"What is now clearer is that AI magnifies risks accumulated over time. Complexity itself has become a security risk."
"Practices and risks that were acceptable in a former technology environment may no longer be tolerable. When technology and threats move faster, tolerance for avoidable risk has to change too. Outdated technology, internet-facing systems and remediation timelines designed for a slower environment can become liabilities with little warning.
Leaders need to reset risk appetite, make exceptions explicit, fund the necessary change and establish accountability across product, technology, security, operations and suppliers."
"Start with a complete, current inventory of software and hardware. Then prioritize by asking three questions:
How exposed is it? Can it be reached directly from the internet?
Can we protect it? Can it still receive timely security fixes?
What is the impact? Could compromise or failure affect customers, disrupt critical operations or impede recovery?"
"Put hard boundaries around AI agents
Frontier technologies are moving from answering questions to taking action. Agents can increasingly interact with enterprise systems, access information and execute tasks with limited human involvement. Capability, however, should not automatically determine authority."
"Give agents only the access required for the task and enforce limits on the systems, data and actions available to them.
Make agents identifiable, monitor their actions in real time and preserve traceability for investigation and recovery.
Maintain the ability to restrict or stop an agent quickly.
Reassess boundaries as capabilities, use cases and dependencies change."
https://www.jpmorganchase.com/about/technology/blog/frontier-ai?utm_source=substack&utm_medium=email