ReadingResearchRadarInvestment framework
Sign in / Sign up
← Back to reading
NewsMaterial3 min readDisconfirmAI Editorial

Cisco's Al Chen: AI in Banking, Changing Version Numbers, Running Backups, and Hiding the Interface Is Not Enough

Al Chen, head of Cisco's AI Observability Software team, shared at the AI Engineer conference that bank security reviews do not seek a 'task completed' status, but rather checkable evidence for the correctness of every step. He used three examples—CVE remediation, cross-region disaster recovery, and LLM judge leakage—to illustrate the same principle: passing an explicit check does not mean the problem does not exist; additional verification is required.

2026-10-20 17:00 GMT+8

At the AI Engineer conference in October 2026, Al Chen, head of Cisco's AI Observability Software team, drew an analogy: his tenth-grade math teacher, Mr. Huff, required answers to be precise to the fourth decimal place, but most of the credit came from the proof process. Bank security and compliance teams are like Mr. Huff, except they hold multi-million-dollar compliance budgets. Chen's team deployed AI observability software into some of the world's largest banks, where they found that the real lever for shortening review cycles is not making models stronger, but ensuring every step can be inspected.

Take CVE remediation as an example. A platform has multiple images, each containing multiple CVEs, with different banks running different versions, using different scanning tools, and having their own severity policies and remediation deadlines. The conventional approach is to upgrade package versions or rebuild base Docker images, after which scanning tools (such as Sysdig, Wiz, Prisma, etc.) confirm the version change and release it. Chen points out this is far from enough: a changed version number does not mean that specific vulnerability cannot still be exploited in the application code. His team built additional evidence using the Harbor task framework—having agents write exploits based on the old version, attempt them on the new version, and then write tests to verify if the exploit still succeeds. Harbor can run multiple containers or sandboxes in parallel, providing multiple trials. Chen also acknowledged the boundary: a failed attempt is evidence regarding that specific exploit, not proof that all possible exploits are absent.

Sign in / Sign up
ReadingResearchRadarInvestment framework

Disaster recovery follows the same pattern. Chen described a ClickHouse deployment where banks must arrange cross-region recovery themselves, as the platform lacks managed cross-region failover services. They use the open-source project clickhouse-backup to back up the primary region database to a storage bucket, then execute restore tasks in the disaster recovery region. Tool logs can show whether the task completed, but Chen says this status does not indicate whether the data is currently correct—bad disks, node failures, migration issues, or replication lag could cause data to be inconsistent with when the task was executed. He added table row count checks and intra-region replica convergence checks, shifting the verification object from 'did the task run' to 'is the data correct'.

The third example is the easiest to overlook. Desensitization processing at the SDK, gateway, or middleware layer makes the user-facing interface look clean, but LLM-as-a-judge creates another leakage path: the judge scores the agent's output and generates explanations for human review. If the judge sees raw traces, its reasoning process may reproduce personally identifiable information (PII) or material nonpublic information (MNPI). Chen suggested checking judge prompts and traces for leakage, and proposed a separation scheme: scores are always persisted for evaluation, while reasoning undergoes sensitive information checks before being displayed; if the bank still needs explanations, a second judge is run on desensitized input. The cost is one additional LLM call per request.

Chen's conclusion is that compliance speed depends on the bank's own readiness—whether there is already a process for pulling images from the registry, whether GPUs are in place, and whether security reviews and access configurations are ready. These delays stem more from organizational alignment than technology. His team treats customer problems as their own, categorizing them into engineering, process, and personnel organization lines, automating as much as possible.

Noteworthy boundaries: Chen describes scenarios where large vendors deploy the same product across multiple banks, and their engineering investment (maintaining the Harbor test framework, running dual judges, tracking open-source upstream dependencies) may not be directly transferable to small teams or single-customer deployments. The 'shortened from a year to a few weeks' he mentioned is relative; actual time still depends on the maturity of the bank's infrastructure and approval processes.

Sources

  • youtube.com↗
Continue researching →