Abdullah Garcia (Principal Cybersecurity Architect at JPMorganChase) presents a data-driven analysis evaluating six major industry threat catalogs (OWASP AI Exchange, OWASP ML Top 10, Plot for AI, OWASP LLM, OWASP Agentic AI, and CSA Maestro). Abdullah exposes why headlines claiming AI creates entirely “novel species of risk” are misleading, demonstrating that nearly two-thirds of all AI/ML security threats are simply longstanding data security problems—such as weak provenance, poor sanitization, and data poisoning—dressed in new clothes.
🗽 Catch Us in New York! Ready to secure enterprise AI architectures, data supply chains, and open-source financial infrastructure?
Join global technology and security leaders at OSFF New York on November 4–5, 2026.
🎟️ Register Now: https://hubs.ly/Q04n_bZL0
🔥 20% OFF DISCOUNT CODE: 26YTOSFFNY20C
🕒 Timestamps:
0:00 Introduction: Abdullah Garcia (Principal Cybersecurity Architect, JPMC)
0:38 The Big Question: Are AI Threats Really Novel?
1:28 Core Finding: 2/3 of AI/ML Threats Are Longstanding Data Security Problems
2:43 Defining “Data” in AI/ML: Weights, Prompts, Corpora & Embeddings
4:11 Breakdown Across 3 Classes: General, Generative, and Agentic AI Threats
7:55 Allocation Strategy: Where Should Your AI Security Budget Go?
8:55 Why Model-Centric Guardrails & Prompt Firewalls Aren’t Enough
10:05 3 Actions Security Leaders Should Take Next Monday
10:27 Audience Q&A: Supply Chain Security, Data Integrity & Governance Pillars
📊 The Problem: The Myth of “Novel” AI Risks & Model-Centric Blind Spots
Cybersecurity vendors and media headlines frequently push the narrative that AI introduces completely novel threat vectors demanding entirely new defense stacks. As a result, enterprise security teams over-invest in model-centric defenses—such as prompt firewalls, red-team evaluations, and output guardrails. However, these tools fail to address the core attack surface: untrusted training data, weak prompt provenance, unverified vector embeddings, and data supply chain manipulation.
🏗️ The Solution: Data-Centric AI Security & Supply Chain Pillars
Abdullah Garcia advocates shifting enterprise security strategy from model-centric firewalls to rigorous data security: Data Supply Chain Inventory: Inventorying all data assets that shape model behavior—including fine-tuning corpora, system prompts, retrieved RAG context, and weights. 4 Pillars of Data Security: Implementing Provenance (verifying data origin), Lineage (tracking data flow), Integrity Attestation (cryptographically verifying data hasn’t been altered), and Strict Access Controls. Emergent Supply Chain Governance: Building data supply chain security through policy, transparency, and dependency management rather than relying solely on runtime model filters.
⚙️ Why This Matters for Financial EngineeringCapital & Budget Optimization:
Financial institutions do not need to reinvent their cybersecurity infrastructure for AI. By recognizing that AI threats are fundamentally data threats, CISOs can allocate budget toward extending existing, battle-tested data security and governance controls. Preventing Insider Backdoors: Enforcing data integrity attestation prevents malicious actors or compromised suppliers from introducing subtle backdoors into proprietary risk, credit approval, or trading models.
🌐 More about FINOS: https://www.finos.org/📧 Join our newsletter: https://www.finos.org/sign-up
🎙️ Listen to our Open Source in Finance Podcast: https://www.youtube.com/@FINOS/podcasts
LinkedIn: https://www.linkedin.com/company/finosfoundation
#FINOS #OSFFNewYork #JPMorganChase #Cybersecurity #AISecurity #DataSecurity #AppSec #DevSecOps #SupplyChainSecurity #FinTech
source
