ProcuRAG

Swedish public organizations have well-established processes for risk and vulnerability analyses when procuring software and applications, yet open access to applications categorized as enterprise social networking or online collaboration tools poses security risks. Security managers in those organizations are concerned about employees downloading without prior basic risk and vulnerability assessments. This behavior is attributed to employees’ lack of security knowledge rather than malicious intent. In response to this concern, the idea of supporting inexperienced employees was formulated as “better than nothing.” To investigate the idea, this pre-study examines whether an artificial intelligence (AI) assistant, in the form of a prototype called ProcuRAG, would fill the “nothing gap” by helping inexperienced employees apply a simple risk assessment through AI-generated summaries of extensive service-level agreement texts. The study uses an inductive approach, collecting qualitative data by having respondents, e.g., security managers and CISOs, discuss practice in relation to the prototype. Understanding respondents’ perceptions of the support an AI assistant would provide is central to the study, rather than the prototype’s technical features. The study suggests that an AI assistant like ProcuRAG can help raise security behavior, particularly by guiding users on the types of questions they need to answer. However, the study also indicates that an AI assistant could bypass the formal, established process, potentially reducing the organization’s control over which software or applications are downloaded and used.