An honest AI security risk assessment covers two directions: what your own AI use exposes (data leaving through tools, unowned accounts, vendor terms) and what AI-equipped attackers change about the threats you already had. Most assessments only look one way.
The inbound side is the one people feel: AI-assisted phishing that imitates your CFO convincingly, faster exploitation of the identity gaps that were always there. The outbound side is quieter and usually bigger: recordings from an AI notetaker holding every customer's pricing, staff accounts on consumer AI plans, contract terms pasted into tools whose vendor agreements nobody read.
Both directions are one track of the Exposure & Opportunity Review — assessed together with where AI genuinely pays, because fear without the upside just freezes companies. No systems access at any point.