Скачать или смотреть AI Agents: Transforming Risk & Compliance Assessments

In this deep dive, we sit down with Justin Garlick from the Risk and Compliance (GRC) team at Plaid to explore how they manage security risk at scale without compromising innovation. For Plaid, a platform connecting millions of people to their financial lives, their approach to security risk is "existential".

Justin shares his wisdom on building a world-class risk program and reveals how his team leverages AI agents to become "risk superhumans".

Key Takeaways:

From Manual to AI-Driven: Plaid's risk assessment process was once "very manual," "time consuming," and full of "repetitive steps". They realized this process "just wouldn't scale" with the volume of risks they faced.

The "Aha Moment" with AI Agents: The speaker describes a "real aha moment" when Zania's AI agent produced meaningful results in "record speed". The difference was "night and day" in how quickly the agent could perform tasks like threat intelligence and parsing control narratives.

AI as a Top-Tier Intern: AI agents are described as being "like a really really top tier intern". They excel at tasks like "discovering data" and "collecting data", freeing senior analysts to focus on validation and review.

Plaid's Modified FAIR Approach: Plaid uses a modified version of the FAIR (Factor Analysis of Information Risk) framework, which provides a quantitative approach to risk analysis. To gain speed and fit their business context, Plaid adapted the framework to be "somewhat more qualitative in nature" rather than using the heavy-handed Monte Carlo simulations.

Training Agents on Complex Frameworks: Plaid found success by creating a "dedicated agent to be the expert" for each parent and child node of the FAIR methodology (e.g., one agent for threat frequency, another for control strength).

The Future of GRC: Justin is most excited about using AI for the proactive identification phase of risk management, continuously monitoring for overlaps between threats and vulnerabilities to create risk tickets automatically. He also sees significant promise for AI in vendor risk management due to the massive volume of due diligence documents required.

Advice for GRC Leaders:

Justin advises GRC leaders to "stay curious". AI is "here to stay," and organizations should have a realistic expectation of their current risk management capabilities before implementing AI solutions. He notes that a good initial proof-of-concept should show "clear value" immediately.

Guest: Justin Garlick, Risk and Compliance Team, Plaid

Host: Shruti Gupta, Founder and CEO of Zania

Tags: #Plaid

#RiskManagement

#FinTech

#GRC

#AIAgents

#AIinGRC

#CyberSecurity

#FAIRFramework

#QuantitativeRisk

#Innovation

#VendorRiskManagement

#RiskAnalysis

#Compliance