AI is everywhere right now, but as we know in financial services, it's not just all about innovation. We've got to think about the security and staying compliant.

Today, we're diving into the world of Large Language Models (LLMs), AI more broadly, and AI-powered services. Just asking a big question: How safe and secure are they really? And what do operational leaders in financial services really need to know before they jump straight in with their teams?

Understanding large language models

I suppose the first question is to take a step back, right? Start from the basics, keep it simple. What exactly is a large language model, and who are the big players in the space right now?

A large language model is the kind of most common one that you've heard of: ChatGPT. That was kind of the main big one. But the other main players are Facebook with Llama, there’s Claude with Anthropic, and Grok with X. They are the main players in this space.

These models require a tremendous amount of energy, power, and graphics in order to be made. It's not a situation where everyone is making up their own model. These core LLMs—ChatGPT, Llama, Claude—they are the main LLMs that we talk about or think about when we say LLM.

LLMs in the wider AI landscape

And how do they fit into the broader AI landscape? So, wider AI services? I think it’s really important because I think a misconception is you might see some AI application, something.ai, that does a particular thing. It’s very unusual that they have their own model, their own LLM that they built. They're just kind of tying into one of these existing large language models like Anthropic, OpenAI, or Facebook's model.

From our perspective at Lanware, what are we seeing in terms of firms starting to use these models? Are there any preferred models or any particular use cases that we're coming across now?

Maybe a couple of years ago, when it was still new, the options really were only ChatGPT through OpenAI or Microsoft Copilot, which uses ChatGPT via OpenAI. These are very much generic models, there to suit every general purpose. But what we’ve started to see now is more and more players enter into this and building up these more tailored AI applications.

I had a lot of clients who were interested in using AI, but went to these more general-purpose tools and maybe found that they didn't exactly do what they wanted to do and were potentially stuck with it. But now, a lot more AI applications are available. The options for using AI have kind of exploded.

We are seeing clients wanting to use more of these specialist AI applications. These specialist applications, again, going back to the ecosystem and wider landscapes, are AI-powered services that perhaps use one of those various large language models, but have really created this to perform a specific function or for a specific use case.

Key security and compliance risks

I want to focus on the risks. If you are looking to adopt, deploy, and use these models, what are the kind of key security and compliance considerations that you would be thinking about and looking at?

The way we look at security and compliance for AI is not too dissimilar to SaaS applications, like web applications that have been around for years. The types of things we look for are whether or not they use encryption, MFA—the very basics.

As we get more to AI, some of the things we would look at for a general web application or business application become even more critical. The main one here is confidentiality or privacy. What happens when you are uploading your data into these applications or into these models? Where's your data going? What's the data residency? And how are they going to use that data? You'd be surprised how many of these newer AI applications don't set out what happens.

That's probably one of the main ones that we look at, and there are a lot of challenges around that. And it's also not just what they do with the data, because they're using one of these other LLMs—ChatGPT or Llama or whatever. What happens when it then goes downstream? What's happening with all that information that you're uploading to it?

Then there are a number of other things that we look at, like features. How often are features introduced? The AI is changing incredibly fast. New features are dropping into products weekly or monthly, and being able to control them—what features are turned on and enabled—is really key.

A new AI feature, for example, being able to share the contents of your chat prompt to a colleague might sound useful, but it might also enable somebody to share that with the world or public. Being able to lock that down is really key.

So, going back to a traditional SaaS environment, the pace of change and new features within SaaS, compared to AI, is that AI is actually a lot faster, so it's harder to keep track of everything new. And there are security and compliance implications that go alongside that. So it's a little bit like a moving target.

Vendor comparison: security vs. features

Let's focus on the big models: the OpenAIs, Anthropic, those ones. You’ve had a look, unlike probably 99.9% of people, at some of the terms and conditions around them. How do they stack up, focusing on it from our world, which is working within financial services, in terms of the security provisions and guarantees and controls and compliance provisions?

I've read through the Microsoft Copilot terms and conditions—a bit of a dry reading—but it has everything in there that you want, expect, and need: the clarification around what they are or are not doing with your data, all the controls that they put in place, and how that works in the standard Microsoft ecosystem.

