Is AI an IT Problem? | TheaterFire

[-]

Clyph00@reddit

AI is not an IT problem. The business owns policy with Legal and HR, security frames risk and control requirements, and IT implements. Start with a RACI, data classification, and a simple intake for AI use cases so approvals and exceptions are traceable. Tie it to ISO 42001 or your existing risk register. What worked for us: business defined acceptable uses, security wrote control standards, IT enforced. We kept it lightweight and auditable. In the browser, we use LayerX to quietly keep prompts compliant while we sort out bigger governance pieces. Kept everyone productive and out of trouble.

Reply

[-]

Kungfubunnyrabbit@reddit

I feel that there should be a collaboration between the business and IT. If we leave the technology decisions to the business who knows what you will end up with.

Reply

[-]

Aerdi@reddit

IT in collaboration with the CISO consults the C-Level Decisionmakers, usually CEO&CFO on the risks and opportunities. I wouldn’t be comfortable with taking responsibility for a decision on such a regulatory pitfall.

Reply

[-]

Kibertuz@reddit

AI is a marketing problem, they dont know shytttt about AI but want to include AI world in every conversation.

Reply

[-]

No_Refrigerator2969@reddit

care to have some AI screen protectors 😂😂

Reply

[-]

Kibertuz@reddit

HaHa as long as it does cybersecurity i will buy 2

Reply

[-]

No_Refrigerator2969@reddit

that would be 100dollars/month standard

Reply

[-]

ConciousActionIsDuty@reddit

It’s a people problem.

Reply

[-]

jsand2@reddit

It depends on the AI you speak of. If you were to allow your end users to use AI, you would need to double and triple check k your security on your network folders. For instance, if Harold had access to a folder of Kumar's that Kumar saved his paycheck stubs in, then Harold would be able to see Kumar's pay information via AI. In this instance, yes AI is 100% an IT problem to deal with. We dont feel comfortable offering AI to our end users. So we have opted to not to offer it to our end users. We do however use AI in our IT Department. We have an AI that sniffs our network for irregularities and reports them to us. If it feels we have a breach it will shut the network down on that workstation until we can react. We have another that sniffs email for irregularities. It will action accordingly as needed whether it be holding an email, locking a link, or converting an attachment. To be honest, it would be hard working for a company that didnt have AI in place for things like this. It is so much more efficient than humans, but still requires someone like me to manipulate it.

Reply

[-]

No-Boysenberry7835@reddit

This ai run on your own server ?

Reply

[-]

jsand2@reddit

We have an in house appliance (basically their server), yes, but most of it happens in the cloud.

Reply

[-]

No-Boysenberry7835@reddit

So a external identitie can shutdown your network ?

Reply

[-]

jsand2@reddit

We survived a ransomware attack around 10 years ago. It took our 3 man team 72 hours pretty much straight to rebuild and recover our data. We had to shut our business down those 3 days. I had a 13 hour phone call with our AV company during that time! That will never happen again. This AI will drop the network of whatever device is corrupted to keep it from spreading. During business hours, we have to take action on 75% of the issues. But after business hours we have something watching for irregularities and stopping anything needed. Being afraid of AI, you might think it is a bad idea, but it has been nothing but a benefit to our company. This new email AI I have fallen in love with. We had our shit so locked down it wasn't even funny. We were able to remove the majority of blocks and let the AI do the job. Before, any office (word, excel, etc) files were blocked by default. Now, AI scans the file and if it feels it is malicious in any way it converts the attachment to something not malicious. For instance an xlsx file in question would convert to csv. They could still get their data, but it removes the macros, etc same with pdfs. It does the same with links. Vets the link and if it is deemed malicious, it locks the link so they can't click it. This allows content to get to employees and if it was actually legit they can request the original. Thats cool if you want to be scared of the future, but I am going to embrace it. I see the good in it and it outweighs the bad. Especially when my job is AI manipulation. I am in control.

Reply

[-]

No-Boysenberry7835@reddit

A black box hosted by a external company admin have full control over your network and you are in control ?

Reply

[-]

ImFromBosstown@reddit

What services are you using for this specifically?

Reply

[-]

jsand2@reddit

The company is called Darktrace. They offer both solutions.

Reply

[-]

admlshake@reddit

Yes and no. We can block it or allow it. But it's up to the company decision makers to decide the use cases.

Reply

[-]

bh0@reddit

This is basically it. I've been asked what options we have to block certain AI sites/tools, but as far as policy decisions about using them, that's not on us to decide.

Reply

[-]

NobodyJustBrad@reddit

I feel like it's also up to Legal/HR to own the use policy.

Reply

[-]

skob17@reddit

Data Protection Office at our place

Reply

[-]

ehxy@reddit

They are the ones that make use of it. We facilitate it and set it up but it's not what we rely on to do our job. Yes, AI can help us but we've been doing this since before AI has been a thing. AI can't troubleshoot physical world space and perform the fix. It knows as much as the person tells it and a user can ask it whatever vague non informative answer it wants and it will spit out a dozen scenarios until it gets to the answer and a user that can stand long enough to read it wouldn't be hitting us up on anything anyway if they had that kind of patience let aloke do a Google search themselves.

Reply

[-]

Wulf621@reddit

Monopolize. Offer to build an in-house AI, get some nice, fat GPUs. They make it your responsibility, you make it your power

Reply

[-]

Greenscreener@reddit (OP)

First you get the GPU, then you get the women, then you get the power...

Reply

[-]

lsudo@reddit

The advent of AI in the school setting is no different from the impact of calculators in the classroom. Our stance is that It's not going anywhere so faculty need to learn to work with not against. We can block AI all day long but It's not going to do a damn thing. The most important thing is for the school to establish what resposible AI utlilzation looks like with the students and faculty. Secondly, outfit faculty with the tools to evuate irresponsible AI utilization (When a student is letting AI do their thinking for them). Thirdly is for the district to adopt firm polocies for what happens when AI is abused. At no point is IT involved aside from helping with the deployment of staff tools and resources.

Reply

[-]

ryuut@reddit

It's cybers problem to define the guidance

Reply

[-]

SneakyPhil@reddit

It's an everyone problem.

Reply

[-]

7FootElvis@reddit

Opportunity

Reply

[-]

Solkre@reddit

But can it Synergy?

Reply

[-]

SneakyPhil@reddit

My eye is twitching in your general direction.

