A New Security Boundary for AI: Not Just Usable, but Trustworthy and Controllable.

On 17 September, the 2026 China Cybersecurity Week Hong Kong Sub-forum was successfully held. Organised by the Digital Policy Office (DPO) and co-organised by the Cyber Security and Technology Crime Bureau of the Hong Kong Police Force, the Hong Kong Internet Registration Corporation Limited, and the Hong Kong Cybersecurity Professional Association, the forum centred on the theme “Innovation and Technology Journey, Cybersecurity with Peace of Mind.”

The event brought together representatives from government agencies, industry, academia and professional organisations from Mainland China and Hong Kong to share insights into cybersecurity trends, emerging challenges and practical experience.

AIStorm, AsiaInfo Security’s international brand, made an appearance at the Hong Kong Forum. Wu Xiangning, Senior Vice President and Chief Customer Success Officer of AsiaInfo Security, was invited to deliver a keynote speech titled “After AI Reshapes Cyber Offence and Defence: The Next Security Boundary for Enterprises.”

His presentation explored how, as artificial intelligence fundamentally reshapes the cybersecurity landscape, organisations need to establish a new security boundary — moving beyond simply asking “Is it secure?” towards determining “Is this action authorised?” — while using verifiable standards to achieve continuous security risk management and control.

Old Gaps, Faster Consequences

The Security Closed Loop Cannot Stop at “Taking Action”

During his presentation, Wu Xiangning noted that enterprises today are facing increasingly severe and costly control gaps.

According to multiple industry studies, exploitation of software vulnerabilities remains the leading initial entry point for data breaches, accounting for 31%, while attackers’ average breakout time has shortened to just 29 minutes. Meanwhile, the average global cost of a data breach has reached US$4.99 million.

Together, these figures raise three fundamental questions for the cybersecurity industry: Can exposure be reduced? Can response keep pace? Can business losses be contained? In real-world enterprise security operations, taking remediation measures does not necessarily mean that the security loop has been closed.

One security incident involving a multinational automotive company, for example, took more than two months from the shutdown of its global systems to a phased resumption of production. This demonstrates that isolation and remediation are merely actions. Enterprises also need sufficient evidence to prove that risks have been brought under control and that the business has genuinely met the requirements for recovery.

Addressing real-world threats such as deepfake-enabled fraud, Wu further emphasised that appearing trustworthy does not mean an action should be allowed to proceed.
Identity must be verified.
Actions must be authorised.
Outcomes must be validated.
Organisations cannot simply equate “I trust this person” with “this action can therefore be executed.”
Two requirements have consequently become central to modern enterprise security management: verify trust before an action takes place, and validate the outcome after the action has been executed.

AI Is Changing More Than Attacks

Three Fundamental Shifts Across Attack, Defence and the Attack Surface
As AI technologies and AI agents become increasingly integrated into enterprise operations, three profound changes are emerging across cyber offence, defence and the attack surface.

On the attack side, AI is increasingly amplifying adversarial capabilities.

AI-enabled attacks have increased 89% year-on-year, while 82% of detection activity involves no malware. This means defence must evolve from asking “Is this file malicious?” towards determining “Is this behaviour or context abnormal?”

On the defence side, the real value of AI is being redefined.

Microsoft research shows that agent assistance resulted in analysts spending 53% more time on malicious emails. IBM research, meanwhile, indicates that organisations using AI and automation experience lower average breach costs. However, this represents an association within the research sample, and organisations should first validate AI’s effectiveness at the individual task level.

On the attack-surface side, AI itself is becoming a system that must be protected.

AI systems are increasingly becoming targets. Vulnerabilities such as EchoLeak, together with AI-related data leakage affecting more than 20% of organisations within surveyed samples, demonstrate that three realities have now emerged simultaneously:
AI enhances attacks. AI enhances defence. AI itself requires protection.

Expanding the Scope of Governance

From “Is the Answer Safe?” to “Is the Action Authorised?” As technology continues to evolve, established principles such as NIST CSF 2.0 and SP 800-207 have not become obsolete.

The key is to embed these principles into a more continuous operational process encompassing:
Continuous asset and exposure identification; Identity-centric controls and contextual authorisation; Cross-domain detection and human–machine collaboration; Resilience and verification of control effectiveness.

A more forward-looking change, however, lies in the expansion of what needs to be governed.

When the entity taking action changes from a human to an AI agent, security governance must evolve from asking whether the model’s answer is safe — essentially, output governance — towards asking whether the action itself has been authorised.

Drawing on the OWASP Top 10 for Agentic Applications and related conceptual frameworks, AIStorm highlights three critical questions that the industry must address:

Identity — Which agent is acting, and on whose behalf?
Permissions — What can it access, and how far is it allowed to act?
Evidence — Can its actions be audited, and can humans take control when something goes wrong?

Model security testing remains necessary, but it is no longer sufficient on its own to address the operational risks introduced by AI agents.

Find – Block – Monitor

Building a Verifiable Closed Loop Through an Innovative Security Approach

Three approaches — prioritising a unified platform, combining specialised security tools, and redesigning workflows with an AI-first approach — can be reasonably combined.

What determines whether an architecture is effective is not what it is called, but whether it produces an effective closed loop.
Regardless of the approach adopted, enterprises should follow a neutral, three-layer reference architecture:
Governance & Accountability → Evidence & Decision-Making → Execution & Recovery

This ensures that AI can assist with analysis and decision-making without automatically being granted unlimited authority to execute actions.

AIStorm summarises this new approach to measuring security through the “Find – Block – Monitor” closed-loop model:
Find — Identify exposures and prioritise them.
Block — Apply appropriate protection measures or compensating controls, such as virtual patching, to buy time for remediation.
Monitor — Continuously monitor residual risks and emerging anomalies.

The cycle is ultimately completed through remediation and verification, with the outcomes feeding back into and improving the next round of discovery and control.

Looking ahead, the evolution of the security closed loop can progress through three stages.

First, strengthen the existing security closed loop.
Organisations should ensure that their fundamental security controls, response processes and verification mechanisms are robust.

Second, develop human–AI collaboration.
AI can help organise evidence, support investigations, prioritise risks and recommend controlled response actions.

Third, progress towards action governance.
Organisations need to establish the identity and ownership of every AI agent, enforce least-privilege access, define which tools each agent is permitted to invoke, ensure that activities remain auditable during runtime, and enable human intervention when abnormal behaviour occurs.

Regardless of how far organisations progress through these stages, the boundaries remain unchanged:
Greater autonomy does not automatically mean greater security.
High-risk actions will continue to require human authorisation for the foreseeable future.
Pressing the stop button does not mean that external consequences which have already occurred will automatically disappear.
The new dividing line in cybersecurity is therefore not whether organisations use AI, but whether they can prove that AI remains under control.

Ultimately, enterprises do not need more “intelligent” labels. They need fewer uncontrolled risks.
Use AI to accelerate judgement.
Use clearly defined boundaries to constrain actions.
Then use evidence to prove that controls are effective.

This represents AIStorm’s latest assessment of the direction of the global cybersecurity industry and reflects its continued commitment to combining innovative technologies with pragmatic standards to help enterprises across Hong Kong and the wider Asia-Pacific region move forward confidently in the era of digital transformation.