If you contrast that with OpenAI, which is effectively using the same model, it’s a bit more difficult because we've got several flavours or license types, and each one has a different control. One allows for data residency, others don't. It becomes really broad and difficult. A good example with OpenAI is that you can get the top-tier enterprise license type, which gives you data residency control, but only allows you to store in an entire region. You could say, "I want all of the data to be stored in Europe," but you can't say, "I want it to be stored specifically in the UK." There are all these little caveats with OpenAI.

At least OpenAI and some of the other ones similar to it have that information, but a huge proportion of AI applications don't even have the information. They might have terms and conditions which say, "This is how you're allowed to use our product," but they don't have the security information needed in order to properly assess the risk of what happens when you use it.

Microsoft is definitely concentrated on all of the compliance tooling and making sure the way they've configured their AI means that there's a level of trust that you can have with them that your data's not going to be used to potentially the detriment of new, flashy AI features.

But it's definitely a theme: compliance tools are not the interesting or flashy tools that people want to use. So, vendors are focusing on features, and all of this other compliance tooling and information around security is either typically not there or is a bit of an afterthought.

However, the other main players, like OpenAI, have definitely started to get up there on a similar footing to Microsoft. My view is they've probably been forced to in order to enable financial services firms and other types of industries to be able to then use that platform.

Security incidents and the risk of add-ins

What have we seen so far out there in terms of high-profile security incidents, data breaches, or any disasters? Is it early days, or is the number of incidents we're seeing ramping up as the pace of change increases?

It's still early days, but I think it is a ticking time bomb. We've all seen or heard of those anecdotes of somebody turning the AI meeting notes on, everyone joined, some people left, and then they talked about the people that left, and then everyone got the notes from the AI. There are lots of those types of things happening.

Very recently, in the last few weeks, we have seen a more dramatic security incident with AI where a third-party AI chatbot that you could hook into your Salesforce application—you gave it access to all your Salesforce data, and then it could use that to respond to questions internally or to clients—was compromised and gave the attacker access to a number of companies' entire Salesforce data.

Again, going back to how SaaS platforms have been around for a long time, and third-party add-ins have frequent security issues, what is it about what's happening with these AI-enabled add-ins that actually means the breaches are more serious or have a greater impact?

I think it's the scope of access they need. The rule of thumb is the more information or text information you can throw at these AI, the better it’s going to be in its response. So, the scope of access that it has to these systems is usually quite broad to get a better response. We've seen this ourselves, where clients ask, "Can we use this AI tool?" We've dug in, and maybe they don't have much security information, but they've said, "We need this access," and we see the access, and it's basically everything. This could be quite dangerous.

That's why the level of access and amount of data it needs access to is much greater than historically would be the case with these traditional add-ins.

Advice for financial services leaders

Let's wrap this up with a little scenario. Let's say you're a COO in a fund. You've got one of your team members doing some brilliant work using one of the models or an AI-powered service, but you're not sure it's the right one from a security and compliance point of view. What's your advice to that person who is delivering something for the team, but you are concerned about the security and compliance?

Well, thinking of that is a good first step, because you should be worried. There are so many unknowns, it's really tricky.

I think where we are at the moment—and that's not necessarily going to be forever—you have kind of two options:

1. You use one of these kinds of more established AI companies, like Microsoft, which has all of those compliance features, all the things that you would expect and need, but you compromise on that specific feature or thing that a niche AI application could do. That's an option.
2. Or, you limit what data you are putting into whatever AI you're using. So maybe you take the view that we can use this AI application, but no company data should be uploaded into that.

I get it. But let's take a scenario where the person within this fund is using, say, Perplexity or maybe just ChatGPT, and they're not using Microsoft Copilot, which is more secure and all the rest of it. And they're saying, "But the model's not as fast, it's not as good." How would you persuade them to rethink coming back to use something like Copilot, which has all these more security guarantees and guardrails?

It definitely is a case that those that are stronger on compliance and security tend to be behind in terms of the quality of response and quality of the product, such as OpenAI, Claude, or Perplexity. But this is just a matter of time. Microsoft could be a few months out in terms of being on the bleeding edge of functionality, but it will get there.

So, you could compromise on maybe it's not the tool that you want to use, and maybe accept that you use one of these other ones that are stronger around security and compliance, but that you might be a few months away from being on top of the latest features.

It's just a lag, a delay. And you're talking months, not years, so you just have to be patient.