PRODUCTION SCENARIO
A retailer plans to launch a gen AI recommendation assistant in eight weeks and add security afterwards. The CISO asks the program lead for Google's recommended approach and for a framework to structure the work across the AI lifecycle.
Which should the program lead propose?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: The Secure AI Framework, applied from the design phase onward
Google's guidance is that security controls are easier to integrate early in design than to add after development - shifting left - and the Secure AI Framework is the structure for it: principles and practices across the whole AI lifecycle, including the AI-specific vectors to assess such as data poisoning, model inversion and adversarial attacks. Security Command Center is a real Google Cloud security tool that watches a workload which already exists, so it covers the run phase rather than the lifecycle. The existing application threat model is genuine hygiene written for conventional software and does not enumerate those AI-specific vectors. A penetration test before the launch gate is diligent, and it is a point check on a design already fixed, not a framework.