AI-Driven Risk Management Strategies

"Throughout the report, we explore a central question: How can organizations reap the benefits of AI adoption while mitigating the associated cybersecurity risks? This report provides a set of actions and guiding questions for business leaders, helping them to ensure that AI initiatives align with overall business goals and stay within the scope of organizations’ risk tolerance. It additionally offers a step-by-step approach to guide senior risk owners across businesses on the effective management of AI cyber risks. This approach includes: assessing the potential vulnerabilities and risks that AI adoption might create for an organization, evaluating the potential negative impacts to the business, identifying the controls required and balancing the residual risk against anticipated benefits. Though focused on AI, the approach can be adapted for secure adoption of other emerging technologies. This report draws on insights from a World Economic Forum initiative, developed in collaboration with the Global Cyber Security Capacity Centre (GCSCC) at the University of Oxford. Through collaborative workshops and interviews with cybersecurity and AI leaders from business, government, academia and civil society, participants explored key drivers of AI-related cyber risks and identified specific capability gaps that need to be addressed to secure AI adoption effectively." Global Cyber Security Capacity Centre (GCSCC), University of Oxford World Economic Forum 

Microsoft's AI Red Team has released a groundbreaking paper titled "Lessons From Red Teaming 100 Generative AI Products" (https://lnkd.in/dGxsydwF) 🌎 Drawing from their extensive experience, they've distilled eight pivotal lessons for enhancing the safety and security of Gen AI systems:- 1. Understand what the system can do and where it is applied. 2. You don’t have to compute gradients to break an AI system. 3. AI red teaming is not safety benchmarking. 4. Automation can help cover more of the risk landscape. 5. The human element of AI red teaming is crucial. 6. Responsible AI harms are pervasive but difficult to measure. 7. LLMs amplify existing security risks and introduce new ones. 8. The work of securing AI systems will never be complete. 📌 Distinguish between Red teaming and safety Benchmarking - Red teaming involves simulating real-world attacks to uncover vulnerabilities, whereas safety benchmarking assesses performance against predefined standards. 🤖 Leverage automation - Utilizing tools like PyRIT can help cover a broader risk landscape more efficiently. 👭 Human judgment is irreplaceable - While automation aids the process, human expertise is essential for nuanced assessments and decision-making. 💭 Responsible AI harms are complex - Identifying and measuring harms require careful consideration, as they can be pervasive yet subtle. 👉 LLMs introduce new security challenges - Large Language Models can amplify existing risks and present novel ones, necessitating continuous vigilance. 👉 Security is an Ongoing Process - Ensuring the safety of AI systems is a continuous effort, demanding regular updates and assessments. 📜 This paper is a must-read for AI practitioners aiming to fortify their systems against emerging threats. #AI #GenerativeAI #AIResearch #RedTeaming #AIEthics #AITrust #MachineLearning #AIInnovation #AIRegulation #TechSafety #ResponsibleAI #CyberSecurity #AIProductDevelopment #AITrends #SafetyInAI

Recently open-sourced ProToxNet: a framework for predicting which drugs cause which side effects, and why certain organs are affected. The problem: Most computational drug safety tools look at a drug's chemical structure and ask "is this toxic?" But the same drug can harm the liver in one patient and the heart in another; because toxicity depends on where the drug's targets are expressed in the body, not just what the drug looks like. The approach: For each drug, we score its predicted binding affinity across 1,507 human proteins (using ConPLex + ESM-1b), then weight those scores by how much each protein is expressed across 68 tissues (from GTEx). The result is a 68-number fingerprint capturing which tissues a drug is most likely to engage; its tissue engagement potential. A lightweight bilinear model trained on 302,307 FDA pharmacovigilance signals (FAERS via DrugCentral) then learns to predict adverse events from these profiles. Data used: DrugCentral · GTEx v10 · STRING v12 · FAERS · CT-ADE clinical trial benchmark - all publicly available. Results across 4,310 drugs and 13,200 adverse event terms: 1) Held-out FAERS AUC: 0.9576 2) Unseen drugs (cold-start): 0.8544 3) Unseen adverse events: 0.8472 4) CT-ADE external benchmark: 0.9157 5) Known hepatotoxic drugs rank significantly higher on liver tissue engagement (DILIrank p=0.0002) Code: https://lnkd.in/gadWTBVp #DrugSafety #ComputationalBiology #MachineLearning #Pharmacovigilance #DigitalMedicine

