AI in Engineering: Driving Innovation Without Compromising Cybersecurity

Executive Summary

Artificial intelligence is rapidly becoming a standard engineering tool, much like version control, automated testing, and continuous integration. At IMT, we use AI to help engineers find information, understand complex systems, prepare documentation, explore design alternatives, and reduce repetitive work. This allows our specialists to spend more time on the engineering decisions that require experience, creativity, and sound judgement. This gives our customer the advantage of shorter time-to-market, lower development costs and more concise documentation.

The value of AI, however, comes with new responsibilities. Engineering organizations work with confidential data like source code, product designs, customer requirements, risk analyses, customer intellectual property, which that cannot simply be submitted to an arbitrary online service. Additionally, AI-generated answers can also be incomplete or wrong, even when they appear convincing. New AI tools may receive excessive access to company systems and data, while unapproved applications and plugins used by developers can create security gaps outside the organization’s visibility.

The relevant question is therefore no longer whether employees should be allowed to use AI. The more useful question is:

At IMT, we addressed this question by combining accessible AI services with clear governance, controlled access, human review, and technical safeguards into an internal AI Platform that can be used for all our customer projects and also for IMT internal workflows. In this way, all our 100+ employes can rely on robust and secure AI support which also benefits our customers.

AI assists our engineers, but it does not replace their responsibility. Sensitive information is handled according to its classification and is only processed by on-premise AI models on our own hardware. All used models and tools must pass our internal approval. Permissions are limited to what an application needs, and important engineering decisions remain with qualified people.

This approach allows us to benefit from AI while protecting intellectual property, customer information, highest quality standards and trust.

Why AI Has Become an Essential Engineering Tool

Imagine a software engineer beginning work on an unfamiliar component. Before solving the actual problem, the engineer may spend several hours searching through documentation, reading existing code, comparing previous implementations, and preparing routine test structures. Much of this work is necessary, but it does not always make the best use of the engineer’s expertise.

AI can shorten this preparation. It can summarize a module, explain how different components interact, identify relevant documentation, or produce a first solution draft. The engineer can then concentrate on whether the proposed solution is behaving as intended, secure, maintainable, and suitable for the product.

This is the central reason we use AI at IMT. We do not see it as a replacement for engineers. We see it as an assistant that reduces friction around engineering work.

The Shift from Automation to Engineering Assistance

Traditional automation is deterministic. A tool follows a predefined sequence and produces an expected result. AI works differently. It can interpret a question, consider a large amount of information, and propose an answer even when the task has not been described as a fixed process.

That makes AI useful in areas that were previously difficult to automate. It can help an engineer understand an unfamiliar codebase, compare requirements, challenge assumptions, or begin a threat analysis. It is particularly valuable when the main obstacle is not executing a known procedure, but finding, structuring, or interpreting information.

At the same time, this flexibility is the reason AI needs careful oversight. An AI-generated proposal is not automatically correct simply because it is presented fluently. Its output must be treated as a starting point for professional review.

Benefits We Have Observed

The most important improvements are not limited to faster text or code generation. AI reduces the time needed to locate and understand information. It can support the onboarding of new team members, make existing knowledge easier to access, and help engineers move between unfamiliar topics with less disruption.

It also improves the starting point for many engineering activities. A first draft, a list of questions, or a proposed set of tests gives a team something concrete to review. This often leads to more focused discussions and more complete results.

AI can also reduce context switching. Instead of moving between many tools, documents, and search results, an engineer can use an approved assistant to bring relevant information together. The saved time can be invested in design decisions, risk analysis, testing, and problem-solving.

The principle behind all these applications is straightforward:

The engineer remains accountable for the result, and it is the engineer’s skill that determines the quality, innovation and ingenuity of the outcome.

Cybersecurity Must Evolve with AI Adoption

Every useful technology introduces new forms of risk. AI is no exception to this rule. What makes the current transition unusual is the combination of access, autonomy, and speed.

AI systems are increasingly moving beyond isolated chat applications. They may have access to large parts of an organization's information landscape: source-code repositories, documentation platforms, issue trackers, internal databases, and cloud services. Through plugins, APIs, and agentic interfaces, they may also be able to act on this information rather than merely read it. A security failure in such a system can therefore have a considerably larger blast radius than a wrong answer in a chatbot.

The risks are not limited to what happens inside the organization. The same technology is available to attackers. AI can accelerate reconnaissance, social engineering, vulnerability analysis, and the adaptation of attacks. Defenders are therefore dealing with both a new class of systems that must be secured and adversaries whose capabilities are evolving at the same time.

