Category Archives: artificial intelligence

The Illusion of Control: What the Second Line Gets Wrong—and What Regulators and Failures Reveal

By Jeremy Swenson

Thirty-one. That is how many unaddressed safety-and-soundness supervisory warnings Silicon Valley Bank was sitting on when it collapsed in March 2023—roughly triple the number carried by comparable banks. The warnings existed. Examiners had written them down. Committees had reviewed them. And the bank failed anyway, in 36 hours, taking $209 billion in assets down with it.[1]

This figure isn’t really just about Silicon Valley Bank; it’s a broader story about how governance can falter right when it was meant to prevent failure. Across modern sectors like finance, healthcare, insurance, and tech—especially under heavy regulation—the structure is quite similar: a First Line managing risks, a Third Line (Internal Audit) independently evaluating effectiveness, and a Second Line acting as an oversight layer to challenge and ensure risk remains within boundaries before issues arise.

The uncomfortable pattern across nearly every major governance failure of the last fifteen years is not that the second line was absent. It was there, busy, and documented—and it still didn’t work.

That is the uncomfortable pattern across nearly every major governance failure of the last fifteen years: the second line of defense (2LOD) was rarely absent. It was there, it was busy, and it was thoroughly documented. JPMorgan’s Chief Investment Office had risk managers. Credit Suisse’s Prime Services division had a dedicated risk team. Wells Fargo had a corporate risk function, a legal department, and an audit group that all reviewed the Community Bank. Danske Bank’s Estonian branch had internal audit and a chief risk officer. In each case, the paperwork existed. The risk did not go away.

This raises the question at the center of this piece, and one that boards, regulators, and chief risk officers are increasingly asking out loud: is the modern second line of defense actually reducing risk—or is it primarily producing evidence that governance activities occurred? The two are not the same thing, and the gap between them is where some of the costliest failures in recent corporate history have lived.

What the Second Line Is Supposed to Do

The three-lines model that underpins risk governance at virtually every large regulated institution was formalized by the Institute of Internal Auditors in 2013 and substantially updated in 2020. The first line is operational management—the traders, lenders, engineers, and business unit leaders who own risk because they create it in the course of doing their jobs. The third line is internal audit, an independent function that reports to the board and periodically tests whether the first two lines are actually working. The second line sits in the middle: risk management, compliance, information security, and similar functions that provide, in the Institute’s own language, “complementary expertise, support, monitoring, and challenge” to the business.[2]

In U.S. banking specifically, this structure is not just best practice—it is regulatory expectation with teeth. The Office of the Comptroller of the Currency’s (OCC) 2014 heightened standards for large national banks explicitly require an independent risk management function, organizationally and financially separate from the business lines it oversees. The Federal Reserve’s 2011 guidance on model risk management, SR 11-7, assigns the second line an independent validation role specifically because business lines have an inherent incentive to trust their own models.[3]

Notably, when the Institute of Internal Auditors rewrote its guidance in 2020, it deliberately dropped the word “defense” from the model’s name, worried that the martial framing had encouraged organizations to treat risk management as purely defensive—blocking and reviewing—rather than as a function that helps an organization take the right risks well. That single word change is a useful preview of this piece’s argument: a second line built entirely around defense metrics—how many reviews were completed, how many policies exist, how many attestations were signed—can satisfy every requirement on paper while missing the actual point.[4]

Where the Model Breaks Down

Strip away the acronyms, and the recurring failure modes of the second line reduce to a short, uncomfortable list. Each one, on its own, sounds like a minor process gap. Together, and when combined with real money and real institutions, they have produced some of the largest corporate governance failures on record.

Documentation Instead of Risk Reduction

The clearest symptom is a second line that measures itself by volume: reviews completed, policies published, attestations collected, meetings held. Every one of those activities can be running at full capacity while the underlying risk grows untouched, because none of them require anyone to verify that a control actually works—only that someone said it does.

Self-Attestation Over Independent Verification

Much of traditional second-line practice depends on the first line telling the second line the truth: attestations, self-assessments, and point-in-time control tests that sample a narrow window and assume it represents the whole. When Danske Bank’s Estonian branch was later examined, the bank’s own lawyers conceded that “major deficiencies in controls and governance made it possible to use Danske Bank’s branch in Estonia for criminal activities such as money laundering,” and that internal reporting simply never reached the people positioned to stop it.[5]

Individual Exceptions Over Systemic Patterns

Second lines are often organized to catch one broken control at a time—a missed reconciliation, a late report, an expired certificate—rather than to notice that dozens of small, individually explainable exceptions are actually one large, systemic problem wearing different clothes.

Compliance Treated as a Proxy for Safety

Perhaps the most persistent conflation in second-line practice is the assumption that a control environment which satisfies a regulation is therefore a control environment that manages the underlying risk. The two frequently travel together. They are not the same claim, and treating them as interchangeable is exactly how organizations end up technically compliant and substantively exposed at once.

A Challenge Function That Doesn’t Actually Challenge

Effective second-line challenge requires two things that are hard to combine: enough independence to say no to a profitable business line, and enough technical and commercial fluency to know when “no” is actually warranted. Many second lines have one without the other—independent enough to be disliked, but not fluent enough in the actual business to be heeded, or so embedded in the business that independence quietly erodes.

Struggling to Govern What It Doesn’t Understand

Every one of the weaknesses above compounds sharply the moment the underlying risk is technical: artificial intelligence models, cloud migrations, third-party data pipelines, or novel cyber threats. A second line built to review loan files and sales scripts is not automatically equipped to evaluate a machine learning model’s training data lineage or a cloud vendor’s shared-responsibility boundary—and regulators are now saying so explicitly. NIST’s AI Risk Management Framework (RMF) and the broader push toward AI-specific governance exist precisely because traditional control catalogs were not written with adaptive, probabilistic systems in mind.[6]

Five Failures, One Pattern

These are not abstractions. They are the documented findings of regulators, board-appointed investigators, and congressional committees—and read together, they describe the same failure recurring in different industries, different countries, and different decades.

1. JPMorgan’s “London Whale” (2012)—When Risk Managers Don’t Know What the Business Is Doing

In 2012, JPMorgan Chase’s Chief Investment Office lost more than $6.2 billion on a series of synthetic credit derivative trades that came to be known as the “London Whale.” The U.S. Senate Permanent Subcommittee on Investigations spent nine months and reviewed more than 90,000 documents before concluding that the unit had mismarked its trading book to hide losses, disregarded multiple indicators of increasing risk, manipulated its own risk models, and evaded regulatory oversight.[7]

The Subcommittee’s report found that JPMorgan’s firm-wide risk managers—the second line—“knew little about” the trading strategy and had no role in approving the positions that produced the loss, even as the bank’s own public statements insisted the trades were consistent with firm-wide risk management. This was a second line that existed on the org chart and was functionally absent from the transaction that mattered most.[8]

2. Wells Fargo’s Sales Practices Scandal (2011–2016)—When Egos and Tenure Silence the Second Line

Between 2011 and 2016, Wells Fargo employees opened millions of unauthorized accounts to meet aggressive sales quotas, ultimately leading to the termination of roughly 5,300 employees and $185 million in regulatory penalties. When the bank’s independent directors released their own 110-page investigation in 2017, the findings went well beyond a rogue sales culture.[9]

The report found that Carrie Tolstedt, the long-tenured head of the Community Bank, and other Community Bank leaders “resisted and impeded scrutiny or oversight from corporate risk management and the Board,” and “minimized the scale and nature of problems” when they were forced to report them. Then-CEO John Stumpf, the report found, relied on “the Bank’s decades of success” and was “too slow to investigate or critically challenge” the sales model—a textbook description of tenure-driven bias, where years of past success become evidence against present-day concerns rather than a reason to look harder.[10]

Just as tellingly, the report found that Wells Fargo’s control functions were structurally weakened by internal politics: risk, legal, HR, and audit were “decentralized” and had “parallel units” embedded inside the Community Bank itself, reporting up through business-aligned structures that deferred to the business rather than challenging it. Audit reviewed the relevant controls and largely found them effective—but, the report notes pointedly, “it did not view its role to include analyzing more broadly the root cause of the improper conduct.” That is the governance-activity trap in a single sentence: the review happened, the box was checked, and the actual problem sailed through untouched.[11]

3. Credit Suisse and Archegos (2021)—When the Second Line Is Afraid to Say No

In March 2021, the collapse of Archegos Capital Management, a lightly regulated family office, cost Credit Suisse $5.5 billion—more than any other bank exposed to the same client. The board-commissioned investigation by Paul, Weiss found no fraud and no missing risk architecture. The controls existed. What failed was the willingness to use them.[12]

The investigation found a “persistent failure” to manage and remediate known risks connected to Archegos, and, more specifically, that Credit Suisse’s risk managers had intended to demand additional margin from Archegos to reflect its mounting credit risk—but were prevented from doing so because the business “deemed” it not to be in the bank’s commercial interest to upset the relationship. One outside review summarized the underlying dynamic bluntly: this was “a business more scared of losing a client than addressing the risks that client was bringing to the bank.” The report also found the Prime Services risk team itself was understaffed, had failed to replace departing senior risk staff, and lacked leadership experience—the second line, quite literally, hollowed out from within.[13]

4. Danske Bank Estonia (2007–2018)—When the Second Line Covers Its Own Mistakes

Danske Bank’s Estonian branch moved an estimated $230 billion in suspicious transactions, much of it linked to Russia, between 2007 and 2015—one of the largest money-laundering cases in European history. It might never have come to light if not for Howard Wilkinson, a British trader who filed four internal whistleblower reports to the bank’s audit unit and Copenhagen management between 2013 and 2014.[14]

Wilkinson later testified before the Danish and European Parliaments that the bank had “deliberately ignored” his warnings and that an Estonia branch executive told him the bank was “not the police.” An internal Danske audit team eventually validated the substance of his concerns, yet the bank still failed to take meaningful action until the money-laundering scandal became public in 2018—four years later. As Wilkinson departed the bank, he was reportedly presented with a nondisclosure agreement. This is the sharpest version of the pattern this piece was asked to examine directly: not a second line that failed to notice a problem, but one that noticed, confirmed it internally, and chose containment over correction—protecting the institution’s narrative rather than fixing the underlying failure.[15]

5. Silicon Valley Bank (2023)—When Periodic Reviews Can’t Keep Up With Real-Time Risk

SVB failed in 36 hours following a bank run, but the vulnerabilities behind it built for years. The Federal Reserve’s own review, led by Vice Chair for Supervision Michael Barr, is remarkable for how directly a regulator indicted its own supervisory process: SVB’s board and management “failed to manage their risks,” Federal Reserve supervisors “did not fully appreciate the extent of the vulnerabilities” as the bank grew, and—critically—even when supervisors did identify problems, they “did not take sufficient steps to ensure that Silicon Valley Bank fixed those problems quickly enough.”[16]

The report also found that SVB itself had changed its own risk-management assumptions specifically to reduce how its interest rate risk was measured, rather than managing the underlying exposure—a second-line control quietly redefined until it stopped producing uncomfortable answers. Barr’s report is also a rare admission that periodic, point-in-time supervisory cycles are structurally too slow for a risk that can move at deposit-run speed; a regulator reaching the same conclusion this piece reaches about the second line more broadly.[17]

What Regulators Learned—And Where Their Own Findings Converge

The most useful evidence that this is a systemic problem, not a string of unrelated scandals, comes from the regulators themselves. On April 28, 2023, the Federal Reserve and the Federal Deposit Insurance Corporation (FDIC) each released their own self-critical report on the same weekend of bank failures—an unusually candid coincidence that let the two reports be read side by side.

The Fed’s report on SVB, discussed above, found that supervisors identified real vulnerabilities but did not escalate forcefully enough once they had. The FDIC’s own report on Signature Bank reached a strikingly similar structural conclusion through a completely separate investigation: the bank’s failure was rooted in poor management, but the report also found that FDIC examiners had downgraded Signature’s liquidity rating as early as 2017 while its overall composite rating stayed at a healthy “2-Satisfactory” for six more years—a gap between what examiners were seeing and what the supervisory rating actually communicated.[18]

The U.S. Government Accountability Office (GAO) took a further step by reviewing both agencies together rather than separately. It concluded that this supports the main argument of this piece concerning federal banking regulation: the Federal Reserve and FDIC “identified numerous concerns at the banks as early as 2018, but did not issue enforcement actions.” Additionally, the GAO pointed out that the Federal Reserve’s “procedures for moving from a lower-level concern to an enforcement action often weren’t clear or specific.” This indicates that a regulator, assessing itself, independently recognizes the same core idea discussed here: identifying a risk is not the same as forcing a change. An institution can recognize risks on a large scale for years without reliably enforcing change.[19]

Read together with the NIST AI Risk Management Framework’s push for governance built around measurable, continuous risk assessment rather than static control catalogs, and the IIA’s 2020 shift away from purely defensive framing, a consistent regulatory direction emerges across otherwise unrelated bodies: less faith in point-in-time review, more emphasis on forcing identified risk into actual remediation, and explicit skepticism that documentation volume is a reliable proxy for safety. None of these bodies coordinated with each other. They arrived at overlapping conclusions anyway, because they were all looking at the same underlying failure pattern from different angles.[20],[21]

Figure 1. Most second-line functions do not lack activity—they sit in the high-activity, low-reduction quadrant, producing evidence of governance without changing risk outcomes.

The 2LOD governance trap and its four related boxes.

The Part Nobody Puts in the Org Chart: Tenure, Ego, and Internal Turf Wars

Every case above shares a dynamic that rarely appears in a governance framework diagram but shows up in nearly every post-mortem: the people closest to a mistake are often the ones best positioned to prevent its discovery, and organizational tenure tends to make that worse rather than better.

