The short answer
Following AI-generated security advice is risky because security is the area where a plausible, slightly wrong answer does the most damage and is the hardest to notice. An assistant can explain multi-factor authentication or email authentication very well. What it cannot do is see your tenant, confirm which policies already apply, test that a change did what it should, or warn you when a control stops working next month. Security failures are usually silent until an attacker finds them. So the safe approach is to use AI for understanding and drafting, and to have any change to live security controls reviewed, tested and recorded by someone accountable.
Why security is different from other IT questions
If an AI suggestion breaks a spreadsheet formula, you see it immediately. Security is not like that:
- Failures are invisible. A misconfigured policy still shows a green tick. You find out when it matters.
- Changes interact. A new rule can override, exclude or duplicate an existing one in ways a chat window cannot see.
- Attackers adapt faster than training data. Advice that was sound when a model was trained may be incomplete now.
- The cost of being wrong is high. Ransomware, business email compromise and data breaches carry recovery costs, downtime and, under the Nigeria Data Protection Act 2023, possible notification of the NDPC within 72 hours.
Six ways AI security advice goes wrong
| Failure mode | Example | What it can cost |
|---|---|---|
| Exclusions that are too broad | "Add this folder to your antivirus exclusions" to stop a slow scan | A permanent blind spot where malware can sit |
| Weakening to fix friction | Disabling a sign-in prompt, legacy protocol block or security default to stop user complaints | Removes a control attackers look for |
| Wrong scope | A script meant for one mailbox applied to all, or a firewall rule opening "any" instead of one address | Wide exposure from one line |
| Outdated method | Instructions for a retired admin centre, protocol or setting | Half-applied change, false confidence |
| Incomplete email authentication | An SPF or DMARC record that omits a sending service, or jumps straight to a reject policy | Lost legitimate email, or spoofing still possible |
| No monitoring step | A control is switched on, but nobody checks alerts | Detection without response |
None of these requires the AI to be absurd. Each is a reasonable-sounding answer missing context the assistant did not have.
The privacy trap
The fastest way to get a precise answer is to paste the real thing: a sign-in log, an email header, a firewall configuration, a list of flagged users. That is also how sensitive data ends up in a public tool. Public AI tools may store or process what you type, so users can unknowingly hand over sensitive corporate data or personal data in a query. Most are hosted outside Nigeria, which can also bring the Nigeria Data Protection Act 2023's rules on transfers outside Nigeria into play (NDPC). Anonymised or de-identified information is the safer habit.
Before pasting anything, remove names, email addresses, phone numbers, IP addresses, account identifiers and, above all, passwords, keys and tokens. If you cannot redact it, do not paste it.
Attackers use AI too
Generative AI also helps attackers produce more convincing phishing at scale, in fluent English and increasingly in local languages and styles. That raises the bar for your own controls: strong authentication, email filtering, patching and staff awareness matter more, not less. These sit at the core of established frameworks such as NIST's Cybersecurity Framework, alongside an incident response plan, backups, access control and securing outsourced IT services. An AI assistant can explain each control; implementing and maintaining them consistently is the harder part.
Rather talk it through? If you have already changed security settings based on AI advice, or are about to, we can review them against your environment and confirm nothing important was weakened. Talk to a Promatics specialist
How to check security advice before acting
- I can explain in one sentence what this change does and why
- The advice matches the vendor's current official documentation
- I know which existing policies or rules this interacts with
- The change is scoped to what I intend (one user, one group, one address), not "all" or "any"
- It does not add exclusions, disable protections or turn off logging
- I have tested it on a pilot user or group first
- I know how to undo it, and I have recorded the previous setting
- Someone will review the related alerts or reports next week
- No personal data or credentials were pasted into the AI tool
If you cannot tick most of these, stop and get a second opinion.
When to bring in help
AI is a fine companion for security awareness: understanding phishing, drafting a password policy, learning what a control is for. Bring in a professional when:
- the change affects identity, email, firewalls, endpoint protection or backups;
- you are responding to an alert, suspicious sign-in or suspected incident;
- you handle health, financial or other sensitive personal data;
- a cyber insurer, auditor, regulator or client is asking you to evidence controls;
- nobody on your team would notice if a control silently stopped working.
A cybersecurity partner brings the context an assistant lacks: your configuration, your risks, your obligations under Nigerian data protection law, and responsibility for the result. If you want to know where you stand today, a security assessment is the usual first step.
AI tools bring security risks of their own, from staff pasting confidential data into chatbots to assistants that can be manipulated by hidden instructions. Our AI governance and security service covers policies, discovery of unapproved AI use and security testing of AI applications.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Cybersecurity Framework, National Institute of Standards and Technology
- Nigeria Data Protection Act 2023 and guidance on personal data, Nigeria Data Protection Commission
- Nigeria's computer emergency response team (ngCERT), Nigerian Communications Commission, ngCERT
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.