The Future Of AI Security Is Better Judgment, Not More Automation

Omar Khawaja, CISO, Databricks.

​My team and I have identified 97 risks across the 13 key components of an end-to-end AI system, including 40 risks that apply to AI agents, through our work developing the Databricks AI Security Framework (DASF). That first number tends to get a reaction. But the framework wasn’t designed to create a 97-item checklist.​

It reflects a more fundamental reality: The same AI capability may present minimal risk in one deployment and significant risk in another, depending on the business objective, the data it can access, the architecture it’s deployed within and the actions it can take. Context is what allows organizations to distinguish meaningful business exposure from theoretical risk. Without it, teams over-govern low-risk use cases, underestimate consequential ones and slow AI adoption. Many enterprises are still struggling to move AI agents from pilots into production. A 2026 report found that 85% of enterprises had AI agent pilots underway, but only 5% had deployed them in production​.

But the threat landscape isn’t waiting. The average time from vulnerability disclosure to weaponized exploit has collapsed from over two years in 2018 to just a few days today. Defenders can’t afford to spend their limited resources on the wrong risks. The future of AI security isn’t simply about more automation. It’s about combining AI with the context and human judgment needed to make better decisions. It’s also about being deliberate and investing in mitigating the specific risks that actually matter in a specific AI use case. ​

Which AI Risks Actually Matter

One practical approach we use is the “lethal trifecta.” When evaluating an AI system, we start with three questions:

1. Does it have access to sensitive or proprietary information?

2. Is it exposed to untrusted content or external inputs?

3. Can it take actions that change the state of another system?​