Long-tenured leaders accumulate something more dangerous than complacency—they accumulate authorship. A risk model, a sales program, a client relationship built over a decade is not just a business asset to the person who built it; it is proof of their own judgment. Wells Fargo’s Board Report describes exactly this pattern in Carrie Tolstedt, who had run the Community Bank for years and treated challenges to the sales model as challenges to her track record, not as useful information. John Stumpf’s decades at the company produced the same effect at the top: reliance on “decades of success” became a reason to discount new evidence rather than investigate it.[22]

Ego compounds this in a specific and predictable way inside the second line itself: once a risk function has signed off on something—approved a model, cleared a client, blessed a control—reversing that judgment later means admitting the earlier review was wrong. The Credit Suisse-Archegos investigation found that risk staff who wanted to tighten margin requirements were overruled by colleagues managing the client relationship, who prioritized the commercial relationship over the escalation. That is not a hypothetical about incentives; it is a documented instance of one part of the organization protecting a prior decision instead of correcting course.[23]

The most direct evidence of internal fighting to cover mistakes is Danske Bank. Wilkinson’s own account describes a bank that did not simply fail to notice a problem—it received internal confirmation that the problem was real, from its own audit function, and chose a non-disclosure agreement and years of silence over disclosure and remediation. That is not a control gap. It is a second line, or the executives who supervise it, actively managing the appearance of the problem rather than the problem itself—the containment instinct that shows up whenever an admission of error threatens a career, a bonus cycle, or a carefully maintained reputation.[24]

A second line that cannot survive telling the truth about its own prior mistakes will eventually stop looking for them.

None of this requires malice to be dangerous. Most of the people in these stories were not villains; they were professionals whose incentives, tenure, and self-image quietly bent the direction of ambiguous judgment calls toward “this is probably fine.” A modern second line has to be designed with the explicit assumption that this bending will happen—through rotation of long-tenured reviewers, external validation of internally cleared decisions, and protected channels for escalation that do not depend on the goodwill of the person whose earlier judgment is being questioned.

Governance Activity Is Not the Same as Risk Reduction

Every case study mentioned earlier successfully passed a compliance test before turning into a scandal. This is the key point repeatedly emphasized here: governance that merely shows evidence of compliance is different from governance that genuinely reduces risk. An organization can generate a lot of documentation proving compliance but still fall short in actually altering risk outcomes.

Evidence-of-compliance governance is legible, defensible in an exam, and relatively cheap to produce: a signed attestation, a completed checklist, a policy that has been “reviewed and approved.” Outcome-based governance is harder and more expensive: independently tested controls, risk metrics tied to actual loss experience, escalation paths that get used even when the news is bad. The first kind of governance protects the organization in an audit. The second kind protects the organization in a crisis. Wells Fargo, Credit Suisse, and Danske Bank all had abundant supplies of the first and a critical shortage of the second.

Figure 2. Modernizing the second line means shifting the underlying operating model, not just increasing the volume of existing activity.

Two columns showing the legacy model of checkbox compliance and the new model of continuous risk governance.

What a Modern Second Line Actually Looks Like

None of this argues for a weaker second line—every case study here shows the cost of that. It argues for a fundamentally different operating model, one that a growing body of regulatory guidance and industry practice is already pointing toward.

Risk-Based, Not Checklist-Based

Oversight intensity should scale with actual risk and complexity, not with how many items happen to be on a standard control list. A stable, well-understood process and a novel AI model deployed into a regulated decision workflow should never receive the same depth of review simply because both appear as line items on the same checklist.

Continuous Monitoring, Not Periodic Snapshots

The Barr report on SVB is itself an argument for this shift: point-in-time exams cannot keep pace with risks—interest rate exposure, deposit concentration, model drift—that can move materially between review cycles. Where technology allows it, continuous, automated monitoring should replace calendar-driven review as the default, with periodic deep-dives reserved for the risks continuous monitoring cannot yet see.

Evidence Over Attestation

Self-reported control effectiveness should be treated as a starting hypothesis, not a conclusion. Independent data validation—sampling actual transactions, actual model outputs, actual system logs—is more expensive than collecting a signature, and it is the only version of assurance that would have caught what self-attestation missed at Danske Bank.

Genuine Business and Technology Fluency

A second line cannot challenge what it does not understand. This means recruiting and developing risk professionals with real technical depth—in derivatives, in cloud architecture, in machine learning—rather than treating the second line as a generalist compliance career track. JPMorgan’s risk managers not knowing what the CIO’s synthetic credit portfolio actually did is the clearest cautionary tale on this point.

Escalation That Survives Internal Politics

Escalation paths need to be structurally protected from the relationship dynamics that killed escalation at Credit Suisse and Danske Bank—which means routing serious concerns to a level of the organization with no commercial stake in the outcome, and protecting the people who raise them, not just on paper but in how the organization actually treats them afterward.

Outcome-Based Metrics

A second line’s effectiveness should be measured by risk events avoided, losses prevented, and issues resolved before they compound—not by the number of reviews completed, policies published, or meetings held. Volume metrics are easy to game and easy to satisfy without changing anything; outcome metrics are harder to fake.

Real Oversight of AI, Cloud, and Third Parties

Emerging-technology governance needs its own competency track within the second line, built around frameworks purpose-designed for these risks—NIST’s AI Risk Management Framework, cloud shared-responsibility models, and structured third-party risk programs—rather than an attempt to stretch legacy control catalogs over technology they were never built to evaluate.[25]

Clear Accountability Between the First and Second Lines

Wells Fargo’s decentralized risk structure, with control functions embedded inside and reporting up through the business they were meant to oversee, shows what happens when the line between “owns the risk” and “challenges the risk” blurs. Modern governance requires those roles to remain organizationally and, where possible, financially distinct—precisely what the OCC’s heightened standards were written to enforce.[26]

Constructive Challenge, Not a Permanent Bottleneck

None of the above is a case for more friction everywhere. A second line that slows every decision equally will be resented, routed around, and eventually ignored—which is its own form of failure. The goal is targeted friction: fast, low-touch review for well-understood, lower-risk activity, and genuinely rigorous, well-resourced challenge concentrated on the decisions that could actually sink the institution.

Conclusion: Measuring the Right Thing

Return to Silicon Valley Bank’s 31 unaddressed supervisory warnings. Every one of them was, in a narrow sense, evidence that governance was happening: someone had identified a risk, written it down, and tracked it. And every one of them failed to change what actually happened to the bank. That is the second line’s central modern challenge, in miniature.

None of this is solvable by better metrics alone. Every case study in this piece also involved someone for whom the honest answer was personally expensive—a bonus, a reputation, a decade of authorship over a program now under question. A second line rebuilt around outcome-based measurement but layered on top of the same career incentives that rewarded Carrie Tolstedt’s silence and cost Howard Wilkinson his job will simply produce more sophisticated versions of the same evasions. The measurement has to change. So does the price of telling the truth.

It is also worth taking seriously what the regulators’ own convergence implies about where this is heading. The Federal Reserve, the FDIC, the GAO, NIST, and the IIA did not coordinate their findings—they arrived at the same conclusion independently, from different mandates, within the same few years. Convergence without coordination is usually a sign that a standard is hardening, not that a moment is passing. Institutions that treat this argument as a post-SVB overreaction, rather than the new baseline expectation, are likely to be rereading their own supervisory letters in a few years and wondering how they missed it.

The stakes of getting this right are also rising, not leveling off. Every failure examined here involved a risk that a sufficiently empowered reviewer could, in principle, still understand—a trading book, a sales incentive, a margin call. The AI models now moving into underwriting, claims, and credit decisions will not extend that same courtesy; their behavior can shift with a single retraining cycle in ways no annual attestation was ever built to catch. A second line that could not reliably catch a mismarked trading book will not reliably catch a model that has quietly drifted—not without first becoming the kind of second line this piece has been describing.

The organizations in this piece did not fail because nobody was watching. They failed because watching, on its own, was mistaken for managing. A modern second line has to be judged by a harder, more honest standard than whether the reviews got done: whether the risks that mattered actually got smaller. Everything else—the frameworks, the dashboards, the attestations—is only useful to the extent it serves that one outcome. Where it doesn’t, it is not governance. It is just paperwork with better branding.

Endnotes

[1]  Board of Governors of the Federal Reserve System, Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank (Washington, DC: Federal Reserve, April 28, 2023), https://www.federalreserve.gov/publications/files/svb-review-20230428.pdf; “Fed’s Barr: ‘Weaknesses in Supervision and Regulation Must Be Fixed,’” American Banker, April 28, 2023, https://www.americanbanker.com/news/feds-barr-weaknesses-in-supervision-and-regulation-must-be-fixed.

[2] The Institute of Internal Auditors, The IIA’s Three Lines Model: An Update of the Three Lines of Defense (Lake Mary, FL: IIA, July 2020), https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf.

[3]  Office of the Comptroller of the Currency, OCC Guidelines Establishing Heightened Standards for Certain Large Insured National Banks, Insured Federal Savings Associations, and Insured Federal Branches, 12 C.F.R. Part 30, Appendix D (2014); Board of Governors of the Federal Reserve System, “Supervisory Guidance on Model Risk Management,” SR Letter 11-7 (Washington, DC: Federal Reserve, April 4, 2011).

[4]  “IIA Unveils New Three Lines Model,” Radical Compliance, July 22, 2020, https://www.radicalcompliance.com/2020/07/22/iia-unveils-new-three-lines-model/.

[5]  “Howard Wilkinson,” Kohn, Kohn & Colapinto Whistleblower Case Archive, accessed August 2026, https://kkc.com/whistleblower-case-archive/howard-wilkinson/.

[6]  National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (Gaithersburg, MD: U.S. Department of Commerce, January 26, 2023), https://doi.org/10.6028/NIST.AI.100-1.

[7]  U.S. Senate Permanent Subcommittee on Investigations, Committee on Homeland Security and Governmental Affairs, JPMorgan Chase Whale Trades: A Case History of Derivatives Risks and Abuses (Washington, DC: U.S. Senate, March 15, 2013), https://www.hsgac.senate.gov/subcommittees/investigations/library/files/report-jpmorgan-chase-whale-trades-a-case-history-of-derivatives-risks-and-abuses-march-15-2013/.

[8]  JP Morgan Chase Whale Trades: A Case History of Derivatives Risks and Abuses, summarized in Demos, https://www.demos.org/research/jp-morgan-chase-whale-trades-case-history-derivatives-risks-and-abuses.

[9]  Independent Directors of the Board of Wells Fargo & Company, Sales Practices Investigation Report (San Francisco: Wells Fargo & Company, April 10, 2017), https://lowellmilkeninstitute.law.ucla.edu/wp-content/uploads/2018/01/WF-Board-Report.pdf.

[10]  Wells Fargo Newsroom, “Wells Fargo Board Releases Findings of Independent Investigation of Retail Banking Sales Practices and Related Matters,” press release, April 10, 2017, https://newsroom.wf.com/news-releases/news-details/2017/Wells-Fargo-Board-Releases-Findings-of-Independent-Investigation-of-Retail-Banking-Sales-Practices-and-Related-Matters/default.aspx.

[11]  “Summary of the Report of the Independent Directors of Wells Fargo & Company into Sales Practices,” Lexology, October 11, 2017, https://www.lexology.com/library/detail.aspx?g=9b82dbcc-146d-4921-847c-526ccbf505a2; Brad S. Karp, Roberto J. Gonzalez, and Vikas Desai, “Lessons Learned from the Wells Fargo Sales Practices Investigation Report,” Harvard Law School Forum on Corporate Governance, April 22, 2017, https://corpgov.law.harvard.edu/2017/04/22/lessons-learned-from-the-wells-fargo-sales-practices-investigation-report/.

[12]  Credit Suisse Group AG, Report of the Special Committee of the Board of Directors of Credit Suisse Group Regarding Archegos Capital Management, prepared by Paul, Weiss, Rifkind, Wharton & Garrison LLP (July 29, 2021), as reported in “Credit Suisse Publishes Independent Review of Archegos Losses,” Paul, Weiss news release, July 29, 2021, https://www.paulweiss.com/practices/litigation/internal-investigations/news/credit-suisse-publishes-independent-review-of-archegos-losses.

[13]  “Unpacking the Report on Credit Suisse’s Archegos Disaster,” Euromoney, July 29, 2021, https://www.euromoney.com/article/28usrfe6tdwq9fkpayosg/capital-markets/unpacking-the-report-on-credit-suisses-archegos-disaster/; “Credit Suisse and the Archegos Collapse – Lessons in Risk Management and Governance for All,” BDO, February 21, 2025, https://www.bdo.co.uk/en-gb/insights/industries/financial-services/credit-suisse-and-the-archegos-collapse-lessons-in-risk-management-and-governance.

[14]  “Whistleblower in Danish Banking Scandal: Bank Ignored Me,” Associated Press via Seattle Times, November 19, 2018, https://www.seattletimes.com/business/whistleblower-in-danish-banking-scandal-bank-ignored-me/; “Danske Bank Money Laundering Scandal – Tip of the Icebergs,” National Law Review, accessed August 2026, https://natlawreview.com/article/danske-bank-money-laundering-scandal-tip-icebergs.

[15]  “Howard Wilkinson,” Kohn, Kohn & Colapinto Whistleblower Case Archive, accessed August 2026, https://kkc.com/whistleblower-case-archive/howard-wilkinson/; “Thanks to Danske Bank Whistleblower, SEC Sets Aside $178 Million for Harmed Investors,” Whistleblower Blog, April 4, 2023, https://whistleblowersblog.org/corporate-whistleblowers/sec-whistleblowers/thanks-to-danske-bank-whistleblower-sec-sets-aside-178-million-for-harmed-investors/.

[16]  Board of Governors of the Federal Reserve System, Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank, i-iii; “Federal Reserve Board Announces the Results from the Review of the Supervision and Regulation of Silicon Valley Bank,” press release, April 28, 2023, https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230428a.htm.

[17]  Board of Governors of the Federal Reserve System, Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank, 3.

[18]  Federal Deposit Insurance Corporation, FDIC’s Supervision of Signature Bank (Washington, DC: FDIC, April 28, 2023), https://www.fdic.gov/news/press-releases/2023/pr23033a.pdf; “FDIC Signature Bank Report Summary,” prepared for the U.S. House Committee on Financial Services, May 2, 2023, https://financialservices.house.gov/uploadedfiles/2023.05.02_-_fdic_signature_bank_report_summary_final.pdf.

[19]  U.S. Government Accountability Office, Bank Supervision: More Timely Escalation of Supervisory Action Needed, GAO-24-106974 (Washington, DC: GAO, 2024), https://www.gao.gov/products/gao-24-106974.

[20]  National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (Gaithersburg, MD: U.S. Department of Commerce, January 26, 2023), https://doi.org/10.6028/NIST.AI.100-1.

[21]  The Institute of Internal Auditors, The IIA’s Three Lines Model: An Update of the Three Lines of Defense (Lake Mary, FL: IIA, July 2020), https://www.theiia.org/globalassets/documents/resources/the-iias-three-lines-model-an-update-of-the-three-lines-of-defense-july-2020/three-lines-model-updated-english.pdf.

[22]  Independent Directors of the Board of Wells Fargo & Company, Sales Practices Investigation Report.

