{
  "id": 18265155,
  "title": "Equal spend: why AI budgets need a security twin",
  "url": "https://urgent.news/2026/11/05/equal-spend-why-ai-budgets-need-a-security-twin",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-05T06:05:36.000Z",
  "source": {
    "name": "e27",
    "slug": "e27",
    "url": "https://e27.co/equal-spend-why-ai-budgets-need-a-security-twin-20261105/"
  },
  "original_language": "en",
  "account": "The past weeks have shown a recurring pattern: new AI agents, assistants, or workflows are announced weekly, often followed by news of breaches, leaks, or drained resources. These two streams of news are closely connected. On October 30th, Binance experienced the largest cryptocurrency theft in history, losing $6.4 billion in just 54 minutes. Binance, a well-funded exchange with a large security team, was not an exception to the rule; the speed of the attack was the key lesson. The attackers are no longer moving at a human pace, and many now use AI agents to carry out their attacks. This is a concern that extends far beyond the cryptocurrency sector.\n\nA recent study found that AI agents have breached into 100 firms for minor gains, and Southeast Asian small online shops are particularly vulnerable targets. In the past, obscurity protected smaller businesses, as breaking in required both skill and patience. However, with AI agents, cheap attacks are now aimed at everyone. Additionally, global organizations faced an average of 2,336 cyber attacks per week in July, a 16% increase from the previous year, with education, energy, and travel sectors under increasing pressure. Supply chains further exacerbate the exposure, with Southeast Asia facing routine supply chain attacks due to a lack of security talent and heavy reliance on third-party technology providers.\n\nThe internal situation within companies is not reassuring. Research by Gravitee revealed that most organizations have deployed AI agents into production, yet fewer than one in five have full security approval. Adobe's findings in Southeast Asia indicate that 57% of firms are stuck in AI's \"frozen middle,\" unable to progress their projects past internal IT and security teams. Some companies rush ahead without proper security, while others wait for security clearance, neither of which is a healthy approach to adopting new technology.\n\nThe risk intensifies as AI agents begin acting autonomously. An OutSystems report found that enterprise executives are confident in keeping AI agents under control, but the room grows quiet when asked what happens if two agents disagree. Technology leaders in the region are learning to trust AI agents, but only in non-production environments. This caution is sensible and an admission that most firms' security controls were designed for human users, not software entities making their own decisions.\n\nOne contributing factor to the problem is the prevalence of shadow AI. Many incidents begin with seemingly innocuous actions, such as using a reused password, clicking a convincing email, or pasting a supplier contract into a free chatbot to save time. This is the reality of shadow AI, and merely banning AI does not solve the issue. The phishing playbook is also evolving, with phishers now asking users to type the malware into the browser themselves, and AI-written lures further eroding the trust in traditional warning signs for staff.\n\nTo effectively secure AI, investment in security measures should match the investment in AI itself. Companies such as Dropbox, Yubico, and Aleph are taking different approaches to address this issue. Dropbox, cautious about its involvement in the AI race (ChatGPT, Claude, and Gemini), has launched Dropbox Protect to address concerns around data security when running large language models over company files. Yubico's hardware security keys provide phishing-resistant access control, making it harder for attackers to gain unauthorized access through stolen passwords. Aleph, a new generation of workforce provider focusing on the people side of the problem, addresses the talent shortage in cybersecurity by hiring based on aptitude rather than CVs. These solutions emphasize the need for identity, accountability, and limits on what each AI agent can access.",
  "summary": "The last few weeks have had a pattern. Every week, another company announces an AI agent, an AI assistant or an AI workflow. Every week, another headline tells us something has been breached, leaked or drained. Those two streams of news are connected. On 30 October, Binance suffered the biggest theft in crypto history, with […] The post Equal spend: why AI budgets need a security twin appeared…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}