Security Magazine featured Sarah Hutchins, Robert Botkin, and Susie Lloyd in a Q&A on how cyber risks can become legal risks. They explained the key legal considerations that organizations should keep in mind when it comes to:

Third-party relationships 
"There are many contractual clauses I look for when representing a business that controls the data but needs to share it with a vendor to perform a necessary business function," Sarah said. "I pay attention to the protections the vendor promises, such as how they secure the data and whether they promise to use it only for performing tasks under the agreement. I especially like to see clauses devoted specifically to data breach response, including when the vendor must disclose the possible incident and who takes financial responsibility for the investigation and notification tasks that may follow."

Artificial intelligence (AI)
"The adoption of generative artificial intelligence (genAI) platforms introduces novel legal risks, many of which are insufficiently addressed by existing regulatory regimes," Robert said. "While AI is increasingly embedded in commercial tools, it is not always transparent how genAI providers will process their users’ data. This opaque environment places the onus squarely on companies and their counsel to anticipate risks and mitigate them through contractual protections and internal governance."

Bring-your-own-device (BYOD) policies
"BYOD policies were once hailed as a cost-effective way to boost productivity, reduce costs, and increase flexibility," Susie said. "But the landscape has shifted. With generative AI (GenAI) entering the workplace, BYOD is no longer just a convenience — it’s a growing liability. Personal devices lack the consistent security controls of corporate-issued hardware. Employees mix work and personal apps, connect to unsecured networks, and often skip critical updates."

Click here to read the full Q&A.

Security Magazine has provided insights on enterprise security issues for more than 50 years. Today it reaches an audience of over 40,000 professionals across a broad range of industries and leadership levels.