Governing the AI and Cyber Frontier

This piece is based on remarks by the author delivered during Aspen Digital’s Global Cybersecurity Meeting in New York City on September 22, on the sidelines of the UN General Assembly.

How do we stop being reactive on AI and cybersecurity? The past year has seen one advancement after another in the cyber capabilities of frontier AI models. Leaders in industry and government alike have proposed, and even implemented, vastly different ideas based on the crisis du jour, from export controls to restricted access. Reaction, though, isn’t a strategy. Instead, I offer three framing questions: what frontier AI governance can be adopted now, rather than perfectly later; which incentives could increase uptake; and where to go next.

In response, I propose seven pragmatic governance features that build on existing interventions. They are intentionally imperfect and offered for rejection or improvement. They rest on a key starting assumption: the technology that creates our best-case scenario for advancing humanity is the same technology that creates our worst-case scenario. We want to enable the cure for cancer without spawning backyard bioterrorism, the unintended wholesale destruction of livelihoods, or a vastly uneven distribution of benefit and harm, while recognizing that some uneven distribution is inevitable.

Neutral Arbiters

Rely on respected neutral arbiters, not a single authoritative arbiter, of good practice. The AI Security Institute, the SANS Institute, the Cloud Security Alliance, and other technology security organizations are providing vital services benchmarking and assessing frontier model capability and risks, and sharing their findings. We should recognize their skill and role in providing neutral analysis and learn from them when identifying the institutions and processes to meet the growing demand for continuous assurance at the leading edge. These bodies have built trust rather than being anointed as authorities and have focused on their area of expertise rather than claim the full assurance field from best practice standards to credentialing a vendor’s operation. Assuming technical competency, an institution will be most authoritative when three conditions hold. First, they are independent from, even if collaborative with, frontier companies and nations, which avoids the perception of self-interest. Second, they are vendor- and country-agnostic in scope, which avoids allegations of bias and exposes vendors or nations not prepared to open themselves to scrutiny. Third, they are transparent in their findings.

Entry Threshold for Oversight

Set a clear entry threshold for governance oversight. Threshold criteria could include the ubiquity or availability of the technology, and the severity or likelihood of harm beyond the supplier or its consenting end user. They could also include features such as anonymity or speed of execution that, unless controlled, may enable harm at scale or prevent individual accountability. To ground what risks becoming an abstract concept, basic indicators could include any harm that exceeds insurable levels, terms and conditions requiring users not to commit war crimes, or loss of individual control of personal information or intellectual property at scale.

Access Criteria

Formalize existing access tiers for consumer, enterprise, research, and national security use. This tiering is commonplace for other high-potential or dual-use capabilities, such as commercial high performance computing or International Traffic in Arms Regulations (ITAR) controlled compute. Normalizing these tiers keeps the most capable tools available for verified purposes or skills while reducing the ability of minors to turn speech into execution, for example. Adaptation is required to provide a special place for early access for defenders. Access control will necessarily slow the potential for harm but not the drive for innovation. It may mitigate fears of unpredictable access to frontier models.

Tech Controls and Accountability

Evaluate models against technical controls that lower the likelihood and severity of harm and enable accountability. Existing security controls, such as zero trust architecture, active monitoring, and mitigating controls, can already be applied. In practice, this could mean three things:

• Separate the agent, its access to inputs, the human decision to execute, and the field of execution. The less skilled the access group is assumed to be, the more important it is to enforce this separation pre-emptively.
• Build the capability to recognize unaligned activity, so the vendor and user can stop it, or a victim can identify and defend against it.
• Make AI tools’ access to inputs and outputs fail closed by default. This responsibility may be shared with software and platform developers.

Authentication should make vendors, models, users, and their decisions and effects readily identifiable and traceable. We should avoid anonymity or human-equivalent role-based access control for AI agents. There is value in default markers of agent activity, so people know what is interacting with them and their systems and can exclude or enable chosen agentic interaction.

