Al Chen of Cisco explains on AI Engineer how his team handles security reviews for customer-facing banking AI. His theme is evidence: show that a fix works, a restore preserves data and an evaluator keeps sensitive information private.

A faster rollout depends on the bank

  • The title and description frame the experience around five major banks. Chen describes strategies for reducing a year-long path to production to a couple of weeks.
  • That timing depends on existing image approvals, available GPUs and the bank’s security setup. Formal reviews and custom infrastructure can add months.
  • He separates production applications serving bank customers from prototypes and internal document assistants.
  • Caveat: these are Chen’s deployment lessons, not a bank-by-bank study or a guaranteed rollout schedule.

Prove a vulnerability fix works

  • CVEs are publicly tracked security vulnerabilities. Each bank can have different container versions, scanning tools, severity rules and remediation deadlines.
  • Open-source dependencies complicate fixes. Chen’s team documents what it can repair and what must wait for upstream maintainers.
  • Updating a package satisfies a version check. Chen also wants evidence that the reported exploit fails against the actual application.
  • His proposed Harbor task gives an agent, a model working with tools, an isolated application environment and tests. The agent attempts to reproduce an older exploit against the updated package.
  • Parallel trials can run in containers or sandboxes such as Modal and Daytona. The talk gives a testing pattern, without measured exploit-detection results.

Verify the restored data

  • Chen describes a ClickHouse setup that backs up the primary region to a storage bucket, then restores into a disaster-recovery region using Altinity’s ClickHouse backup tool.
  • A successful job log proves the job ran. Row counts and checks that replicas agree give additional evidence about the data after restoration.
  • Bad disks, failed nodes, migrations and replication delays can leave data stale even after a successful backup.
  • Region choices also affect data residency, the rules governing where records may be stored. Chen suggests replicating IDs and metadata while keeping core trace data in its permitted region.
  • His claim about missing managed cross-region failover describes the ClickHouse deployment problem in the talk, rather than every current hosting option.

Evaluator explanations can expose private data

  • Redacting the interface leaves another path open: a judge model, an AI evaluator, can repeat sensitive details in its explanation.
  • Chen calls out both PII, personally identifiable information, and MNPI, material nonpublic information.
  • His first approach retains the evaluation score while withholding the explanation unless an application check permits it to be shown and persisted.
  • If reviewers need an explanation, a second judge can work from redacted input. Chen says this adds another model call to the request.
  • Caveat: the talk describes privacy controls, without reporting a measured zero-leakage result.

Own the organizational work

  • Approved image imports and GPUs ready for inference shorten the path. Missing procurement and approval processes can dominate the schedule.
  • Chen divides customer problems into engineering, workflow and human or organizational workstreams.
  • His school-math analogy connects the three technical pillars: compliance teams need the proof behind an answer, not just the answer itself.