[23]  “Credit Suisse and the Archegos Collapse,” BDO; “Unpacking the Report on Credit Suisse’s Archegos Disaster,” Euromoney.

[24]  “Whistleblower in Danish Banking Scandal: Bank Ignored Me,” Seattle Times; “Howard Wilkinson,” Kohn, Kohn & Colapinto.

[25]  National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0).

[26]  Office of the Comptroller of the Currency, OCC Guidelines Establishing Heightened Standards, 12 C.F.R. Part 30, Appendix D; Independent Directors of the Board of Wells Fargo & Company, Sales Practices Investigation Report.

From Mythos to Fable: What Business Leaders Must Learn from the New AI Governance Crisis

Anthropic Claud Mythos InfoSec Infographic, generic rights-free, 2026.

The Mythos Moment Just Got Bigger

A few weeks ago, Anthropic’s Mythos model was being celebrated as a breakthrough in AI-enabled cybersecurity. Reports suggested it could identify software vulnerabilities at unprecedented speed, accelerate remediation efforts, and potentially transform how organizations secure critical infrastructure. Some observers described it as one of the most capable cyber-focused AI systems ever developed.¹

Today, the conversation looks very different. The White House has ordered Anthropic to suspend access to Mythos 5 and Fable 5 for foreign nationals, citing national security concerns. Reports indicate that government officials were concerned not only about potential jailbreak vulnerabilities but also about the possibility that a China-linked group may have accessed the models.² The administration reportedly fears that advanced frontier models could be reverse-engineered through model distillation techniques, allowing strategic competitors to replicate key capabilities.³

Whether those concerns ultimately prove justified is almost beside the point. For business leaders, the real lesson is not about Anthropic. It is about the future of AI itself. The Mythos controversy signals that AI governance is rapidly evolving from a technology management issue into a business resilience, geopolitical risk, and digital supply chain challenge.⁴

The New Reality: AI Is Becoming Strategic Infrastructure

For years, organizations treated cloud computing as utility infrastructure. Access was largely assumed. The same cloud services were available whether you were in Minneapolis, Mumbai, London, or Singapore. Artificial intelligence appeared to be following a similar trajectory.

That assumption may no longer hold. The government’s restrictions on Mythos and Fable represent one of the first major examples of an advanced AI model being treated more like sensitive defense technology than commercial software.⁵ In effect, policymakers are beginning to ask whether some AI systems should be governed similarly to advanced semiconductors, encryption technologies, or military capabilities.

If that trend continues, organizations may find that access to critical AI capabilities can be restricted, delayed, licensed, monitored, or even revoked based on national security considerations.⁶ That should concern every executive currently building long-term business strategies around AI-enabled operations.

Why Business Leaders Should Care

Many executives may be tempted to dismiss the Mythos controversy as a dispute between Anthropic and the federal government. That would be a mistake. The more important story is not whether Anthropic’s safeguards were sufficiently robust or whether a jailbreak vulnerability actually existed. The real story is that organizations are rapidly becoming dependent on AI systems they do not own, cannot fully inspect, and may not always be able to access.

Imagine investing millions of dollars to integrate a frontier AI model into cybersecurity operations, software development, customer service, fraud detection, or enterprise decision-making, only to discover that access has been restricted due to a government directive, geopolitical concerns, export controls, or actions taken by the model provider itself. What appeared to be a stable technology platform can quickly become a strategic dependency.⁷

This is precisely why the Mythos situation deserves attention from boards, executives, and risk leaders. The disruption was not caused by a system outage, ransomware attack, or cloud failure. Instead, it emerged from a combination of national security concerns, policy decisions, and uncertainty surrounding advanced AI capabilities. These are risks that many organizations have not yet incorporated into their enterprise risk management programs.⁸

Historically, leaders worried about disruptions involving suppliers, cloud providers, telecommunications carriers, or critical software vendors. Frontier AI models now belong in that same category. Organizations increasingly depend upon a relatively small number of providers for advanced AI capabilities, creating concentration risks that may become more significant as AI becomes embedded in core business processes.⁹

Endnotes

  1. Anthropic, Project Glasswing Technical Findings, June 2026.
  2. Terrence O’Brien, “China May Have Accessed Mythos,” The Verge, June 14, 2026.
  3. Ibid.
  4. Kristian McCann, “Why the US Restricted Anthropic’s Mythos and Fable and What It Means for AI Access,” June 15, 2026.
  5. Hadas Gold, “Anthropic Suspends All Access to Mythos Model After US Government Bans Foreign Nationals Use,” CNN, June 13, 2026.
  6. McCann, “Why the US Restricted Anthropic’s Mythos and Fable.”
  7. Gold, “Anthropic Suspends All Access to Mythos Model.”
  8. O’Brien, “China May Have Accessed Mythos”; Gold, “Anthropic Suspends All Access to Mythos Model.”
  9. McCann, “Why the US Restricted Anthropic’s Mythos and Fable.”

Digital Horizons: 8 Transformative Trends Reshaping AI, Cybersecurity, Strategy, and Crypto for a Smarter 2025

Fig. 1. Digital Horizons Infographic, Jeremy Swenson, 2025.

Minneapolis—

The rapid technological developments of 2024 have established a foundation for significant shifts in artificial intelligence (AI), cybersecurity, digital strategy, and cryptocurrency. Business executives, policy leaders, and tech enthusiasts must pay attention to these key learnings and trends as they navigate the opportunities and challenges of 2025 and beyond. Here are eight insights to keep in mind.

1. AI Alignment with Business Goals:

2024 underscored the importance of aligning AI initiatives with overarching business strategies. Companies that successfully integrated AI into their workflows—particularly in areas like customer service automation, predictive analytics, tech orchestration, and supply chain optimization—reported not only significant productivity gains but also enhanced customer satisfaction. For instance, AI-powered tools allowed firms to anticipate customer needs with remarkable accuracy, leading to a 35% improvement in retention rates. However, misalignment of AI projects often resulted in wasted resources, showcasing the need for thorough planning. To succeed in 2025, organizations must create cross-functional AI task forces and establish KPIs tailored to their unique business objectives.[1]

2. The Rise of Responsible AI:

As AI adoption grows, so does scrutiny over its ethical implications. 2024 saw regulatory frameworks such as the EU’s AI Act and similar policies in Asia gain traction, emphasizing transparency, accountability, and fairness in AI deployments. Companies that proactively implemented explainable AI models—capable of detailing how decisions are made—not only avoided legal risks but also gained consumer trust. Moreover, organizations adopting responsible AI practices observed better team morale, as employees felt more confident about using ethically sound tools. The NIST AI Risk Management Framework is a good start. Leaders in 2025 must view responsible AI as a strategic advantage, embedding ethical considerations into every stage of AI development.[2]

3. Cyber Resilience Becomes Non-Negotiable:

The escalation of sophisticated cyber threats—including AI-driven malware and deepfake fraud—led to a dramatic increase in cybersecurity investments. Many businesses adopted zero-trust models, ensuring that no user or device is trusted by default, even within corporate networks. Product owners must build products with a DevSecOps mindset and must think out misuse cases from many angles. Additionally, the integration of machine learning for anomaly detection enabled real-time identification of threats, reducing breach response times by over 50%. As the cost of cybercrime is projected to exceed $10 trillion globally by 2025, organizations must prioritize cyber resilience through advanced threat intelligence, employee training, and frequent vulnerability assessments. Cyber resilience is no longer a luxury but a fundamental pillar of operational stability.[3]

4. Quantum Readiness Emerges as a Critical Strategy:

Quantum computing made significant strides in 2024, with breakthroughs in error correction and hardware scalability bringing the technology closer to mainstream use. While practical quantum computers remain years away, their potential to break traditional encryption methods has already prompted a cybersecurity rethink. Forward-looking organizations have begun transitioning to quantum-safe cryptographic algorithms, ensuring that their sensitive data remains secure against future quantum attacks. Industries like finance and healthcare—where data sensitivity is paramount—are leading the charge. By adopting a proactive quantum readiness strategy, businesses can mitigate long-term risks and position themselves as leaders in a post-quantum era.[4]

5. The Blockchain Renaissance:

Blockchain technology continued to evolve beyond its cryptocurrency roots in 2024, finding innovative applications in sectors such as logistics, healthcare, and real estate. For example, blockchain’s immutable ledger capabilities enabled unprecedented transparency in supply chains, reducing fraud and enhancing consumer trust. Meanwhile, the tokenization of physical assets, such as real estate and fine art, democratized access to investment opportunities, attracting a broader range of participants. Organizations leveraging blockchain reported reduced operational costs and faster transaction times, proving that the technology’s value extends far beyond speculation. In 2025, businesses must explore blockchain’s potential as a tool for enhancing efficiency and fostering trust.[5]

6. Employee Upskilling for Digital Transformation:

The digital skills gap emerged as a critical bottleneck in 2024, prompting organizations to invest heavily in workforce development. Comprehensive upskilling programs focused on AI literacy, cybersecurity awareness, and digital strategy were launched across industries. Employees equipped with these skills demonstrated greater adaptability and productivity, enabling their organizations to better navigate technological disruptions. Additionally, companies that prioritized learning cultures saw higher retention rates, as employees valued the investment in their professional growth. As digital transformation accelerates, the ability to upskill and reskill the workforce will be a key differentiator for organizations aiming to remain competitive.[6]

7. Convergence of AI and IoT:

The integration of AI and the Internet of Things (IoT) reached new heights in 2024, driving advancements in smart factories, connected healthcare, and autonomous vehicles. AI-enabled IoT devices allowed businesses to predict equipment failures before they occurred, reducing downtime and maintenance costs by up to 20%. In healthcare, AI-powered wearable devices provided real-time insights into patient health, enabling early intervention and personalized treatment plans. The growing adoption of edge computing further enhanced the responsiveness of AI-IoT systems, enabling real-time decision-making at the device level. This convergence is set to redefine operational efficiency and customer experiences in 2025 and beyond.[7]

8. The Decentralized Finance (DeFi) Evolution:

Decentralized Finance (DeFi) continued to mature in 2024, overcoming early criticisms of security vulnerabilities and lack of regulation. Enhanced interoperability between DeFi platforms and traditional financial systems enabled seamless cross-border transactions, attracting institutional investors. Innovations such as decentralized insurance and automated compliance tools further bolstered confidence in the ecosystem. As traditional banks increasingly explore blockchain for settlement and lending services, the line between centralized and decentralized finance is beginning to blur. In 2025, DeFi’s scalability and innovation are poised to challenge the dominance of legacy financial institutions, creating new opportunities for both consumers and businesses.[8]

Looking Ahead:

The intersection of AI, cybersecurity, digital strategy, and cryptocurrency offers unprecedented opportunities for value creation. However, success will hinge on leaders’ ability to navigate complexity, embrace innovation, foster outstanding leadership, and prioritize ethical stewardship. As these trends continue to evolve, businesses must remain agile and forward-thinking.

About the Author:

Jeremy A. Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and seasoned senior management tech risk and digital strategy consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds a certificate in Media Technology from Oxford University’s Media Policy Summer Institute, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota’s Technological Leadership Institute, an MBA from Saint Mary’s University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale, and New Hope Community Police Academy (MN), and the Minneapolis FBI Citizens Academy. You can follow him on LinkedIn and Twitter.

Footnotes:

  1. Smith, J. (2024). “AI’s Business Integration Challenges.” Tech Review.
  2. European Commission. (2024). “AI Act Regulatory Guidelines.” EU Tech Law Journal.
  3. Cybersecurity Ventures. (2024). “The Cost of Cybercrime: Annual Report.”
  4. Quantum Computing Report. (2024). “Quantum Progress and Cryptographic Implications.”
  5. Blockchain Association. (2024). “The Blockchain Beyond Crypto Study.”
  6. World Economic Forum. (2024). “The Future of Work: Digital Upskilling.”
  7. IoT Analytics. (2024). “The AI-IoT Convergence Report.”
  8. DeFi Pulse. (2024). “State of Decentralized Finance.”

Why You Should Spit Out the Corporate Kool-Aid if You Want Innovation

Fig. 1. The Fallacy of Corporate Kool-Aid, Jeremy Swenson, 2024.

Minneapolis—

Corporate culture often prides itself on “innovation” and “forward-thinking,” yet more often than not, it’s hindered by bias, malignant egos, and groupthink. Ironically, in organizations claiming to embrace innovation, employees can become immersed in an environment where dissent is discouraged, and adherence to the company’s established perspectives is a prerequisite for professional survival. This “corporate Kool-Aid” fosters an atmosphere where true innovation struggles to survive. For those who genuinely want to innovate, shedding these restrictive mindsets is essential.

The Innovation Blockers: Bias, Malignant Egos, and Groupthink:

Biases are deeply embedded in most corporate structures, forming an invisible barrier that subtly yet persistently stifles new ideas. Whether it’s confirmation bias, where decision-makers favor ideas that reinforce their pre-existing beliefs, or status quo bias, which resists significant change, these biases ensure that only certain perspectives are entertained. When an organization prioritizes only safe, incremental improvements, true breakthrough ideas are abandoned. Biases in corporations thus serve as a gatekeeper against ideas that could lead to substantial innovation, as anything that doesn’t fit within the current framework is dismissed as too risky.

Ego also plays a significant role in corporate stagnation. In large corporations, leaders are often incentivized to maintain their status, limiting the emergence of truly groundbreaking ideas that may disrupt existing hierarchies. Malignant egos—those that view challenges to the status quo as personal affronts—tend to quash any idea that questions their own vision. When ego takes precedence over objective evaluation, promising concepts are often sidelined or dismissed outright, limiting the potential for progress.

Perhaps the most insidious blocker of innovation is groupthink, a phenomenon that thrives in environments where conformity is rewarded. Groupthink arises when employees, out of fear of ostracization or in pursuit of consensus, align their ideas with what they believe to be the dominant perspective. This limits a company’s ability to approach problems creatively. Once groupthink takes hold, organizations become less adaptable, focusing on pleasing internal stakeholders instead of exploring unconventional approaches that could lead to innovation.

The Alternative: Start-Ups and Their Blueprint for Innovation:

Unlike large corporations, small start-ups are known for their nimbleness and freedom from these entrenched mindsets. Start-ups, by necessity, must adopt a creative approach to stand out in a competitive market. Their size allows them to quickly adapt, test, and refine ideas based on real-world feedback. They lack the layers of management and rigid protocols that stifle creativity in corporations, allowing them to pivot and re-imagine solutions as challenges arise.

