SecurityScorecard Says Risk Management Verification Is 'Necessary' Before Enterprise AI Adoption ... Checklists Released
TECHWORLD ·
✦ AI Summary
SecurityScorecard on the 19th released verification guidelines and a checklist for "How to Manage AI Vendor Risk."
The guidelines outlined data flow checks, privacy checks, AI functionality verification, vendor capability verification, ethical AI verification, and bias verification.
The company also said a continuous monitoring system and pre- and post-contract data control checks are needed to respond to changing risks after AI adoption.
As enterprise AI adoption spreads, risks related to shadow AI are emerging. In response, SecurityScorecard on the 19th released verification guidelines and a checklist for "How to Manage AI Vendor Risk."
The purpose of the release is safe AI adoption and risk management. Based on cases officially identified by SecurityScorecard's security team, the company found that untracked AI tools are being used. These untracked AI tools make it difficult to audit data flows and usage status, and they also make it difficult to control data flows and usage status.
Behind this trend is the fact that, given the nature of AI systems, models and data continue to change even after contracts are signed. As a result, existing static third-party risk management (TPRM) assessments have limitations, and it is difficult to continuously manage risk.
SecurityScorecard presented verification criteria for security risk assessments used to select AI companies. The criteria included data flow checks, privacy checks, AI functionality verification, vendor capability verification, ethical AI verification, and bias verification.
On the data handling side, the company said it is necessary to identify what AI vendors can access. Items to be checked include customer data, employee records, and regulated information, and it also said it is necessary to verify whether the relevant data is properly anonymized. It also said the review should focus on the actual contract, not just the marketing page, and that the contract should be checked for rights to use data for AI training, data retention periods, and a list of subcontractors (Subprocessor). It also said that if an AI system requires permanent use of all data, that is an obvious red flag.
In terms of verifying the technical substance and performance, the company said it is necessary to check whether the AI vendor operates its own deep learning stack directly and whether it operates machine learning algorithms directly. It also said it is necessary to determine whether it is a Wrapper around an existing Foundation Model behind an API. It then said that checks through adoption cases at companies of a similar scale are needed, and that specific performance metrics and verification processes should be reviewed in those cases.
When evaluating AI vendors and systems, it is important to check bias mitigation procedures, and it is also important to review the structure of the training data. It is also important to confirm whether third-party audits have been conducted, and in the case of high-risk AI, whether independent researchers can review it. In addition, it is necessary to check whether there is an open-source disclosure component for high-risk AI.
Before signing a contract, companies should review whether AI training use is allowed or denied, and they should also examine data anonymization and AI regulatory responses. They should also review RPA and chatbot data management, the impact of Foundation Model changes, and whether continuous auditing of AI systems is possible. They must also confirm whether data control will remain in place after the contract ends.
Woo Cheong-ha, country manager of SecurityScorecard, said that as AI adoption rapidly expands, companies are also introducing new AI vendors and tools, making it necessary to respond to new risks related to data and the supply chain. He explained that there is a need to pre-verify the technical and data-processing methods of AI vendors. He added that a continuous monitoring system is also needed to respond to risks that change after adoption.
SecurityScorecard provides TITAN AI, a third-party risk management (TPRM) platform that combines AI and threat intelligence. TITAN AI is an AI-based solution that automates third-party security assessments and questionnaires, and it helps identify real threats across vendors and the extended supply chain beyond the scope of regular security assessments, while also supporting risk prioritization and response.
Source: TECHWORLD · Kim Hye-jin
Original: https://www.epnc.co.kr/news/articleView.html?idxno=408365
References
This article was produced with the help of an automated content generation algorithm.
Source: TECHWORLD
View originalThis article was summarized and organized by BizCrush based on the original article from TECHWORLD. For exact quotations and full details, please refer to the original article.