The Essential ROI Focus: Implementing AI, Ensuring Security, and Strengthening Governance

In anticipation of the upcoming TechEx North America event on June 4-5, we had the privilege to converse with Kieran Norton, the leader of Deloitte's US Cyber AI & Automation division, who is scheduled to speak at the conference on June 4th. With over 25 years of experience in the sector, Kieran is well-versed in cybersecurity matters and currently advises Deloitte clients on the integration of AI in business applications, focusing on cybersecurity aspects.

Most organizations have implemented at least basic cybersecurity measures and, fortunately, many operate with a comprehensive range of protections addressing communications, data storage, and perimeter defenses.

In recent years, AI has significantly altered the landscape, affecting not just how companies can internally utilize the technology but also its application in cybersecurity for advanced threat detection and by malicious actors in innovative attack strategies.

In its role as a cybersecurity tool, AI can be applied in network anomaly detection and intelligently identifying phishing attempts, among other applications. As a business enabler, AI requires enterprises to proactively ensure its responsible use, balancing innovation with privacy, data sovereignty, and risk management.

AI, smart automation, and data governance are currently niche areas, but with the increasing presence of AI in business, these niches are expected to become mainstream concerns. Organizations will soon need to address these issues with applicable solutions and guidance.

Integrating AI into business processes goes beyond technology and deployment techniques. Companies will need to adapt internal operations to maximize AI benefits and enhance protection for businesses relying on AI daily. Kieran compares these changes to past adaptations necessitated by new technologies, like cloud adoption, which involved significant shifts that businesses recognized took varying times to achieve.

These transitions require a broad approach, updating governance frameworks, establishing secure architectures, and leveraging a new generation of specialists to ensure AI and its data are used safely. Companies employing AI need to identify and address bias, test for inaccuracies or malfunctions, impose safeguards, and monitor AI usage comprehensively. As Kieran notes, businesses must integrate testing for issues like hallucinations, bias, and data vulnerabilities into their processes.

These topics are substantial, and for a comprehensive understanding, we recommend attending Kieran's two talks at TechEx North America. He will delve into issues surrounding AI deployment, business application strategies, and methods to deter and detect advanced AI-powered threats and attack vectors.

Kieran advises companies to begin with smaller, low-risk AI implementations. Initially seen in chatbots, AI's encounter in real-world scenarios has expanded, differentiating simple chatbots that answer customer queries from agents that trigger actions with business applications. "This delineation [5] suggests that chatbots are among the initial applications [5] As we advance towards agents, complexity and risk profiles evolve," he explains.

Agentic AI, particularly in customer-facing instances, poses higher risks, as errors can seriously impact brand reputation. "Such scenarios are riskier, especially when agents handle financial transactions or healthcare coverage decisions [5] not an ideal first use case," explains Kieran.

"When you connect multiple agents together, creating a network of agency [5] interactions grow intricate, presenting diverse issues," he observes.

The challenges of automation and system interfaces have existed for nearly a decade. Data silos and RPA (robotic process automation) issues are hurdles enterprises have faced for years. "Knowing your data, having access [5] fundamental principles remain true," Kieran affirms.

In the AI era, questions of infrastructure, data visibility, security, and sovereignty hold significant relevance. AI conversations often revisit these issues, underscoring the need for comprehensive discussions about AI's impact on enterprise operations and infrastructure.

Kieran underscores the necessity of practicality and careful assessment of needs and capabilities before AI can establish itself. "Understanding use cases [5] should provide clarity on ROI [5] determining the worth of investing in development," he advises.

Deloitte employs AI where clear use cases with measurable returns exist, such as initially triaging SOC tickets. Here, AI operates as a Level I incident analysis engine. "We track generated ticket volume [5] reducing triage time by 60 to 80% carries significant benefits." Given AI's relative infancy, specific operational applications serve as prototypes and effectiveness proofs, being internally non-customer-facing and overseen by qualified experts.

Kieran advises business professionals exploring AI for their organizations not to originate AI risk management programs from scratch. Instead, businesses should adapt existing systems, grasp each use-case, and avoid constructions based on theoretical value.

"Don’t create another AI security program on top of what exists [5] Update your programs to accommodate AI workload nuances." Success in AI requires clear, realistic goals grounded in solid foundations.

For more on TechEx North America and to register for attendance, visit the Deloitte team at booth #153 and join its June 4 sessions: 'Securing the AI Stack' on the AI & Big Data stage from 9:20 am-9:50 am, and 'Leveraging AI in Cybersecurity for business transformation' on the Cybersecurity stage from 10:20 am–10:50 am.