Reply

[-]

7FootElvis@reddit

Lol! I'm half serious, half mocking the corporatese.

Reply

[-]

Baerentoeter@reddit

But for real though... never waste a good crisis.

Reply

[-]

7FootElvis@reddit

Yes, and it's a great opportunity for IT people to lead the way to help use the proper tools, in the proper way, to achieve better business outcomes, or to achieve existing outcomes more efficiently or effectively.

Reply

[-]

SneakyPhil@reddit

Aye, only one eye is twitching in some other general direction then.

Reply

[-]

ehxy@reddit

Yeah but who wants to own it 😄

Reply

[-]

Jacmac_@reddit

Not an IT problem. Most organizations that are having panic attacks over AI are flailing around trying to stop it's usage, meanwhile Joe Employee is on his cell phone sending and recieving attachments and using AI left and right to get work done faster. The orgs worried about information leakage are straight up shouting at clouds.

Reply

[-]

megasxl264@reddit

The business If it’s up to IT just blanket ban it until further notice

Reply

[-]

nohairday@reddit

Personally, I prefer "Kill it with fire" rather than a blanket ban.

Reply

[-]

Proof-Variation7005@reddit

Half of what AI does is just google things and then take the most upvoted Reddit answers and present them as fact so I've found the best way to prevent it from being used is to put on a frog costume and throw your laptop into the ocean. If you don't have access to an ocean, an inground pool will work as a substitute. Above-ground pools (why?) and lakes/rivers/puddles/streams/ponds won't cut it.

Reply

[-]

jsand2@reddit

You do realize that there are much more complex AI out there than the free versions you speak of on the internet, right?? We pay a lot of money for the AI we use at my office and it is worth every penny. That stuff seems to find a new way to impress me everyday.

Reply

[-]

nohairday@reddit

Can you give some examples? Genuinely curious as to what benefits you're seeing. My impression of the GenAI options is that they're highly impressive in terms of natural language processing and generating fluff text. But I wouldn't trust their responses for anything technical without an expert reviewing to ensure the response both does what is requested and doesn't create the potential for security issues or the like. The good old "just disable the firewall" kind of technical advice.

Reply

[-]

jsand2@reddit

We have 2 different AIs that we use. The first sniffs our network for irregularities. It constantly sniffs all workstations/servers logging behavior. When a non common behavior occurs it documents it and depending on the severity shits the network down on that workstation/server. So examples of why it would shut the network down on that device could range from and end users stealing data onto a thumb drive to a ransomware attack. We have a 2nd AI that sniffs our emails. It also learns patterns of who we receive email from. It is able to check hyperlinks for mailciousness and lick the hyperlink if needex, check files and convert the document as needed, identify malicious emails, and so much more. While a human can do these tasks, it would take 10+ humans to provide the same amount of time invested to do all of these things. I was never offered 10 extra people, it was me and 1 other person handling these 2 roles. Now we have AI assisting for half the cost of 1 other human, but providing us the power of 10 humans. They do require user interaction for tweaking and dialing it in. But it runs pretty damn smooth on its own.

Reply

[-]

sprtpilot2@reddit

Not really AI.

Reply

[-]

daishi55@reddit

How so?

Reply

[-]

nohairday@reddit

So both ML's then. Rather than LLM's. That's what I was suspecting, but wanted to confirm. Genuinely curious what the AI is to your examples as opposed to more standard email AV/intrusion detection solutions, as they can also check for dodgy hyperlinks and the like. And the same for the network. Sounds very similar to what SCOM could be set up to do. Admittedly, I haven't been near SCOM or any replacements for quite a few years. But giving employees access to Copilot, chatGPT, and the like? That's where all of the security implications *really* come into play.

Reply

[-]

daishi55@reddit

LLMs are ML

Reply

[-]

Frothyleet@reddit

>So both ML's then. Rather than LLM's. 5 years ago, the technology was just "algorithms". Then LLMs made "AI" popular, and now any software that includes "if-then" statements is now AI.

Reply

[-]

jsand2@reddit

Yea we weren't comfortable opening up AI to the employees. While we feel we have things locked down properly, but we didnt want to take chances unleashing AI through our network folders and giving all employees access to that kind of power.

Reply

[-]

giantrobothead@reddit

“…depending on the severity shits the network down…” Please don’t correct this typo.

Reply

[-]

perfecthashbrowns@reddit

I recently had to swap from pgCat to pgpool-II because I ended up hating pgCat so I told Claude to convert the pgcat.toml config to an equivalent pgpool-ii config and it did just great. I also use it for things like double-checking GitHub Actions before I commit them so I don't miss anything dumb. Or I'll have it search the source code for something to find an option that isn't documented, which I had to do a bit with pgCat. Lots of times I'm also using it to learn, asking it to test me on something and I will check my understanding that way. Claude once got an RBAC implementation in Kubernetes correct while Deepseek R1 got it wrong, though! And sometimes I'll run architectural questions to a couple different LLMs to see if they give me any ideas or they correct me on something. I also recently asked Claude if an idea I had with Facebook's Faiss would work and it pumped out 370 lines of Python code to test and execute my idea which worked. But that is code that's not going to be used. I'm just going to use it as a guideline and re-write all of it since I need to actually double-check everything. I didn't even ask it to write anything! Just asked it if my idea would work.

Reply

[-]

Rawme9@reddit

I have had the exact same experience. It is good if *you* know what it's talking about and can save some time with some tasks. If not, it is outright dangerous and untrustworthy.

Reply

[-]

Proof-Variation7005@reddit

why don't you ask AI what a joke is then

Reply

[-]

poorest_ferengi@reddit

What about a dragon costume and thermite?

Reply

[-]

Proof-Variation7005@reddit

that only makes AI stronger

Reply

[-]

Still-Snow-3743@reddit

Most of what the internet is used for is to look up lewd images, but to categorize all of the internet as being only used in that way puts a big blinder on practical uses of the internet. I think you have the same sort of blinders on if you are approaching AI in this way. It's a strawman falacy - categorize this thing as something it's not, easily disprove the mischaracterization, and therefore you think you've disproven the target thing, but because of flawed logic you really haven't proven anything. I see people use this argument all the time as a synthesized reason for 'not liking a thing' when really, they haven't really thought about it. Ok, so it isn't always good at recalling exactly correct specific information on demand. But what is it good at? Because it's \*realllllly\* good at some things that aren't that ability, modern LLM models have off the charts comprehension and ability to provide abstract solutions to complex novel problems. And those are the things you should be acquainting yourself with. Having embraced LLM stuff myself for the last couple years, I am certain it would take a couple years to catch up to a level of understanding how to leverage these tools in interesting ways, which was only possible through experimentation and practice. The longer you wait to deep dive this technology, the longer you hold yourself back from drastically easier managing of all aspects of your job and life, and the longer it will take to catch up when you realize the value this technology really offers.