Start-ups encourage dissent and debate rather than penalizing it, knowing that innovation rarely emerges from echo chambers. In these environments, groupthink is less likely to flourish because diverse, disruptive perspectives are often essential to a start-up’s success. Without the burden of malignant egos dominating decision-making, start-ups can remain focused on solving genuine problems instead of adhering to individual agendas.

Another advantage of start-ups is their natural resistance to the biases that pervade larger corporations. Start-ups often draw talent from diverse backgrounds and ideologies, meaning biases are more likely to be challenged and less likely to dictate outcomes. This environment fosters resilience against the conformity that stifles corporate innovation, creating an ecosystem where unique ideas can grow.

Breaking Free: Encouraging Innovation Outside the Corporate Mindset:

For those within corporate structures who still wish to innovate, breaking free from the influence of corporate Kool-Aid requires courage and a willingness to challenge entrenched perspectives. Start by questioning assumptions and biases, both personal and organizational, and by fostering a culture where dissent and debate are embraced rather than discouraged. Encourage cross-departmental collaboration, and resist the urge to fall in line with the dominant viewpoint. Innovation rarely emerges from comfort zones; it thrives in the challenging, often uncomfortable process of questioning and exploring new perspectives.

To truly innovate, corporations must consider restructuring their approach. They could adopt leaner, start-up-like teams with the flexibility to pursue independent projects. They must create a culture where ideas are judged on merit, not on the ego or position of the proposer.

Conclusion:

Innovation and corporate Kool-Aid are often incompatible. The groupthink, biases, and egos prevalent in large organizations act as barriers to breakthrough thinking, driving companies to favor predictability over exploration. By shedding these restrictive mindsets and looking to the adaptable, challenge-embracing cultures of start-ups, those genuinely committed to innovation can find ways to foster creativity, disruption, and genuine progress. In doing so, they have the potential to reshape not only their organizations but also their industries—proving that sometimes, the best way forward is to spit out the Kool-Aid.

About the Author:

Jeremy A. Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and seasoned senior management tech risk and digital strategy consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds a certificate in Media Technology from Oxford University’s Media Policy Summer Institute, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota’s Technological Leadership Institute, an MBA from Saint Mary’s University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale, and New Hope Community Police Academy (MN), and the Minneapolis FBI Citizens Academy. You can follow him on LinkedIn and Twitter.

8 Key AI Trends Driving Business Innovation in 2024 and Beyond

Minneapolis—

Artificial Intelligence (AI) continues to drive massive innovation across industries, reshaping business operations, customer interactions, and cybersecurity landscapes. As AI’s capabilities grow, companies are leveraging key trends to stay competitive and secure. Below are six crucial AI trends transforming businesses today, alongside critical insights on securing AI infrastructure, promoting responsible AI use, and enhancing workforce efficiency in a digital world.

1. Generative AI’s Creative Expansion

Generative AI, known for producing content from text and images to music and 3D models, is expanding its reach into business innovation.[1] AI systems like GPT-4 and DALL·E are being applied across industries to automate creativity, allowing businesses to scale their marketing efforts, design processes, and product innovation.

Business Application: Marketing teams are using generative AI to create personalized, dynamic campaigns across digital platforms. Coca-Cola and Nike, for instance, have employed AI to tailor advertising content to different customer segments, improving engagement and conversion rates. Product designers in industries like fashion and automotive are also using generative models to prototype new designs faster than ever before.

2. AI-Powered Personalization

AI’s ability to analyze vast datasets in real time is driving hyper-personalized experiences for consumers. This trend is especially important in sectors like e-commerce and entertainment, where personalized recommendations significantly impact user engagement and loyalty.

Business Application: Streaming platforms like Netflix and Spotify rely on AI algorithms to provide tailored content recommendations based on users’ preferences, viewing habits, and search history.[2] Retailers like Amazon are also leveraging AI to offer personalized shopping experiences, recommending products based on past purchases and browsing behavior, further boosting customer satisfaction.

3. AI-Driven Automation in Operations

Automation powered by AI is optimizing operations and processes across industries, from manufacturing to customer service. By automating repetitive and manual tasks, businesses are reducing costs, improving efficiency, and reallocating resources to higher-value activities.

Business Application: Tesla and Siemens are implementing AI in robotic process automation (RPA) to streamline production lines and monitor equipment for potential breakdowns. In customer service, AI chatbots and virtual assistants are being used to handle routine inquiries, providing real-time support to customers while freeing human agents to address more complex issues.

4. Securing AI Infrastructure and Development Practices

As AI adoption grows, so does the need for robust security measures to protect AI infrastructure and development processes. AI systems are vulnerable to cyberattacks, data breaches, and unauthorized access, highlighting the importance of securing AI from development to deployment.

Business Application: Organizations are recognizing the importance of securing AI models, data, and networks through multi-layered security frameworks. The U.S. AI Safety Institute Consortium is actively developing guidelines for AI safety and security, including red-teaming and risk management practices, to ensure AI systems are resilient to attacks. DevSecOps needs to be on the front end of this. To address challenges in securing AI, companies are pushing for standardization in AI audits and evaluations, ensuring consistency in security practices across industries.

5. AI in Predictive Analytics and Decision-Making

Predictive analytics, powered by AI, is enabling companies to forecast trends, predict consumer behavior, and make data-driven decisions with greater accuracy. This is particularly valuable in finance, healthcare, and retail, where anticipating demand or market shifts can lead to significant competitive advantages.

Business Application: Financial institutions like JPMorgan Chase are using AI for predictive analytics to evaluate market conditions, identify investment opportunities, and manage risk.[3] Retailers such as Walmart are employing AI to forecast inventory needs, helping to optimize supply chains and reduce waste. Predictive analytics also allows companies to make proactive decisions regarding customer retention and product development.

6. AI for Enhanced Cybersecurity

AI plays an increasingly pivotal role in improving cybersecurity defenses. AI-driven systems are capable of detecting anomalies, identifying potential threats, and responding to attacks in real-time, offering advanced protection for both physical and digital assets.

Business Application: Leading organizations are integrating AI into cybersecurity protocols to automate threat detection and enhance system defenses. IBM’s AI-powered QRadar platform helps companies identify and respond to cyberattacks by analyzing network traffic and detecting unusual activity.[4] AI systems are also improving identity authentication through biometrics, ensuring that only authorized users gain access to sensitive data.

Moreover, businesses are adopting AI governance frameworks to secure their AI infrastructure and ensure ethical deployment. Evaluating risks associated with open- and closed-source AI development allows for transparency and the implementation of tailored security strategies across sectors.

7. Promoting Responsible AI Use and Security Governance

Beyond technical innovation, AI governance and responsible use are paramount to ensure that AI is developed and applied ethically. Promoting responsible AI use means adhering to best practices and security standards to prevent misuse and unintended harm. The NIST AI risk management framework is a good reference for this.[5]

Business Application: Companies are actively developing frameworks that incorporate ethical principles throughout the lifecycle of AI systems. Microsoft and Google are leading initiatives to mitigate bias and ensure transparency in AI algorithms. Governments and private sectors are also collaborating to develop standardized guidelines and security metrics, helping organizations maintain ethical compliance and robust cybersecurity.

8. Enhancing Workforce Efficiency and Skills Development

AI’s role in enhancing workforce efficiency is not limited to automating tasks. AI-driven training and simulations are transforming how organizations develop and retain talent, particularly in cybersecurity, where skilled professionals are in high demand.

Business Application: Companies are investing in AI-driven educational platforms that simulate real-world cybersecurity scenarios, helping employees hone their skills in a dynamic, hands-on environment. These AI-powered platforms allow for personalized learning, adapting to individual skill levels and providing targeted feedback. Additionally, AI is being used to identify skill gaps within teams and recommend tailored training programs, improving workforce readiness for future challenges. Yet, people who are AI capable still need to support these apps and managerial efforts.

Conclusion: AI’s Role in Business and Security Transformation

As AI tools advance rapidly, it’s wise to assume they can access and analyze all publicly available content, including social media posts and articles like this one. While AI can offer valuable insights, organizations must remain vigilant about how these tools interact with one another, ensuring that application-to-application permissions are thoroughly scrutinized. Public-private partnerships, such as InfraGard, need to be strengthened to address these evolving challenges. Not everyone needs to be a journalist, but having the common sense to detect AI- or malware-generated fake news is crucial. It’s equally important to report any AI bias within big tech from perspectives including IT, compliance, media, and security.

Amid the AI hype, organizations should resist the urge to adopt every new tool that comes along. Instead, they should evaluate each AI system or use case based on measurable, real-world outcomes. AI’s rapid evolution is transforming both business operations and cybersecurity practices. Companies that effectively leverage trends like generative AI, predictive analytics, and automation, while prioritizing security and responsible use, will be better positioned to lead in the digital era. Securing AI infrastructure, promoting ethical AI development, and investing in workforce skills are crucial for long-term success.

Cloud infrastructure is another area that will continue to expand quickly, adding complexity to both perimeter security and compliance. Organizations should invest in AI-based cloud solutions and prioritize hiring cloud-trained staff. Diversifying across multiple cloud providers can mitigate risk, promote vendor competition, and ensure employees gain cross-platform expertise.

To navigate this complex landscape, businesses should adopt ethical, innovative, and secure AI strategies. Forming an AI governance committee is essential to managing the unique risks posed by AI, ensuring they aren’t overlooked or mistakenly merged with traditional IT risks. The road ahead holds tremendous potential, and those who proceed with careful consideration and adaptability will lead the way in AI-driven transformation.

About the Author:

Jeremy A. Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and seasoned senior management tech risk and digital strategy consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds a certificate in Media Technology from Oxford University’s Media Policy Summer Institute, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota’s Technological Leadership Institute, an MBA from Saint Mary’s University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale, and New Hope Community Police Academy (MN), and the Minneapolis FBI Citizens Academy. You can follow him on LinkedIn and Twitter.

References:

[1] PYMNTS. “AI Sparks a Creative Revolution in Business, With an Unexpected Twist.” 07/19/24. https://www.pymnts.com/artificial-intelligence-2/2024/ai-sparks-a-creative-revolution-in-business-with-an-unexpected-twist/

[2] Josifovski, Vanja. “The Future Of AI-Powered Personalization: The Potential Of Choices.” Forbes. https://www.forbes.com/councils/forbestechcouncil/2023/07/03/the-future-of-ai-powered-personalization-the-potential-of-choices/

[3] Son, Hugh. “JPMorgan Chase is giving its employees an AI assistant powered by ChatGPT maker OpenAI.” 08/09/24. https://www.cnbc.com/2024/08/09/jpmorgan-chase-ai-artificial-intelligence-assistant-chatgpt-openai.html

[4] Culafi, Alexander. “IBM launches AI-powered security offering QRadar Suite.” Tech Target. 04/23/23. https://www.techtarget.com/searchsecurity/news/365535549/IBM-launches-AI-powered-security-offering-QRadar-Suite

[5] NIST. “AI Risk Management Framework.” 07/26/24. https://www.nist.gov/itl/ai-risk-management-framework

Navigating the Future of Media, Law, and AI: Reflections on the 2024 Oxford Media Policy Summer Institute

Fig 1. Jeremy Swenson at the 2024 Oxford Media Policy Summer Institute, 2024.

#medialaw #oxford #mediaethics #airegulation #aipolicy #techethics #oversightboard #techrisk. #web3 #blockchain #techcensorship #contentmoderation Oxford Media Policy Summer Institute Centre for Socio-Legal Studies, University of Oxford Faculty of Law, University of Oxford

Minneapolis—

The Oxford Media Policy Summer Institute[1], held annually for over twenty-five years in person in Oxford, UK, is a prestigious program that unites leading communications scholars, media lawyers, regulators, human rights activists, technologists, and policymakers from around the globe. As an integral part of Oxford’s Centre for Socio-Legal Studies and the Faculty of Law, specifically through the Program in Comparative Media Law and Policy (PCMLP), the Institute fosters a global and multidisciplinary understanding of the complex relationships between technology, media, and policy. It aims to broaden the pool of talented scholars and practitioners, connect them to elite professionals, facilitate interdisciplinary dialogue, and build a space for future collaborations. With over 40 participants from more than 20 countries, the Institute provides an unparalleled opportunity to engage with diverse experiences and media environments. Its alumni network, comprising leaders in government, corporations, non-profits, and academia, remains vibrant and collaborative long after the program concludes.

Reflecting on my completion of the 2024 Oxford Media Policy Summer Institute, I am struck by the depth of knowledge I gained, particularly in the areas of media, tech and diversity, and AI policy. One of the most enlightening discussions revolved around the EU’s approach to regulating platforms like Facebook, Twitter, and Google. The EU has been at the forefront of creating frameworks that balance the need for free expression with the imperative to curb harmful content. I learned about the evolving regulatory landscape, including the Digital Services Act (DSA)—which addresses content moderation, online targeted advertising, and the configuration of online interfaces and recommender systems; and the Online Safety Bill—which seeks to hold tech giants accountable for the content on their platforms. These discussions highlighted the increasing importance of the “Fifth Estate,” a concept coined by William H. Dutton, referring to the networked individuals who, through the Internet, are empowering themselves in ways that challenge the control of information by traditional institutions.[2] The EU’s policies aim to regulate this new power dynamic while protecting vulnerable users and ensuring transparency and accountability.

Fig. 2. The 2024 Cohort of the Oxford Media Policy Summer Institute, 2024.

The Institute also provided invaluable insights into AI types, elections, and content moderation in the Global South. The discussions on the Global South’s technological maturity and policy governance revealed significant gaps in infrastructure, regulation, and policy. These challenges are evident in cases of internet censorship and shutdowns during political unrest, as well as instances of election manipulation. However, I also learned about innovative approaches being developed across the continent, which could serve as models for other regions. One such approach is a proposed third-wave model of tech governance that emphasizes local context, community involvement, and adaptive regulation.[3] This model would be more responsive to the unique challenges faced by countries in the Global South, including the need to balance development goals with the protection of human rights, ensuring they are not overpowered by the tech giants, which are primarily U.S.-based. This new model aligns with the idea of the Fifth Estate, as it seeks to empower local communities and their digital influence.

A particularly compelling aspect of the Institute was the examination of Meta’s Oversight Board and its role in protecting human rights amid global tech acceleration.[4] The Oversight Board represents a novel approach to content moderation, offering a degree of independence and transparency that is rare among tech companies. However, the discussions also highlighted the challenges the Board faces, including its limited jurisdiction and the broader question of how to ensure that human rights are upheld in an era of rapid technological change. Then there is the question of if it’s funded by Meta how can it be truly independent?

