There is a version of a security, risk or audit function that responds to AI by slowing it down: a long questionnaire, a standing prohibition, a policy saying employees may not use these tools. It feels responsible. It is, in almost every case, the higher-risk choice.

It produces unmonitored use. People paste customer data into consumer chatbots on personal devices, outside your logging, DLP, contracts and incident response. The organisation gets all the exposure and none of the controls, and you find out during the incident. A sanctioned tool with logging, a data-processing agreement and an acceptable-use policy is safer than a ban, by a wide margin.

• Publish the paved road. A named, approved way to use AI — this tool, this data classification, these use cases, this is how you get an exception. Teams overwhelmingly take the paved road when one exists; their goal was never to evade you, it was to ship.
• Tier your scrutiny. Spending equal effort on a notes summariser and a credit decision is how the queue becomes the bottleneck and the business routes around you.
• Answer in days. A two-week turnaround is functionally a prohibition for a team on a sprint. Speed is a security control, because it determines whether people come to you at all.
• Bring the mitigation, not just the risk. “This is a prompt-injection exposure” ends a conversation. “Scope the tool to read-only and put approval on send, and I can sign this off today” ships a product safely.
• Say what you are not worried about. Explicitly clearing five of seven concerns is what earns you the two that matter.

The data says something specific about your career. AI appears in 92% of security postings, and the practice to govern it in 9%. That gap will close over the next few years as the discipline matures. The people who close it are those who learned this material while it was still unusual.

You do not need to become a machine learning engineer. You need the seven chapters of Part I, the four genuinely-new risks in chapter 9, and the evidence set in chapter 12. That is a few weekends — on current numbers, some of the highest-return weekends available in this profession.