Reply

[-]

RoomyRoots@reddit

And that is how shadow IT starts.

Reply

[-]

TheThoccnessMonster@reddit

We call that DevOps these days.

Reply

[-]

nohairday@reddit

Fire cleanses all, including Shadow IT and the perpetrators of it. Seriously, there are so many potential issues with the current 'AI' craze that I wouldn't let it near any data at present. It's not my decision, but it is my opinion.

Reply

[-]

RoomyRoots@reddit

I agree with you. I am extremely opposed to AI and I work in the Data field. But both in my agency and my client, it was IT that started the Shadow AI usage and it took months until either acted up to regulate it and they did it badly.

Reply

[-]

H3rbert_K0rnfeld@reddit

Seconded

Reply

[-]

thecstep@reddit

Everything has AI. So what now?

Reply

[-]

TechCF@reddit

Yes, it is like the API craze from 20 years ago. Is API an IT issue?

Reply

[-]

daishi55@reddit

> API craze Are you referring to computers interacting with each other? I didn’t realize that constituted a craze

Reply

[-]

TheThoccnessMonster@reddit

…. Depends on whose but yes.

Reply

[-]

Thoughtulism@reddit

Unless there's HR consequences and procurement controls you can accept responsibility all you want if nothing happens when rules are broken then they're not rules

Reply

[-]

ImFromBosstown@reddit

Correct

Reply

[-]

RobertBiddle@reddit

Malicious compliance level 9000!!! 😈

Reply

[-]

RobertBiddle@reddit

Malicious compliance level 9000!!! 😈

Reply

[-]

RobertBiddle@reddit

Malicious compliance level 9000!!! 😈

Reply

[-]

hkusp45css@reddit

Yeah, I'll just blanket ban the Edge browser. There, no more AI. How do you like THAT?

Reply

[-]

azurite--@reddit

This is how you get your employees to hate your department. You don't do a blanket ban without an explanation, and even so there is copilot which protects company data on an enterprise level so if you are a Microsoft shop there is less of a reasoning to not explore it at least.

Reply

[-]

SocialDoki@reddit

This is my approach. I can be there to advise on how different AIs work if the org wants to build a policy but I don't know what ways people are going to use it and I'm not taking that risk if it ends up on my shoulders.

Reply

[-]

Warm-Reporter8965@reddit

I work in healthcare so I'm unsure of AI within the industry due to the risk of HIPAA since you know some dingus is going to plug in client data looking for exact results.

Reply

[-]

dontmakemewait@reddit

I don’t think any one department should be setting the rules. It’s a risk management problem. If your company is big enough, they will have a risk team. If it’s not, then someone still has the role of deciding what is your appetite for risk. That’s going to start defining your guard rails. Once they are in place tech teams need to figure out how to manage the tech side of the problem. It probably starts with education. Teach your staff about where the info Comes from that builds Ls and make sure they are not adding IP or PII data into that mix.

Reply

[-]

Dreilala@reddit

We have a very expensive project regarding copilot with extremely positive people spouting the virtues of using AI in the work place. I once dared ask what actual (monetary) benefit has arisen for the company as a result of said AI I was deemed too negative. I have since changed my attitude. Go Copilot!!!

Reply

[-]

JazzlikeSurround6612@reddit

Sadly that's how it is. All the smooth brain MBA C-level types creaming themselves over AI but they don't care to hear if you don't have the proper data sets, environment, resources etc to implement it, or actual use cases that may have a payback.

Reply

[-]

TheMagecite@reddit

Our company drank the Gen AI kool aid and went mad trying to get AI wins. I have noticed virtually all of our AI wins lately have strangely been lumped in with automation wins with just traditional automations using Power Automate considered "AI". I have been telling everyone for ages we will get far more bang for buck automating than Gen AI could ever deliver. Go AI ..... I guess.

Reply

[-]

jbourne71@reddit

Legal, HR, management/leadership set policy. Cybersec/infosec develops security controls to implement policy. IT executes within scope. Or something like that.

Reply

[-]

X0mbiRapt0r@reddit

This. 👆🏻

Reply

[-]

wanderinggoat@reddit

reminds me of working for an MSP at a larger company and i noticed a machine had become infected and had spread to a share on the NAS, I went straight over to the security team, advised them and asked what the process was and who would manage it. blank stairs and somebody said "maybe the helpdesk.."

Reply

[-]

stitchflowj@reddit

I respect the point of view that most people are making on this thread that it's a business policy problem first - they set the objectives and IT can implement. It's an understandable sentiment but I don't think it's realistic. Every CEO is on Twitter reading folks like Aaron Levie (Box CEO) and Tobi Lutke (Shopify CEO) talk about AI enabled productivity and how AI adoption is a strategic imperative. That means AI tools are going to mushroom super fast in your orgs and IT/compliance/security can't be seen as the productivity killing police. But of course, these shiny new apps are shipping with zero enterprise-grade controls - no SAML, no SCIM, often not even usable user admin controls. So every tool and account turns into a one-off headache. Bottom line IMHO: IT/Security/Compliance can't wait for the business to define the policy here. The teams responsible for keeping the lights on are going to be stuck between enabling productivity and cleaning up an ever-growing security, compliance, and cost mess, and so you need to get ahead of it.

Reply

[-]

Killbot6@reddit

We blocked all IT websites on our network, except for enterprise Copilot. As Copilot has at least said they will save guard the info and data that is input into it, and not use it. Do I really trust it? Not really, but our C-Suite team has decided they need it and disregard anything else said on the topic.

Reply

[-]

thegeekgolfer@reddit

Not everything that involves a computer is IT. It's easy for businesses to say it's IT, because many are ran by idiots. But, everything coming into a company these days involves a computer in one way or another.

