Navigating the New AI Security Landscape
summary
Maps OWASP-style risks to concrete LLM failures and mitigations, showing RAG vector attacks, prompt injection that leaks system prompts and connection strings, and a real-world cost example where an agent-generated backup triggers a $47,000 API bill plus GDPR hits (~4% revenue fine and 72-hour remediation). Recommends specific tools and practices: Presidio (99% PII scrub) for training data, CycloneDX/ESBOM for model provenance, Pirate ARG for red‑teaming, and Guardian for secret scanning.
AI-written summary · about
chapters (15)
- 0:00Introduction and speaker setup
- 3:19Apple Labs worst week scenario
- 4:44Three-part security framework
- 5:29Prompt injection risks
- 7:39Train data time bomb explained
- 9:28Vector embedding weaknesses
- 12:41Code assistant cost explosion
- 16:15API bombing and token limits
- 18:03Supply chain surprises
- 20:16Misinformation and bias
- 23:17Evaluation-driven development
- 24:41Keeping security momentum
- 26:52Q&A on third-party risks
- 28:16LLMs improving security
- 29:39Closing remarks
related talks
35mGenAI Application Security: Not Just Prompt Injection
54mA Practical Guide to AI Threats & Mitigation Strategies
57mAI Applications Security Puzzle
34mLLM Security 101 - An Introduction to AI Red Teaming
18mCommit Secure AI: Embedding Security in Code, Pipelines, and Production
24mSecuring AI Integration with API's
44mWhat Security Teams Need to Know and Do
59mSecuring the Digital Landscape: A Deep Dive into OWASP Top 10 for Applications, APIs, and LLMs