AI risk hides in contracts. (And you have more leverage than you think). A significant amount of AI risk is external. It's buried in vendor contracts and across the supply chain. And APRA's latest letter makes clear this is a significant governance gap in financial services. Our new article breaks down APRA's 30 April letter to industry and suggests 5 actions you can take now: (1) Audit your AI vendor register today.  Map every AI system in use (including those embedded in SaaS platforms). Compare against the foundation models and fourth-party providers that underpin them. If your team cannot answer that question, that gap is itself a finding. (2) Stress-test your contracts against APRA’s checklist.  Review AI vendor agreements. Specifically, look for: model update notification obligations, audit and inspection rights, incident notification timelines, data handling change triggers, and termination portability (APRA's checklist). Many standard vendor terms will not pass this review. You should be negotiating these with vendors before signing away on standard supplier terms and conditions. (3) Conduct a genuine concentration risk assessment.  For each CPS 230 'critical' AI provider, assess what a sudden loss of service, or a material change in model behaviour, would mean for your operations. Then assess whether your substitution or exit plan is actually executable in that scenario, not just documented. (4) Establish model change notification protocols with key vendors.  If a vendor can update the underlying model without triggering a formal notification... the change management and validation program is incomplete. This is particularly acute for insurers using AI in claims or underwriting decisions. (5) Document what you cannot see. Where upstream opacity is unavoidable, document how you've assessed the risk and why you've accepted it. APRA's proportionality principle cuts both ways. That means your risk management has to match the materiality of the use case. One of my biggest learnings talking to our team is this: most don't realise is that you can (and should) actually negotiate vendor terms across these issues. Link to the article below. MinterEllison Mark Teys Chelsea Gordon

How can we decrease pharmacy spend on high-cost drugs by double digits without worse outcomes? --- Uplift modeling is a common tactic in marketing to target the specific people for a promotion that otherwise wouldn’t buy the product. While marketing in general can lead to overconsumption, in healthcare/#pharmacy, the same mathematical techniques used for uplift modeling could be repurposed to support #PrecisionMedicine or personalized medicine, where the goal is to identify which patients are most likely to benefit from a specific treatment while avoiding unnecessary treatments for patients who might not respond well. Identifying the cohort that is getting most of the outcomes from a drug varies by drug, but some drugs have only a fraction of the total population driving a larger share of clinical results. --- Here's the basic process for using #UpliftModeling (you can find more details from my Milliman white paper in the comments): 1. Treatment: Identify the treatment for which you want to predict response (e.g., a high-cost brand/specialty drug like GLP-1s). This could also be done for a medical device or any intervention. 2. Data collection: Gather comprehensive data and studies about patients, including their medical history, genetic information, and any other relevant attributes. This is often the limiter of building a good model. 3. Control group: Assemble a control group of patients who are similar to those receiving the treatment but are not receiving the treatment themselves. This helps establish a baseline for comparison. 4. Outcome measurement: Measure the effectiveness of the treatment for both the treatment group and the control group. This could involve monitoring health improvements, cardiac events, or other relevant medical outcomes. For FDA-approved drugs, this could come from published research on the “absolute risk reduction” or “number needed to treat.” 5. Model building: Develop predictive models using machine learning algorithms that estimate the likelihood of a positive response to the treatment for each individual. 6. Uplift calculation: Calculate the difference in response rates between the treatment group and the control group to determine the net impact of the treatment. 7. Segment: Divide patients into different segments based on their predicted response probabilities. 8. Action: Use the insights from uplift modeling to guide treatment, coverage, or other decisions. --- A payer or employer can use this information how they’d like, but I imagine it will be used to adjust formularies or utilization management strategies. It could also be used when setting up contracts for how a drug should be used while carving out certain drugs or disease states (e.g. oncology drugs at a center of excellence). There are more potential use cases in the white paper in the comments. --- Would you use this strategy for #PharmacyBenefits or #ValueBasedCare models that take on risk for cost of care?