Reply

[-]

TechIncarnate4@reddit

>Not everything that involves a computer is IT You're right. Its everything that has a power cable. :-)

Reply

[-]

GloveLove21@reddit

Ah yes, "the water fountain isn't working!" A ticket I once received.

Reply

[-]

No_Refrigerator2969@reddit

😂🥲🥲

Reply

[-]

xdamm777@reddit

What about a director opening a ticket because he can’t get Apple Car Play to work on his new BMW? Still IT according to the guy.

Reply

[-]

12inch3installments@reddit

Our CEO did this. Bought a brand new M8 convertible, couldn't pair his phone, came to IT for us to pair it for him.

Reply

[-]

rcp9ty@reddit

I had a coworker ask me to help setup an app for his new company truck so he could do remote start 🙄 My boss said do that when you get bored and everything else is taken care of don't even bother giving it a priority or zero.

Reply

[-]

NorthAntarcticSysadm@reddit

It is a shared responsibility, not a problem When used right it can enable roles and businesses to excel. Most think it is solely an IT function to manage. Any policy or process which does not have backing of management, leadership, HR, etc, doesn't have any teeth. As IT you can guide the business leaders, HR and Legal to come up with policies for the business, but without a top-down approach it'll end up like your home lab. You know, the lab that is full of old equipment you don't have the time or energy to even power on.

Reply

[-]

SwiftSpear@reddit

I assume IT manages things like accounts for third party services. The vast majority of AI business use are variants of that system. Very few businesses are running their own AI in AWS or something like that.

Reply

[-]

lord_of_networks@reddit

As usual this sub is full of angry greybeards. The business is asking you because they think IT is the group with the best chance of guiding the org. Now, you need to be upfront with the organisation about needing the budget to do it, you also need to demand help where needed like legal issues. But take the opportunity to shine and be seen as more than a digital janitor

Reply

[-]

Ok-Juggernaut-4698@reddit

Because we all love taking on more work and responsibility for the same pay. You either just graduated and haven't learned that you're nothing more than a disposable tampon to your employer, or you are that employer looking for fresh tampons.

Reply

[-]

bigwetdog10k@reddit

Some people *like* integrating new tech into our organizations. Any crude analogies for that?

Reply

[-]

nlfn@reddit

How about "oh, you're just giving the users a strap-on only to have them turn around and use it on you"? (I'm team "ITS should be familiar with AI and help decision-makers" but it's hard to resist the call of a crude analogy)

Reply

[-]

bigwetdog10k@reddit

Well, maybe I'm just lucky in that I try to keep my projects user focused. My philosophy is "give people what they want, and then give them what they didn’t know they wanted". Everyone seems happy. Maybe your guys problems come from weird ideas about inserting things into people.

Reply

[-]

TheMagecite@reddit

A lot of people are jaded by the business demanding everything getting people to work insane hours and in return they now want to lump more on them. If you look at it from that point of view the reaction makes sense.

Reply

[-]

azurite--@reddit

Still doesn't make sense IMO, why would you not want to implement something that will have a huge impact for the future? I completely understand why some IT people have a stereotype of being grumpy assholes. This subreddit is that stereotype to the very root.

Reply

[-]

ABotelho23@reddit

AI is not a fridge or a toaster.

Reply

[-]

NoSellDataPlz@reddit

I raised concerns to management and HR and let them hash out the company policy. It’s not IT’s job to decide policy like this. You let them know the risks of allowing AI use and let them decide if they’re willing to accept the risk and how far they’re willing to let people use AI.

Reply

[-]

azurite--@reddit

It is absolutely ITs job to control data security. Yes HR should create a policy in the company handbook, but IT at the end of the day should be putting controls in place for data security.

Reply

[-]

Greenscreener@reddit (OP)

Yeah that is the road I am currently on. They are still playing dumb to a degree and wanting IT to guide the discussion (that we are trying to do) but I seem to be going in circles. Thanks for the reply.

Reply

[-]

FarToe1@reddit

Remember that it's okay to say no. Your job is to inform the decision makers about the risks, and any mitigations you can form against them. If the risks are still present (and some will be) then you make them clear and loud and unambiguous.

Reply

[-]

NoSellDataPlz@reddit

Welcome. Were I in your shoes and I was being put on the spot to make a decision, I’d put my wishlist together… and my wishlist would be 1 line: Full corporate ban on the use of LLMs, SLMs, generative AI, general AI, and all other AI models yet to be created with punitive actions to include immediate dismissal of employment. And the only way this policy is reversed is once the general public understands the ramifications of AI use and data security. This will hopefully result in management and HR rolling their eyes and deciding it’s just best to consult it with technical questions and leaving policy making with them.

Reply

[-]

biebiep@reddit

>Full corporate ban on the use of LLMs, SLMs, generative AI, general AI, and all other AI models currently and yet to be created with punitive actions to include immediate dismissal of employment. Reasonable IT take, as always.

Reply

[-]

iliekplastic@reddit

They are trying to make you do work that you aren't paid to do because they are too lazy to do it themselves.

Reply

[-]

RestInProcess@reddit

IT usually has a security team (maybe it's separate), but it's them that hash out the risks. In our case we have agreements with Microsoft to use their Office oriented Copilot, and for some we have the Github Copilot and all other AI is blocked. Business should identify the use case, security (IT) needs to deal with the potential leak of company secrets as they do with all software. That means investigation and helping managers at the upper levels understand, so proper safeguards can be put in place.

Reply

[-]

NoSellDataPlz@reddit

I’d agree this is the case in larger organizations. In my case, and likely OP and many others, security is another hat sysadmins wear. In my case, I don’t have a security team - it’s just lil ol’ me.

Reply

[-]

Maximum_Bandicoot_94@reddit

Putting the people charged with and goaled upon uptime in charge of security is a conflict of interest.

Reply

[-]

NoSellDataPlz@reddit

You’d be shocked what a small budget does to drive work responsibilities. I’ve been putting together a proposal to expand IT by another sysadmin, a cyber and information security admin, an IT administrative assistant, and an IoT admin for systems that aren’t servers or workstations. My hope is that it slides the Overton Window enough that they’ll hire a security admin and forego the other items and will be thrilled if they hire an additional any of the other staff.

Reply

[-]

Maximum_Bandicoot_94@reddit

My last shop worked like that. I fixed the problem by dumping their toxic org. They floundered for 2+ years to completely replace me, by the time my last contacts at the former org left they had to replaced me with 5 people which combined, including benefits etc, probably cost that org 3x what I did. "At will"' cuts both ways in the states. Companies would due well to be reminded of that more often.

