By Dvir Shapira
The next wave of corporate endpoints is already here. AI-powered PCs, equipped with dedicated neural processing units (NPUs), which have the capability to run generative AI workloads locally on the endpoint instead of sending data to the cloud.
They promise faster insights, more personalized experiences, and have the potential for stronger privacy. According to IDC, 77 percent of IT leaders expect AI PCs to deliver more personalized experiences, while 75 percent said they’ll improve privacy by keeping AI processing local.
Yet this shift from the cloud to the endpoint is introducing a set of security challenges the industry is only beginning to understand.
One recent report by Absolute Security found 92 percent of enterprise PCs remain unprepared for AI-specific security risks. While AI PCs provide new capabilities, they also bring new responsibilities for IT and security teams.
To that end, the following are five emerging security risks associated with AI PCs organizations need to be aware of:
1. Hardware-Level Blind Spots
AI PCs rely on new NPU chips and firmware layers that most endpoint security tools weren’t built to monitor. These components can run workloads outside the visibility of traditional endpoint detection and response (EDR) tools, opening the door for firmware-level attacks or malicious driver exploits that could go undetected.
2. Data Leakage
Running AI workflows locally introduces the potential for sensitive data to end up exposed. Model inversion, prompt injection, or inadvertent caching could potentially allow confidential information – like customer data or proprietary code – to end up extracted from model outputs. Without robust data loss prevention (DLP) and endpoint controls, these risks grow substantially.
3. Compliance Shifting to the Endpoint
With AI processing happening on the device, endpoints themselves become critical points of regulatory responsibility. Every AI-capable endpoint could pose a compliance risk if sensitive data ends up processed outside approved environments, especially in hybrid or contractor-heavy workforces that operate across multiple jurisdictions.
4. Decentralized Visibility Gaps
Local AI workloads bypass central monitoring and cloud-based controls, leaving IT teams without insight into how corporate data and AI models end up used. Without new auditing practices, companies risk losing track of where sensitive information resides and how it ends up processed.
5. Unmanaged Devices Multiply Risk
Organizations rely on unmanaged or third-party managed laptops for contractors and consultants. As these devices gain AI capabilities, the combination of unmanaged endpoints and local AI processing blurs the line between personal and corporate activity. This increases the potential for security incidents and compliance violations unless corporate workloads are isolated and consistently secured.
How to Mitigate AI PC Security Risks
AI PCs offer significant advantages (speed, personalization, and stronger privacy), but they also redefine endpoint security. To manage these security risks, organizations should focus on three core strategies:
- Isolate corporate workloads: Keep corporate applications and data separate from personal or even corporate-run AI activity on the same device. This prevents accidental data leaks and ensures sensitive information remains within controlled environments.
- Enforce endpoint-level controls: Apply security policies, encryption, and access management directly on the device. These controls ensure all AI workloads – whether local or networked – adhere to organizational security standards.
- Maintain visibility and compliance: Implement monitoring and auditing across every endpoint, including company-owned, contractor-managed, and BYOD devices. This ensures IT teams can track data usage, enforce compliance policies, and respond quickly to potential security incidents.
By focusing on workload isolation, endpoint controls, and comprehensive visibility, organizations can safely harness AI PCs while protecting sensitive data and meeting compliance requirements.
Dvir Shapira is the chief product officer at Venn Software.