@mj1602 wrote:I want to open up discussion on how security community is taking it up. Are we good to accept the risks over the benefits or shall this be banned for enterprise consumption.
It really depends on how it's being used. As a broad statement, I'd say the challenge with ChatGPT is that it may be cost-prohibitive to use it to replace employees for critical business functions. However, to use it as a tool supporting people in those business functions, it may prove very useful. Really, this is the discussion that began 30 years ago with spell check. It can help people do their jobs, but if you rely on it unconditionally, you're going to end up with unintended, embarrassing, and maybe even dangerous results.
AI is about being able to synthesize conclusions or connections. It's about inference. In terms of risk assessment, given the uncertainty around loss expectancy and frequency, in many cases, you can't adequately accept the risk, and I can't imagine a transference option. You're left with mitigation. The only way to reduce the risk associated with AI doing someone's job is to have someone who knows the job well enough and who can intervene if it goes wrong. In many cases, that becomes cost prohibitive. Where it is manageable is when the AI isn't used for a critical function (e.g., supports employees but doesn't replace them) or in limited cases where loss expectancy is quantifiable, mostly because the business function has rather limited value (AI is fine for selecting songs to listen to, but don't put in charge of regulating water in the nuclear reactor).