The need for stronger international frameworks and greater cooperation among stakeholders was a recurring theme, underscoring the importance of global collaboration in addressing these challenges. The Fifth Estate plays a critical role here as well, as the collective influence of networked individuals and organizations can push for greater accountability and human rights protections in the digital age.

Fig. 3. One of many group discussions, 2024.

The issue of foreign information manipulation, particularly disinformation campaigns designed to interfere with elections, was another critical topic. The example of Russia’s interference in U.S. and Ukrainian elections served as a stark reminder of the power of disinformation in destabilizing democracies.[5] The discussions at the Institute underscored the need for robust strategies to counter such threats, including better coordination between governments, tech companies, and civil society. Cybersecurity emerged as a key area of focus, particularly in ensuring the integrity of information in an age where AI is increasingly used to create and spread false narratives.

The role of the U.S. Federal Communications Commission (FCC) in shaping the future of AI and media policy was also a major point of discussion.[6] I gained a deeper understanding of the FCC’s mandate, particularly its focus on ensuring fair competition, protecting consumers, and promoting innovation. The FCC’s approach to AI reflects cautious optimism, recognizing the potential benefits of AI while also acknowledging the need for regulation to prevent abuses. The discussions highlighted the importance of balancing innovation with the need to protect the public from potential harms, particularly in areas such as privacy and data security.

Finally, the Institute emphasized the critical role of cybersecurity in maintaining information trust, especially against the backdrop of emerging AI technologies, which I detailed in my presentation (Fig 4). This included an overview of both the new NIST Cyber Security Framework (CSF) 2.0, which includes governance, and the NIST AI Risk Management Framework (RMF)—its lifecycle swim lanes with a description of the inputs and outputs. As AI becomes more sophisticated, the potential for malicious use grows, making cybersecurity a vital component of any strategy to protect information integrity. The discussions reinforced the idea that cybersecurity must be integrated into all aspects of tech policy, from content moderation to data protection, to ensure that AI is used responsibly.

Fig 4. Jeremy Swenson Presenting Eight Artificial Intelligence (AI) Cyber-Tech Observations, 2024.

In conclusion, my experience at the 2024 Oxford Media Policy Summer Institute was truly impactful. It underscored the significance of inclusivity, collaborative technological innovation, and the vital role of private sector competition in advancing progress. The recurring focus on the growth of the Global South’s tech economy emphasized the need for adaptable and locally tailored regulatory frameworks. As AI continues to develop, the urgency for comprehensive regulation and risk management frameworks is becoming increasingly evident. However, in many areas, it is still too early for definitive solutions, highlighting the necessity for ongoing research and learning.

There is a clear need for independent entities to provide checks and balances on big tech, with the Facebook Oversight Board serving as a promising start, though much more remains to be done. The strength and independence of journalism and free speech are undermined if they are weakened by misinformed platforms or overreaching governments. Network shutdowns and censorship should be rare, thoroughly justified, and subject to transparent auditing. The Institute has provided me with knowledge of the key stakeholders and their dependencies and levels of regulation. Importantly, I obtained key connections across the globe to engage meaningfully in these critical discussions, and I am eager to apply these insights in my future endeavors, be it a tech start-up, writing, or business advisory.

Last but not least, a big thanks to my esteemed fellow classmates this year. I could not have done it so well without all of you; thanks and much respect!

Ashwini Natesan for always correctly offering the Sri Lankan perspective. Martin Fertmann for shedding light on social media oversight. Erik Longo for offering insight on the DSA and related cyber risk. Davor Ljubenkov for the emerging tech and automation insight.Carolyn Khoo for insight on ‘The Korean Wave’. Purevsuren Boldkhuyag for the Asian legal and communication insight. Elena Perotti for the on-point public policy insight. Brandie Lustbader for winning a key legal issue and setting the example of justice and free speech in media. Jan Tancinco for the great insight on video and digital content strategy and innovation with the Prince reference! Thorin Bristow for your great article “Views on AI aren’t binary – they’re plural”. Eirliani Abdul Rahman for your insight on social media and digital AI from many orgs. Hafidz Hakimi ,Ph.D for the Malaysian legal perspective. Vinti Agarwal for the Indian legal view of e-sports/gaming. Numa Dhamani for your insight on AI, tech, and book writing. Bastian Scibbe for your insight on data protection and digital rights. John Okande for the Kenyan perspective on tech governance and policy. Ivana Bjelic Vucinic for the insight on the Global Forum for Media Development (GFMD). Ibrahim Sabra for insight on digital expression and social justice. Mesfin Fikre Woldmariam for the Ethiopian perspective on tech governance and free speech. Katie Mellinger for the FCC knowledge. Margareth Kang for the Brazilian tech public policy insight. Luise Eder for helping organize and lead all of this among a bunch of crafty intellectuals. Nicole Stremlau for leading such a diverse and important agenda at a time when it is so relevant. Thanks to everyone else as well.

About the Author:

Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and senior management tech risk consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds a certificate in Media Tech Policy from Oxford University. He holds an MBA from St. Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy.

References:

[1] University of Oxford. “Oxford Media Policy Summer Institute”. 2024. https://pcmlp.socleg.ox.ac.uk/oxford-media-policy-summer-institute-2024/

[2] Dutton, William. “The fifth estate: the power shift of the digital age.” Oxford University Press. 2023. https://www.tandfonline.com/doi/full/10.1080/1369118X.2024.2343811

[3] Flew, T., & Lin, F. “The third way of global Internet governance: A dialogue with Terry Flew.” Communication and the Public, 7(3). 2022. https://journals.sagepub.com/doi/full/10.1177/20570473221123150

[4] Meta. “The Oversight Board”. 2024. https://www.oversightboard.com/

[5] Tucker, Eric. “US disrupts Russian government-backed disinformation campaign that relied on AI technology”. AP. 2024. https://apnews.com/article/russia-disinformation-fbi-justice-department-50910729878377c0bf64a916983dbe44

[6] FCC. “The Opportunities and Challenges of Artificial Intelligence for Communications Networks and Consumers.” 2023. https://www.fcc.gov/fcc-nsf-ai-workshop

The Synergy of Art and Technology: Innovation Through Music

Fig. 1. Explore the landscape of AI-Generated Music. Todd S Omohundro, 2024.

Art and technology, though seemingly different realms, have consistently converged to drive groundbreaking innovations. When these two domains intersect, they enhance each other’s potential, creating new pathways for expression, communication, and progress. Music, a quintessential form of art, has particularly benefited from technological advancements, leading to transformative changes in how music is created, distributed, and experienced. This essay explores the importance of the symbiotic relationship between art and technology in music, highlights pioneering musicians who have embraced technology, and outlines the steps to innovation in this fusion, including the significant financial and business impacts of technologies like streaming.

The Convergence of Art and Technology in Music

Music and technology have been intertwined since the earliest days of instrument development. From the invention of the piano to the electric guitar, technological advancements have continually expanded the boundaries of musical expression. In the modern era, digital technology has revolutionized music production, distribution, and consumption.

The importance of this convergence lies in its ability to democratize music creation and distribution. Technology enables musicians to produce high-quality recordings without the need for expensive studio time, distribute their music globally via digital platforms, and interact with their audience in real-time through social media. This democratization has not only increased the diversity of music available but has also given rise to new genres and forms of expression that were previously unimaginable.

Pioneering Musicians in Technology

Several musicians have stood out as pioneers in integrating technology into their art, pushing the boundaries of what is possible in music.

  1. Brian Eno: Often regarded as the godfather of ambient music, Brian Eno’s work in the 1970s with synthesizers and tape machines laid the foundation for electronic music. His innovations in the use of the studio as an instrument and his development of generative music, which uses algorithms to create ever-changing compositions, have had a lasting impact on the music industry.
  2. Björk: Icelandic artist Björk is renowned for her avant-garde approach to music and technology. Her 2011 album “Biophilia” was released as a series of interactive apps, each corresponding to a different track. This innovative format allowed listeners to explore the music through visual and tactile interaction, blending auditory and digital experiences.
  3. Imogen Heap: British musician Imogen Heap has been at the forefront of music technology with her development of the Mi.Mu gloves. These wearable controllers allow musicians to manipulate sound and effects through hand gestures, providing a new way to perform and interact with music.
  4. Prince: Prince was a visionary who seamlessly integrated technology into his music. He was one of the first major artists to sell an album (1997’s “Crystal Ball”) directly to fans via the internet, bypassing traditional distribution channels. Prince’s use of digital recording techniques and electronic instruments in his music, along with his pioneering approach to online music distribution, showcased his forward-thinking approach to the convergence of music and technology.
  5. Billy Corgan: As the frontman of The Smashing Pumpkins, Billy Corgan has been an advocate for technological advancements in music. He embraced the digital recording revolution early on and has continually pushed the boundaries of what can be achieved in the studio. His use of layered guitars and innovative recording techniques has influenced countless artists and producers.

Financial and Business Impacts of Music Technology

The fusion of music and technology has not only transformed artistic expression but has also had significant financial and business impacts. The advent of digital streaming platforms like Spotify, Apple Music, and Tidal has revolutionized the music industry’s economic model.

  1. Revenue Streams: Streaming has created new revenue streams for artists, labels, and tech companies. While physical album sales have declined, the revenue from streaming subscriptions and ad-supported models has surged, offering artists new ways to monetize their work.
  2. Global Reach: Technology has enabled artists to reach global audiences instantly. Musicians can now distribute their music worldwide with a single click, breaking down geographical barriers and allowing for a more diverse and inclusive music industry.
  3. Data Analytics: Streaming platforms provide valuable data analytics to artists and labels, offering insights into listener behavior, preferences, and trends. This information helps musicians make informed decisions about marketing, touring, and production.
  4. Direct-to-Fan Engagement: Social media and other digital tools allow artists to engage directly with their fans, fostering a more personal connection and enabling innovative marketing strategies. Crowdfunding platforms like Kickstarter and Patreon have also emerged, allowing fans to directly support their favorite artists’ projects.

Steps to Innovation in Music Technology

Innovation at the intersection of music and technology follows several key steps:

  1. Identification of a Need or Opportunity: Innovation begins with recognizing a gap or potential for improvement. For instance, the traditional music industry’s limitations in distribution and production led to the development of digital audio workstations (DAWs) and streaming platforms.
  2. Research and Development: This step involves exploring existing technologies and experimenting with new ideas. Musicians like Brian Eno experimented with tape loops and synthesizers to create new sounds, while modern artists might explore artificial intelligence to compose music.
  3. Implementation and Dissemination: Once a viable innovation is developed, it must be implemented and shared with the broader community. Digital platforms like SoundCloud and Bandcamp have been instrumental in distributing new music technologies and innovations.
  4. Feedback and Iteration: Continuous improvement based on feedback is essential. As technology evolves, so too must the tools and methods used by musicians. This iterative process ensures that innovations remain relevant and effective.
  5. Collaboration: Innovation often requires interdisciplinary collaboration. Musicians work with software developers, engineers, and designers to create new instruments, applications, and performance tools. Björk’s “Biophilia” project, for example, involved collaboration with app developers, designers, and scientists.
  6. Prototyping and Testing: Creating prototypes and testing them in real-world scenarios is crucial. Imogen Heap’s development of the Mi.Mu gloves involved numerous iterations and live performance testing to refine the technology.

Conclusion

The fusion of art and technology, particularly in music, has led to profound innovations that have reshaped the landscape of the industry. Pioneering musicians like Brian Eno, Björk, Imogen Heap, Billy Corgan, and Prince have not only expanded the boundaries of musical expression but have also democratized the creation and distribution of music. The integration of technology in music production and distribution has had significant financial and business impacts, revolutionizing revenue streams, global reach, data analytics, and fan engagement. By following a structured approach to innovation, which includes identifying opportunities, research and development, collaboration, prototyping, implementation, and iteration, artists can continue to push the envelope and create transformative experiences. As technology continues to evolve, the potential for new and exciting innovations in music is boundless, promising a future where the synergy of art and technology will continue to inspire and amaze.

About the Author:

Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and senior management tech risk consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds an MBA from St. Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy.

Four Key Emerging Considerations with Artificial Intelligence (AI) in Cyber Security

#cryptonews #cyberrisk #techrisk #techinnovation #techyearinreview #infosec #musktwitter #disinformation #cio #ciso #cto #chatgpt #openai #airisk #iam #rbac #artificialintelligence #samaltman #aiethics #nistai #futurereadybusiness #futureofai

By Jeremy Swenson

Fig. 1. Zero Trust Components to Orchestration AI Mashup; Microsoft, 09/17/21; and Swenson, Jeremy, 03/29/24.

1. The Zero-Trust Security Model Becomes More Orchestrated via Artificial Intelligence (AI):

      The zero-trust model represents a paradigm shift in cybersecurity, advocating for the premise that no user or system, irrespective of their position within the corporate network, should be automatically trusted. This approach entails stringent enforcement of access controls and continual verification processes to validate the legitimacy of users and devices. By adopting a need-to-know-only access philosophy, often referred to as the principle of least privilege, organizations operate under the assumption of compromise, necessitating robust security measures at every level.

      Implementing a zero-trust framework involves a comprehensive overhaul of traditional security practices. It entails the adoption of single sign-on functionalities at the individual device level and the enhancement of multifactor authentication protocols. Additionally, it requires the implementation of advanced role-based access controls (RBAC), fortified network firewalls, and the formulation of refined need-to-know policies. Effective application whitelisting and blacklisting mechanisms, along with regular group membership reviews, play pivotal roles in bolstering security posture. Moreover, deploying state-of-the-art privileged access management (PAM) tools, such as CyberArk for password check out and vaulting, enables organizations to enhance toxic combination monitoring and reporting capabilities.

      App-to-app orchestration refers to the process of coordinating and managing interactions between different applications within a software ecosystem to achieve specific business objectives or workflows. It involves the seamless integration and synchronization of multiple applications to automate complex tasks or processes, facilitating efficient data flow and communication between them. Moreover, it aims to streamline and optimize various operational workflows by orchestrating interactions between disparate applications in a cohesive manner. This orchestration process typically involves defining the sequence of actions, dependencies, and data exchanges required to execute a particular task or workflow across multiple applications.