Consequences

Design enforcement for a world in which government cannot keep pace. Meaningful enforcement must reflect two realities: government systems and processes cannot keep pace with rapidly changing technology, and they are constrained by the disproportionate cost and effort of pursuing individual cases. One option is strict liability for key failures by a vendor or user. Such failures might include not submitting a tool that meets the threshold criteria for scrutiny, not preventing a pre-defined high-impact or high-likelihood harm scenario, a model’s escape from control, or sale to users outside acceptable access criteria. Other corporate consequences for frontier companies could include loss of priority for independent assessment or stand-down of third-party assurance operations, which would create an incentive to submit for assessment proactively. There is also a place for positive reinforcement of good behavior, through transparency and financial incentives, covered in the final topics.

Transparency

Maintain an expectation of public disclosure. Frontier developers should be expected to publicly disclose training parameters, sources of context, assessments, incidents, and the effectiveness of controls, so that future harm can be prevented. Transparency validates effective governance in four ways. It supports continuous dissemination of good practice and accountability for departures from it. It creates more discerning consumers. It facilitates efficient cross-accreditation between arbiters or test labs. And it allows faster convergence on critical controls and assessment frameworks.

Positive Financial Incentives

Work the other end of the problem by accelerating cybersecurity investment. Existing cybersecurity agencies and non-governmental organizations are equipped to research and publish granular, data-based, good-practice governance. They could, for instance, identify the critical financial metrics of an organization’s cyber resilience, differentiated by sector, such as the proportion and comparative rate of spending on specific resilience controls per capital investment cycle. With further specialist input, a common accounting standard could recognize cybersecurity as its own intangible asset class on the balance sheet, perhaps with a faster rate of depreciation than the asset it protects. This could be paired with accepted methods for valuing technical debt and recognizing it on the balance sheet. Tax rebates or other financial incentives could reward measures that only a particular part of the supply chain is able to provide, such as secure development practices, proactive takedown, and rolling automated patches, in contrast to generic awareness raising. These incentives would target protections that serve the public interest but would otherwise not serve shareholders’ interests, for instance because existing terms and conditions exclude the potential liability for and costs of harm. Combined, these efforts could lead frontier model companies to scale investment in secure models and public-good defense measures at the rate of their models’ success. If feasible, these financial approaches offer general incentives to all organizations to invest in cybersecurity.

Looking Ahead

Govern the consequences of technology, not the technology itself. The next step would be to extend these features to govern the consequences of emerging technology generally, not AI specifically, anticipating the same issues with quantum and other future technologies. Rather than define and govern AI, these features focus on containing the harm, or high likelihood of harm, that may arise from its use. That approach is not unique to AI. Regulating the consequences of emerging technology, rather than specific types of technology, helps offset the slow pace of legislation, because governance can adapt to new technologies as they emerge.

Some or all of these features could be adopted immediately by global, regional, national, or private operators across the cybersecurity and technology ecosystem. Our biggest failure would be to wait for higher authority or consensus to start. I closed the session by asking participants what features would help a governance solution stand out. It should be authoritative enough to be above claims of politicization. It should be workable in a practical and timely manner. And it should be of genuine benefit to participants, so that incentives invest different parties in the governance model. Most of all, I am keen that we all continue to see the upside from these technologies, while better managing their downside.

The views represented herein are those of the author(s) and do not necessarily reflect the views of the Aspen Institute, its programs, staff, volunteers, participants, or its trustees.

Lisa Fong Chief Resilience Officer at DEFEND, a cyber security services firm owned by telecommunications operator One NZ. Lisa headed the New Zealand National Cyber Security Centre from 2016 to 2025 where she established government system leadership for information security, led the national security response to cyber security incidents and lifted engagement across the economy. She delivered numerous award-winning cyber defence capabilities including the Prime Minister’s Award for Malware Free Networks, a partnership with the private sector to detect and disrupt threats before they reach potential victims. With over two decades experience as a senior public servant Lisa is now focused on the potential for private industry to drive cyber resilience at scale. She has an LLM from NYU School of Law and a BA/LLB(Hons).