At the same time, the technology itself is developing at extraordinary speed. New models, tools, integrations, and attack techniques appear continuously. Organizations cannot rely on security processes designed around technologies that change only every few years. They need mechanisms that allow them to evaluate new capabilities, make informed decisions, and react to emerging risks quickly.

This does not mean that banning AI is an effective long-term response. Employees who already experience the benefits of AI will look for ways to use it. If the organization provides no practical solution, this use may take place through personal accounts and tools that the company cannot govern.

Security must therefore enable responsible use rather than attempt to stop adoption. The goal is to make the approved path safer, easier, and more useful than the uncontrolled alternatives.

The following section examines five major cybersecurity risks introduced or amplified by AI and how we have addressed them at IMT.

The action takes only a few seconds, but the information has now left the organization’s controlled environment. Depending on the service, its configuration, and the applicable agreements, the company may have limited control over where the data is processed, how long it is retained, and who can access it.

The risk is not limited to highly visible secrets. A small code fragment can reveal intellectual property. A requirement can contain confidential customer information. A log file may include personal data, system addresses, or access credentials. Even a seemingly harmless question can disclose important details when combined with other information.

This can lead to a breach of contractual obligations, customer confidentiality, intellectual-property protection, or regulatory requirements.

IMT Solution

At IMT, we address this risk through controlled access to approved AI services. A central AI platform provides access to models that have been assessed for professional use. Data classification combined with strict AI governance determines which information may be processed by which type of model. Depending on the sensitivity of the task, engineers can use local models, controlled private-cloud services, or approved external models.

Contractual protections, user awareness, and clear rules complement the technical controls. Employees must not only know which tools are available, but also which information is suitable for each tool.

The first question every organization should answer before introducing AI is therefore simple:

The challenge is not simply that AI makes mistakes. People and conventional software tools also make mistakes. The particular danger is that an AI system can present incorrect information in a confident and coherent way. A plausible answer may pass an initial reading, especially when the reviewer is unfamiliar with the topic.

In a medical-device development project, an apparently small error can have wider consequences. Incorrect code may affect product behavior or even patient safety. An incomplete test may create a false sense of coverage. A misleading interpretation of a standard may influence project documentation or planning. Such undetected wrong or incomplete answers can immediately affect the project success and cost unnecessary time and money.

IMT Solution

For this reason, we treat AI output as a proposal rather than a decision. Code must go through the normal human review and testing process. Engineering standards continue to apply. Architecture decisions require approval by the responsible experts, and formal documentation remains subject to established checks.

The required level of verification depends on the consequence of an error. A draft meeting summary does not require the same controls as safety-relevant source code or a cybersecurity risk assessment. The more important the result, the stronger the review must be.

A useful mental model is to treat AI like a fast and knowledgeable junior colleague. It can contribute valuable ideas and complete substantial work, but its output cannot be accepted solely on the basis of confidence or presentation.

This behavior is not always driven by carelessness. It often appears when employees have a legitimate need but the approved solution is difficult to access, slow, or too limited for their work.

A policy that only says “do not use AI” does not remove the demand. It moves usage outside the organization’s view. Security teams then cannot determine what information is being shared, which providers are involved, or whether contractual and technical safeguards are in place.

IMT Solution

Our response is to provide an approved alternative that is genuinely useful. Engineers can access suitable models through a central, governed platform, using their normal company identity. The platform can be integrated into established workflows and developer tools, while policies and logging are applied consistently.

Offering more than one approved model can also be important. Different models have different strengths, and a single option may not meet every legitimate engineering need. Controlled choice reduces the temptation to seek unapproved alternatives.

The practical lesson is that usability is part of security. If the secure option creates unnecessary obstacles, people will look for a shortcut.

These capabilities increase the value of AI, but they also raise the impact of a compromised or incorrectly instructed tool.

Imagine an AI agent using one long-lived technical key to access source-code repositories, the company wiki, the issue tracker, product secrets, and production systems. If that key is exposed or the agent performs an unintended action, the consequences extend far beyond the original task.

AI tools should therefore be treated like other software identities. They require defined ownership, controlled authentication, limited permissions, and traceable actions. Access should be granted for a particular purpose, not simply because an AI tool might need it in the future.

IMT Solution

At IMT, we favor identity-based authentication and short-lived credentials over shared, permanent keys. Authorization is managed centrally, and permissions follow the principle of least privilege. Where an action could have a significant effect, human approval is required before it is carried out. Logging makes it possible to understand which user, agent, and service performed an action.

