Emergency drills are needed to prep for cyberattacks in a world of AI

Nik Devidas, CEO of the Axelo Group, which helps organisations with artificial intelligence (AI) and cybersecurity, said ahead of a Community Directors webinar this month that live exercises helped expose vulnerabilities in organisations. 

He said that while AI was rapidly raising the threat level, the basics of risk management had not changed.  

“You've got to rehearse that bad day,” Devidas said.  

Comparing it to a workplace fire drill, he said, “Everyone rolls their eyes and slowly meanders their way to the exit, but in the event of an actual fire [people remember] ‘I've done this before, I actually know where to go.’” 

Unlike fires, cyber breaches could be “silent”, Devidas said, noting, “The average dwell time for a bad guy in a network is something like six weeks,” meaning attackers could sit inside a system for weeks before an organisation realised they were there. 

"They're very skilled as well. If they get in there and find there is something of value, they will sit there waiting for the right moment to strike. That could be getting into an email system, changing invoice details … or more of a smash and grab [in which attackers will] jump into a customer database they know has some value to use or to resell." 

Devidas said tabletop exercises could replicate different kinds of incidents, and could be run internally or by a third-party provider. Boards without the funds or in-house skills could start by asking an AI tool to generate scenarios. 

"You can just ask ChatGPT or Claude or whatever it is you're using: 'Hey, I really want to run a cyber event simulation. Just write out a few cards for me to run through with the board.' It just gives you a starting point." 

In his experience, the first drills often left "a lot of people just looking at each other going, 'Oh, I don't know the answer to that'". Repeating the exercise a few months later usually found people much better prepared with answers, plans and responses. 

He said preparation readied an organisation for the inevitable attack. 

"You don't know how the breach will occur. You don't know when you'll find out. You don't know the impact of it. But at least you've run a few scenarios. You know to call the relevant authorities in certain scenarios, to turn off systems in certain scenarios, and you've already got a communications plan ready for the key stakeholders."

AI makes attacks cheaper and faster  

Devidas said AI’s rapid development meant cyberattacks were now cheaper, faster and more convincing, taking the form of deepfake voice calls to finance teams, or sophisticated phishing scams without telltale spelling errors, for example. 

He said not-for-profits were fooling themselves if they thought they were too small to be targeted, given the fact that community sector organisations of all kinds had been victims of phishing, cyberattacks and ransomware attacks over the past 20 years, but rarely made headlines.  

“Size has never been an issue for the bad guys.” 

Small organisations are just as exposed to threats as large corporations, but their defences are more likely to be restricted by tight budgets or reliance on volunteers, he said. 

And he stressed that NFPs often held sensitive data on health, financial hardship, children or donors, with trust and reputation among organisations’ biggest assets.  

Human error remains a weak point 

The recent breach of Medicare by a rogue AI agent showed how routinely humans left data unsecured, and it was one of numerous examples of developers loading customer databases into unsecured “storage containers” in the cloud.  

In the Medicare case, “all that OpenAI agent did was find something that was publicly available. It just shouldn't have been publicly available. So it was a human error.” 

Prime Minister Anthony Albanese said in September that the agent had accessed both public and non-public files from Medicare’s statistics reporting service after bypassing blocks. 

Devidas said the rise of AI meant threats were evolving. 

“That whole approach to cybersecurity needs to change … because AI, it would appear, will just find a way in.” 

He cited the case of an AI agent asked to book a gym class. Finding nothing available, it hacked into the system to delete other customers to assist its client.  

“It did exactly what was intended. … but it did not do it in a way that was ethically acceptable, because that wasn't a guardrail that was put in.” 

Cyber risk belongs with the board 

Devidas said AI adoption was running ahead of governance, with staff already putting organisational data into AI tools, often without a policy in place, a trend known as "shadow AI". 

Blanket bans on AI failed, he said, because “people just find a way around it”. 

He stressed that in a crisis arising from AI or a cyberattack, it would be the CEO or the chair – not the IT chief – who was likely to have to face the media or “have their head on the chopping block”.  

He said it was up to the board to manage cyber and AI risks.  

“The best way is to really own it at board level. You wouldn't be putting a blanket ‘no’ on it, but you'd be putting in place mechanisms to prevent inappropriate use of it.  

“It typically comes down to the sorts of information you would put into a large language model … the sort of data that you hold and want to manipulate.” 

“You've got to have an appropriate policy, and that policy is super simple: stuff we agree we're going to use and put into AI, and stuff we don't. It's literally two columns and two rows. It's really not that hard.” 

He said organisations needed a two-part approach covering technology and people. To stop the release of credit card details, for example, technology could block data likely to reveal sensitive information, but staff also needed education so they understood the risks, didn't try to bypass the barriers, and supported the organisation's policies. 

“You can get around the technology, so that's when education comes in, even though it is harder, and slower, and less effective, because you've got to do it over long periods of time.” 

Returning to the fire analogy, Devidas said while “defensive measures” did not directly make money or save money, the costs of a fire or cyberattack could be catastrophic. 

He said boards should not “outsource” their understanding or decisions about the risks.  

“You've got to get reporting that the board can understand, in non-technical language, that then flows the other way and guides decisions. That's the only way to do it.” 

“Boards need to really approach this as their risk to own.” 

He said good governance did not have to be expensive, but organisations should pay attention and be disciplined in applying their policies. 

“The threats are ever evolving and changing, and you'd go crazy trying to keep up with everything that is possible. But the mitigations have been the same for 20 years. Cyber is just an operational risk. You treat it like any other operational risk. It falls into a lot of the same categories as workplace health and safety. It's just about not being confronted by the technical nature of it and not deferring it to a technical person. That, I think, is the biggest trap.” 

Watch a replay of Nik Devidas’s webinar 

← Back to the newsletter

Improve digital access and security with our guidance

Community Directors hosts thousands of pages of free guidance, such as this help with your tech: Damned Good Advice on Cybersafety and Fraud Prevention | 10 questions every board member needs to ask about cybersecurity | Preparing a technology plan for your organisation | Cybersecurity policy | Data retention and destruction policy | More help with tech | More help with artificial intelligence

Find more resources under tools and resources on the Community Directors website.