Shipping AI Into 5 Major Banks Without a 12-Month Compliance Wait — Al Chen, Cisco
Summary
Deploying AI in major banks requires overcoming significant compliance and security hurdles, often taking years. The speaker outlines three critical pillars for achieving 'compliance velocity': securing the build pipeline, ensuring robust disaster recovery, and preventing PII/MNPI leakage. Key strategies include using specialized agents for CVE remediation testing, implementing multi-step backup and restore procedures (e.g., for ClickHouse), and adding redundant LLM calls to sanitize judge reasoning to maintain data sovereignty.
Key takeaways
-
Compliance Velocity is about Evidence
Achieving rapid deployment (weeks vs. years) requires demonstrating detailed evidence and process work (showing your work) to security and compliance teams, rather than just stating a timeline.
-
Data Sovereignty is Not Free
Ensuring zero leakage and data sovereignty requires implementing extra steps, such as running a second LLM call on a request to redact and validate sensitive information, which adds operational cost.
-
Focus on Organizational Challenges
The biggest bottlenecks in deployment are often less technical and more related to internal human and organizational challenges and alignments within the bank.
Technical details
-
CVE Remediation Testing
417s
Standard scanning tools (Sysdig, Wiz, Prisma) only check if a package version was bumped. To prove remediation, a specialized 'harbor task' is needed. This task allows an agent to write and test an exploit against the new version to confirm the vulnerability is truly patched, providing concrete evidence.
-
Disaster Recovery (DR) for Data Platforms
830s
For platforms like ClickHouse, managed failover across regions is often unavailable. A robust DR pattern involves a job that backs up data to a bucket, followed by a restore job to a DR region. Crucially, data correctness must be verified by checking row counts between tables, not just confirming the job ran.
-
PII/MNPI Leakage via LLM Judges
1033s
Even if the UI is redacted, the reasoning generated by an LLM judge (used for evaluation) can potentially leak PII or MNPI. Mitigation involves having the judge read raw trace data but ensuring the reasoning output is not persisted, or implementing a secondary LLM judge that operates on pre-redacted input.
-
Build Pipeline Resilience
215s
The build pipeline must account for data resiliency if a region fails mid-request. The process involves managing image pulls, ensuring data integrity, and verifying the entire flow from source to cluster.
Mentioned resources
- NVD, CISA, or MITRE
- ClickHouse
Channel & topics
Watch on YouTube · Back to latest
This independent, AI-assisted summary is provided for commentary and informational purposes. It may contain errors or omit important context. Please watch the original video for the creator's complete presentation. Video, thumbnail, and related copyrights belong to their respective owners.