An assistant that needs to explain code may require read access to one repository. It does not automatically need access to production systems, secrets, financial information, or every customer project.

A team might download an open-source model because it performs well in a demonstration. An employee might install a plugin that promises to connect the assistant to an internal tool. A new integration may request access to engineering data without making its security behavior clear.

The component may contain vulnerable dependencies, malicious functionality, unclear licensing, or unsafe default settings. A compromised integration can also become an indirect route to sensitive company information.

IMT Solution

We manage this risk by treating AI components in the same disciplined way as other third-party software. Models, plugins, and tool integrations pass through an approval process before being made available. Relevant components are checked for vulnerabilities and licensing concerns. Approved tools are maintained in a central catalog, monitored during use, and updated or removed when necessary.

Model governance also includes lifecycle management. A model that is suitable today may later become outdated, unsupported, or inappropriate for a particular use. Changes in provider terms, hosting arrangements, security findings, or model behavior may require a new assessment.

The objective is not to prevent experimentation. It is to separate controlled evaluation from unrestricted operational use.

The five risks are different, but the controls behind them form one coherent approach.

Security by design means considering data protection, identity, access, monitoring, and human responsibility from the beginning. These elements are difficult to add consistently after many teams have already adopted separate tools.

Central governance provides a common set of approved services and rules. It gives the organization visibility while allowing engineers to work with models suited to their tasks.

Identity-based access connects AI use to known users and services. This avoids anonymous access and reduces dependence on shared technical keys. Least privilege then limits each person, application, and agent to the resources required for its work.

Human involvement remains essential. AI may prepare, recommend, and assist, but people approve decisions with significant technical, safety, security, or regulatory consequences.

Monitoring and auditability complete the picture. The organization must be able to understand which tools are in use, what systems they access, and whether their behavior remains consistent with policy. Monitoring should support both security investigations and continuous improvement of the AI platform.

Finally, the model must fit the data. Not every task requires the most capable external model, and not every type of information should be processed in the same environment. A local model may be appropriate for highly sensitive material. A private-cloud model may provide a balance between capability and control. An approved frontier model may be suitable when advanced reasoning is required and the information can be processed under the agreed conditions.

The choice should be intentional rather than accidental.

This mapping is important because the principles are not abstract security slogans. Each one addresses a practical problem that engineering teams encounter when AI becomes part of daily work.

AI adoption is not simply a decision for the IT department. It affects engineering productivity, information handling, software development, cybersecurity, quality processes, and organizational knowledge. It therefore requires business ownership and clear responsibilities.

We have also learned that secure AI must be easy to adopt. Policies alone cannot compete with tools that employees can open in seconds. Organizations need to provide a practical service, explain its boundaries, and improve it in response to real user needs.

Productivity and security are not opposing goals. A well-designed platform can improve both. Central access makes AI easier for employees to use while giving the company better control over data, identities, permissions, and approved components.

Technology, however, is only part of the solution. Employees need clear guidance and relevant training. Managers must understand which uses are appropriate. Engineering teams must retain their established review and testing practices. Procurement, legal, quality, and security functions must be involved when providers and data-processing arrangements are assessed.

The strongest control is often not an additional technical restriction. It is a working environment in which the secure behavior is also the most convenient and useful behavior.

AI is becoming another standard engineering tool, following the path of compilers, version-control systems, computer aided design (CAD), automated testing, and continuous delivery. It can help engineers understand complex systems, improve documentation, explore risks, and spend less time on repetitive tasks.

Its limitations and security implications cannot be ignored. Sensitive information may leave the organization. Incorrect answers can appear authoritative. Unapproved tools can create blind spots. AI agents can receive excessive permissions, and new models or plugins can introduce supply-chain risks.

These challenges are manageable when AI is introduced deliberately. Data classification, approved models, identity-based access, least privilege, human review, and continuous monitoring provide a practical foundation for secure use.

The organizations that benefit most will not necessarily be those that adopt AI first. They will be those that integrate it thoughtfully into their engineering processes.

At IMT, our goal is to give engineers useful AI capabilities while maintaining the standards our customers and regulated projects require. This means allowing AI to accelerate the work without allowing it to bypass accountability.

Used in this way, AI strengthens engineering rather than weakening its controls. It helps people work more effectively while protecting the intellectual property, customer information, product quality, and trust on which successful engineering depends.