Conf42 DevSecOps 2025 - Online

- premiere 5PM GMT

Securing AI-Driven Financial Operations: RAG & Agentic Systems at Scale

Video size:

Abstract

Learn to secure AI-driven financial systems at massive scale. Covers DevSecOps patterns for RAG/LLM pipelines, real-time threat detection, and compliance automation achieving 40% efficiency gains with bulletproof security.

Summary

Transcript

This transcript was autogenerated. To make changes, submit a PR.
I'm Vice President of AI and Machine Learning. We work on building real world AI solutions and leading teams and team ideas into impactful technology. We're excited to be at Kyle 42 and share some of the work we've been doing, securing AI during financial operations systems at scale. Investment banking operations demand bulletproof security alongside efficiency. This presentation reveals how we implemented a security first enhanced agent, ai clean work that transforms middle office operations, enterprise grade security standards, the security impaired, the challenge. Financial institutions face an uncomfortable issue. Traditional security families were never designed for complexities of agents and AI systems. Three, AI capability introduced attack vectors within existing traditional systems. Where do you secure a system where decisions emerge from probabilistic models rather than deterministic needs? How do you maintain compliance when. AI agents autonomously feed and synthesize information from vast knowledge basis. Power approach. Security must be embedded in architecture for not bolted on. Using means treating every component of the AI pipeline as a potential vulnerability and designing accordingly to careful architecture, rigorous dev practices, and continuous refinement. We created a platform that process enormous transaction volumes while maintaining security standards that exceed industry benchmarks. Three layer security architecture, value knowledge retrieval, multi-tiered knowledge base with seconded domains into maintain control, encryption, speech mechanisms. Dynamic security posture adjust measures based on information sensitivity. Orchestration. Multiple specialized AI agents collaborate within strictly defined skills. Blockchain inspired consensus mechanism, stakes decisions. Zero trust model with end-to-end encryption between agents, full amount processing pipelines, sandbox environments with no direct access to production systems, multi-stage input, sanitation. Adequate validation air gap approach prevents compromised models from that security, multi-layered protection and value implementation or security at every step of the retrieval process. When an ai, the knowledge base, the Red Cross passes through multiple validation layers before any information is released. Identity verification. By identity and authorization credentials to query San sanitization C as queries to prevent injection types. Three. Access control. Apply road base control to limit retrieval information. Log every interaction. For compiles secure transmission, you can retrieve information through transmission. Orchestration and consensus and zero trust. Specialized agents shared validation, compilation, risk assessment, communication, section handling, operational. Each agent operate within a strictly defined school, principles of least privilege, consensus mechanism. High stakes decisions require agreement across multiple specialized agents. Execution agent by proposed action that compli to risk and operation agents must independently before execution proceeds. EC helps integrating security seamlessly. Proactive automated security testing, cool comprehensive security testing from the earliest stages. This includes standard analysis to recommend. Testing and isolated tanes, continuous automated penetration testing and fuzzy to identify vulnerabilities before deployment. Secure infrastructure as code, also known as IAC, define security policies, access controls, and encryption configurations directly as version code. Ensures consistency, reproducibility, and compliance across all the development, staging, and production environments. Eliminating, embracing, shift left security, embedding security considerations and practices into the development lifecycle. The very first secure coding templates beyond generation. We make sure the development is the most efficient natural path for engineers. AI model security. From training to development training data, curations carefully curate treating data to what incorporates system information buyers. For examples, training occurs in isolated environments with non network access. Two, no validation. Security benchmarks demonstrates resistance to non pattern consistency with previous versions, graphically, site and store, and secure. Three deployment controls. Reverse validation processes before production. Multiple. Natalie approval from security and compliance teams required for it. Continuous monitoring track performance metrics that drift and conceptual drift. Regular back testing validates models continue to perform as expected under current conditions. Real time threat detection, AI securing millisecond speed out threat detection system operates on multiple timescales simultaneously. Perform real time analysis for every transaction system. Interaction as occur. Machine learning models examine transactions, metadata agent behavior system call patterns, network traffic, and data access patterns within second one will plus security events daily process with subsecond response types. Collect 8% detect accuracy. High fidelity alerts with minimal false. Subsecond detection rating. Think for most threats. Multimodel detection approach. Statistical models identify deviations from baseline behavior patterns. Deep learning, recognized complex attack signatures and patterns. Grasp neuro networks, detect unusual relationship patterns across system. Reinforce my learning, adapt to loving threat landscape dynamic. Combining these approaches through outside, we achieve above high detection rates and low false positive rates. Maintaining operational efficiencies while ensuring comprehensive security cut tier, alert system, low severity, automated defensive response without human intervention. Additional authentication requirements. Rate limiting enhanced lighting restrictions, medium severity, known for security analysis, but allow operations to continue under increase monitoring, gather additional forensic information measures, and export to senior security staff to legitimate users. Compliance governance, investment banking require transaction reporting. DODD, Frank Risk Management, GDP, data Protection Standards training oversight. AI Risk management framework, explainability strategies, multiple EXPLAN explainability approaches tailored to different audience regulatory audit trails with input data using steps and decisions. Technical model architecture, feature importance, sensitivity analysis, business simplified explanations, focusing on business logic and risk factors. Performance at scale. Security without sacrifice. System availability maintained across all operations vary period time even with millions of documents. Daily transactions process with security checks, transaction latencies, including all security validations through intelligent cash. And optimized architecture. We have proven that security and performance are complimentary rather than competing objectives. Our system maintains some second response times ing extensive security checks on every operation. Key lessons learned, security from inception. Retro fitting security into an architecture design without it is far more difficult than building security from the start. Treat security as first class requirement, align their functionality and performance. Human oversight remains critical. The right balance involves clear Donation of AI handles autonomously versus human judgment. With rapid escalation path, like AI encounters uncertainty, cultural success requires transparent communication, training programs, environment of operation staff and AI system design. Demonstration of all how ai, rather than replaces human expertise, def defense. The threat landscape involves constantly security systems themselves must learn and improve the regular red team exercise and active participation in security. C. Future directions. Emerging technology federated learning. Improve models without centralizing sensitive data, encryption, ation and encrypted data. Quantum computing. Accelerate AI operations are prepared for quantum industry standards. Develop shared frameworks for secure AI agent communication, regulatory vault, and evolution. We anticipate more perspective requirements for AI govern the standardization of explainability, of expectations and international coordination on AI regulation. Building the future of secure ai. The transformations of financial operation to AI is not future possibility. It's happening now. Responsibility is to ensure that transformation strengthened rather than weakness. The security posture of financial institutions start with security. Security throughout your architecture from day one, continuous process. Treat security as ongoing. Evolution, not destination. Invest in culture, build the people and culture needed to make it work. Responsible innovation, embrace AI's potential while maintaining security and reliability. So security first at large. We pioneer then demonstrates that we can embrace AI transformation potential while maintaining the security and reliability, the financial operations demand. The journey continues and we invite others to join sustainability of the future. Secure, intelligent financial. Thank you for any questions. Please reach out. Wanna do.
...

Swamy Biru

Vice President Software Engineering @ JPMorganChase & Co

Swamy Biru's LinkedIn account



Join the community!

Learn for free, join the best tech learning community

Newsletter
$ 0 /mo

Event notifications, weekly newsletter

Access to all content