Values washing is the use of ethics language, responsible-AI claims, or trust-building slogans without the operational controls needed to make them real. In security terms, it is a gap between policy and practice: an organization says it has safeguards, but cannot show logging, ownership, review workflows, escalation paths, or human override.
This matters because modern cyber defense depends on evidence. If AI systems influence access decisions, fraud checks, hiring, routing, or incident triage, defenders need audit trails, permission controls, and clear accountability. Values washing can hide weak governance, make risks harder to detect, and leave no proof when an automated decision must be explained to auditors, users, or regulators. Attackers and insiders also benefit when controls are only cosmetic, because missing logs and unclear ownership reduce traceability and make misuse easier to conceal. Real defense requires controls that operate every day, not just responsible-AI statements on a policy page.