ISJ hears exclusively from Aare Reintam, Chief Operating Officer, CybExer about organisations reliance on AI technology.
Organisations are increasingly giving AI access to data, applications, APIs and identities and allowing it to act inside business and operational systems before they have seen how it behaves under the conditions in which they will rely on it.
An agent can behave impeccably on a quiet Tuesday but become a very different risk on a bad day when its data is manipulated, a critical service fails or an attacker starts exploiting the access it has been given.
Organisations deploy AI because they expect it to improve something.
The question is not simply how capable the model is, but whether the resulting system improves the process it was introduced to improve while staying within the role it was given.
AI changes the playing field.
Traditional benchmarks evaluate how a model performs against a set of predefined tasks, but operational environments are much messier.
Once AI is connected to infrastructure, data, tools and identities, a benchmark cannot tell us everything about how the resulting system will behave.
An agent with credentials and tool access may encounter manipulated data, conflicting instructions or unavailable services.
It may also find ways to be helpful that nobody specified.
Testing therefore needs to take place in controlled, monitored and repeatable conditions where behaviour can be observed rather than assumed.
Does the agent stay within its authority? Does it stop when human approval is required? What happens when an input can no longer be trusted?
Policy and regulatory movement in Europe
Earlier this summer, the European Union Agency for Cybersecurity (ENISA) published its view on cybersecurity in the frontier AI era.
This includes analysis of what the rapid development and deployment of frontier AI models means in practice for policymakers, defenders, manufacturers, service providers and national authorities.
That combination matters because it pushes evaluation closer to the way security problems unfold in practice: across connected systems, interacting weaknesses and controls, rather than in isolation.
The EU AI Act sets a different kind of direction.
Obligations for providers of general-purpose AI models have applied since August 2025, with additional risk-management and cybersecurity requirements for models with systemic risk.
Since the 2nd August 2026, the European Commission has been able to enforce those obligations.
But these are obligations on model providers.
They cannot answer the question sitting on an organisation’s desk: whether this particular AI-enabled system, connected to these processes, permissions and dependencies, can be relied upon in practice.
Finding the weakness is only the beginning
Finding a vulnerability is not the same as understanding whether it matters.
That is the chain testing needs to follow: from AI behaviour and weakness, through exploitability and controls, to operational consequence.
The same principle applies when AI becomes part of the defence.
Organisations are increasingly using AI for detection, triage and security analysis.
A capability may perform well against a static benchmark and behave very differently when an adversary actively adapts to it.
In defence and cybersecurity in particular, controlled, realistic environments have long been used to test critical capabilities before they are relied upon operationally.
As AI becomes part of both the systems being defended and the defence itself, that principle needs to extend to AI.
Evidence before reliance
Organisations need to be able to connect AI behaviour to exploitability, controls and operational consequence, giving them a basis for deciding whether and under what conditions, to rely on an AI-enabled system.
However, those findings also have a shelf life as models and infrastructure change, agents gain new tools and permissions and attackers adapt.
The goal is not to prove that an AI system is trustworthy once and for all.
It is to understand how it behaves as the system, its permissions and the threats around it change.
Organisations need to understand not only how AI performs, but what happens when it fails, is manipulated or meets conditions it was not designed for.
Crucially, this is what they need to know before deciding whether they can rely on it.
Aare Reintam is the Chief Operating Officer of CybExer. Prior to joining CybExer in 2018, Aare worked as the Cyber Defence Exercise Manager of the NATO Cooperative Cyber Defence Centre of Excellence. While there he planned, executed, and oversaw several iterations of world-leading cyber defence exercises (Locked Shields, Crossed Swords, and other NATO organised exercises) between 2014-2018. Prior to that, he held several key roles within the Estonian National Cyber Security Agency, including as the Head of Department for National Information Security. Aare has received The Order of the White Star from Estonian President Alar Karis for outstanding efforts in strengthening the cyber defense capabilities of Ukraine.