      However, while the concept of zero-trust offers a compelling vision for fortifying cybersecurity, its effective implementation relies on selecting and integrating the right technological components seamlessly within the existing infrastructure stack. This necessitates careful consideration to ensure that these components complement rather than undermine the orchestration of security measures. Nonetheless, there is optimism that the rapid development and deployment of AI-based custom middleware can mitigate potential complexities inherent in orchestrating zero-trust capabilities. Through automation and orchestration, these technologies aim to streamline security operations, ensuring that the pursuit of heightened security does not inadvertently introduce operational bottlenecks or obscure visibility through complexity.

      2. Artificial Intelligence (AI) Powered Threat Detection Has Improved Analytics:

      The utilization of artificial intelligence (AI) is on the rise to bolster threat detection capabilities. Through machine learning algorithms, extensive datasets are scrutinized to discern patterns suggestive of potential security risks. This facilitates swifter and more precise identification of malicious activities. Enhanced with refined machine learning algorithms, security information and event management (SIEM) systems are adept at pinpointing anomalies in network traffic, application logs, and data flow, thereby expediting the identification of potential security incidents for organizations.

      There will be reduced false positives which has been a sustained issue in the past with large overconfident companies repeatedly wasting millions of dollars per year fine tuning useless data security lakes that mostly produce garbage anomaly detection reports [1], [2]. Literally the kind good artificial intelligence (AI) laughs at – we are getting there. All the while, the technology vendors try to solve this via better SIEM functionality for an increased price at present. Yet we expect prices to drop really low as the automation matures.  

      With enhanced natural language processing (NLP) methodologies, artificial intelligence (AI) systems possess the capability to analyze unstructured data originating from various sources such as social media feeds, images, videos, and news articles. This proficiency enables organizations to compile valuable threat intelligence, staying abreast of indicators of compromise (IOCs) and emerging attack strategies. Notable vendors offering such services include Dark Trace, IBM, CrowdStrike, and numerous startups poised to enter the market. The landscape presents ample opportunities for innovation, necessitating the abandonment of past biases. Young, innovative minds well-versed in web 3.0 technologies hold significant value in this domain. Consequently, in the future, more companies are likely to opt for building their tailored threat detection tools, leveraging advancements in AI platform technology, rather than purchasing pre-existing solutions.

      3. Artificial Intelligence (AI) Driven Threat Response Ability Advances:

      Artificial intelligence (AI) isn’t just confined to threat detection; it’s increasingly playing a pivotal role in automating response actions within cybersecurity operations. This encompasses a range of tasks, including the automatic isolation of compromised systems, the blocking of malicious internet protocol (IP) addresses, the adjustment of firewall configurations, and the coordination of responses to cyber incidents—all achieved with greater efficiency and cost-effectiveness. By harnessing AI-driven algorithms, security orchestration, automation, and response (SOAR) platforms empower organizations to analyze and address security incidents swiftly and intelligently.

      SOAR platforms capitalize on AI capabilities to streamline incident response processes, enabling security teams to automate repetitive tasks and promptly react to evolving threats. These platforms leverage AI not only to detect anomalies but also to craft tailored responses, thereby enhancing the overall resilience of cybersecurity infrastructures. Leading examples of such platforms include Microsoft Sentinel, Rapid7 InsightConnect, and FortiSOAR, each exemplifying the fusion of AI-driven automation with comprehensive security orchestration capabilities.

      Microsoft Sentinel, for instance, utilizes AI algorithms to sift through vast volumes of security data, identifying potential threats and anomalies in real-time. It then orchestrates response actions, such as isolating compromised systems or blocking suspicious IP addresses, with precision and speed. Similarly, Rapid7 InsightConnect integrates AI-driven automation to streamline incident response workflows, enabling security teams to mitigate risks more effectively. FortiSOAR, on the other hand, offers a comprehensive suite of AI-powered tools for incident analysis, response automation, and threat intelligence correlation, empowering organizations to proactively defend against cyber threats. Basically, AI tools will help SOAR tools mature so security operations centers (SOCs) can catch the low hanging fruit; thus, they will have more time for analysis of more complex threats. These AI tools will employ the observe, orient, decide, act (OODA) Loop methodology [3]. This will allow them to stay up to date, customized, and informed of many zero-day exploits. At the same time, threat actors will constantly try to avert this with the same AI but with no governance.

        4. Artificial Intelligence (AI) Streamlines Cloud Security Posture Management (CSPM):

        With the escalating migration of organizations to cloud environments, safeguarding the security of cloud assets emerges as a paramount concern. While industry giants like Microsoft, Oracle, and Amazon Web Services (AWS) dominate this landscape with their comprehensive cloud offerings, numerous large organizations opt to establish and maintain their own cloud infrastructures to retain greater control over their data and operations. In response to the evolving security landscape, the adoption of cloud security posture management (CSPM) tools has become imperative for organizations seeking to effectively manage and fortify their cloud environments.

        CSPM tools play a pivotal role in enhancing the security posture of cloud infrastructures by facilitating continuous monitoring of configurations and swiftly identifying any misconfigurations that could potentially expose vulnerabilities. These tools operate by autonomously assessing cloud configurations against established security best practices, ensuring adherence to stringent compliance standards. Key facets of their functionality include the automatic identification of unnecessary open ports and the verification of proper encryption configurations, thereby mitigating the risk of unauthorized access and data breaches. “Keeping data safe in the cloud requires a layered defense that gives organizations clear visibility into the state of their data. This includes enabling organizations to monitor how each storage bucket is configured across all their storage services to ensure their data is not inadvertently exposed to unauthorized applications or users” [4]. This has considerations at both the cloud user and provider level especially considering artificial intelligence (AI) applications can be built and run inside the cloud for a variety of reasons. Importantly, these build designs often use approved plug ins from different vendors making it all the more complex.

        Furthermore, CSPM solutions enable organizations to proactively address security gaps and bolster their resilience against emerging threats in the dynamic cloud landscape. By providing real-time insights into the security status of cloud assets, these tools empower security teams to swiftly remediate vulnerabilities and enforce robust security controls. Additionally, CSPM platforms facilitate comprehensive compliance management by generating detailed reports and audit trails, facilitating adherence to regulatory requirements and industry standards.

        In essence, as organizations navigate the complexities of cloud adoption and seek to safeguard their digital assets, CSPM tools serve as indispensable allies in fortifying cloud security postures. By offering automated monitoring, proactive threat detection, and compliance management capabilities, these solutions empower organizations to embrace the transformative potential of cloud technologies while effectively mitigating associated security risks.

        About the Author:

        Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist / researcher, and senior management tech risk consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds an MBA from St. Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy.

        References:

        [1] Tobin, Donal; “What Challenges Are Hindering the Success of Your Data Lake Initiative?” Integrate.io. 10/05/22: https://www.integrate.io/blog/data-lake-initiative/

        [2] Chuvakin, Anton; “Why Your Security Data Lake Project Will … Well, Actually …” Medium. 10/22/22. https://medium.com/anton-on-security/why-your-security-data-lake-project-will-well-actually-78e0e360c292

        [3] Michael, Katina, Abbas, Roba, and Roussos, George; “AI in Cybersecurity: The Paradox.” IEEE Transactions on Technology and Society. Vol. 4, no. 2: pg. 104-109. 2023: https://ieeexplore.ieee.org/abstract/document/10153442

        [4] Rosencrance, Linda; “How to choose the best cloud security posture management tools.” CSO Online. 10/30/23: https://www.csoonline.com/article/657138/how-to-choose-the-best-cloud-security-posture-management-tools.html

        Key Artificial Intelligence (AI) Cyber-Tech Trends and What it Means for the Future.

        Minneapolis –

        #cryptonews #cyberrisk #techrisk #techinnovation #techyearinreview #infosec #musktwitter #disinformation #cio #ciso #cto #chatgpt #openai #airisk #iam #rbac #artificialintelligence #samaltman #aiethics #nistai #futurereadybusiness #futureofai

        By Jeremy Swenson & Matthew Versaggi

        Fig. 1. Quantum ChatGPT Growth Plus NIST AI Risk Management Framework Mashup [1], [2], [3].

        Summary:

        This year is unique since policy makers and business leaders grew concerned with artificial intelligence (AI) ethics, disinformation morphed, AI had hyper growth including connections to increased crypto money laundering via splitting / mixing. Impressively, AI cyber tools become more capable in the areas of zero-trust orchestration, cloud security posture management (CSPM), threat response via improved machine learning, quantum-safe cryptography ripened, authentication made real time monitoring advancements, while some hype remains. Moreover, the mass resignation / gig economy (remote work) remained a large part of the catalyst for all of these trends.

        Introduction:

        Every year we like to research and comment on the most impactful security technology and business happenings from the prior year. This year is unique since policy makers and business leaders grew concerned with artificial intelligence (AI) ethics [4], disinformation morphed, AI had hyper growth [5], crypto money laundering via splitting / mixing grew [6], AI cyber tools became more capable – while the mass resignation / gig economy remained a large part of the catalyst for all of these trends. By August 2023 ChatGPT reached 1.43 billion website visits per month and about 180.5 million registered users [7]. This even attracted many non-technical naysayers. Impressively, the platform was only nine months old then and just turned a year old in November [8]. These numbers for AI tools like ChatGPT are going to continue to grow in many sectors at exponential rates. As a result, the below trends and considerations are likely to significantly impact government, education, high-tech, startups, and large enterprises in big and small ways, albeit with some surprises.

        1. The Complex Ethics of Artificial Intelligence (AI) Swarms Policy Makers and Industry Resulting in New Frameworks:

        The ethical use of artificial intelligence (AI) as a conceptual and increasingly practical dilemma has gained a lot of media attention and research in the last few years by those in philosophy (ethics, privacy), politics (public policy), academia (concepts and principles), and economics (trade policy and patents) – all who have weighed in heavily. As a result, we find this space is beginning to mature. Sovereign nations (The USA, EU, and elsewhere globally) have developed and socialized ethical policies and frameworks [9], [10]. While major corporations motivated by profit are all devising their own ethical vehicles and structures – often taking a legalistic view first [11]. Moreover, The World Economic Forum (WEF) has weighed in on this matter in collaboration with PricewaterhouseCoopers (PWC) [12]. All of this contributes to the accelerated pace of maturity of this area in general. The result is the establishment of shared conceptual viewpoints, early-stage security frameworks, accepted policies, guidelines, and governance structures to support the evolution of artificial intelligence (AI) in ethical ways.

        For example, the Department of Defense (DOD) has formally adopted five principles for the ethical development of artificial intelligence capabilities as follows [13]:

        1. Responsible
        2. Equitable
        3. Traceable
        4. Reliable
        5. Governable

        Traceable and governable seem to be the most clear and important principles, while equitable and responsible seem gray at best and they could be deemphasized in a heightened war time context. The latter two echo the corporate social responsibility (CSR) efforts found more often in the private sector.

        The WEF via PWC has issued its Nine AI Ethical Principles for organizations to follow [14], and The Office of the Director of National Intelligence (ODNI) has released their Framework for AI Ethics [15]. Importantly, The National Institute For Standards in Technology (NIST) has released their AI Risk Management Framework as outlined in Fig. 2. and 3. They also released a playbook to support its implementation and have hosted several working sessions discussing it with industry which we attended virtually [16]. It seems the mapping aspect could take you down many AI rabbit holes, some unforeseen – inferring complex risk. Mapping also impacts how you measure and manage. None of this is fully clear and much of it will change as ethical AI governance matures.

        Fig. 2. NIST AI Risk Management Framework (AI RMF) 1.0 [17].

        Fig. 3. NIST AI Risk Management Framework: Actors Across AI Lifecycle Stages (AI RMF) 1.0 [18].

        The actors in Fig. 3. cover a wide swath of spaces where artificial intelligence (AI) plays, and appropriately so as AI is considered a GPT (general purpose technology) like electricity, rubber, and the like – where it can be applied ubiquitously in our lives [19]. This infers cognitive technology, digital reality, ambient experiences, autonomous vehicles and drones, quantum computing, distributed ledgers, and robotics to name a few. These were all prior to the emergence of generative AI on the scene which will likely put these vehicles to the test much earlier than expected. Yet all of these can be mapped across the AI lifecycle stages in Fig. 3. to clarify the activities, actors, dimensions, and if it gets to build, then more scrutiny will need to be applied.

        Scrutiny can come in the form of DevSecOps but that is extremely hard to do with such exponentially massive AI code datasets required by the learning models, at least at this point. Moreover, we are not sure if any AI ethics framework does justice to quality assurance (QA) and secure coding best practices much at this point. However, the above two NIST figures at least clarify relationships, flows, inputs and outputs, but all of this will need to be greatly customized to an organization to have any teeth. We imagine those use cases will come out of future NIST working sessions with industry.

        Lastly, the most crucial factor in AI ethics governance is what Fig. 3. calls “People and Planet”. This is because the people and planet can experience the negative aspects of AI in ways the designers did not imagine, and that feedback is valuable to product governance to prevent bigger AI disasters. For example, AI taking control of the air traffic control system and causing reroutes or accidents, or AI malware spreading faster than antivirus products can defend it creating a cyber pandemic. Thus, making sure bias is reduced and safety increased (DOD five AI principles) is key but certainly not easy or clear.

        2. ChatGPT and Other Artificial Intelligence (AI) Tools Have Huge Security Risks:

        It is fair to start off discussing the risks posed by ChatGPT and related tools to balance out all the positive feature coverage in the media and popular culture in recent months. First of all, with artificial intelligence (AI), every cyber threat actor has a new tool to better send spam, steal data, spread malware, build misinformation mills, grow botnets, launder cryptocurrency through shady exchanges [20], create fake profiles on multiple platforms, create fake romance chatbots, and to build the most complex self-replicating malware that will be akin to zero-day exploits much of the time.

        One commentator described it this way in his well circulated LinkedIn article, “It can potentially be a formidable social engineering and phishing weapon where non-native speakers can create flawlessly written phishing emails. Also, it will be much simpler for all scammers to mimic their intended victim’s tone, word choice, and writing style, making it more difficult than ever for recipients to tell the difference between a genuine and fraudulent email” [21]. Think of MailChimp on steroids with a sophisticated AI team crafting millions and billions of phishing e-mails / texts customized to impressively realistic details including phone calls with fake voices that mimic your loved ones building fake corroboration [22].

