Generative AI and cybersecurity: governance, risk, compliance and management

This is a quick summary of a much longer substack: https://solresol.substack.com/p/generative-ai-and-cybersecurity-governance and a ~40 minute video: https://youtu.be/jHFa_08_Y9E

The world of AI is rapidly evolving. AI researchers are divided on whether superhuman intelligence can be achieved by scaling up current technology or if fundamental breakthroughs are still needed. 

Key AI Concepts for Cybersecurity Professionals:

1. AI Alignment: Controlling AI systems that may become smarter than humans.
2. Explainable AI: Understanding why AI programs make certain decisions.
3. Agentic AI: AI systems that can perform actions autonomously.
4. Prompt Injection: A major security concern in AI systems.

Impact on Management:

1. Distinguishing between genuine understanding and AI-generated artifacts.
2. Using AI for performance improvement plans and automation.
3. Dealing with potential fraud and impersonation using AI.
4. Monitoring AI-driven automation by employees.
5. Adapting to increased use of speech recognition and document management.

Corporate Governance and Responsible AI Use:

Pre-2022, AI governance focused on controlling the training process. Post-2022, governance must shift to maximizing benefits while managing risks. Key challenges include prompt injection, hallucination, and lack of moral sense in AI systems. Blocking AI usage may lead to data leaks to less reputable companies. Organizations must embrace AI while implementing proper guardrails.

Required Capabilities for AI Governance:

1. Observatory: Monitoring AI usage and its impacts.
2. Reward Giving: Incentivizing staff to automate tasks responsibly.
3. Expansion: Propagating new ideas and methods for AI use.
4. Financial: Balancing AI costs with staffing savings.
5. Cybersecurity: Defending against new attack vectors.
6. HR Responsiveness: Managing job role changes due to AI automation.

Key Processes:

1. Audit/Discovery/Inventory Management: Identifying new AI activities.
2. Incident Response: Handling prompt injection attacks and rogue employee actions.
3. Rapid Iteration on Education and Training: Keeping staff up-to-date on AI capabilities.

Regulation:

Few regulations currently exist for generative AI usage. China requires AI systems to act in the benefit of social harmony. Japan allows training models on copyrighted works, potentially leading to faster AI adoption. India requires registration for AI model training, hindering the development of language models. The USA has proposed limitations on large-scale AI training.

#AlchemyAPI bought by IBM for #Watson -- it's obvious whom IBM will buy next

Every time I start getting enthusiastic about an artificial intelligence company's products, IBM buys them for Watson.

Last year I blogged about the code I had written to make a Google App Engine mail handler which displayed summaries of emails by keywords and sentiment. Today I've discovered that AlchemyAPI (who provided a lot of the smarts) have just been bought by IBM.

Earlier last year I was working with Cognea (and a few other chatbot companies) trying to get a service desk agent that could outperform human beings at a mega-sized organisation -- where even handling helpdesk text chats and email was a job handled by a large team. The part I was looking after (routing of incident tickets and predicting failed changes) turned into Queckt (AEED).

Yes, well, anyway, Cognea got bought last year too.

So here's my next prediction: IBM buys x.ai. 

Two reasons:

1. I'm a big fan of x.ai's work, so based on past experience they will be bought out by someone sooner or later. If IBM doesn't, someone else will.
2. Lotus has an integrated calendar and mail system. It's in large organisations with busy executives who could be served very well by an (AI) agent who could organise meetings on their behalf. x.ai only need to plug-in a new back-end calendar service and a new fetch-from-a-Domino-server mail client. Then Notes actually has a useful feature that might stop customers slipping away to Google Apps and Office365.

On the other hand, not every company with artificial intelligence products gets bought by IBM. For example, IFOST hasn't. ;-)

Here are some of the things we've done:

• Smart systems monitoring: automatic anomaly detection for events on CPU, memory and I/O; detection of log files without human intervention and then determining which messages are important or trivial; prediction of future capacity exhaustion.
• Intra-oral dental image analysis
• Improving ITIL ticket handling by 30% using vocabulary detection
• Identifying student learning disabilities by timing analysis

Let me know if you are interested in any of these. I'll make sure we're not bought out by IBM!