Reply

[-]

NoSellDataPlz@reddit

My employer isn’t toxic or anything like that. It’s a state job with a very well spent budget. If my proposal gets accepted, even if in part, it’s up to the bean counters to find the money. It’s not my problem. My problem is exposing the risks to the organization should they fail to act. If they opt to not act, I’m free and clear and I still get my paycheck should shit hit the fan.

Reply

[-]

MarshallHoldstock@reddit

I'm the lone IT guy, but we have a security team of two. One of them is third-party. They meet once a month to go over all ISMS stuff and do nothing else. All policies, all risk-assesment, etc. that would normally be done by security I have to do, because it's less than an afterthought for the rest of the business.

Reply

[-]

RabidBlackSquirrel@reddit

Security itself would rarely be the one to hash out the policy. It's not infosec's job to accept risk on behalf of the company. We would however, detail the risks and propose controls and detail negative outcomes so Legal/whoever can make an informed risk decision, and then maintain controls going forward. If I got to accept risks, I'd have a WAY more conservative approach. Which speaks to the need to not have infosec/IT be the one making the decision - it's supposed to be a balance and align with the business objectives.

Reply

[-]

mrcollin101@reddit

It’s a technology, it’s IT’s role to document the risks and controls, then partner with the business units to determine what controls to put in place and what risks to accept. Sysadmin determines the technologies capabilities for controls Security Admin documents the risks IT manager sets expectations for the above and determine priorities and timelines (maybe with a project manager in there if your org has one) IT director partners with the business units to articulate and document the controls and accepted risks Then one the decisions are made it all flows in reverse to production

Reply

[-]

RobertBiddle@reddit

From a corporate perspective, the concerns about AI usage fundamentally amount to data policy and management. That <i><b>is IT</I></b>>.

Reply

[-]

ShowMeYourT_Ds@reddit

Starting place: Free AI: Don’t put anything in any AI you’d wouldn’t want in public. Paid AI: Pay for an AI that won’t use your data to train.

Reply

[-]

AmSoDoneWithThisShit@reddit

It is when idiots think they can use AI to fix a problem and end up making it worse because AI is so confidently wrong so much of the time.

Reply

[-]

MateusKingston@reddit

Shared as most people said, no one has all the info needed to do this alone

Reply

[-]

redditphantom@reddit

I feel it's a shared responsibility. IT needs to think about security from data exposure and access. Management needs to think about appropriate usage from the business perspective. Management should also understand the risks to business that they may not be aware of if they aren't versed in IT language. It is not a black and white discussion and both sides have to discuss and solution the policy to what makes sense for the business. Every business is going to be different but without understanding the risks and benefits from all sides will this be solved

Reply

[-]

ButtThunder@reddit

Absolutely shared. I wrote the policy with input from HR and legal.

Reply

[-]

accidentalciso@reddit

It involves computers, so yes, it’s going to get dumped on IT, but in reality, it’s every part of the company’s problem. Like security, if it gets concentrated in a single team/function, you are going to have a terribly difficult time.

Reply

[-]

Wheredidthatgo84@reddit

Management 100%. Once they have decided what they want, you can the implement it.

Reply

[-]

Defconx19@reddit

Eeehhhh, sort of. I'm say it's joint. The problem is management can quickly decide on a scope of AI implementation that isnt realistic. IT should be at the table to advise what the implications are and what resources are likely needed. Then ELT can decide from there and IT can deploy.

Reply

[-]

hkusp45css@reddit

DLP is a compliance problem, in my sector. Thank goodness.

Reply

[-]

GloveLove21@reddit

100% a risk management/IT/leadership joint issue in my opinion and org.

Reply

[-]

blissed_off@reddit

Never legit management make technology decisions without involving IT.

Reply

[-]

telmo_gaspar@reddit

No! It's s tool.

Reply

[-]

xgreenyflo@reddit

no, it's a tool

Reply

[-]

MoeraBirds@reddit

AI needs a joint governance approach: Privacy, Legal, IT, Security, Business. That lot agree the policy and governance model. Then IT operations people make it work within the guardrails. In a few years it’ll be core IT but right now it needs special attention.

Reply

[-]

Redacted_Reason@reddit

Establish an SLA

Reply

[-]

discosoc@reddit

It's an HR and/or legal problem, same as watching porn or exfiltrating company data. Sure, you can implement technical measures to curb it, but those measures need to be framed around what's established at a policy level. Right now, however, nobody really knows what "AI" actually means for businesses because it's being tossed into fucking everything by everyone. This is probably not going to chance until we finally see corporate lawsuits from AI fallout slugging it out in court, or Boeing going under after AI designed planes start crashing or something equally crazy. Even then, I suspect it's not going to be "banning AI" so much as just trying to regulate how it's used -- especially in regard to client data. I'm seeing this a little in insurance and HIPAA industries but it's kind of vague, like there's a known concern about protected or client data being ingested in an AI model, but nobody is really sure how to even outline the risk or verify such an infraction. So it gets mentioned as prohibited with zero guidance on *how*.

Reply

[-]

GhostDan@reddit

I've been asked to troubleshoot coffee machines.. Everything is IT

Reply

[-]

Complex86@reddit

It is a legal issue more than anything

Reply

[-]

BarsoomianAmbassador@reddit

The assumption would be that the IT department would have a better understanding of AI than the management team. It's tech, so it falls under the umbrella of the IT department to manage, ultimately. IT would help guide management in creating policies for AI use.

Reply

[-]

BlueNeisseria@reddit

"IT will become the HR of AI" - Jensen Huang, CEO Nvidia but the business MUST define the Policy objectives that IT works within

Reply

[-]

matt95110@reddit

Oh good, so that means I can become an incompetent asshole who fails upwards. I love it.

Reply

[-]

ISeeDeadPackets@reddit

Is uh....is that not what we're all doing? ![gif](giphy|vUEznRmVQfG2Q)

Reply

[-]

Rawme9@reddit

Sometimes I feel that way and then I talk to some of my co-workers

Reply

[-]

pdp10@reddit

It's very competitive, failing upwards in the pyramid.

Reply

[-]

matt95110@reddit

Lots of backstabbing in HR. Only one person can be the head asshole.

