An AI system can be secure. The data can be intact. Access controls can be correct, governance can be defined, and a human can even click approve at the end. And yet, the decision can still be wrong, manipulated, or impossible to justify. AI therefore opens up a new perspective: Not only must information and systems be protected, but increasingly, so must the decisions that result from them.

We Must Learn to Protect Decisions

For decades, organizations have invested considerable effort in protecting information. Confidentiality, integrity, and availability remain the cornerstones of modern information security. Access is controlled, systems are hardened, vulnerabilities are identified, data flows are monitored, and attacks are simulated. This work remains essential.

Artificial intelligence, however, is bringing about a fundamental shift: Information is increasingly no longer merely stored, transmitted, or presented to humans for evaluation. AI systems interpret information, synthesize it, weigh relationships, generate recommendations, and thereby influence decisions. Agentic systems go one step further. They can invoke tools, interact with external systems, and turn a recommendation directly into action.

This changes the scope of what needs to be protected. It is not only the information itself that must be trustworthy; the decision that results from it also becomes an object of protection and trust.

We refer to this emerging perspective as Decision Security.

Information Has Value. Decisions Create Impact.

Information alone does not change the world. Impact arises through interpretation, recommendation, decision, and action. A doctor evaluates test results. A company selects a supplier. A bank assesses a risk. A Security Operations Center decides whether to block an activity. Management prioritizes investments, personnel, or strategic initiatives.

There is therefore a chain between information and impact. This chain is not new. What is new is how many of its components are increasingly influenced by AI or partially taken over by it. A large language model can interpret information. A retrieval system provides additional context. A specialized model evaluates a situation. An agent derives the next steps. Other systems can execute those steps directly.

This narrows the gap between information and impact. At the same time, it becomes increasingly important to understand how a decision was reached, what information it was based on, which systems influenced it, and who bears responsibility for it.

This is precisely why we see decisions becoming independent objects of trust.

Secure Information Does Not Guarantee Trustworthy Decisions

An organization can successfully ensure the integrity of its data and still make a problematic decision. The data may be correct but incomplete. A model may function correctly from a technical perspective but be used outside its intended context. A recommendation may appear plausible even though relevant counterevidence is missing. An AI system may express uncertainty while a downstream application turns its output into a seemingly definitive statement. And a person may formally approve a recommendation without realistically being able to assess how it was reached.

For us, the following applies:

Secure information and secure systems are necessary prerequisites for trustworthy decisions. But they do not guarantee them.

Decision Security begins precisely at this point. It considers not only the security of individual components, but also the trustworthiness of the entire decision-making process.

This broader perspective can also be found in existing approaches to Trustworthy AI. The NIST Artificial Intelligence Risk Management Framework considers AI risks across design, development, deployment, and evaluation, and explicitly treats their management as a multidisciplinary task. The framework organizes this task around the functions Govern, Map, Measure, and Manage, and treats risk management as a continuous activity throughout the AI lifecycle.

Decision Security Extends Beyond Individual Disciplines

Decision Security is not a new subdiscipline of cybersecurity. Cybersecurity is an important component of it, but it is not the overarching framework.

Cybersecurity addresses questions such as: Can data be manipulated? Is a model vulnerable to attack? Are identities and permissions correct? Can agents or integrations be misused? This perspective is essential, but it is not sufficient on its own.

A decision can be problematic even when no cyberattack has occurred. Perhaps the data set was unsuitable. Perhaps a statistical correlation was misinterpreted. Perhaps human oversight was formally required but ineffective in practice. Perhaps accountability is unclear. Perhaps the process is compliant but still poorly suited to supporting a particular decision.

Decision Security therefore lies at the intersection of cybersecurity, governance, human factors, risk management, data, AI engineering, and assurance.

The common object of protection is the decision.

The OECD AI Principles also take a deliberately broad approach to Trustworthy AI. Among other things, they address human agency and oversight, transparency and explainability, robustness, security and safety, and accountability. Particularly relevant to Decision Security is the emphasis on traceability across data, processes, and decisions throughout the AI lifecycle.

The Actual System Is the Decision Flow

When people talk about AI today, the discussion often focuses on the model. Which model is being used? How large is it? How accurate is it? Is it proprietary or open source? Where is it deployed?

For Decision Security, this perspective is insufficient. What matters is the complete Decision Flow.

Consider a company using an AI-based agent to evaluate potential suppliers. The crucial question is no longer simply: Is the model secure? It becomes: Is the entire decision flow trustworthy?

This includes which data enters the process, how it is interpreted, which models are involved, what uncertainties exist, how humans are involved, who bears responsibility, and what action results from the decision.

Not Every Problematic Decision Requires an Attacker

By its very nature, cybersecurity takes a strongly adversarial perspective: Who could manipulate something, and how?

This perspective remains important. Decision Security, however, expands it to include non-adversarial causes.

A decision can be compromised because data is outdated. Because relevant factors are missing. Because the environment has changed since the original validation. Because an organizational process creates the wrong incentives. Because a person overestimates a system. Or because an output is generated correctly but used in the wrong context.

