Page 199 - Cyber Defense eMagazine RSAC Special Edition 2025

Technical Implementation: Deploy appropriate security controls based on risk. This might include API-
based redaction services, authentication mechanisms and monitoring tools. The GCE security team
initially considered building their own redaction solution but quickly realized this would significantly delay
their AI initiative. Instead, they identified an API-based solution that could be implemented quickly while
meeting their security requirements.

Education and Awareness: Perhaps most importantly, educate users about AI security. Help them
understand what information is appropriate to share and how to use AI systems safely.

Start with high-risk use cases – perhaps those handling sensitive records or research data – and expand
from there. Remember that this is an iterative process; as AI capabilities evolve, so too must security
measures. The most successful implementations come from close collaboration between security teams,
developers and stakeholders who can work together to achieve the desired outcomes.

Looking ahead, what emerging AI security challenges should organizations prepare for?

We're entering a fascinating period where AI is becoming increasingly embedded in nearly every process.
Several challenges are emerging:

First, the line between generative AI and traditional applications is blurring. AI features are being
integrated into everything from information systems to learning management platforms. This means
security can't be bolted on as an afterthought – it needs to be woven into the fabric of these applications.
Second, multimodal AI that processes images, audio and video creates new security dimensions.
Organizations will need to think about how to protect sensitive information in these formats as well.

Third, the regulatory landscape around AI is rapidly evolving. Organizations should prepare for new
compliance requirements specifically addressing AI usage and data protection.

Finally, there's the challenge of AI alignment – ensuring that AI systems act in accordance with
organizational values and objectives. This goes beyond traditional security but is equally important for
maintaining trust.

GCE's implementation shows how API-driven, SaaS microservice architecture provides the flexibility to
adapt security policies over time as AI platforms evolve. Their team appreciated that with this approach,
making redaction policy changes doesn't require developer sprint cycles – security teams can update
policies directly through a management console, significantly reducing the time needed to implement
security changes.

The organizations that will thrive in this new landscape are those that view AI security not as a barrier to
advancement but as an enabler – a foundation that allows them to deploy AI confidently and responsibly.

199