A blueprint for responsible and secure GenAI deployment

COMMENTARY: Since its elevation to mainstream consciousness in November 2022, generative artificial intelligence (GenAI) has reshaped industries, offering transformative potential to streamline operations, enhance customer experiences, and drive innovation. However, as with any groundbreaking technology, the rush to adopt GenAI comes with critical challenges organizations cannot overlook.

In the race to innovate, businesses must balance speed with caution, ensuring they leverage GenAI both responsibly and securely. These concepts, while closely related and aligned in their goals of maximizing benefits and minimizing risks, are distinct. Addressing them requires a thoughtful and comprehensive approach.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

At its core, responsible AI focuses on strategic decision-making around AI development and use to minimize ethical risks and societal harm, while upholding important principles such as fairness, accountability and trust. Critical to this methodology are elements such as data integrity, privacy and model transparency, which have become central to the global conversation on AI ethics.

Although technology providers, lawmakers and academics work to establish frameworks for responsible AI, because the field remains nascent, we’ve yet to see universal standards. However, a lack of standardized guidelines does not justify inaction.

Organizations must define what responsible AI means within their specific operational contexts. This includes the following:

Proactive efforts in these areas will mitigate risks, and also position organizations as ethical leaders in AI. Secure AI focuses on identifying and mitigating cybersecurity risks specific to AI systems. It prioritizes protecting the confidentiality, integrity and availability of AI models and the data they rely on.

The Mitre Atlas defines AI security as the tools, strategies and processes implemented that identify and prevent threats and attacks that could compromise the confidentially, integrity or availability of an AI model or AI-enabled system.

Without robust security measures, AI systems are vulnerable to both internal and external cyber threats. Organizations simply cannot achieve responsible AI without secure AI.

Prioritize secure AI

Because responsible AI has been rooted in a theoretical framework of ideas and guiding principles focused on ethical decision-making, many organizations have invested heavily in this area and may feel that AI has already been made secure via traditional means. This focus on ethics is undeniably important, but overlooking security maturation can create a gap in the broader AI strategy, exposing even the most ethically designed systems to security incidents and regulatory risks.

Leaders must challenge the tendency to defer security considerations, acknowledging that a robust AI ecosystem requires holistic governance. To build a resilient AI ecosystem, teams must embed security from the ground up. Leaders must:

Developers also must play a part by integrating safety measures throughout the development lifecycle. This includes embedding security-by-design, implementing guardrails through robust data governance, and creating scalable systems that prioritize privacy and transparency.

Moving forward, organizations must adopt a holistic approach that integrates responsible and secure AI practices. This means recognizing that they are not siloed priorities, but complementary components of a holistic AI strategy founded on governance and risk management.

Defining and upholding these practices has become an imperative today, not just a mere competitive advantage. In doing so, businesses can earn user trust, drive sustainable growth and contribute positively to the societal impact of AI technologies.

Jennifer Mahoney, demand delivery manager of data governance, privacy and protection, Optiv  

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.