Artificial Intelligence in business: creating value without exposing the company to risk

Article by: Giuliana Barba and Marianna Lezzi, both PhDs from Università del Salento.

Generative Artificial Intelligence (GenAI) refers to a set of advanced Artificial Intelligence (AI) models trained on enormous amounts of data and capable of generating new content, such as text, images and code. For example, Large Language Models (LLMs) are GenAI models capable of understanding and producing natural language with a high degree of coherence and contextualization (Barba et al., 2025). Other examples of GenAI models include Generative Adversarial Networks (GANs), based on a competitive mechanism between two neural networks — a generator and a discriminator — that makes it possible to produce highly realistic synthetic data (Ayyaz & Malik, 2024). Although these models differ in structure and purpose, they share the ability to learn complex representations of data and generate plausible outputs.

The adoption of GenAI in industrial contexts represents a structural transformation for privacy management and information security systems, enabling automatic anomaly detection, synthetic data generation and attack-scenario simulation. In this sense, GenAI is a sociotechnical technology capable of simultaneously redefining defensive capabilities and risk surfaces, understood respectively as the set of functions that strengthen prevention, detection and response to threats, and as the expansion of vulnerability points — both technical and socio-organizational — resulting from its integration into information systems and decision-making processes (Storey et al., 2025).

However, GenAI also presents significant risks, particularly in critical industrial sectors such as healthcare and defence (Nyoto & Devega, 2024). For example, GenAI models can be used to amplify social engineering attacks such as spear phishing and deepfakes, endangering organizations’ reputation and operational continuity and facilitating broader attacks such as information theft. Significant data-governance issues also emerge. Empirical evidence shows that uncontrolled usage practices contribute to increasing risk (Diro et al., 2025): 62% of employees enter sensitive information into GenAI systems, 48% share non-public data and 45% disclose employee-related data, with significant consequences such as the exposure of proprietary code and confidential notes.

Opportunities of GenAI

The literature shows that GenAI can make a significant contribution to strengthening protection mechanisms. In particular, generative models such as LLMs can be used for automatic anomaly detection, making it possible to identify suspicious behaviour within complex systems (Ferrag et al., 2024). Similarly, models such as GANs can dynamically model normal and anomalous patterns, improving the effectiveness of intrusion-detection systems in industrial cyber-physical environments (Amato et al., 2024). This is particularly relevant in Industrial Internet of Things (IIoT) environments, where security management requires real-time, large-scale analytical capabilities.

A central contribution of GenAI to privacy protection is the generation of synthetic data. The “privacy-by-synthesis” paradigm makes it possible to create artificial datasets that preserve the statistical properties of real data without exposing sensitive information, overcoming regulatory and operational constraints associated with data sharing and promoting collaboration among industrial actors (Partovian et al., 2024). In addition, integration with federated learning — a distributed-learning approach in which models are trained locally on data held by individual actors without the need to share them centrally — makes it possible to keep data at its original sources, further reducing breach risks and improving compliance with data-protection regulations (Hoefler et al., 2024).

Another relevant element is the integration of GenAI with blockchain technologies, which strengthens the security and integrity of industrial information through immutable distributed ledgers and traceability mechanisms. This integration supports decentralized governance models in which synthetic-data generation and analysis processes can be verified without compromising privacy (Ghani et al., 2024). A significant example can be found in healthcare, where GenAI is used to generate synthetic clinical data for research and the training of diagnostic models, avoiding direct exposure of sensitive patient data while maintaining high standards of security and regulatory compliance.

A further area of application for GenAI concerns the advanced simulation of realistic attack scenarios, enabling organizations to test the resilience of their systems. For example, GAN-based active-defence systems capable of generating deceptive environments can significantly reduce the success rate of attacks and increase the time required to compromise a system (Qin et al., 2024). These results demonstrate how GenAI can support a proactive approach to security, strengthening risk-management and business-continuity capabilities.

Risks of GenAI

Alongside the opportunities associated with GenAI, the literature also emphasizes the risks introduced by this technology. One area concerns the offensive use of GenAI. Generative models can be used to develop highly personalized spear-phishing attacks (Yamin et al., 2021) and to automatically generate malicious code (Gupta et al., 2023). Deepfakes represent a further risk because they enable the creation of extremely realistic content capable of undermining trust and information security (Vijaya et al., 2023). The vulnerability of systems to model inversion and inference attacks, through which private data can be reconstructed from trained models, is another critical issue (Hu et al., 2024).

Other concerns relate to the management of training data, which may be incomplete, unvalidated or biased. These issues have significant implications because they can undermine model reliability, generate distorted and discriminatory decisions and introduce vulnerabilities that malicious actors can exploit, for example through data poisoning attacks or manipulation of training data (Barba et al., 2024).