Reply

[-]

SparkStormrider@reddit

Keep firing assholes! There can be only one!

Reply

[-]

KnightNZ@reddit

It's better to burn out than to fade away.

Reply

[-]

chilli_cat@reddit

No, you are a competent asshole/arsehole who can rightly delegate upwards

Reply

[-]

EldeederSFW@reddit

The HR motto, “If there aren’t any fires to put out, start one!”

Reply

[-]

pmandryk@reddit

> I can become an incompetent asshole who fails upwards. This guy's got management written all over him.

Reply

[-]

Important-Product210@reddit

I don't oppose this path but everyone should think of what policies improve the processes the most and work as a team.

Reply

[-]

limlwl@reddit

That's lazy to put the onus on the business MUST define the policy objectives. If IT doesn't know, then sucks to be in IT.

Reply

[-]

loupgarou21@reddit

In our organization it was somewhat easy because policies like that all come from HR, so our AI policy is coming out of the HR department. That being said, HR worked with us in IT to help draft the policy.

Reply

[-]

DaemosDaen@reddit

My answer is going to be "It depends" Each org has a different set to regulation, guidelines and requirements concerning data. Your bosses may not know what those all are since they rely on IT to keep them on the up and up. (Or at least to let them know and they ignore. Make sure you document it.) So it could easily be on the IT Department to make a suggestion that gets sent and Lawyered up before becoming Polify. Example: I work for several Police Departments, due to the unreliable nature and the fact that the data leaves our reasonable control, it is not acceptable for CJIS data to be opened to it. I advised my Director then we advised the County Admin (my Primary employer) of this and now we have a lawyered up version of "No AI at this time." One of the cities I work for has already made their own Policy. Once I advised of the CJIS information, they decided to have use separate the data.

Reply

[-]

ultraspacedad@reddit

It's 100% Management that decides what AI Controls are needed moving forward. If they are asking you because they don't know and pushing it on you then good. Just make sure company Data is Private and if the Boss doesn't know just use best practices and pray

Reply

[-]

Zenin@reddit

TL;DR - Yes, it's *VERY* much an IT problem. Our vendors have been pushing it on us with free credit bribes, etc...because as IT we're where their money comes from. I've been pushing back hard on two fronts: 1) We're IT, we don't build projects we support them. Get us *training* and on how to best deploy and support the AI applications we're sure Business will be throwing at us. We don't want to be the roadblock to progress, but we're probably not going to be the driver. 2) Hey you the vendor: If there are good use cases for IT to be using AI directly (not just deploying/supporting it), surely you've already got some idea of those from your other customers? Please give us some high level (no NDA info) examples of how IT using AI directly is helpful. And then explain how those use cases aren't already being covered by features of the IT apps we do use today such as within CrowdStrike, etc. 3) What specific guardrails can we put around these AI tools? AWS for example is telling us that Q Developer in the Console/CLI will have "the permissions of the user". As someone with pretty extensive permissions...that sounds absolutely horrible. Our TAM is currently going to get back to me on what limit policy, if any, we can put around Q to satisfy this. For example I *do* want Q to be able to see most all resource meta data, metrics, and logs, but absolutely *not* see data within buckets, dynamo tables, etc. 4) Additionally talk to me about your *business* AI tools in depth for two reasons: First, because like I noted in #1 we'll probably be asked to deploy and support them, but Secondly because as IT *we* can probably be customers for these "Business" tools. For example, Amazon Q for Business can train against our Confluence docs, past issues in Jira, Slack discussions, email threads, etc and possibly combine those knowledge bases with our monitoring data, etc and be able to help IT trace down and connect the dots around new trouble tickets more efficiently and effectively. BUT...like #3...that's going to need some very solid and clear guardrails because we certainly can't have user A seeing data that only user B should have access to simply because user A was clever with their prompts or whatever. 5) ROIs on *everything*. AI is stupidly expensive. What's the story around proving what the business spends on this actually returns meaningful value? In revenue, in time to market, in systems reliability, etc. Can we trace per-user metrics of AI to see if/how it's being adapted and/or what results it does or doesn't bring?

Reply

[-]

Xibbas@reddit

Its a legal/IT/Cybersecurity problem.

Reply

[-]

aintthatjustheway@reddit

It's a business decision. My company blocks all public 'AI' resources. I'm really happy about that.

Reply

[-]

ARobertNotABob@reddit

There are *very few* Directors fully conversant with the ramifications of embracing AI, which means it's going to be a case of the blind leading the blind most everywhere, with only bottom-lines truly scrutinised for effect, as increasingly usual.

Reply

[-]

fresh-dork@reddit

i work at a largish company that has an articulated AI policy: * business set the policy (don't leak confidential info to external AI, bounds on how we use it internally, etc) * IT and security implement controls to execute the policy and make exceptions from the norm when warranted. i think the company is a but stuffy, but generally consistent in following good practices

Reply

[-]

povlhp@reddit

A cloud service is a problem of whoever uses it and those who pays. IT pays for servers and services in the cloud here. So our AI is our problem. The other AI is a problem for legal.

Reply

[-]

Apfaehler22@reddit

We had training done for all our users. Especially in a healthcare environment it’s wild West with some of these guys. Very scary how security best practices are thrown out the window with the info they put in there. But who ever made the training video was not IT. Someone in upper management. It was trash and pretty sure half of the video was generated with AI. Using examples such as smart Alexa speakers and google assistant and calling them AI devices. I’ve been telling users who ask about it. To treat it like any other security measure we have while using the internet or checking emails and so on. And no your google assistant is not AI. It’s a wild time for sure.

Reply

[-]

dcsln@reddit

Do you want another department to manage AI in your organization? AI is like any other software/SaaS/product/etc. You can manage it, or someone else can manage it. The more tech tools are managed outside of IT, the less valuable IT is. Is that fair? No. Is that more work with no more compensation? Maybe. Broadly speaking, IT's role is to be smart about tech, and help the org make good technical decisions. Some of that involves managing tech directly, some of it involves being a trusted advisor. Both roles are really important. That's why all your vendors want to manage your systems and/or be your "trusted advisor". Give your advice. Recommend a program. Recommend training, project time, proofs-of-concept, and other stuff the IT team can do. Treat it like real work, that pushes out some other work. Whatever you do, don't sit on the sidelines.

