a broad technology replacement exercise, Cyber Insight recommends walking through an incident involving one important business process.

The discussion should establish what would be detected, who would investigate, what could happen automatically and how the organisation would respond if the initial assessment changed.

The company believes this is a useful way to identify unclear responsibilities and assumptions before they are tested by a real incident.

"The objective is not to make organisations hesitant about AI," concludes Smal. "It is to make them confident enough to use it properly. That confidence should rest on tested controls and clear responsibility, rather than an expectation that every decision will be right."

Local experts. Global intelligence. Trusted protection.