AI security must be built in from the start, speakers tell AI for Good workshop

Trust starts with security

The workshop, titled "Trustworthy AI through AI security: The AI security nexus", brought together voices from international organizations, government, business, standards bodies and industry. It looked at how to protect AI systems while also using the technology to strengthen cybersecurity and resilience. Matteo Quattrocchi, Government Affairs Director and Head of EMEA AI Policy at Cisco, moderated the discussion.

Cosmas Luckyson Zavazava, Director of ITU's Telecommunication Development Bureau, opened by calling trustworthy AI and AI security "two sides of the same coin." He said: "Trust is not a feature you can build on at the end of a production cycle. Trust is the foundation."

Zavazava pointed out that, unlike traditional software, AI systems adapt, interpret information and make decisions, which creates attack surfaces beyond static data. He listed data poisoning, which can manipulate what a system learns, prompt injection, which can bypass safeguards, and adversarial inputs that can cause systems to misinterpret images, audio or commands. In his view, data needs provenance and protection from tampering, models must resist adversarial inputs and preserve privacy, and deployed systems need continuous monitoring. He also called for secure-by-design development, red teaming, transparency about limitations and global security benchmarks, and for moving away from treating speed as the main measure of innovation.

Business and Global South perspectives

Whitney Baird, CEO of the United States Council for International Business, said AI is improving threat detection, behavioral analytics, identity management, network security and phishing detection. At the same time it is raising the scale and sophistication of cybercrime. She argued that building confidence requires risk-based and proportionate governance, secure and resilient systems by design, and international cooperation that limits fragmentation. Public-private partnerships matter especially for critical infrastructure, she said, because cyber threats cross borders.

On digital sovereignty, Baird said policymaking should include the companies that use AI and run critical infrastructure, not only AI developers. She noted that the term can carry different meanings, so shared definitions are needed. Governments, she suggested, should set high-level principles that protect critical infrastructure without excluding companies from global partnerships.

Cynthia Leungo Lesufi, Minister Counsellor at the South African Permanent Mission in Geneva, focused on Africa and the wider Global South. She said AI could improve public services in healthcare, education, agriculture, finance and government, but only if systems are secure, resilient, inclusive and trusted. She framed AI security as a strategic policy issue tied to national security, economic growth, public trust, resilience and digital sovereignty. African countries and other developing economies, she said, must help shape global AI standards, which will require investment in skills, capacity building, technology transfer, regional cooperation and public-private partnerships. "This investment should not be seen as an additional cost. Rather, it should be seen as an investment in resilient economic growth and sustainable development of African countries," she said.

Standards and continuous assurance

Igor Minaev, Director of External Relations at ETSI, described how standards can turn policy goals into technical requirements. ETSI's framework for AI cybersecurity covers AI-specific threats across the lifecycle, from design and development to deployment, maintenance and end of life. It also assigns responsibilities to developers, system operators, data custodians, users and other participants in the AI supply chain.

Minaev described a shift from one-time conformity assessments toward continuous assurance, since AI systems change during operation and emerging regulations increasingly require products to stay compliant throughout their lifecycle. He argued that isolated national approaches cannot secure a global technology, and that safety, cybersecurity, software engineering and AI expertise need to be brought into a coherent system. "Trustworthiness is not created by regulation alone. It is not created by technology alone," he said. "It is created when policy, engineering, cybersecurity, and international standards evolve together."

A faster threat landscape

Quattrocchi closed the presentations with Cisco's view. He described AI security as a whole-of-infrastructure challenge that begins with data centers and extends through datasets, models, networks, applications and autonomous agents. Existing threats such as phishing are becoming more sophisticated through generative AI, while new systems create new vulnerabilities.

He said agentic AI widens the attack surface by letting systems act with more autonomy, and that open protocols connecting AI tools with external systems can add further points of exposure. He placed particular emphasis on the shrinking window between the discovery of a vulnerability and its exploitation.

What it means

The speakers' message was consistent: organizations and governments that adopt AI should plan for security across the whole stack from the outset, rather than treat it as a late-stage feature. For standards bodies, regulators and companies, the workshop pointed to continuous assurance, sustained coordination and shared definitions as the route to resilient systems. The session also highlighted that countries in the Global South want a role in shaping the standards they will be expected to follow.