        SAP’s Head of Cybersecurity Market Strategy, Gabriele Fiata, took the words out of our mouths when he described it this way, “The threat landscape surrounding artificial intelligence (AI) is expanding at an alarming rate. Between January to February 2023, Darktrace researchers have observed a 135% increase in “novel social engineering” attacks, corresponding with the widespread adoption of ChatGPT” [23]. This is just the beginning. More malware as a service propagation, fake bank sites, travel scams, and fake IT support centers will multiply to scam and extort the weak including, elders, schools, local government, and small businesses. Then there is the increased likelihood that antivirus and data loss prevention (DLP) tools will become less effective as AI morphs. Lastly, cyber criminals can and will use generative AI for advanced evidence tampering by creating fake content to confuse or dirty the chain of custody, lessen reliability, or outright frame the wrong actor – while the government is confused and behind the tech sector. It is truly a digital arms race.

        Fig. 4. ChatGPT Exploit Risk Infographic [24].

        In the next section we will discuss the possibilities of how artificial intelligence (AI) can enhance information security increasing compliance, reducing risk, enabling new features of great value, and enabling application orchestration for threat visibility.

        3. The Zero-Trust Security Model Becomes More Orchestrated via Artificial Intelligence (AI):

        The zero-trust model assumes that no user or system, even those within the corporate network, should be trusted by default. Access controls are strictly enforced, and continuous verification is performed to ensure the legitimacy of users and devices. Zero-trust moves organizations to a need-to-know-only access mindset (least privilege) with inherent deny rules, all the while assuming you are compromised. This infers single sign-on at the personal device level and improved multifactor authentication. It also infers better role-based access controls (RBAC), firewalled networks, improved need-to-know policies, effective whitelisting and blacklisting of applications, group membership reviews, and state of the art privileged access management (PAM) tools. Password check out and vaulting tools like CyberArk will improve to better inform toxic combination monitoring and reporting. There is still work in selecting / building the right tech components that fit into (not work against) the infrastructure orchestra stack. However, we believe rapid build and deploy AI based custom middleware can alleviate security orchestration mismatches in many cases easily. All of this is likely to better automate and orchestrate zero-trust abilities so that one part does not hinder another part via complexity fog.

        4. Artificial Intelligence (AI) Powered Threat Detection Has Improved Analytics:

        Artificial intelligence (AI) is increasingly being used to enhance threat detection capabilities. Machine learning algorithms analyze vast amounts of data to identify patterns indicative of potential security threats. This enables quicker and more accurate identification of malicious activities. Security information and event management (SIEM) systems enhanced with improved machine learning algorithms can detect anomalies in network traffic, application logs, and data flow – helping organizations identify potential security incidents faster.

        There will be reduced false positives which has been a sustained issue in the past with large overconfident companies repeatedly wasting millions of dollars per year fine tuning useless data security lakes (we have seen this) that mostly produce garbage anomaly detection reports [25], [26]. Literally the kind good artificial intelligence (AI) laughs at – we are getting there. All the while, the technology vendors try to solve this via better SIEM functionality for an increased price at present. Yet we expect prices to drop really low as the automation matures.  

        With improved natural language processing (NLP) techniques, artificial intelligence (AI) systems can analyze unstructured data sources, such as social media feeds, photos, videos, and news articles – to assemble useful threat intelligence. This ability to process and understand textual data empowers organizations to stay informed about indicators of compromise (IOCs) and new attack tactics. Vendors that provide these services include Dark Trace, IBM, CrowdStrike, and many startups will likely join soon. This space is wide open and the biases of the past need to be forgotten if we want innovation. Young fresh minds who know web 3.0 are valuable here. Thus, in the future more companies will likely not have to buy but rather can build their own customized threat detection tools informed by advancements in AI platform technology.

        5. Quantum-Safe Cryptography Ripens:

        Quantum computing is a quickly evolving technology that uses the laws of quantum mechanics to solve problems too complex for traditional computers, like superposition and quantum interference [27]. Some cases where quantum computers can provide a speed boost include simulation of physical systems, machine learning (ML), optimization, and more. Traditional cryptographic algorithms could be vulnerable because they were built and coded with weaker technologies that have solvable patterns, at least in many cases. “Industry experts generally agree that within 7-10 years, a large-scale quantum computer may exist that can run Shor’s algorithm and break current public-key cryptography causing widespread vulnerabilities” [28]. Quantum-safe or quantum-resistant cryptography is designed to withstand attacks from quantum computers, often artificial intelligence (AI) assisted – ensuring the long-term security of sensitive data. For example, AI can help enhance post-quantum cryptographic algorithms such as lattice-based cryptography or hash-based cryptography to secure communications [29]. Lattice-based cryptography is a cryptographic system based on the mathematical concept of a lattice. In a lattice, lines connect points to form a geometric structure or grid (Fig. 5).

        Fig. 5. Simple Lattice Cryptography Grid [30].


        This geometric lattice structure encodes and decodes messages. Although it looks finite, the grid is not finite in any way. Rather, it represents a pattern that continues into the infinite (Fig. 6).

        Fig. 6. Complex Lattice Cryptography Grid [31].

        Lattice based cryptography benefits sensitive and highly targeted assets like large data centers, utilities, banks, hospitals, and government infrastructure generally. In other words, there will likely be mass adoption of quantum computing based encryption for better security. Lastly, we used ChatGPT as an assistant to compile the below specific benefits of quantum cryptography albeit with some manual corrections [32]:

        1. Detection of Eavesdropping:
          Quantum key distribution protocols can detect the presence of an eavesdropper by the disturbance introduced during the quantum measurement process, providing a level of security beyond traditional cryptography.
        2. Quantum-Safe Against Future Computers:
          Quantum computers have the potential to break many traditional cryptographic systems. Quantum cryptography is considered quantum-safe, as it relies on the fundamental principles of quantum mechanics rather than mathematical complexity.
        3. Near Unconditional Security:
          Quantum cryptography provides near unconditional security based on the principles of quantum mechanics. Any attempt to intercept or measure the quantum state will disturb the system, and this disturbance can be detected. Note that ChatGPT wrongly said “unconditional Security” and we corrected to “near unconditional security” as that is more realistic.

        6. Artificial Intelligence (AI) Driven Threat Response Ability Advances:

        Artificial intelligence (AI) is used not only for threat detection but also in automating response actions [33]. This can include automatically isolating compromised systems, blocking malicious internet protocol (IP) addresses, closing firewalls, or orchestrating a coordinated response to a cyber incident – all for less money. Security orchestration, automation, and response (SOAR) platforms leverage AI to analyze and respond to security incidents, allowing security teams to automate routine tasks and respond more rapidly to emerging threats. Microsoft Sentinel, Rapid7 InsightConnect, and FortiSOAR are just a few of the current examples. Basically, AI tools will help SOAR tools mature so security operations centers (SOCs) can catch the low hanging fruit; thus, they will have more time for analysis of more complex threats. These AI tools will employ the observe, orient, decide, act (OODA) Loop methodology [34]. This will allow them to stay up to date, customized, and informed of many zero-day exploits. At the same time, threat actors will constantly try to avert this with the same AI but with no governance.

        7. Artificial Intelligence (AI) Streamlines Cloud Security Posture Management (CSPM):

        As organizations increasingly migrate to cloud environments, ensuring the security of cloud assets becomes key. Vendors like Microsoft, Oracle, and Amazon Web Services (AWS) lead this space; yet large organizations have their own clouds for control as well. Cloud security posture management (CSPM) tools help organizations manage and secure their cloud infrastructure by continuously monitoring configurations and detecting misconfigurations that could lead to vulnerabilities [35]. These tools automatically assess cloud configurations for compliance with security best practices. This includes ensuring that only necessary ports are open, and that encryption is properly configured. “Keeping data safe in the cloud requires a layered defense that gives organizations clear visibility into the state of their data. This includes enabling organizations to monitor how each storage bucket is configured across all their storage services to ensure their data is not inadvertently exposed to unauthorized applications or users” [36]. This has considerations at both the cloud user and provider level especially considering artificial intelligence (AI) applications can be built and run inside the cloud for a variety of reasons. Importantly, these build designs often use approved plug ins from different vendors making it all the more complex.

        8. Artificial Intelligence (AI) Enhanced Authentication Arrives:

        Artificial intelligence (AI) is being utilized to strengthen user authentication methods. Behavioral biometrics, such as analyzing typing patterns, mouse movements and ram usage, can add an extra layer of security by recognizing the unique behavior of legitimate users. Systems that use AI to analyze user behavior can detect and flag suspicious activity, such as an unauthorized user attempting to access an account or escalate a privilege [37]. Two factor authentication remains the bare standard with many leading identity and access management (IAM) application makers including Okta, SailPoint, and Google experimenting with AI for improved analytics and functionality. Both two factor and multifactor authentication benefit from AI advancements with machine learning via real time access rights reassignment and improved role groupings [38]. However, multifactor remains stronger at this point because it includes something you are, biometrics. The jury is out on which method will remain the security leader because biometrics can be faked by AI [39]. Importantly, AI tools can remove fake accounts or orphaned accounts much more quickly, reducing risk. However, it likely will not get it right 100% of the time so there is a slight inconvenience.

        Conclusion and Recommendations:

        Artificial intelligence (AI) remains a leading catalyst for digital transformation in tech automation, identity and access management (IAM), big data analytics, technology orchestration, and collaboration tools. AI based quantum computing serves to bolster encryption when old methods are replaced. All of the government actions to incubate ethics in AI are a good start and the NIST AI Risk Management Framework (AI RMF) 1.0 is long overdue. It will likely be tweaked based on private sector feedback. However, adding the DOD five principles for the ethical development of AI to the NIST AI RMF could derive better synergies. This approach should be used by the private sector and academia in customized ways. AI product ethical deviations should be thought of as quality control and compliance issues and remediated immediately.

        Organizations should consider forming an AI governance committee to make sure this unique risk is not overlooked or overly merged with traditional web / IT risk. ChatGPT is a good encyclopedia and a cool Boolean search tool, yet it got some things wrong about quantum computing in this article for which we cited and corrected. The Simplified AI text to graphics generator was cool and useful but it needed some manual edits as well. Both of these generative AI tools will likely get better with time.

        Artificial intelligence (AI) will spur many mobile malware and ransomware variants faster than Apple and Google can block them. This in conjunction with the fact that people more often have no mobile antivirus on their smart phone even if they have it on their personal and work computers, and a culture of happy go lucky application downloading makes it all the worse. As a result, more breaches should be expected via smart phones / watches / eyeglasses from AI enabled threats.

        Therefore, education and awareness around the review and removal of non-essential mobile applications is a top priority. Especially for mobile devices used separately or jointly for work purposes. Containerization is required via a mobile device management (MDM) tool such as JAMF, Hexnode, VMWare, or Citrix Endpoint Management. A bring your own device (BYOD) policy needs to be written, followed, and updated often informed by need-to-know and role-based access (RBAC) principles. This requires a better understanding of geolocation, QR code scanning, couponing, digital signage, in-text ads, micropayments, Bluetooth, geofencing, e-readers, HTML5, etc. Organizations should consider forming a mobile ecosystem security committee to make sure this unique risk is not overlooked or overly merged with traditional web / IT risk. Mapping the mobile ecosystem components in detail is a must including the AI touch points.

        The growth and acceptability of mass work from home (WFH) combined with the mass resignation / gig economy remind employers that great pay and culture alone are not enough to keep top talent. At this point AI only takes away some simple jobs but creates AI support jobs, yet the percents of this are not clear this early. Signing bonuses and personalized treatment are likely needed for those with top talent. We no longer have the same office and thus less badge access is needed. Single sign-on (SSO) will likely expand to personal devices (BYOD) and smart phones / watches / eyeglasses. Geolocation-based authentication is here to stay with double biometrics, likely fingerprint, eye scan, typing patterns, and facial recognition. The security perimeter remains more defined by data analytics than physical / digital boundaries, and we should dashboard this with machine learning tools as the use cases evolve.

        Cloud infrastructure will continue to grow fast creating perimeter and compliance complexity / fog. Organizations should preconfigure artificial intelligence (AI) based cloud-scale options and spend more on cloud-trained staff. They should also make sure that they are selecting more than two or three cloud providers, all separate from one another. This helps staff get cross-trained on different cloud platforms and plug in applications. It also mitigates risk and makes vendors bid more competitively. There is huge potential for AI synergies with Cloud Security Posture Management (CSPM) tools, and threat response tools – experimentation will likely yield future dividends. Organization should not be passive and stuck in old paradigms. The older generations should seek to learn from the younger generations without bias. Also, comprehensive logging is a must for AI tools.

        In regard to cryptocurrency, non-fungible tokens (NFTs), initial coin offerings (ICOs), and related exchanges – artificial intelligence (AI) will be used by crypto scammers and those seeking to launder money. Watch out for scammers who make big claims without details, no white papers or filings, or explanations at all. No matter what the investment, find out how it works and ask questions about where your money is going. Honest investment managers and advisors want to share that information and will back it up with details in many documents and filings [40]. Moreover, better blacklisting by crypto exchanges and banks is needed to stop these illicit transactions erroring far on the side of compliance. This requires us to pay more attention to knowing and monitoring our own social media baselines – emerging AI data analytics can help here. If you are for and use crypto mixer and / or splitter services then you run the risk of having your digital assets mixed with dirty digital assets, you have high fees, you have zero customer service, no regulatory protection, no decent Terms of Service and / or Privacy Policy if any, and you have no guarantee that it will even work the way you think it will.

        As security professionals, we are patriots and defenders of wherever we live and work. We need to know what our social media baseline is across platforms. IT and security professionals need to realize that alleviating disinformation is about security before politics. We should not be afraid to talk about this because if we are, then our organizations will stay weak and outdated and we will be plied by the same artificial intelligence (AI) generated political bias that we fear confronting. More social media training is needed as many security professionals still think it is mostly an external marketing thing.

        It’s best to assume AI tools are reading all social media posts and all other available articles, including this article which we entered into ChatGPT for feedback. It was slightly helpful pointing out other considerations. Public-to-private partnerships (InfraGard) need to improve and application to application permissions need to be more scrutinized. Everyone does not need to be a journalist, but everyone can have the common sense to identify AI / malware-inspired fake news. We must report undue AI bias in big tech from an IT, compliance, media, and a security perspective. We must also resist the temptation to jump on the AI hype bandwagon but rather should evaluate each tool and use case based on the real-world business outcomes for the foreseeable future.

        About the Authors:

        Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist / researcher, and senior management tech risk consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds an MBA from St. Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy.

