As AI becomes embedded in core business operations, CISOs face a class of risks that traditional security models were never designed to handle, said Shivani Arni, Enterprise CISO at Mahindra Group.
Securing a multi-industry conglomerate that spans automotive, farm equipment, IT and financial services means standardizing guardrails without stifling innovation. By building security into business ROI evaluations and adopting unified frameworks such as NIST, organizations can enable safe AI adoption and keep shadow AI in check.
“AI for security and security for AI are both keeping us equally busy,” Arni said. “It’s about how we, along with the business, try to do something that is true value for the enterprise rather than stopping or blocking anything.”
In this video interview with CISONow, Arni also discussed:
- Telling “AI for security” (threat hunting, L1 triage, RCA documentation) apart from “security for AI” (guardrails, prompt injection, model governance);
- Making identity the foundational control for agentic AI and managing inherited permissions;
- Standardizing cyber risk frameworks across business units with distinct risk profiles;
- Governing third-party vendor AI tools, maintaining kill-switch controls and ensuring security has a seat on AI executive committees.
Shivani Arni is Enterprise Chief Information Security Officer at Mahindra Group, where she oversees cybersecurity strategy, risk governance and digital defense architecture across the conglomerate’s global businesses. With extensive leadership experience in enterprise risk management, she works with executive boards and business units to drive secure digital transformation and resilient AI adoption.