AI can generate information that sounds accurate but is completely wrong. AI hallucinations can undermine trust in reporting, introduce compliance exposure, and create financial or operational losses. They can also surface sensitive data or misinform decisions that affect capital allocation, investor communication, and audit readiness. AI hallucinations are not a signal to slow down innovation. They are a signal to strengthen your governance and controls. With a thoughtful risk management approach, leaders can understand uncertainty and build a more confident, resilient AI strategy. Considerations for leaders to reduce AI hallucination risk: 1. Create a validation and review process for AI generated financial outputs. Leaders must ensure that any AI generated forecasts, variance analyses, reconciliations, or narrative summaries have structured validation for source accuracy and logic. 2. Strengthen compliance and regulatory controls within AI workflows. AI hallucinations can create errors that lead to noncompliance and regulatory exposure. Leaders can embed compliance checkpoints into AI driven processes to avoid misstatements, inaccurate filings, or unintended disclosure. 3. Prioritize data governance using high quality, company specific data to reduce the risk of fabricated or inaccurate outputs. This is critical for forecasting, scenario modeling, and automated reporting. 4. Use retrieval augmented generation and automated reasoning for workflows. Pairing these methods anchors AI generated analysis in verified data sources rather than probability-based guesses. 5. Enable filtering and moderation tools to block misleading or irrelevant results. Teams cannot work from flawed or unverified outputs. Filters help prevent misleading content from entering critical workflows or influencing decisions. AI is gaining traction. Now is the time to formalize your AI risk mitigation approach. Start the discussion within your leadership team today. Identify where AI is already influencing decision-making, assess your current controls, and define the safeguards you need next. #RiskManagement #AI #Leaders

Did you know that in July this year, an AI coding tool wiped out a startup's production database and, on top of it, lied about it? Earlier in the summer, a global newspaper published a summer reading list of fake books because it had used an AI tool to research the list. Last February, a global airline had to pay damages because its AI-powered chatbot had lied. If you are a founder or a CXO looking to deploy AI responsibly and ethically, such that your company doesn't end up in an AI-soup, what are the key factors that you need to bear in mind? Here are some pearls of wisdom that I picked up from Kitman Cheung at IBM during the #ThinkSingapore event earlier this year: 🌟 Fairness: You need to train your models on an inclusive data set to ensure that there are as few biases as possible. At the end of the day, AI needs to treat people without prejudice 🌟 Transparent: You need to make sure that the AI systems are understandable, and disclose how they operate and reason, thus building trust and confidence. 🌟 Robustness: You want to ensure that AI can withstand attacks of various scales. The right guardrails and mechanisms need to be in place to not just alert management about attacks, but have an action planned out for various scenarios, including exception handling 🌟 Privacy: You have to protect customers' data and ensure that they are not shared or monetized without consent; it is archived for limited time periods and deleted thereafter. 🌟 Accountability: You need to ensure that clear responsibilities are mapped out and redressal mechanisms are in place when issues arise Such a framework will ensure that risk is appropriately mitigated; brand trust and organizational reputation are protected; regulations are complied with, whilst ensuring a culture of innovation that thrives within the enterprise. To implement a responsible and ethical AI framework, there needs to be buy-in from the leadership, and they need to encourage, enable, and empower their teams to: 👉 document AI training and testing data throughout its lifecycle 👉 put in place governance structures to keep a check and balance, and 👉 more importantly, provide tools, processes, and training to equip them If you haven't already done so, make it a point to discuss this with your management and leadership at the next town hall or board meeting and protect your AI initiative from derailing and your enterprise being in the press for the wrong reason! #ThinkSingapore #IBMPartner