At the organizational level, improper employee use of GenAI represents a significant source of risk. In the Samsung case, for example, entering confidential information into GenAI systems led to the disclosure of proprietary code and internal notes, demonstrating the concrete risk of information leakage (Diro et al., 2025). This shows that security does not depend exclusively on technological solutions, but also requires appropriate organizational practices, usage policies and user training.

Finally, significant governance and regulatory issues emerge from the inadequacy of current regulatory models in addressing matters such as liability, copyright and data protection (Taeihagh, 2025). In addition, the limited transparency of models, often perceived as “black boxes”, restricts the ability to guarantee accountability and control over automated decision-making processes (Abumalloh et al., 2024). There is also the risk of technological power becoming concentrated in the hands of a small number of global actors, with significant implications for security, competition and data sovereignty (Srivastava et al., 2025).

Operational guidelines

An integrated reading of the opportunities and risks associated with GenAI suggests that its adoption in industrial contexts should be guided by a logic of conscious and progressive integration. For managers, the key issue is not whether to adopt these technologies, but rather how to do so strategically, balancing operational benefits with risk implications. The literature shows that GenAI can generate significant advantages in terms of efficiency, cost reduction and advanced analytical capabilities, but these benefits are fully realized only when supported by adequate organizational and governance capabilities.

From this perspective, a first operational recommendation is to avoid imitative approaches or decisions driven exclusively by competitive pressure. GenAI adoption should be preceded by a structured analysis of trade-offs that considers both expected economic returns and hidden costs related to security, data management, regulatory compliance and technological dependence (Fischer, 2024). Digital-transformation processes require a continuous reallocation of resources and skills; without this capacity, technology adoption risks generating inefficiencies or vulnerabilities rather than value (Vial, 2019). There is also a strong need to adopt a systemic perspective in managing GenAI. Decisions concerning the implementation of these technologies must include the protection of stakeholders, such as employees, customers and partners. This involves adopting “security-by-design” and “privacy-by-design” practices, as well as defining clear organizational policies for the use of GenAI in order to prevent risky behaviour such as the unintended sharing of sensitive data (Abdel-Basset et al., 2023).

Furthermore, in a context characterized by a strong concentration of power in the hands of a few major technology players, managers should carefully assess the opportunity to integrate open-source solutions or hybrid models that allow greater control over data, transparency and flexibility. The use of open ecosystems can reduce the risk of technological lock-in and encourage the development of internal capabilities, while also contributing to a more equitable distribution of the value generated by innovation (Bagdasarian, 2020).

The introduction of GenAI also profoundly changes professional requirements, making systematic training and continuous upskilling necessary. The risk of a skills gap is real and may translate into new forms of organizational and social inequality. Investing in training therefore becomes a strategic lever for enhancing human capital and ensuring effective and responsible use of technologies (Mahmoud et al., 2025).

Finally, it is important to reflect on the pace at which transformative technologies are adopted. Although competitive pressure encourages rapid GenAI implementation, the literature suggests that uncontrolled acceleration may lead to forms of “destructive competitiveness”, in which innovation generates systemic risks greater than its benefits (Mäkitie et al., 2023). In addition, the absence of adequate regulatory and governance mechanisms can amplify disparities among companies, with repercussions for civil society, and undermine trust in digital systems (Taeihagh, 2025).

Conclusion

The transformative potential of GenAI in less explored but strategically important areas, such as synthetic-data generation, federated learning and integration with distributed technologies, enables new models for data protection and management. However, this very evolution highlights a structural paradox: the same technologies that strengthen defensive capabilities simultaneously broaden and increase the sophistication of risk surfaces. The ability to simulate attacks, generate realistic data or automate complex processes not only improves system resilience, but also provides new opportunities for malicious actors, making the threat landscape more dynamic and difficult to govern.

Within this scenario, the growing focus on so-called responsible AI represents an important but insufficient step. Ethical models and governance frameworks risk remaining formal or declarative if they are not accompanied by an effective transformation of organizational practices. GenAI ethics cannot be reduced to a set of guidelines; it must be integrated into decision-making processes, individual behaviour and corporate culture. Without such integration, there is a concrete risk that responsibility will be reduced to superficial compliance, unable to influence the real dynamics of technology use.

In conclusion, GenAI stands out as one of the most disruptive and pervasive technologies of the current digital transformation. Precisely because of its nature, it should be interpreted as an opportunity to question and correct the structural weaknesses of existing governance and security systems. Risk mitigation is possible, but it first requires explicit recognition of vulnerabilities and the willingness to translate that awareness into concrete action.