Close Menu
  • Home
  • Managing resilience
    • AI resilience
    • Business continuity
    • Business resilience
    • Climate resilience
    • C-suite and the board
    • DORA – the EU Digital Operational Resilience Act
    • Operational resilience
    • Organizational resilience
    • Supply chain resilience
    • Technology
  • Risk
    • Enterprise risk management
    • Operational risk
    • Threatscape
  • Cyber resilience
    • Cyber resilience updates
    • DORA – the EU Digital Operational Resilience Act
    • Product updates
More items
  • All News
  • Research
  • Jobs in Resilience
  • Resilience Resources
  • About Resilience Forward
X (Twitter) LinkedIn
  • Home
  • Managing resilience
    • AI resilience
    • Business continuity
    • Business resilience
    • Climate resilience
    • C-suite and the board
    • DORA – the EU Digital Operational Resilience Act
    • Operational resilience
    • Organizational resilience
    • Supply chain resilience
    • Technology
  • Risk
    • Enterprise risk management
    • Operational risk
    • Threatscape
  • Cyber resilience
    • Cyber resilience updates
    • DORA – the EU Digital Operational Resilience Act
    • Product updates
Login
LinkedIn Bluesky
Resilience Forward
Subscribe Now
  • All News
  • Research
  • Jobs in Resilience
  • Resilience Resources
  • About Resilience Forward
Resilience Forward
You are at:Home»Risk»Enterprise risk management»The risks of GenAI risk assessment: beyond the obvious (Page 19)
Enterprise risk management

The risks of GenAI risk assessment: beyond the obvious

October 12, 20254 Mins Read
A man walks on an impossible Escher-style triangle.

By David Honour

Resilience Forward recently highlighted the issue of probabilistic drift, an inherent characteristic of most large language models.  This isn’t a design flaw; it is an aspect of probability. However, it results in inconsistent answers to the same question or prompt – and that creates an issue if organizations are relying on generative AI for risk assessments or decision support. That variability becomes a risk factor in itself.

Probabilistic drift isn’t the only area where relying on GenAI for risk assessments, horizon scanning, and related scenario planning brings its own risks. The attraction is obvious: AI offers speed, clarity, and the ability to synthesise vast quantities of information into neat, authoritative insights. But here lies the paradox. Because AI communicates in a voice of confidence, charm, and apparent empathy, distortions can be subtle, persuasive, and easily overlooked.

The dark psychology of AI

Generative AI does not have intent, ego, or emotion. Yet the style of its outputs often mirrors what psychology calls the Dark Triad: narcissism, Machiavellianism, and psychopathy. These traits, when embodied in human leaders, can be simultaneously attractive and dangerous. The same is true when echoed in AI systems.

  • Narcissistic echoes: AI presents insights with certainty, vision, and authority. As a result, it is highly believable, even when it presents conjecture as fact; and its responses often lack nuance. Where it lacks solid information, AI will make a best guess rather than giving an I’m not sure answer. However, this guess will often be perceived as fact by the recipient.
  • Machiavellian echoes: AI reframes and persuades, steering conversations in ways that feel constructive. This is effective for engagement – but can also be manipulative.
  • Psychopathic echoes: AI remains calm, unemotional, and detached. It has no empathy, although it may appear empathetic at a surface level. When assessing information that requires an understanding of human impacts, GenAI will fail to do this effectively.

These echoes are not accidental. They reflect training data drawn largely from academic, corporate, and thought-leadership sources – domains where confidence, persuasion, and detachment often dominate. In other words: the culture of leadership and risk thinking is already saturated with Dark Triad energy; and AI mirrors it back to us.

In addition, developers often tune models to prioritise helpfulness, coherence, and confidence, which reinforces the narcissistic tendency to not admit error or ignorance, regardless of the training data’s subject matter.

Hidden risks for risk professionals

When applied to horizon scanning and risk assessment, the above creates several hidden dangers:

  1. False certainty: overconfidence in outputs can encourage professionals into narrow thinking, discouraging the exploration of uncertainty.
  2. Manipulated perception: AI’s framing of risks can skew horizon scanning toward dominant narratives, creating its own blind spots.
  3. Illusion of trust: simulated empathy and mirroring build rapport, lowering critical challenge functions.
  4. Narrow horizons: weak signals outside mainstream discourse are easily overlooked, reinforcing groupthink. From an AI perspective the more an idea or concept is repeated by reputable sources, the more credence it is given. There is little room for those on the fringe who think outside the box.
  5. De-skilling and dependency: over time, professionals may lose their sceptical edge as they grow reliant on AI structuring and analysis.

The danger is not dramatic bias in a single answer. It is the slow shaping of professional judgement by an endlessly charming manipulator!