        Matthew Versaggi is a senior leader in artificial intelligence with large company healthcare experience who has seen hundreds of use-cases. He is a distinguished engineer, built an organization’s “College of Artificial Intelligence”, introduced and matured both cognitive AI technology and quantum computing, has been awarded multiple patents, is an experienced public speaker, entrepreneur, strategist and mentor, and has international business experience. He has an MBA in international business and economics and a MS in artificial intelligence from DePaul University, has a BS in finance and MIS and a BA in computer science from Alfred University. Lastly, he has nearly a dozen professional certificates in AI that are split between the AI, technology, and business strategy.

        References:

        [1] Swenson, Jeremy, and NIST; Mashup 12/15/2023; “Artificial Intelligence Risk Management Framework (AI RMF 1.0)”. 01/26/23: https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf.

        [2] Swenson, Jeremy, and Simplified AI; AI Text to graphics generator. 01/08/24: https://app.simplified.com/

        [3] Swenson, Jeremy, and ChatGPT; ChatGPT Logo Mashup. OpenAI. 12/15/23: https://chat.openai.com/auth/login

        [4] The White House; “Fact Sheet: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence.”    10/30/23: https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/ 

        [5] Nerdynav; “107 Up-to-Date ChatGPT Statistics & User Numbers [Dec 2023].” 12/06/23: https://nerdynav.com/chatgpt-statistics/

        [6] Sun, Zhiyuan; “Two individuals indicted for $25M AI crypto trading scam: DOJ.” Cointelegraph. 12/12/23: https://cointelegraph.com/news/two-individuals-indicted-25m-ai-artificial-intelligence-crypto-trading-scam

        [7] Nerdynav; “107 Up-to-Date ChatGPT Statistics & User Numbers [Dec 2023].” 12/06/23: https://nerdynav.com/chatgpt-statistics/

        [8] Nerdynav; “107 Up-to-Date ChatGPT Statistics & User Numbers [Dec 2023].” 12/06/23: https://nerdynav.com/chatgpt-statistics/

        [9] The White House; “Fact Sheet: President Biden Issues Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence.”    10/30/23: https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/30/fact-sheet-president-biden-issues-executive-order-on-safe-secure-and-trustworthy-artificial-intelligence/ 

        [10] EU. “EU AI Act: first regulation on artificial intelligence.” 12/19/23: https://www.europarl.europa.eu/news/en/headlines/society/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence

        [11] Jackson, Amber; “Top 10 companies with ethical AI practices.” AI Magazine. 07/12/23: https://aimagazine.com/ai-strategy/top-10-companies-with-ethical-ai-practices

        [12] Golbin, Ilana, and Axente, Maria Luciana; “9 ethical AI principles for organizations to follow.” World Economic Forum and PricewaterhouseCoopers (PWC). 06/23/21 https://www.weforum.org/agenda/2021/06/ethical-principles-for-ai/

        [13] Lopez, Todd C; “DOD Adopts 5 Principles of Artificial Intelligence Ethics”. DOD News. 02/25/20: https://www.defense.gov/News/News-Stories/article/article/2094085/dod-adopts-5-principles-of-artificial-intelligence-ethics/

        [14] Golbin, Ilana, and Axente, Maria Luciana; “9 ethical AI principles for organizations to follow.” World Economic Forum and PricewaterhouseCoopers (PWC). 06/23/21 https://www.weforum.org/agenda/2021/06/ethical-principles-for-ai/

        [15] The Office of the Director of National Intelligence. “Principles of Artificial Intelligence Ethics for the Intelligence Community.” 07/23/20: https://www.dni.gov/index.php/newsroom/press-releases/press-releases-2020/3468-intelligence-community-releases-artificial-intelligence-principles-and-framework#:~:text=The%20Principles%20of%20AI%20Ethics,resilient%20by%20design%2C%20and%20incorporate

        [16] NIST; “NIST AI RMF Playbook.” 01/26/23: https://airc.nist.gov/AI_RMF_Knowledge_Base/Playbook

        [17] NIST; “Artificial Intelligence Risk Management Framework (AI RMF 1.0).” 01/26/23: https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf

        [18] NIST; “Artificial Intelligence Risk Management Framework (AI RMF 1.0).” 01/26/23: https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf

        [19] Crafts, Nicholas; “Artificial intelligence as a general-purpose technology: an historical perspective.” Oxford Review of Economic Policy. Volume 37, Issue 3, Autumn 2021: https://academic.oup.com/oxrep/article/37/3/521/6374675

        [20] Sun, Zhiyuan; “Two individuals indicted for $25M AI crypto trading scam: DOJ.” Cointelegraph. 12/12/23: https://cointelegraph.com/news/two-individuals-indicted-25m-ai-artificial-intelligence-crypto-trading-scam

        [21] Patel, Pranav; “ChatGPT brings forth new opportunities and challenges to the Cybersecurity industry.” LinkedIn Pulse. 04/03/23: https://www.linkedin.com/pulse/chatgpt-brings-forth-new-opportunities-challenges-industry-patel/

        [22] FTC; “Preventing the Harms of AI-enabled Voice Cloning.” 11/16/23: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/11/preventing-harms-ai-enabled-voice-cloning

        [23] Fiata, Gabriele; “Why Evolving AI Threats Need AI-Powered Cybersecurity.” Forbes. 10/04/23: https://www.forbes.com/sites/sap/2023/10/04/why-evolving-ai-threats-need-ai-powered-cybersecurity/?sh=161bd78b72ed

        [24] Patel, Pranav; “ChatGPT brings forth new opportunities and challenges to the Cybersecurity industry.” LinkedIn Pulse. 04/03/23: https://www.linkedin.com/pulse/chatgpt-brings-forth-new-opportunities-challenges-industry-patel/

        [25] Tobin, Donal; “What Challenges Are Hindering the Success of Your Data Lake Initiative?” Integrate.io. 10/05/22: https://www.integrate.io/blog/data-lake-initiative/

        [26] Chuvakin, Anton; “Why Your Security Data Lake Project Will … Well, Actually …” Medium. 10/22/22. https://medium.com/anton-on-security/why-your-security-data-lake-project-will-well-actually-78e0e360c292

        [27] Amazon Web Services; “What are the types of quantum technology?” 01/07/23: https://aws.amazon.com/what-is/quantum-computing/ 

        [28] ISARA Corporation; “What is Quantum-safe Cryptography?” 2023: https://www.isara.com/resources/what-is-quantum-safe.html

        [29] Swenson, Jeremy, and ChatGPT; OpenAI. 12/15/23: https://chat.openai.com/auth/login

        [30] Utimaco; “What is Lattice-based Cryptography? 2023: https://utimaco.com/service/knowledge-base/post-quantum-cryptography/what-lattice-based-cryptography

        [31] D. Bernstein, and T. Lange; “Post-quantum cryptography – dealing with the fallout of physics success.” IACR Cryptology. 2017: https://www.semanticscholar.org/paper/Post-quantum-cryptography-dealing-with-the-fallout-Bernstein-Lange/a515aad9132a52b12a46f9a9e7ca2b02951c5b82

        [32] Swenson, Jeremy, and ChatGPT; OpenAI. 12/15/23: https://chat.openai.com/auth/login

        [33] Sibanda, Isla; “AI and Machine Learning: The Double-Edged Sword in Cybersecurity.” RSA Conference. 12/13/23: https://www.rsaconference.com/library/blog/ai-and-machine-learning-the-double-edged-sword-in-cybersecurity

        [34] Michael, Katina, Abbas, Roba, and Roussos, George; “AI in Cybersecurity: The Paradox.” IEEE Transactions on Technology and Society. Vol. 4, no. 2: pg. 104-109. 2023: https://ieeexplore.ieee.org/abstract/document/10153442

        [35] Microsoft; “What is CSPM?” 01/07/24: https://www.microsoft.com/en-us/security/business/security-101/what-is-cspm 

        [36] Rosencrance, Linda; “How to choose the best cloud security posture management tools.” CSO Online. 10/30/23: https://www.csoonline.com/article/657138/how-to-choose-the-best-cloud-security-posture-management-tools.html

        [37] Muneer, Salman Muneer, Muhammad Bux Alvi, and Amina Farrakh; “Cyber Security Event Detection Using Machine Learning Technique.” International Journal of Computational and Innovative Sciences. Vol. 2, no (2): pg. 42-46. 2023: https://ijcis.com/index.php/IJCIS/article/view/65.

        [38] Azhar, Ishaq; “Identity Management Capability Powered by Artificial Intelligence to Transform the Way User Access Privileges Are Managed, Monitored and Controlled.” International Journal of Creative Research Thoughts (IJCRT), ISSN:2320-2882, Vol. 9, Issue 1: pg. 4719-4723. January 2021: https://ssrn.com/abstract=3905119

        [39] FTC; “Preventing the Harms of AI-enabled Voice Cloning.” 11/16/23: https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2023/11/preventing-harms-ai-enabled-voice-cloning

        [40] FTC; “What To Know About Cryptocurrency and Scams.” May 2022: https://consumer.ftc.gov/articles/what-know-about-cryptocurrency-and-scams

        Top Pros and Cons of Disruptive Artificial Intelligence (AI) in InfoSec

        Fig. 1. Swenson, Jeremy, Stock; AI and InfoSec Trade-offs. 2024.

        Disruptive technology refers to innovations or advancements that significantly alter the existing market landscape by displacing established technologies, products, or services, often leading to the transformation of entire industries. These innovations introduce novel approaches, functionalities, or business models that challenge traditional practices, creating a substantial impact on how businesses operate (ChatGPT, 2024). Disruptive technologies typically emerge rapidly, offering unique solutions that are more efficient, cost-effective, or user-friendly than their predecessors.

        The disruptive nature of these technologies often leads to a shift in market dynamics, digital cameras or smartphones for example. These with new entrants or previously marginalized players gain prominence while established entities may face challenges in adapting to the transformative changes (ChatGPT, 2024). Examples of disruptive technologies include the advent of the internet, mobile technology, and artificial intelligence (AI), each reshaping industries and societal norms. Here are four of the leading AI tools:

        1.       OpenAI’s GPT:

        OpenAI’s GPT (Generative Pre-trained Transformer) models, including GPT-3 and GPT-2, are predecessors to ChatGPT. These models are known for their large-scale language understanding and generation capabilities. GPT-3, in particular, is one of the most advanced language models, featuring 175 billion parameters.

        2.       Microsoft’s DialoGPT:

        DialoGPT is a conversational AI model developed by Microsoft. It is an extension of the GPT architecture but fine-tuned specifically for engaging in multi-turn conversations. DialoGPT exhibits improved dialogue coherence and contextual understanding, making it a competitor in the chatbot space.

        3.       Facebook’s BlenderBot:

        BlenderBot is a conversational AI model developed by Facebook. It aims to address the challenges of maintaining coherent and contextually relevant conversations. BlenderBot is trained using a diverse range of conversations and exhibits improved performance in generating human-like responses in chat-based interactions.

        4.       Rasa:

        Rasa is an open-source conversational AI platform that focuses on building chatbots and voice assistants. Unlike some other models that are pre-trained on large datasets, Rasa allows developers to train models specific to their use cases and customize the behavior of the chatbot. It is known for its flexibility and control over the conversation flow.

        Here is a list of the pros and cons of AI-based infosec capabilities.

        Pros of AI in InfoSec:

        1. Improved Threat Detection:

        AI enables quicker and more accurate detection of cybersecurity threats by analyzing vast amounts of data in real-time and identifying patterns indicative of malicious activities. Security orchestration, automation, and response (SOAR) platforms leverage AI to analyze and respond to security incidents, allowing security teams to automate routine tasks and respond more rapidly to emerging threats. Microsoft Sentinel, Rapid7 InsightConnect, and FortiSOAR are just a few of the current examples

        2. Behavioral Analysis:

        AI can perform behavioral analysis to identify anomalies in user behavior or network activities, helping detect insider threats or sophisticated attacks that may go unnoticed by traditional security measures. Behavioral biometrics, such as analyzing typing patterns, mouse movements and ram usage, can add an extra layer of security by recognizing the unique behavior of legitimate users. Systems that use AI to analyze user behavior can detect and flag suspicious activity, such as an unauthorized user attempting to access an account or escalate a privilege.

        3. Enhanced Phishing Detection:

        AI algorithms can analyze email patterns and content to identify and block phishing attempts more effectively, reducing the likelihood of successful social engineering attacks.

        4. Automation of Routine Tasks:

        AI can automate repetitive and routine tasks, allowing cybersecurity professionals to focus on more complex issues. This helps enhance efficiency and reduces the risk of human error.

        5. Adaptive Defense Systems:

        AI-powered security systems can adapt to evolving threats by continuously learning and updating their defense mechanisms. This adaptability is crucial in the dynamic landscape of cybersecurity.

        6. Quick Response to Incidents:

        AI facilitates rapid response to security incidents by providing real-time analysis and alerts. This speed is essential in preventing or mitigating the impact of cyberattacks.

        Cons of AI in InfoSec:

        1. Sophistication of Attacks:

        As AI is integrated into cybersecurity defenses, attackers may also leverage AI to create more sophisticated and adaptive threats, leading to a continuous escalation in the complexity of cyberattacks.

        2. Ethical Concerns:

        The use of AI in cybersecurity raises ethical considerations, such as privacy issues, potential misuse of AI for surveillance, and the need for transparency in how AI systems operate.

        3. Cost and Resource Intensive:

        Implementing and maintaining AI-powered security systems can be resource-intensive, both in terms of financial investment and skilled personnel required for development, implementation, and ongoing management.

        4. False Positives and Negatives:

        AI systems are not infallible and may produce false positives (incorrectly flagging normal behavior as malicious) or false negatives (failing to detect actual threats). This poses challenges in maintaining a balance between security and user convenience.

        5. Lack of Human Understanding:

        AI lacks contextual understanding and human intuition, which may result in misinterpretation of certain situations or the inability to recognize subtle indicators of a potential threat. This is where QA and governance come in case something goes wrong.

        6. Dependency on Training Data:

        AI models rely on training data, and if the data used is biased or incomplete, it can lead to biased or inaccurate outcomes. Ensuring diverse and representative training data is crucial to the effectiveness of AI in InfoSec.

        About the author:

        Jeremy Swenson is a disruptive-thinking security entrepreneur, futurist / researcher, and senior management tech risk consultant. He is a frequent speaker, published writer, podcaster, and even does some pro bono consulting in these areas. He holds an MBA from St. Mary’s University of MN, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale and New Hope Citizens Police Academy, and the Minneapolis FBI Citizens Academy.