Transcript
This transcript was autogenerated. To make changes, submit a PR.
I'm Vice President of AI and Machine Learning.
We work on building real world AI solutions and leading teams and team
ideas into impactful technology.
We're excited to be at Kyle 42 and share some of the work we've been
doing, securing AI during financial operations systems at scale.
Investment banking operations demand bulletproof security alongside efficiency.
This presentation reveals how we implemented a security first enhanced
agent, ai clean work that transforms middle office operations, enterprise
grade security standards, the
security impaired, the challenge.
Financial institutions face an uncomfortable issue.
Traditional security families were never designed for complexities
of agents and AI systems.
Three, AI capability introduced attack vectors within
existing traditional systems.
Where do you secure a system where decisions emerge from probabilistic
models rather than deterministic needs?
How do you maintain compliance when.
AI agents autonomously feed and synthesize information from vast knowledge basis.
Power approach.
Security must be embedded in architecture for not bolted on.
Using means treating every component of the AI pipeline as a potential
vulnerability and designing accordingly to careful architecture, rigorous dev
practices, and continuous refinement.
We created a platform that process enormous transaction volumes while
maintaining security standards that exceed industry benchmarks.
Three layer security architecture, value knowledge retrieval, multi-tiered
knowledge base with seconded domains into maintain control,
encryption, speech mechanisms.
Dynamic security posture adjust measures based on information sensitivity.
Orchestration.
Multiple specialized AI agents collaborate within strictly defined skills.
Blockchain inspired consensus mechanism, stakes decisions.
Zero trust model with end-to-end encryption between agents, full amount
processing pipelines, sandbox environments with no direct access to production
systems, multi-stage input, sanitation.
Adequate validation air gap approach prevents compromised models from
that security, multi-layered protection and value implementation or security
at every step of the retrieval process.
When an ai, the knowledge base, the Red Cross passes through multiple validation
layers before any information is released.
Identity verification.
By identity and authorization credentials to query San sanitization C
as queries to prevent injection types.
Three.
Access control.
Apply road base control to limit retrieval information.
Log every interaction.
For compiles secure transmission, you can retrieve information through transmission.
Orchestration and consensus and zero trust.
Specialized agents shared validation, compilation, risk
assessment, communication, section handling, operational.
Each agent operate within a strictly defined school, principles of least
privilege, consensus mechanism.
High stakes decisions require agreement across multiple specialized agents.
Execution agent by proposed action that compli to risk and operation agents must
independently before execution proceeds.
EC helps integrating security seamlessly.
Proactive automated security testing, cool comprehensive security
testing from the earliest stages.
This includes standard analysis to recommend.
Testing and isolated tanes, continuous automated penetration
testing and fuzzy to identify vulnerabilities before deployment.
Secure infrastructure as code, also known as IAC, define security policies,
access controls, and encryption configurations directly as version code.
Ensures consistency, reproducibility, and compliance across all the development,
staging, and production environments.
Eliminating,
embracing, shift left security, embedding security considerations and
practices into the development lifecycle.
The very first secure coding templates beyond generation.
We make sure the development is the most efficient natural path for engineers.
AI model security.
From training to development training data, curations carefully curate
treating data to what incorporates system information buyers.
For examples, training occurs in isolated environments with non network access.
Two, no validation.
Security benchmarks demonstrates resistance to non pattern consistency
with previous versions, graphically, site and store, and secure.
Three deployment controls.
Reverse validation processes before production.
Multiple.
Natalie approval from security and compliance teams required for it.
Continuous monitoring track performance metrics that drift and conceptual drift.
Regular back testing validates models continue to perform as
expected under current conditions.
Real time threat detection, AI securing millisecond speed out
threat detection system operates on multiple timescales simultaneously.
Perform real time analysis for every transaction system.
Interaction as occur.
Machine learning models examine transactions, metadata agent behavior
system call patterns, network traffic, and data access patterns within second
one will plus security events daily process with subsecond response types.
Collect 8% detect accuracy.
High fidelity alerts with minimal false.
Subsecond detection rating.
Think for most threats.
Multimodel detection approach.
Statistical models identify deviations from baseline behavior patterns.
Deep learning, recognized complex attack signatures and patterns.
Grasp neuro networks, detect unusual relationship patterns across system.
Reinforce my learning, adapt to loving threat landscape dynamic.
Combining these approaches through outside, we achieve above high detection
rates and low false positive rates.
Maintaining operational efficiencies while ensuring comprehensive security cut
tier, alert system, low severity, automated defensive response
without human intervention.
Additional authentication requirements.
Rate limiting enhanced lighting restrictions, medium severity, known for
security analysis, but allow operations to continue under increase monitoring,
gather additional forensic information
measures, and export to senior security staff
to legitimate users.
Compliance governance,
investment banking
require transaction reporting.
DODD, Frank Risk Management, GDP, data Protection Standards training oversight.
AI Risk management framework, explainability strategies, multiple EXPLAN
explainability approaches tailored to different audience regulatory audit trails
with input data using steps and decisions.
Technical model architecture, feature importance, sensitivity analysis,
business simplified explanations, focusing on business logic and risk factors.
Performance at scale.
Security without sacrifice.
System availability maintained across all operations vary period time
even with millions of documents.
Daily transactions process with security checks, transaction
latencies, including all security validations through intelligent cash.
And optimized architecture.
We have proven that security and performance are complimentary
rather than competing objectives.
Our system maintains some second response times ing extensive
security checks on every operation.
Key lessons learned, security from inception.
Retro fitting security into an architecture design without
it is far more difficult than building security from the start.
Treat security as first class requirement, align their functionality and performance.
Human oversight remains critical.
The right balance involves clear Donation of AI handles
autonomously versus human judgment.
With rapid escalation path, like AI encounters uncertainty, cultural success
requires transparent communication, training programs, environment of
operation staff and AI system design.
Demonstration of all how ai, rather than replaces human expertise, def defense.
The threat landscape involves constantly security systems themselves must learn
and improve the regular red team exercise and active participation in security.
C.
Future directions.
Emerging technology federated learning.
Improve models without centralizing sensitive data, encryption,
ation and encrypted data.
Quantum computing.
Accelerate AI operations are prepared for quantum industry standards.
Develop shared frameworks for secure AI agent communication,
regulatory vault, and evolution.
We anticipate more perspective requirements for AI govern the
standardization of explainability, of expectations and international
coordination on AI regulation.
Building the future of secure ai.
The transformations of financial operation to AI is not future possibility.
It's happening now.
Responsibility is to ensure that transformation strengthened
rather than weakness.
The security posture of financial institutions start with security.
Security throughout your architecture from day one, continuous process.
Treat security as ongoing.
Evolution, not destination.
Invest in culture, build the people and culture needed to make it work.
Responsible innovation, embrace AI's potential while maintaining
security and reliability.
So security first at large.
We pioneer then demonstrates that we can embrace AI transformation potential while
maintaining the security and reliability, the financial operations demand.
The journey continues and we invite others to join sustainability of the future.
Secure, intelligent financial.
Thank you for any questions.
Please reach out.
Wanna do.