AI Is Already in Your Business. Is It Under Control?
AI has changed cybercrime, and the numbers prove it.
Fortinet's 2026 Global Threat Landscape Report shows that attackers are guessing less and hitting harder. In 2025, FortiGuard Labs recorded 640 billion reconnaissance events (down 45% year-on-year), 67.65 billion brute-force attempts (down 22%), and 121.99 billion exploitation attempts (up 25%).
The message is clear: attackers no longer need to cast a wide net. With AI doing much of the heavy lifting, they don't even need advanced technical skills. They can pick a target and go straight for it.
Meanwhile, businesses face a dilemma of their own: move fast enough on AI to keep up with the market, without putting sensitive data at risk. But while many companies are still debating the rules, AI has already moved in. Employees are using it every day, with or without approval. And AI that nobody governs is AI that nobody controls. That's where the risk lives.
There's another blind spot too. Many companies know their internal systems inside out but have surprisingly little idea of what attackers can see from the outside.
At TechHosted12 we sat down with Kash Valji, VP Fabric CSE, EMEA/APAC at Fortinet, to talk about how to bring unsanctioned AI tools under control and what good AI governance looks like in practice, why do AI agents need to be treated with the same caution as any other user on your network, and how do you find weak spots before criminals do.
What does AI sprawl, the uncontrolled spread of AI, actually look like inside a real organization?
AI sprawl rarely starts with a major strategic decision. More often, it happens through multiple decisions made independently across the business. Each decision may appear reasonable on its own. But collectively, the organization has created an ecosystem of AI tools, data connections, service accounts, and autonomous processes that nobody is managing centrally. From Fortinet's perspective, the first step is discovery. Organizations need to identify sanctioned and unsanctioned AI services, understand their data flows, and introduce consistent policies across the entire environment.
Which poses the greater risk: scattered AI tools that employees use on their own or AI agents that no one is coordinating?
Both represent significant risks, but the opinion of our threat research teams is that uncoordinated AI agents have the potential to create greater systemic damage. Shadow AI applications primarily create concerns around data leakage, regulatory compliance, intellectual property, and the exposure of confidential business information; those risks are serious. However, autonomous AI agents introduce something different: the ability to execute actions at scale and machine speed.
TechHosted12
What are the consequences of uncontrolled AI use within an organization?
The consequences can be much broader than many organizations initially realize. Naturally, data leakage is a primary concern, but we also have to consider the integrity of business decisions—what happens when AI-generated information is inaccurate, manipulated, or used to make decisions without appropriate validation? And as organizations connect AI to operational systems, the risks expand further. An incorrectly configured or compromised agent could modify records, execute unauthorized processes, or disrupt essential business services.
What would you say to organizations that have no visibility into their AI use at all?
Don't panic, but don't underestimate the problem either. The reality is that AI adoption is probably already happening throughout your organization, whether you have formally approved it or not. And simply banning AI isn't necessarily the solution. Employees will continue looking for tools that make them more productive, potentially pushing usage into less visible channels. What we recommend is starting with visibility.
What does a well-governed AI environment look like? What are the best examples you've seen?
The best example of AI governance isn't an organization that has blocked every emerging technology; it is an organization where employees are empowered to use AI but within clearly defined security and business boundaries.
What risks do you see in deploying AI agents and connecting them to an organization's internal systems?
The biggest difference between traditional AI applications and AI agents is that agents don't just provide information—they can take action. If an AI agent has excessive permissions or is manipulated through malicious prompts, it could perform actions that a human employee would never have been authorized to perform. At Fortinet, our position is that AI agents must be treated as non-human identities within a zero-trust architecture. Every agent should have a clearly defined identity, limited permissions, monitored interactions, and boundaries around autonomous decision-making.
What happens when the managed AI control plane itself becomes the target?
Any digital system becoming the target for threat actors is a bad thing—especially when this includes control over autonomous AI agents. Solutions such as strong administrator authentication, privileged access management, network segmentation, separation of duties, continuous monitoring, and independent logging help protect the AI control plane.
TechHosted12
As attackers find new ways to exploit identity, how do defenses need to adapt? How well do organizations look at their business from the outside in?
Many companies have excellent visibility into their internal security infrastructure but surprisingly limited understanding of what is exposed externally. This is why we emphasize continuous threat exposure management. Solutions such as FortiRecon allow organizations to identify exposed assets, leaked credentials, and external threats before attackers can exploit them. Red Teaming is an essential toolkit in understanding what an organization looks like to attackers on the outside.
What are the three things executives in Bosnia and Herzegovina need to know to manage cybersecurity in their organizations in 2027?
Cyber resilience is interwoven with business continuity; NHI should be a top priority. Prepare for stronger EU-driven governance.