The short answer
In security, a plausible, slightly wrong answer does the most damage and is hardest to notice. An assistant can explain multi-factor or email authentication well, but cannot see your tenant, know which policies apply, test a change or warn you when a control stops working. Failures stay silent until an attacker finds them. Use AI to understand and draft; have live changes reviewed, tested and recorded by someone accountable.
Why security is different from other IT questions
A broken spreadsheet formula shows at once; security failures do not. AI can explain a control; implementing and maintaining controls consistently is the hard part.
Failures are invisible
A misconfigured policy still shows a green tick until it matters.
Changes interact
A new rule can override, exclude or duplicate one the chat cannot see.
Attackers outpace training data
Advice sound when a model was trained may now be incomplete.
Attackers use AI too
More convincing phishing at scale: authentication, filtering, patching and awareness matter more.
Mistakes cost more
Ransomware, email compromise and breaches: recovery costs, downtime, possible reporting duties under Canadian privacy law.
Six ways AI security advice goes wrong
| Failure mode | Example | What it can cost |
|---|---|---|
| Too-broad exclusions | "Exclude this folder from antivirus" to speed up a scan | A permanent blind spot for malware |
| Weakening to fix friction | Disabling a sign-in prompt, legacy protocol block or security default after complaints | Removes a control attackers look for |
| Wrong scope | A one-mailbox script run on all, or a firewall rule opening "any" | Wide exposure from one line |
| Outdated method | Steps for a retired admin centre, protocol or setting | Half-applied change, false confidence |
| Incomplete email authentication | SPF or DMARC missing a sending service, or jumping straight to reject | Lost legitimate email, or spoofing still possible |
| No monitoring step | A control switched on, alerts unchecked | Detection without response |
Each is a reasonable answer missing context the assistant did not have.
The privacy trap
Pasting the real thing (a sign-in log, email header, firewall configuration, flagged users) gets the most precise answer, and puts sensitive data in a public tool.
What Canadian guidance says
- The Canadian Centre for Cyber Security warns that users may "unknowingly provide sensitive corporate data or personally identifiable information" in AI queries (Cyber Centre ITSAP.00.041).
- The Office of the Privacy Commissioner of Canada recommends anonymized or de-identified information in prompts where possible (OPC).
- The same Cyber Centre guidance notes that generative AI helps attackers produce more convincing phishing at scale. Its baseline controls for small and medium organizations include strong authentication, email filtering, patching, staff awareness, an incident response plan, backups, access control and securing outsourced IT services.
Rather talk it through? If you have already changed security settings based on AI advice, or are about to, we can review them against your environment and confirm nothing important was weakened. Talk to a Promatics specialist
How to check security advice before acting
- I can explain in one sentence what this change does and why
- The advice matches the vendor's current official documentation
- I know which existing policies or rules this interacts with
- Scoped to one user, group or address, not "all" or "any"
- No new exclusions, disabled protections or logging turned off
- Tested on a pilot user or group first
- I know how to undo it and recorded the previous setting
- Someone will review the related alerts or reports next week
- No personal information or credentials pasted into the AI tool
Cannot tick most? Stop and get a second opinion.
When to bring in help
AI is a fine companion for awareness: understanding phishing, drafting a password policy, learning what a control is for. Bring in a professional when:
- Identity, email, firewall, endpoint or backup changes
- Alerts, suspicious sign-ins or incidents
- Health, financial or sensitive personal data
- Insurer, auditor or client wants evidence
- Nobody would notice a silent failure
A cybersecurity partner brings what an assistant lacks: your configuration, risks, Canadian privacy obligations and responsibility for the result. A security assessment is the usual first step.
AI tools carry their own risks (confidential data pasted into chatbots, assistants manipulated by hidden instructions): AI governance and security covers policies, discovery of unapproved AI use and security testing.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Generative artificial intelligence (ITSAP.00.041), Canadian Centre for Cyber Security
- Baseline cyber security controls for small and medium organizations, Canadian Centre for Cyber Security
- Principles for responsible, trustworthy and privacy-protective generative AI technologies, Office of the Privacy Commissioner of Canada
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.