Reply

[-]

Carter-SysAdmin@reddit

ISO 42001 is a new cert not many folks have locked in yet, I imagine it will become more and more relevant to more and more companies as things keep speeding up.

Reply

[-]

ABotelho23@reddit

I think it's silly to think IT shouldn't at least be consulting about AI. Do you really want laypeople making these decisions?

Reply

[-]

alexandreracine@reddit

The business should create the policy, then you tell them how much it will cost, then they will change the policy :P

Reply

[-]

kagato87@reddit

It informs management if risks that require considering. For example customer data or pii needs to be kept out of public models. Management creates the policy, IT tells them it's impossible to enforce from a purely technical standpoint and they need HR backing. At least, that's usually how it goes...

Reply

[-]

Timberwolf_88@reddit

The CIO/CISO needs to own the policy and governance, IT may need to own implementation and config to ensure compliance with policy. If the company is/wants to be iso270001/nis2/cis/etc. compliant then ultimately the board witll have personal accountability.

Reply

[-]

Ok_Fortune6415@reddit

It’s both. The company decides what is and isn’t appropriate. IT use technology to enforce rules where and when they can. I never understood these questions. Yes, the policy is for the business to make and for the employees to follow. That doesn’t mean we still don’t enforce. Oh your policy says you cannot install any unapproved software on your work machine. Do you give everyone local admin? I mean, they won’t install anything because of policy so.. That’s how I see these things as. If the business wants to blocked, it gets blocked.

Reply

[-]

SifferBTW@reddit

I give input when asked, but I'm not drafting language. That's for the lawyers

Reply

[-]

imnotabotareyou@reddit

It’s just another software to manage.

Reply

[-]

MalwareDork@reddit

Unless your confidentiality is ironclad, it's a general assumption IP is going to be leaked into chatGPT or the equivalent. The whole Tencent grift here on Reddit for Deepseek was a very comical circus show of the lack of concern people have for IP protection. I'd just assume you're going to implement it in the future or shadow IT already has it churning its wheels. College students and professors already use chatGPT and its associates to a mind-numbing degree so it's a matter of when, not if.

Reply

[-]

m0henjo@reddit

Business leaders are being sold on the idea that they need AI. So in essence it's a solution in search of a problem. Can it help? Sure. But if your organization is littered with ancient technology that can't easily be swapped out, AI isn't going to help. As an IT professional, it's important to learn it and understand it.

Reply

[-]

zerinsakech1@reddit

IT doesn't make the rules, we follow them.

Reply

[-]

ephemere_mi@reddit

Company policies, by their nature, should be owned by HR, and enforced by the appropriate management. That said, if you are asked to help write the policy, you should take that opportunity to make sure it doesn't end up being a bad one. If you're still early in your career, it may also end up being a valuable experience and you'll likely get facetime with the people that will approve your next promotion.

Reply

[-]

Ivy1974@reddit

AI basically an interactive Google. It is as good as the person that programmed it. Till it can weed out the nonsense fixes on its own we are still needed.

Reply

[-]

kerosene31@reddit

How it would work if I ruled the world: \-IT would be a strategic parter at the table with the same voice as other areas of the business. IT should have a seat at the table from the start when decisions are made until implementation. How it will likely work: \-Businesses will buy things without consulting IT at all, and leave it to the IT janitors to clean up the mess.

Reply

[-]

That_Fixed_It@reddit

IT should have a better chance of understanding of what products and restrictive policies can be deployed, and how to mitigate specific security implications. I'm not ready to hand my credentials to an AI agent to work on its own, but I've had good luck with anonymous AI chat bots when I need a quick PowerShell script or Excel macro.

Reply

[-]

JohnBeamon@reddit

Asking me to use AI without telling me what you want done is like telling me to use Excel without giving me tasks or data. If management has a task that's well-suited for AI, I'll use AI to solve it. Otherwise, they're paying me FT salary to make six-fingered memes all day.

Reply

[-]

CLE-Mosh@reddit

Walk over to the rack power supply.... Pull the plug... Can AI Do That???? Walk Away

Reply

[-]

kitkat-ninja78@reddit

IMO, it's a joint issue. IT can not do this alone, yet IT has to be the one to protect users from a technical point of view. Business management/leader has to be the one to set business policy with other departments to back up and implement, eg HR from a people procedure point of view, IT from a technical standpoint, etc.... Having IT solely sorting this out would be like the tail wagging the dog, instead of the dog wagging the tail.

Reply

[-]

Actor117@reddit

I built a general policy using the framework NIST offers. I already was given an idea bout what AI the company wants to allow and what it doesn’t. I completed a draft of the policy and submitted it to Legal and the CEO to make changes as they see fit. Once that’s done I’ll implement controls, where possible, to enforce the policy and the rest will be handled by an understanding that anything outside of ITs ability to control is a management issue.

Reply

[-]

Bright_Arm8782@reddit

I think we should, we are the department that think about implications of what we are doing and raise questions that most of the rest of business find annoying, things like compliance with standards, making sure that data we don't want going out to places doesn't get there and the like. If we don't then someone else will, because they want to use grammarly or the like and then we become the bad guys for taking their toys away.

Reply

[-]

axle2005@reddit

It's 100% IT's job when upper manglement pushes out an "AI-based" application that immediately crashes half the working systems and no one else is smart enough to fix what it broke... unfortunately...

Reply

[-]

toebob@reddit

It is up to IT to explain the risks in clear language that the business can understand. And not just general risks - evaluate each use case. Using AI to create pictures for the intranet department webpage is a much different risk than putting an AI bot on the public homepage.

Reply

[-]

Greenscreener@reddit (OP)

Yeah that is part of the issue tho. The number of tools and different ways ‘AI’ can be used is changing on a daily basis. Big chunk of the challenge is keeping up so advice can be given. It is a major workload addition that is not being recognised.

Reply

[-]

toebob@reddit

“More work than workers” is not a new problem. We should deal with that the same way we did before AI. Don’t be a hero and work a bunch of unpaid overtime to cover up a staffing problem. The way we do it at my place: all new software with AI components has to be evaluated by IT. If IT doesn’t have the staff or time to get to the evil right away then the business doesn’t get that AI component until IT can properly evaluate it and provide a risk assessment. If the business goes around IT and takes the risk anyway - that’s not IT’s fault.