Mitigations: guardrails for AI in risk work

If AI echoes Dark Triad styles, then the controls mirror those we would apply to human leaders with such traits:

  • Ensure there is human challenge: pair AI outputs with structured human dissent to challenge overconfidence. Any mission-critical decision-making that uses GenAI must also include an appropriately trained human capable of assessing and verifying the information being generated.
  • Force uncertainty: prompt AI for ranges, alternative framings, and blind spots, not just polished conclusions.
  • Diversify sources: use multiple AI systems alongside expert opinion and play AI systems off against each other, assessing the responses that come back with human insight.
  • Audit regularly: test AI-generated risk assessments against independent benchmarks.
  • Educate users: train risk professionals to recognise how AI’s charm, confidence, and apparent empathy can shape perceptions.

Conclusion

The risk is real: while AI has a role in risk assessment, organizations may absorb not just its speed and power, but also its distortions. This is a meta-risk that could leave organizations blind to the very uncertainties they sought to understand.

Generative AI is not malevolent. But it is persuasive, authoritative, and charming. Without boundaries, risk professionals may find themselves seduced by its credibility – and in doing so, undermining the very resilience they seek to build.

The author

David Honour is editor of Resilience Forward.

Africa Asia Asia Pacific Australasia Europe Middle East North America UK
Share. Facebook Twitter Pinterest LinkedIn Tumblr Email WhatsApp
Previous ArticleHow campaign-centric detection can address alert fatigue
Next Article UK National Cyber Security Centre sees large increase in ‘nationally significant’ cyber attacks

Related Posts

An exploding digital padlock illustrates the requirement for post-quantum cryptography.

Research breakthrough brings reliable quantum computers and Q-day closer to reality

September 10, 2026
A danger sign on a digital background.

New blob URL phishing technique evades detection by using legitimate Microsoft services

September 10, 2026
AI risks

Unmanaged AI workflows expose EMEA organizations to rising compliance and data risks

September 9, 2026
City skyline at sunset with bright light trails and a translucent blue smart-city grid overlay and GPS pins indicating locations.

AI world models: future possibilities for organizational resilience?

September 7, 2026
DRJ and BCI logos

DRJ and BCI publish guidance for governing, managing, and using AI in resilience

September 7, 2026
Decision making with over whelming information.

AI can find the vulnerability. Accountability still sits with your crisis leadership

September 7, 2026
Advertisement
Resilience First
This week's most read articles
Under pressure: An egg cracking under pressure applied by squeezing clamps form the sides.

Managing scenario testing for operational resilience

May 16, 2024
COSO logo

New COSO ERM guidance aims to help organizations with practical implementation

May 12, 2026
Close-up of a green-brown iris peering through a jagged tear in dark paper or wall material.

The blind spots in business continuity

September 2, 2026
Latest resources
A hand places a wooden block onto a stack of blocks forming a circular process symbol with gears and arrows, representing the building of resilient, iterative IT systems and operational foundations.

Why most IT environments aren’t ready for agentic AI – and what CIOs can do about it

December 18, 2025
Load More

Subscribe to Updates

Get our Resilience Updates newsletter.

Most Popular Feature Articles
Three dark coloured light bulbs on a black background illustrate the concept of The Dark Triad in Crisis Management.

The Dark Triad in crisis management

Five stage crisis management framework

A five stage framework for a crisis management process

Blue interconnected gears and network nodes symbolizing automation and complex machinery.

Agent zero – the 2028 digital pandemic

Latest Reports
A futuristic red warning alert icon with glowing exclamation mark.

Cloud Security Alliance publishes Hugging Face Incident Initial Post-Mortem

A person hold a building door open for a person behind who is tailgating to get unauthorised access.

Security Culture: A Strategic Capability That Builds Resilience in a Volatile World

An identity icon with a map marker on it, indicating the concept of identity as a target for attackers. The icon is on a generic IT background predominantly in black and orange.

Identity-based approaches dominate initial access for ransomware attacks

A promo box for an article about resilience governance.
© 2026 Resilience Forward
  • About Resilience Forward
  • Newsletter
  • Newsfeed
  • Advertise
  • Call for Papers
  • Contact
  • Privacy Policy and Cookie Use
  • AI Use Policy

Type above and press Enter to search. Press Esc to cancel.

Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
  • Manage options
  • Manage services
  • Manage {vendor_count} vendors
  • Read more about these purposes
View preferences
  • {title}
  • {title}
  • {title}
Manage Cookie Consent
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
  • Manage options
  • Manage services
  • Manage {vendor_count} vendors
  • Read more about these purposes
View preferences
  • {title}
  • {title}
  • {title}
Ad Blocker Enabled!
Ad Blocker Enabled!
Our website is made possible by displaying online advertisements to our visitors. Please support us by disabling your Ad Blocker.

Sign In or Register

Welcome Back!

Login to your account below.

Lost password?