If "infosec people are not okay", that means that you have to account for the human element in your security analysis. You are not a consistent, trustworthy system, you are a sack of water and proteins.
Infosec processes aim at reducing this effect.
That's also AI companies attack surface.