Reply

[-]

mrtobiastaylor@reddit

Depend on how many business functions sit with IT. In my firm - my team look after Data and Compliance (so DPO and associated functions) Policy first for using AI, any tooling that uses it needs to approved where reasonable i.e Google Search wouldn't be within scope, but Chat GPT would be. Staff cannot setup accounts on systems on behalf of the business, nor share anything relating to the company including PII, IP or internal communications/materials. And we obviously, very strict on this. Second to that, all systems we use must be protectable by SSO/IDP. This somewhat limits what systems we can use which is useful. All applications must go on a risk register, and be accountable and auditable. We save all privacy policies and only approve applications where our data can be validated end to end (so we get data flow diagrams e.t.c) along with ensuring that our data does not get shared into any collective LLM. Ive always taken the approach that if policy doesn't exist, I'm writing it and sharing it with the firm. If someone kicks up, ask them why they didn't do it if it was their responsibility.

Reply

[-]

Fast-Mathematician-1@reddit

It's up to the business to identify the want an IT to box it up and deliver it. Business drives the need, and IT CONTROLS the implementation within the scope of the business requirements.

Reply

[-]

CyberpunkOctopus@reddit

I’m on the security team, and I’m making it my business, because it’s just another app that needs a business justification to exist in our environment. I’ve drafted our AI AUP, set up rules in our DLP tools to block certain data types from getting shared, blocked Copilot in group policy per CIS controls, and I’m looking at making an AI training module to go along with the annual awareness training. Is it perfect? Heck no. But I have to do my due diligence to educate the organization to at least stop and think before they try to do shit like ask for an AI keylogger because they never learned how to write.

Reply

[-]

BlueHatBrit@reddit

AI is not a discrete area - it cuts across multiple spaces and will need broad collaboration from areas of the business to ensure it's usage is properly thought about. IT and technology departments will of course have to play a big role. They'll probably be responsible for a lot of integration work, as well as the technical implementation of policies (blocks or whatever). But the company as a whole needs to figure out what makes sense for each area and where to draw lines. You probably need a small group with IT, InfoSec, HR, and representation from the revenue generting sections of the business. They can figure out what the starting point is. That's probably blessing a chosen vendor and putting together a policy which says things like "don't upload healthcare patient data into the chatgpt UI" or whatever is needed. Then the business as a whole goes from there, each doing their roles. HR make sure policies are communicated, understood, and enforced. IT and InfoSec do whatever is needed to make the blessed tools accessible and limit access to the others, etc etc... The businesses that treat this as just one person or departments job to "do AI" are the ones who won't find any benefit from it at all. Someone will use it to pad their resume for a year or two, maybe spend a bunch of money badly, and then move on to some strange "AI Adoption Development" role in another company.

Reply

[-]

pmandryk@reddit

Ok. This is great but what about A1? Who gets to use A1 and on what!?!

Reply

[-]

TuxAndrew@reddit

Unless we have a BAA with them we generally can’t use it for critical data unless we’re hosting the system.

Reply

[-]

dankmemelawrd@reddit

Absolutely not.

Reply

[-]

qwikh1t@reddit

IMO; companies should host their own AI. That way is controllable by IT. Put out policy concerning AI usage is only allowed through the company.

Reply

[-]

yawn1337@reddit

IT looks at data protection and cybersecurity laws, then outlines what is allowed and not allowed. Management signs off on the use policies. IT restricts what can be restricted

Reply

[-]

kremlingrasso@reddit

AI is primarily an access problem from an IT point of view. Both who has access to it and what data those people have access to. So whoever controls those best define the AI policy. In most case that's IT unless you have a dedicated compliance/data governance org.

Reply

[-]

user3872465@reddit

Policy = HA, or other Descision makers Realization, Kowhow, Technical Background info = IT I am not making policies nor do I descide on where,what,how,who can use AI and whatnot. I can give info and context to help others in Policy or Descision making. I'll gladly talk to managment and educate them as far as I know. But I am not making a Descision for them, I don't get payed enough to do that.

Reply

[-]

SoonerMedic72@reddit

The only way you should be writing policies is if you are in IT/InfoSec management. Like, I had to write policies before, but I also present any changes to the board every quarter. I wouldn't have asked someone else to do it. 🤷‍♂️

Reply

[-]

Ok-Big2560@reddit

It's a corporate compliance issue. I block everything unless a senior leader/decision maker/scapegoat provides documented approval.

Reply

[-]

JimmySide1013@reddit

AI is content and IT shouldn’t be doing content. There’s certainly a permission/logging component which IT would be responsible for but that’s it. We’re not responsible for what users type into their email any more than what they type into ChatGPT.

Reply

[-]

TechCF@reddit

I prefer it IT is asked about tooling, but tools used at a company. Hardware,software or human resources is not an IT issue. Replace AI with words like "hammer" or "powerpoint" and ask again.

Reply

[-]

Zolty@reddit

A company I know of has a policy explicitly banning AI chat bots meanwhile half the departments are shockingly seeing 40-50% increases in productivity on projects. If you ban something this useful you're going to have a revolt. Get your company a paid for AI provider that will obey your data privacy requirements.

Reply

[-]

psu1989@reddit

AI is a company (tech risk mgt team) concern and any technical controls they request would then be a request to Security\\IT. Any other concerns would be a Company/HR concern.

Reply

[-]

slashinhobo1@reddit

I raised concerns, but they didn't act on it. It's no longer my problem.

Reply

[-]

jupit3rle0@reddit

It should be 100% up to the business to own the policy. At the very least, they need to have a FULL understanding of what they are asking AI to accomplish, and what it could potentially cover (and replace?). At the end of the day, someone needs to remind these people that AI could very likely end up being their #1 competition in the job market, and I'd imagine that is supposed to result in collective hesitancy, not wonder.

Reply

[-]

limlwl@reddit

Why should it be 100% up to the business to own the policy? Is IT not part of the business?? If you do separation now, then IT will never be the leader; especially when "the business" is looking to IT for leadership in the field of AI.

Reply

[-]

vlad_h@reddit

You’d have to elaborate with more details on what controls and what the issue is that you are trying to solve. In my experience LLMs (it’s not AI people!) are a tool and are very useful but far from perfect.

Reply

[-]

imgettingnerdchills@reddit

All of these discussions/decisions need to happen at the management level and also very likely need to involve legal team. Once they decide on the policy then you can do what part you have in enforcing it.

Reply to Post

205 Comments