Technology and Security · Topic 6 of 7
Emerging Technologies
CRISC emerging technologies: assessing AI, IoT and OT, quantum computing, blockchain and automation for threats, vulnerabilities and opportunities.
- 5 min
- Evaluate emerging technology for threats, vulnerabilities and opportunities.
- Little loss data means scenarios, expert judgement and pilots.
- Generative AI risks include data leakage, inaccurate output, bias and prompt injection.
What it is
Emerging technologies are technologies that are new to the organization or still maturing in the market, such as generative AI, connected devices, quantum computing or new automation tools. They bring opportunities for the business and new risks that existing controls may not cover.
The job practice asks the practitioner to evaluate emerging technologies and changes in the environment for threats, vulnerabilities and opportunities. The goal is informed adoption, not blanket refusal.
How it works
Why emerging technology is hard to assess
There is little historical loss data, standards and regulation are still developing, skills are scarce, and vendors change products quickly. Business units often adopt new tools before risk teams know about them. Assessment therefore relies on scenarios, expert judgement, pilots and close monitoring.
Examples and their risk themes
| Technology | Opportunities | Key risks |
|---|---|---|
| Artificial intelligence and generative AI | Automation, better decisions, customer service | Inaccurate or fabricated output, bias, leakage of confidential data into prompts, prompt injection, unclear accountability, intellectual property and regulatory exposure |
| Internet of things (IoT) | Monitoring, efficiency | Weak default credentials, limited patching, large attack surface |
| Operational technology (OT) | Connected plant and industrial control | Safety impact, legacy protocols, links between IT and OT networks |
| Quantum computing | Faster complex calculations | Future ability to break widely used public key cryptography |
| Blockchain and distributed ledgers | Shared, tamper-evident records | Key loss, smart contract flaws, unclear legal status |
| Robotic process automation | Faster routine processing | Bots with broad access, errors repeated at scale, weak bot credential management |
| Edge computing | Low-latency processing near devices | Distributed devices that are harder to secure and update |
Quantum and cryptography
Data encrypted today could be collected now and decrypted later once powerful quantum computers exist, a risk often called "harvest now, decrypt later". NIST published its first post-quantum cryptography standards, FIPS 203, 204 and 205, in August 2024. The practitioner's role is to make sure the organization has a cryptographic inventory and a migration plan, starting with long-lived sensitive data.
Governing AI use
AI adoption needs an inventory of AI uses, an acceptable use policy (for example, what data may be entered into public generative AI tools), risk assessment before deployment, human oversight for significant decisions, monitoring of output quality, and vendor assessment for AI services. ISO/IEC 42001:2023 specifies requirements for an AI management system, and the NIST AI Risk Management Framework offers voluntary guidance.
An approach to evaluating new technology
- Understand the business case: what objective the technology serves.
- Identify threats and vulnerabilities, including third-party and regulatory risk.
- Identify opportunities and the risk of not adopting.
- Assess against appetite and existing controls.
- Set guardrails: policy, approved tools, data rules, ownership.
- Pilot in a controlled scope, with monitoring.
- Review and scale, updating the risk register and roadmap.
Opportunity risk
Refusing all new technology is itself a risk. Competitors may gain cost or service advantages, and staff may adopt tools anyway without oversight, creating shadow IT. ISACA's view is that risk management enables value as well as protecting it.
A worked example
Staff at a law firm start pasting client documents into a public generative AI chatbot to draft summaries. The IT team proposes blocking all AI tools.
The practitioner instead assesses the use. Threats include confidential client data leaving the firm and inaccurate summaries reaching clients. The opportunity is significant time savings.
The recommendation is an enterprise AI service with contractual data protections, an acceptable use policy banning client data in public tools, mandatory lawyer review of AI output, and a three-month pilot with monitoring. The managing partner, as risk owner, approves.
How the exam asks about this
- "What should the practitioner do FIRST when the business wants to adopt a new technology?" Understand the business objective and assess the risks and opportunities before adoption.
- "What is the GREATEST risk of employees using public generative AI tools?" Disclosure of confidential or personal data entered into the tool.
- "Which is the BEST way to prepare for the risk that quantum computing poses to encryption?" Build a cryptographic inventory and plan migration to post-quantum algorithms.
What to remember for the exam
- Evaluate emerging technology for threats, vulnerabilities and opportunities.
- Little loss data means scenarios, expert judgement and pilots.
- Generative AI risks include data leakage, inaccurate output, bias and prompt injection.
- NIST published FIPS 203, 204 and 205 for post-quantum cryptography in August 2024.
- Blocking all new technology creates opportunity risk and shadow IT.
"Ban it" is rarely the BEST answer. ISACA favours assessing the risk, setting guardrails and piloting, so the business can gain value within appetite.
Common mistakes
Waiting for loss data before assessing. By then the risk has already materialized.
Treating new technology as only an IT matter. Business owners must own the use and accept the risk.
Ignoring third parties. Most emerging technology arrives through vendors and cloud services, which need assessment too.
Check yourself
Why is emerging technology harder to assess than established technology?
There is little historical loss data, standards and laws are still developing, and products change quickly, so assessment relies on scenarios and expert judgement.
What does "harvest now, decrypt later" mean?
Attackers collect encrypted data today in order to decrypt it in the future once quantum computers can break current public key cryptography.
Why can refusing to adopt a new technology be a risk?
The organization may lose competitive advantage, and staff may use the technology anyway without controls.
Topic 6 of 7 in Technology and Security
Test yourself on Technology and Security
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.