Oliver Simonnet, CultureAI’s Lead Cybersecurity Researcher, argues that organisations should first find out which AI tools employees use and how they use them. Without that visibility, security teams cannot credibly assess exposure or choose proportionate controls. His prescription is governance rather than an automatic ban: understand the use, set safeguards, and consider deployment and containment choices before rolling tools out.
What does Simonnet mean by deploying AI and “hoping for the best”?
In an October 5, 2026 interview with IT Security Guru, Simonnet uses the phrase “You adopt it, you deploy it, and then you hope for the best” to describe rushed AI adoption. It is his characterization of a pattern, not a measured claim about how many organisations behave this way. The interview gives no prevalence estimate.
As an Amazon Associate I earn from qualifying purchases.
His concern is a mismatch in pace: employees can adopt tools and share information faster than security teams can identify, assess, or control the resulting exposure. AI may accelerate capabilities an organisation already has; Simonnet does not argue that every AI-related threat is entirely new.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why might employees share sensitive information with an LLM?
Simonnet’s explanation is that people often provide more context because they expect a more useful answer. A conversational exchange can also feel less formal than a search query, which may lower a user’s guard. In a work setting, that can mean sensitive information is submitted through an account connected to a third-party service.
#1 Best Overall
This is Simonnet’s account of user behaviour, not a conclusion supported in the interview by a cited psychological study. It is nevertheless a practical risk to investigate: what employees enter, which service receives it, and what protections or restrictions apply.
Why should visibility come before risk assessment?
Simonnet’s central point is that an organisation cannot meaningfully assess exposure if it does not know what AI is being used or how. He puts it plainly: “Having visibility of what AI is being used, and how it’s being used, is key.” That means looking beyond tools formally approved by IT to include unsanctioned use and AI features embedded in other workplace products.
Rank #2
Visibility is an input to governance, not a control by itself. Knowing that a tool is in use does not establish what data employees share, whether the use is appropriate, or whether the organisation’s requirements are met. Those questions need to be answered before deciding whether to permit, restrict, or support a particular use.
Recommended Free Tools
How can organisations enable experimentation without blocking everything?
Simonnet advocates visibility, controls, and processes rather than reflexive prohibition. The interview does not prescribe a universal policy or a particular product. A practical way to apply his argument is to assess each use case and tool against the organisation’s needs before deployment.
Rank #3
- Map use: identify sanctioned, shadow, and embedded AI, and understand what employees are doing with it.
- Assess information exposure: determine whether prompts or other inputs may contain sensitive work information and where that information goes.
- Set proportionate controls: establish processes that let appropriate work proceed while limiting uses or data sharing the organisation cannot accept.
- Review deployment choices: consider whether the organisation’s requirements point toward containment of agents or local deployment, rather than assuming every tool should be deployed the same way.
- Keep evidence: when evaluating a tool, ask what visibility, controls, deployment options, and audit evidence it can provide. These are evaluation questions, not proof that any specific product meets them.
CultureAI describes its own platform in terms of AI visibility and controls, but that is a vendor description, not an independent evaluation of its capabilities or effectiveness.
What additional risks do AI agents raise?
In a separate April 10, 2026 CultureAI article, Simonnet identifies several security concerns associated with agentic AI. He names prompt injection, supply-chain trust, identity and credential management, and failures in model judgement. The article recommends layered defence, human oversight, and continuous monitoring. These are the company’s analysis and recommendations, not independent test findings.
The practical implication is to treat an agent as more than a chat interface: assess the instructions it can receive, the components it depends on, the identities and credentials it uses, and the actions it may take. The interview does not establish a timetable or guarantee for wider agent adoption; Simonnet’s view of that adoption is uncertain.
Who is responsible while standards and regulation develop?
Simonnet sees a role for industry standards, while leaving open whether legislation will follow if voluntary action proves inadequate. He says it is too early to know where governance will land; continued industry action remains possible. His immediate point is that uncertainty about future rules does not remove present responsibility: “In the meantime, though, organisations are responsible for making sure they do everything right.”
That is a call to act on current organisational responsibilities, not a claim that a particular future regulatory outcome is settled.
How much weight should readers give the broader AI-use figures?
A November 5, 2025 CultureAI article, “Securing AI in the Enterprise,” reports that more than 70% of enterprises used generative AI in some capacity in 2024 and that around 55% of data submitted to AI platforms was sensitive. The available article excerpt does not establish the original study or publisher behind either figure. Treat them as figures reported by CultureAI, not independently verified estimates that can be generalized to every organisation or current usage.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