Decision Security therefore addresses not only deliberate manipulation, but also failures in development, interpretation, and use.

This broadens the scope beyond traditional security.

AI Is Also Changing the Target of Attacks

The offensive perspective remains particularly intriguing. Traditionally, attackers often attempt to compromise information or systems. They want to extract data, execute code, elevate privileges, or gain control over an environment.

In AI-supported decision-making processes, another target is emerging: the decision itself.

An attacker may attempt to manipulate content that is later used as trusted context during retrieval. Prompt injection can alter the behavior of an LLM-based system. Poisoning can influence data or models. Overly broad agent permissions can ultimately allow a manipulated interpretation to result directly in real-world action.

NIST describes such adversarial influences in NIST Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations, NIST AI 100-2 E2025. The taxonomy addresses attacks across different phases of the machine learning lifecycle and includes, among other things, data poisoning, evasion, and other forms of manipulation targeting AI systems.

In addition, the OWASP Top 10 for LLM Applications 2026 examines risks in modern LLM-based applications, including prompt injection, data and model poisoning, vector and embedding weaknesses, and excessive agency.

As a result, an environment can function largely correctly from a technical perspective. Identities are valid, APIs respond, permissions are formally correct, and an agent performs only permitted actions. Nevertheless, the decision may have been successfully influenced.

The Decision Attack Path emerges as an additional attack path.

Human Oversight Is More Than a Person in the Process Diagram

A frequently cited safeguard for AI-based decisions is human in the loop. This sounds convincing, but it is effective only if the human can actually assess the situation and intervene.

To do so, they need context, time, expertise, authority, and transparent information. If an employee approves hundreds of AI recommendations every day, human oversight may exist in name only. In practice, it may amount to little more than automated approval.

For Decision Security, therefore, the decisive question is not whether a human appears somewhere in the process. It is whether effective human control actually exists.

Humans are not the final firewall of an AI system. They are part of the decision-making system.

This distinction is also relevant from a regulatory perspective. Article 14 of the EU AI Act requires effective human oversight mechanisms for high-risk AI systems. Among other things, humans should understand the system’s relevant capabilities and limitations, remain aware of automation bias, interpret outputs, and—depending on the system—be able to intervene, ignore or override outputs, or halt operation.

The AI Act does not define Decision Security. It does, however, clearly demonstrate that human oversight means more than the formal presence of a human in the decision-making process.

Trustworthy AI Inevitably Leads to the Decision

International frameworks and standards point in the same direction, even though they do not define Decision Security as a distinct discipline.

In addition to the NIST AI RMF and the OECD AI Principles, ISO/IEC 42001:2023 takes an organization-wide approach to AI management systems. The standard defines requirements for establishing, implementing, operating, and continuously improving an AI management system and links the responsible use of AI with governance and risk management.

For us, these developments reveal a clear pattern:

AI trustworthiness does not end with the model. It extends into the decision-making process.

The more AI influences real-world decisions, the more important it becomes to ensure that this process is transparent, controllable, and accountable.

Our Working Definition of Decision Security

We currently define Decision Security as:

An organization’s ability to prepare AI-supported decisions transparently, protect the decision-making process against relevant manipulation and failure, make decisions responsibly, and monitor their impact throughout the lifecycle.

This definition deliberately encompasses multiple perspectives. Not just security. Not just governance. Not just AI. Not just people. At its core is the entire decision-making process.

Our work to date has focused on five areas of analysis:

• Decision Flow: How is a decision formed, and what dependencies does it have?
• Data Integrity: What information enters the process, where does it come from, and how trustworthy is it?
• AI Models: Which models influence the decision, and what capabilities, limitations, and uncertainties do they have?
• Human Oversight: Who bears responsibility, and who can actually intervene?
• Decision Governance: How are decisions made traceable, auditable, monitored, and aligned with an organization’s risk appetite?

These areas are not independent of one another. For us, their interrelationships are even more important than considering them in isolation.

From Data Integrity to Decision Integrity

Information security has recognized the importance of data integrity for decades. With AI, the integrity of the decision-making process itself becomes increasingly relevant.

Decision Integrity does not mean that every decision must be correct. Rather, it asks whether the essential prerequisites, information, processing steps, and control mechanisms have remained trustworthy throughout the decision-making process.

What information was used? Which information actually influenced the decision? Which model interpreted it? What uncertainties existed? What recommendation was generated? Who evaluated it? What decision was made? What action resulted from it?

If this chain can no longer be reconstructed later, it creates not only a compliance problem but also a learning problem. An organization can improve a flawed decision only if it understands how that decision came about.

This line of reasoning also has an interesting regulatory dimension. Article 86 of the EU AI Act provides, under certain conditions, a right to an explanation for individual decisions based on the outputs of certain high-risk AI systems. This includes, among other things, the role of the AI system in the decision-making process and the main elements of the decision.

Decision Security Is a Management Issue

Artificial intelligence has long since ceased to be merely a technological issue. What began only a few years ago with organizations asking, Shouldn’t we have an AI project too? is now reshaping processes, responsibilities, and increasingly the allocation of resources. At the very latest, when AI not only supports work but also prepares or influences decisions, it becomes a management responsibility.

