AI is already part of everyday work. Employees use it to summarize documents, write code, translate text, and analyze information. Much of that use is legitimate and useful. Problems arise when employees turn to tools that sit outside approved corporate environments, leaving organizations with limited visibility over what is being used, what data is being shared, and what those tools can access or do.

On November 5, the Charter of Trust brought together experts from cybersecurity, enterprise risk, and technology to discuss how companies can manage Shadow AI without shutting down useful AI adoption.

Moderated by Friso Jankowsky (Atos), the panel featured Sudhir Ethiraj (TÜV SÜD), Tony Fergusson (Zscaler), Haydn Griffiths (Allianz Commercial), Scott Kannry (Axio), and Andy Schneider (Palo Alto Networks).

A clear message emerged: Shadow AI is often driven by unmet business demand. If approved tools are too limited, slow, or difficult to use, employees will look for alternatives.

The discussion highlighted four priorities:
- Make secure AI the easier option. Blanket bans can push AI use further into the shadows.
- Control data, access, and actions. AI agents should only see the information and perform the functions they need.
- Build security in from the start. Security by Default means clear guardrails, protected data flows, and defined recovery mechanisms.
- Prepare for faster incidents. AI can increase the speed and scale of both attacks and operational failures, making resilience and crisis preparedness more important.

The conclusion was not to slow AI adoption to a halt, but to make it safer through trusted tools, clear boundaries, and better preparation.

Thank you to everyone who joined the discussion. A recording of the webinar can be found at the bottom of this page.

Artificial Intelligence (AI) is rapidly becoming a cornerstone of economic competitiveness, public service delivery, and national security. At the same time, it introduces new systemic risks to cybersecurity, privacy, and societal trust. This paper, developed under the Charter of Trust’s Principle 3 “Security by Default”, addresses this dual challenge: securing AI systems throughout their lifecycle while responsibly leveraging AI to strengthen cybersecurity.

Aligned with the Charter of Trust’s overarching goals—to protect data, prevent harm to people and infrastructure, and establish a reliable foundation for trust in a digital world—the paper outlines how Security by Default can operationalize Trustworthy AI. It positions security not as a reactive compliance exercise, but as an inherent, continuously enforced design principle that enables innovation while safeguarding resilience, transparency, and accountability.

Against a backdrop of increasing geopolitical competition, fragmented regulatory regimes, and accelerating AI adoption, the paper highlights the strategic importance of trust as a differentiator for organizations and societies alike. It examines key governance, technical, and regulatory risks surrounding AI, and underscores the need for coherent governance models that integrate cybersecurity, privacy, and ethical considerations from design through deployment and operation.

Building on the Charter of Trust’s prior work, the paper provides a high-level framework for embedding Security by Default across the AI lifecycle, aligned with emerging global regulations such as the European Union (EU) AI Act. It also demonstrates how AI, when securely designed and governed, can serve as a powerful enabler of cybersecurity—enhancing threat detection, incident response, and risk management.
Ultimately, the paper reinforces the Charter of Trust’s conviction that trust, security, and innovation must advance together. By embedding Security by Default and Trustworthy AI principles at the core of AI development and use, organizations can strengthen digital trust, improve resilience, and contribute to a safer and more reliable digital future.

Please download the full report below.

On Tuesday, the Charter of Trust convened a timely virtual panel discussion on 'Security by Default in View of Major Cybersecurity Regulations in North America'. With more than 100 participants joining from around the world, the discussion underscored just how urgent, and global, the cybersecurity challenge has become.

A huge thank you to our outstanding panellists for their invaluable insights and for sharing their experiences with us: Linda Strick (Cloud Security Alliance), Kyle McMillan (Siemens), Lauren Zabierek (CAS Strategies), Rob Spiger (Microsoft), Sam Curry (Zscaler), and great moderation from Sudhir Ethiraj (TÜV SÜD).

The CoT expert panel:
- discussed fragmented cybersecurity regulations in North America and the need for more resilient infrastructure and security-by-default practices ​
- emphasized the need to embed security early in product architecture rather than addressing it post-incident ​
- highlighted the importance of structured collection of security signals and incident reporting to improve software safety​
- discussed about software as critical infrastructure affecting national security, economy, and public health, requiring robust safety measures

Thank you to everyone who participated! A recording of the webinar can be found at the bottom of this page.