Beyond the code: How AI security talent gaps create vulnerabilities

WEST LAFAYETTE, Ind. — Researchers and developers are aware of numerous security risks associated with artificial intelligence. But one security risk is often overlooked: the people associated with the AI programs.

Shaila Rana, a faculty member who specializes in AI and cybersecurity in Purdue Global’s School of Business and Information Technology, said the growing AI security talent gap impacts the people, teams and organizations who oversee securing AI.

The human complexity of AI security is a fast-growing field, especially as everyone — including chief information security officers, security managers and personnel, AI practitioners, and leaders — has a role in the issue.

“There are technical issues that we have to address, but we’re entirely missing the people side of AI,” Rana said. “This isn’t just a technology problem. It’s also a people problem.”

Rana’s findings are in her recently released book, “The Human Side of AI Security.”

Q: What is the biggest human risk regarding AI security? 
A: We have to look at human-in-the-loop (HITL) practices where a human approves or rejects certain AI processes or they become the bottleneck. I focused on moving humans up a layer, where they set the parameters, risk tolerance, ethics and boundaries. We can’t rely on HITL practices as it doesn’t scale in today’s tech landscape. Human-above-the-loop is where we need to be focusing and creating the architecture where agentic AI can operate, and humans are there for those consequential decisions.

Q: What do we need to learn about AI to keep others safe?
A: This is not the responsibility of only the cybersecurity/information services department anymore; it is a cross-disciplinary issue. Everyone has a role to play with this. You see executives and lawyers working on this, but we will need to foster collaboration among the tech industry, cybersecurity and AI students, and others. One security aspect is that we need to start prioritizing thinking skills over the technical skills. There’s a big shortage of thinking skills in individuals who can reason about probabilistic systems. I believe people have to start thinking outside the box and following their creativity and reason.

Q: What are some basic steps that workers who use AI programs in their daily workflows can do to keep their organizations safe?
A: It’s important to use approved tools and that we’re not giving away information that could harm the organization or ourselves in some way. If you are working with proprietary data, don’t put it into a large language model or compromise the information by giving it to a third party. Don’t blindly trust AI; always review the outputs and make sure you are not using malicious information within your organization.

Q: What are your biggest takeaways from writing this book?
A: It’s interesting how quickly things have changed since I began writing the book in 2024. There is definitely a path forward, and there are constant changes in the field so people can use AI in a secure way. We must stay adaptable and agile. This is how we can move forward. Another takeaway is that we must stay educated and vigilant. This needs to be taught in schools and programs so that people can go out there and they can make that impact in the field. We must build organizational structures that support AI security by helping lawyers, compliance officers, AI developers and others. Everyone now must be involved.