A data scientist can validate models. A CISO can assess technical risks. Legal can interpret regulatory requirements. Risk management can evaluate impacts. Management can accept risks. Business units understand the actual decision-making context.

None of these functions alone has the complete picture.

Decision Security is therefore necessarily interdisciplinary.

This makes it challenging, but that is precisely where its value lies. Organizations do not make decisions based on a single model. They make decisions through a sociotechnical system of people, information, models, rules, processes, and technology.

Security Is Only One Part of Trust

An AI system can be secure and still not be trustworthy.

It can be hardened against known attacks and still support inappropriate decisions. It can be compliant and yet be used outside its intended scope. It can demonstrate strong statistical performance and still be unsuitable for a single critical decision.

Trust therefore does not arise from a single characteristic. It arises from evidence, transparent boundaries, accountability, means of control, and an organization’s ability to recognize when it should not trust a system.

The OECD AI Principles likewise do not reduce Trustworthy AI to a single technical characteristic. They address, among other things, human oversight, transparency and explainability, robustness, security and safety, as well as accountability and traceability.

For us, this is one of the most important aspects of Trustworthy AI: not always providing an answer, but knowing when additional evidence, a different process, or a human is required.

Decision Security Is Part of the AI Assurance Methodology

Decision Security does not stand alone. For us, it is part of the AI Assurance Methodology. AI Assurance asks whether sufficient evidence exists to justify trust in a specific use of an AI system under defined conditions.

The Future of Decision-Making Will Be Increasingly Machine-Mediated

Today’s discussion of AI focuses heavily on autonomy. How many decisions will machines make entirely on their own in the future?

We consider another question to be at least as important:

How many human decisions will be influenced by AI in the future, even if a human continues to make the formal decision?

This number will very likely be significantly higher than the number of fully autonomous decisions.

AI will synthesize reports, prioritize risks, evaluate candidates, structure medical information, model financial scenarios, classify security alerts, analyze contracts, and prepare strategic options.

The major change, therefore, is not merely that machines make decisions. It is that more and more human decisions are becoming machine-mediated.

This is precisely where Decision Security becomes important.

A New Perspective

Cybersecurity remains indispensable in this environment. Attackers will manipulate data, target models, abuse agents, and compromise identities. We need robust architectures, red teaming, detection, monitoring, and traditional security engineering. But this perspective is only part of the picture.

Governance establishes accountability. Human oversight brings human judgment to bear. Risk management assesses potential impacts. Data and AI engineering determine quality and technical limits. Assurance provides evidence.

Decision Security brings these perspectives together at the point where information becomes action.

The common object of protection is the decision.

We do not view Decision Security as a replacement for existing disciplines. We see it as the space where these disciplines must come together. After all, trustworthy AI will ultimately not be judged by whether a model produces impressive answers. It will be judged by whether organizations can use AI to make good, transparent, and accountable decisions.

Information has value. Decisions create impact. Both deserve protection.

Conclusion

We must learn to protect decisions.

AI will not wait until we have answered all our questions. It will continue to become more deeply embedded in decision-making processes, generate recommendations, interpret context, and prepare actions. The crucial question, therefore, is no longer whether AI will influence our decisions. It already does.

We should not respond to this with fear of autonomy, but with competence. Anyone who wants to use AI responsibly must understand how decisions are made, what can influence them, where their limits lie, and what evidence is necessary to trust them. A person in the process diagram is just as insufficient as a technically secure model or a neatly formulated governance policy.

Decision Security requires us to look more closely—at data and models, but also at people, processes, dependencies, responsibilities, and impacts. And it requires a willingness to connect these perspectives rather than viewing them in organizational isolation.

This is precisely where an opportunity lies. We do not have to make AI perfect before we can use it effectively. But we must learn to recognize its limitations, make decisions verifiable, and regain control where trust alone is not enough.

This requires more than a new tool or another checklist. It requires technical depth, offensive curiosity, experience with complex systems, an understanding of governance, and, above all, a willingness to continually question supposed certainties. This combination of perspectives has shaped our work and research for many years. Decision Security brings them together at a new juncture.

The next generation of organizations will therefore not be distinguished by whether they use AI. What will distinguish them is whether they understand when they can trust the resulting decisions—and when they cannot.

We should not wait until a wrong decision shows us that a secure system alone is not enough.

We have learned to protect information. Now we must learn to protect decisions.

About the Author

Simon Zumstein has been working in IT since the 1990s as an engineer, project lead, security consultant and CIO. Integral risk management while taking managerial-economic factors and the presentability to decision makers are his area of expertise.

Links

• https://airc.nist.gov/airmf-resources/
• https://csrc.nist.gov/pubs/ai/100/2/e2025/final
• https://eur-lex.europa.eu/eli/reg/2024/1689/oj
• https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/
• https://www.iso.org/standard/42001.html
• https://www.oecd.org/en/topics/ai-principles.html
• https://www.scip.ch/?ai_assurance
• https://www.scip.ch/?labs.20260709