Securing the algorithm: IT’s evolving role in governing AI access, identity, and risk

Artificial intelligence (AI) is redefining security — not just by creating new threats but also by becoming a threat surface itself. As intelligent systems are integrated into core workflows, IT teams are now responsible for governing how AI accesses data, interacts with users, and introduces risk into the environment.

In the Q1 2025 IT Trends Report from JumpCloud, 67% of the surveyed IT administrators said AI is advancing faster than their ability to secure it. That gap highlights the urgent need for new frameworks that go beyond traditional security thinking.

AI-generated threats are reshaping security priorities

AI is not just a target for attack; it’s also a tool attackers are using. The report shows that 33% of recent security incidents were linked to AI-generated threats. These attacks often bypass traditional security measures, by using adaptive techniques, synthetic identities, or AI-crafted phishing campaigns.

As a result, IT teams are shifting from passive perimeter defenses to proactive detection and response. Tools that can spot unusual behavior, monitor AI access patterns, and detect anomalies in real time are becoming essential.

Security strategies now need to account for both the behavior of AI tools themselves and the ways those tools might be exploited.

Governing how AI systems access data

Unlike users, AI systems don’t follow fixed schedules or patterns. Their access to data can be continuous, complex, and opaque — unless they are managed carefully. That’s why organizations are beginning to define access policies for AI agents, enforce least-privilege models, and log all AI activity with detailed audit trails.

Modern identity and access management (IAM) tools must evolve to support these needs. AI agents often require their own identities, application programming interface (API) –level access controls, and model-specific permissions. Legacy tools such as Active Directory are often too rigid to meet these demands.

A shift to more flexible IAM platforms, which are designed to handle nonhuman identities and fine-grained authorization, is already under way in many forward-looking organizations.

Shining a light on shadow AI

Unauthorized AI use is another growing concern. With 88% of IT professionals reporting worries about shadow IT, the risk of unsanctioned AI tools’ slipping into the environment is real — and growing.

Discovery tools and endpoint detection and response (EDR) platforms can help identify unapproved AI usage across networks and endpoints. But visibility alone isn’t enough. IT teams must also define acceptable-use policies, educate departments on AI risks, and monitor integrations to ensure they comply with governance rules.

Preparing for the next wave of AI threats

Real-time readiness is becoming a critical capability. Security teams are increasingly turning to AI-powered detection systems to monitor behavior patterns and catch anomalies before damage is done. But tools alone aren’t enough.

Organizations also need:

• Incident response plans tailored to AI attacks
• Regular audits of AI access and activity
• Continuous training on emerging AI security threats
• Cross-functional communication between IT, security, and business stakeholders

The goal isn’t just to secure AI — it’s also to treat it as a first-class component of the security ecosystem.

JumpCloud’s Q1 2025 IT Trends Report reveals how IT teams are adapting to AI across support, infrastructure, and security. Download the full report to see how your peers are navigating this transformation — and what it means for the future of IT.