Omar Khawaja, CISO, Databricks.
My team and I have identified 97 risks across the 13 key components of an end-to-end AI system, including 40 risks that apply to AI agents, through our work developing the Databricks AI Security Framework (DASF). That first number tends to get a reaction. But the framework wasn’t designed to create a 97-item checklist.
It reflects a more fundamental reality: The same AI capability may present minimal risk in one deployment and significant risk in another, depending on the business objective, the data it can access, the architecture it’s deployed within and the actions it can take. Context is what allows organizations to distinguish meaningful business exposure from theoretical risk. Without it, teams over-govern low-risk use cases, underestimate consequential ones and slow AI adoption. Many enterprises are still struggling to move AI agents from pilots into production. A 2026 report found that 85% of enterprises had AI agent pilots underway, but only 5% had deployed them in production.
But the threat landscape isn’t waiting. The average time from vulnerability disclosure to weaponized exploit has collapsed from over two years in 2018 to just a few days today. Defenders can’t afford to spend their limited resources on the wrong risks. The future of AI security isn’t simply about more automation. It’s about combining AI with the context and human judgment needed to make better decisions. It’s also about being deliberate and investing in mitigating the specific risks that actually matter in a specific AI use case.
Which AI Risks Actually Matter
Security teams have long used the OODA loop (observe, orient, decide, act) to manage threats, and companies have become sophisticated at both observing and acting. The harder challenge is in the middle: orienting information within the context of a specific AI deployment and deciding what warrants attention. Knowing a risk exists isn’t enough, and saying “AI is risky” is like a doctor telling a patient they’re “sick.” The diagnosis is too broad to determine the right treatment. You need to understand the business objective, deployment architecture, data flows and downstream actions to know whether it creates real exposure.
One practical approach we use is the “lethal trifecta.” When evaluating an AI system, we start with three questions:
1. Does it have access to sensitive or proprietary information?
2. Is it exposed to untrusted content or external inputs?
3. Can it take actions that change the state of another system?
Consider an AI agent that summarizes internal meeting notes for a project team. It accesses proprietary information, but it doesn’t ingest external content, and it can’t modify any system; it only produces read-only summaries. That’s one of three conditions.
Now consider an AI agent that analyzes social media and news alongside internal customer data to track product sentiment. It needs access to proprietary data as well as content from the open internet, processing both and then writing information back to internal systems. A malicious instruction embedded in a social media post could influence the agent to access data beyond its intended scope or alter information used in downstream decisions. When all three conditions overlap, it creates a radically different risk profile.
The value of this framework isn’t simply identifying higher-risk deployments. It gives security, data, legal and business teams a common framework for evaluating AI systems using the same criteria. When all three conditions overlap, apply heightened governance and security controls. If one can be eliminated or mitigated, the overall risk profile changes significantly.
Building Trust Incrementally
This context-driven approach also gives organizations a way to build trust in AI incrementally. An AI agent might initially investigate an issue and recommend an action without executing it. As the organization develops confidence in its performance and establishes appropriate guardrails, it can gradually expand what the agent is permitted to do. Trust doesn’t have to be binary.
That matters because the scale of AI-driven decisions is about to explode. Gartner predicts Fortune 500 companies will run more than 150,000 AI agents within the next two years, dramatically increasing the number of decisions organizations will need to evaluate and govern.
At that scale, no organization can manually evaluate every risk. But automating without context risks making the wrong decisions faster. AI will increasingly need access to the same governed context security teams rely on today to investigate, prioritize and make informed decisions.
Trust in an AI agent’s judgment will develop gradually. An agent may begin by investigating and recommending actions, then take on more decision-making and execution as organizations establish where they can operate safely and reliably. But that context can’t be treated as a one-time input. Business objectives change, architectures evolve and models gain new capabilities. An AI system that presented one level of risk six months ago may have access to different data, tools or permissions today.
Where Human Judgment Still Belongs
For security leaders, the real world ahead is about defining boundaries: where AI can act independently, where it should recommend rather than execute and where human judgment remains essential. Those boundaries should evolve as organizations gain confidence in the technology and as the context surrounding each deployment changes.
Start by mapping your three highest-priority AI deployments against the lethal trifecta. Identify which conditions apply, which can be mitigated and where the residual risk demands human oversight. The future of AI security isn’t about choosing between automation and human judgment. It’s about giving AI the context to make better decisions while keeping human judgment where it matters most.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?