25 posts tagged with "Security"

Before production, MonGo must show the hybrid customer-service AI is lawful, fair, secure, accountable, controllable and fit for purpose. The goal is not zero risk—it is proportionate controls, measured residual risk and evidence for every decision to continue, restrict or stop.

This article is Part VI of the Banking Customer-Service AI playbook. It follows Part I through Part V.

Most AI engagements fail not because the organisation lacks frameworks, but because it has too many of the wrong kind. Teams accumulate strategy canvases, maturity models, scoring formulas and governance checklists until the methodology itself becomes the delivery risk. The practical response is not a larger catalogue. It is a core set: enough structure to run end-to-end AI solution engineering, and little enough that practitioners can actually use it.

A Big Four firm does not compete only through its technical expertise, global network, technology platforms or client relationships. Its most valuable asset is trust.

Clients trust the firm with commercially sensitive information, strategic decisions, financial records, personal data and complex regulatory matters. Regulators trust the firm to exercise professional judgement and uphold required standards. Investors, employees, governments and the wider public expect the firm to behave responsibly, independently and ethically.

Data and AI create significant opportunities for growth, operational improvement, better decision-making and new client services. However, these opportunities also introduce risks that are different from, and often more complex than, those associated with traditional technology.

Information security for AI should not exist as a pile of threat models, vendor questionnaires and one-off pen tests. ISO/IEC 27001 establishes an organisation-wide Information Security Management System—scope, policy, risk assessment, control selection, operation, audit, management review and continual improvement—so confidentiality, integrity and availability remain enforceable when models, retrieval systems, agents and suppliers change.

The OWASP Top 10 for LLM Applications is not a reading list. It is a release language: every generative-AI system that touches tools, retrieval, personal data or production users should map risks, implement controls, test them and accept residual risk before scale.

A software licence is a legal agreement that gives a person or organisation permission to use software in ways that would otherwise be controlled by copyright law. The copyright owner is the licensor, while the person or organisation receiving the permissions is the licensee.

Artificial intelligence systems introduce a new class of security problems. A conventional application may fail because of insecure code, weak authentication or an exposed API. An AI application can suffer from all of those problems plus prompt injection, poisoned retrieval data, unsafe tool execution, model extraction, sensitive-data leakage, misleading outputs and autonomous agent behaviour.

AI red teaming is the structured practice of testing these systems from an adversarial perspective. The objective is not simply to make a model produce an inappropriate answer. It is to discover how an attacker, careless user, compromised data source or unexpected interaction could cause the complete AI system to violate its security, safety, privacy or business requirements.

APIs connect web applications, mobile apps, cloud services, partners, customers, internal systems and increasingly AI agents. They also expose valuable business capabilities directly: creating payments, changing account details, retrieving customer records, submitting claims, placing orders and triggering operational workflows.

That makes API security much broader than adding authentication to an endpoint.

A secure API must verify:

• Who or what is making the request.
• Whether that identity is allowed to perform the requested action.
• Whether it may access the specific object and properties involved.
• Whether the request is structurally and semantically valid.
• Whether the operation is being abused at scale.
• Whether sensitive information is exposed in the response.
• Whether the service and its dependencies remain secure throughout deployment and operation.

The AWS Learning Roadmap follows a sensible progression: learn cloud fundamentals, identity, networking and compute first; then add storage, databases, containers, serverless and operational services. This Azure roadmap follows the same learning philosophy but expands it into an enterprise-grade programme covering cloud architecture, application delivery, AI engineering, cybersecurity, Responsible AI, regulatory compliance and operating-model design.

Terminology note: Microsoft’s current documentation refers to its unified enterprise AI development platform as Microsoft Foundry. You may still encounter the previous “Azure AI Foundry” name in existing projects, articles and interfaces. Microsoft Foundry brings together models, agents, development tooling and production AI operations as an Azure platform service. (Microsoft Learn)