The conversation around Responsible AI is evolving. And It is no longer enough to talk about transparency, fairness, or explainability. The real challenge is embedding these principles into corporate governance. The question is not whether an organization has an AI policy. The question is whether it has a governance model capable of managing the risks that AI introduces into decision-making. Among the most significant challenges are: • Increasing reliance on third-party models whose training data and decision-making processes cannot be fully audited. • Risks arising from bias, hallucinations, and limited explainability in business-critical processes. • Difficulties in assigning accountability when decisions are assisted—or even executed—by AI systems. • New operational risks associated with autonomous AI agents capable of acting without direct human intervention. • Reputational and regulatory exposure resulting from decisions that may be technically accurate but ethically unacceptable. • Geopolitical, technological, and cultural dependencies that shape how AI models behave and evolve. The answer is not regulation alone. AI governance must be built upon a comprehensive enterprise risk management framework that includes, at a minimum: • Identification and classification of all AI systems deployed across the organization. • Periodic ethical, legal, and operational impact assessments. • Robust controls for traceability, auditability, and continuous monitoring. • Clearly defined accountability and ownership structures. • Meaningful human oversight, particularly for high-impact AI systems. • Integration with Compliance, Risk Management, Cybersecurity, Data Protection, and Internal Audit functions. Trust in artificial intelligence cannot be achieved through statements of principle alone. It is earned through effective governance, verifiable controls, and a risk management framework that evolves at the same pace as the technology itself. In the years ahead, organizational maturity will not be measured by the number of AI solutions deployed, but by the ability to govern them responsibly.

𝐓𝐡𝐞 𝐎𝐯𝐞𝐫𝐥𝐨𝐨𝐤𝐞𝐝 𝐑𝐢𝐬𝐤 𝐋𝐚𝐲𝐞𝐫 𝐢𝐧 𝐄𝐧𝐭𝐞𝐫𝐩𝐫𝐢𝐬𝐞 𝐀𝐈 As AI adoption accelerates across enterprises, governance maturity is not always keeping pace. This misalignment is subtle, but consequential. Over time, it can introduce a form of organizational risk comparable to technical debt, with far greater strategic implications. AI governance, at its core, is not just a compliance exercise. It is a leadership discipline. It rests on six foundational pillars: 𝟏) 𝐓𝐫𝐚𝐧𝐬𝐩𝐚𝐫𝐞𝐧𝐜𝐲 Leaders must be able to understand and articulate how AI systems arrive at decisions. Opaque systems limit trust, both internally and externally. 𝟐) 𝐀𝐜𝐜𝐨𝐮𝐧𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 AI does not replace ownership. Clear human accountability for automated decisions is essential to maintain control and credibility. 𝟑) 𝐅𝐚𝐢𝐫𝐧𝐞𝐬𝐬 Unchecked models can perpetuate historical bias. Robust oversight ensures outcomes remain aligned with organizational values and stakeholder expectations. 𝟒) 𝐒𝐚𝐟𝐞𝐭𝐲 & 𝐑𝐞𝐥𝐢𝐚𝐛𝐢𝐥𝐢𝐭𝐲 In enterprise environments, consistency is non-negotiable. Systems must perform predictably under varying conditions to support critical operations. 𝟓) 𝐏𝐫𝐢𝐯𝐚𝐜𝐲 Data usage must be deliberate, visible, and governed. Strong data stewardship is fundamental to sustaining trust. 𝟔) 𝐀𝐮𝐝𝐢𝐭𝐚𝐛𝐢𝐥𝐢𝐭𝐲 Traceability is a prerequisite for scale. If decisions cannot be reviewed, they cannot be confidently deployed at enterprise level. AI governance is often positioned as a constraint on speed. In practice, it is an enabler of scale. Because sustainable innovation depends on control, clarity, and confidence. As AI becomes more deeply embedded in decision-making, the technology may inform outcomes, but accountability will continue to  reside with leadership. That responsibility is enduring. #AIGovernance #EnterpriseAI #Leadership #DataStrategy