AI is upending file security. Here’s how to fight back

With cybercriminals adopting artificial intelligence to create more effective attacks, organizations are finding that the traditional methods of file protection such as antivirus scanning, phishing controls, and sandboxes are no longer adequate.

Another complication is that AI demands file sharing that is easy, frictionless, and largely unmonitored — and file-sharing tools are in sore need of better security controls.

Completing the AI trifecta: AI coding is invading software development in most organizations. 

Here’s why you need to modernize your file security to keep up with AI’s rise.

See webinar: AI Redefines Software Risk: Develop a New Playbook

How AI coding and gen AI create new challenges

The use of AI in development and other business workflows is threatening file security and raising a broad range of security issues for IT leaders, said Stuart Phillips, technical marketing manager at ReversingLabs (RL).

In a good shop, you would say, ‘I want you to build this agent, but I want to build [security] guidelines in. Using this agent, [users] should not be able to see anybody else’s information. They should not be able to query private information within the organization or be allowed to go out to the internet and do something with it.

Stuart Phillips

But this is not always how it works these days, he said. For many companies, the lure of generative AI is that projects can be completed very quickly, he said, and taking the time to ensure that things are being done securely might erase those speed gains. 

The shift to AI removes a lot of the safeguards employed with traditional, human-centered development. 

[AI agents] want to get into production. And there are significant flaws and a large number of agents where they allow people to exploit weaknesses.

Stuart Phillips

How files — and file security — have changed

Paul Nashawaty, principal analyst for application development (AppDev) and modernization at theCUBE Research, noted AI’s effect on file sharing, which has quietly become one of AI’s biggest risk amplifiers. 

The volume and velocity of files today have exploded because every team, especially developers, is feeding data into models, exporting test outputs, sharing artifacts, and moving information across more tools than ever. … Files are no longer just documents; they’re part of the AI supply chain. That means their value to attackers increases dramatically, and the opportunity for mistakes or malicious insertion goes up with it.

Paul Nashawaty

Nashawaty said the challenge is that traditional file security such as sandboxes, legacy data leak prevention (DLP), and signature-based antivirus all break down when malware is polymorphic. Sandboxes are generating too many false positives, DLP rules don’t understand the business context of files, and developers are forced to work around tools that can’t keep up.

[Attackers] are using AI to tailor payloads, [and] files move through dozens of cloud services, many of which security teams don’t even know are in use.

Paul Nashawaty

At the same time, file transfer has become commoditized, making securing files harder than ever, Nashawaty explained.

When file sharing becomes a commodity [with] Slack uploads, GitHub artifacts, Google Drive links, CI pipelines, and one-click share buttons, you lose centralized control, and the attack surface expands faster than security controls can catch up.

Paul Nashawaty

How you can fight back 

Nashawaty said security teams must adopt the same multilayered, context-aware approach that modern AppDev and AI teams use.

We see the leaders shifting from ‘Protect the perimeter’ to ‘Understand the file and its intent.’ They’re moving to automated classification, contextual DLP that adapts to user behavior, modern behavioral sandboxes, and integrated endpoint/cloud detection that tracks files whether they’re in local drives or shared across SaaS apps.

Paul Nashawaty

In addition, companies need layered defenses that follow the file wherever it goes, he said. They must treat files the same way they treat their APIs or data pipelines, said Nashawaty. “Because in the AI era, files are data pipelines. They’re inputs to models, sources of truth for decisions, and carriers of the company’s most sensitive logic” he said.

How modern file security can battle AI-fueled attacks

RL’s Phillips said that in addition to those measures, other critical steps include writing new file security policies with AI realities in mind. 

You should have a policy related to the use of files and the sources of files. [When] developers are pulling files in from open-source repositories or the internet, very often those files are not subject to standard or traditional security measures.

Stuart Phillips

When there are holes in file security policies, critical problems and vulnerabilities can arise, and any resulting file security lapses can lead to damaging attacks, Phillips said.

Writing effective use policies is challenging but essential, Phillips said. “In no way am I implying that this is easy. The easiest thing to do in an organization is saying that their systems are good enough.”

Phillips said key requirements for modernizing file security include bringing in more powerful multilayered tools to monitor systems more quickly and effectively. They include:

• System automation
• Binary analysis (versus source-code analysis)
• Modern endpoint detection
• Comprehensive threat intelligence 

And the tools must be easy to use, so that teams don’t ignore them. “The idea is to be able to automate most of this,” Phillips said.

File threats require new controls

Chirag Mehta, principal cybersecurity analyst at Constellation Research, said the immense power and potential security threats unleashed by AI mean enterprises can no longer trust traditional methods when it comes to file security.

AI doesn’t just find vulnerabilities; it invents them faster than humans can patch. The key is to make file security ambient. It should operate everywhere that files move, not just at upload or download points.

Chirag Mehta

Enterprises must integrate scanning, content disarm and reconstruction (CDR), and DLP into every sharing workflow, including email, chat, storage, and APIs. “That means embedding controls into collaboration and developer tools rather than relying on separate gates,” Mehta said.

Such dramatic changes in file security methods are required because AI accelerates both attack speed and deception, said Mehta. “It enables weaponized content such as malicious macros, poisoned prompts, and deepfaked documents, which can slip through conventional filters,” he said.

Organizations need stronger oversight of AI data flows, including access governance and human review checkpoints, along with strict policies on data classification and model interaction, Mehta said.

Essentially, AI makes file security essential because it blurs the line between legitimate and malicious content, making it more difficult for IT security teams to detect the latter, said Mehta. 

Attackers can auto-generate polymorphic payloads or subtly alter file structures to evade detection. Even more, AI tools inside organizations can unintentionally exfiltrate sensitive data through poorly governed prompts or integrations.

Chirag Mehta

To fight back, he said, enterprises must assume that every shared file could be weaponized. “Users should treat AI-assisted documents or external uploads with scrutiny, verify origins, and never upload sensitive data to public AI tools or unvetted storage platforms,” Mehta cautioned. 

Tackling file security in the AI age requires moving from reactive scanning to proactive governance, Mehta said. “Define approved sharing channels, automate file inspection at every hop, and integrate audit trails into storage APIs. Pair that with continuous education so employees recognize the role they play in safeguarding data,” he said.

“File sharing has become frictionless, and that’s exactly why it’s dangerous,” said Mehta. “Commoditization breeds complacency. When sharing is frictionless, governance often gets sacrificed for convenience.”

File transfer tools have become utilities, but without consistent scanning, expiration, and encryption policies, they present fragmented risk surfaces. 

When files move faster than policies, risk moves faster than security.

Chirag Mehta

Your file security must evolve

Despite the many challenges, enterprises and their IT leaders need not be discouraged, Mehta said.

Being careful now means automating trust, not slowing work. Layered defense is no longer optional; it’s the new baseline for digital resilience. Every file should be scanned, logged, and governed as if it holds the company’s reputation.

Chirag Mehta

File security technologies are moving smartly and quickly since the old days of single defenses that were designed for static threats, Mehta said. Today’s file risks span endpoints, clouds, insiders, and AI-driven deception, he said. “Multilayered detection — file reconstruction, behavioral analytics, and sandboxing — provides depth against blended and polymorphic attacks,” he said. 

New controls should look like guardrails, not gates — enforcing least-privilege rules, validating content, and detecting anomalies without hindering collaboration, Mehta said.

Modern file security calls for unified platforms where encryption, malware detection, DLP, and access controls work together. Fragmented tools invite gaps, while consolidation ensures consistency across endpoints, clouds, and SaaS systems.

Chirag Mehta