Notifications
Clear all
Topic starter
18/08/2026 2:49 pm
TL;DR: Financial services are using AI in underwriting, fraud detection, and customer service, but Securiti argues that visibility gaps, shadow AI, and manual compliance still prevent safe scale, even as institutions report a 25% throughput lift in underwriting. The real issue is governance of sensitive data access and AI behaviour, not AI adoption itself.
NHIMG editorial — based on content published by Securiti: DataAI Security for Financial Services: Turn Risk Into competitive Advantage
By the numbers:
- Institutions using AI for underwriting report a 25% increase in loan throughput.
Questions worth separating out
Q: How should security teams govern AI access to sensitive financial data?
A: They should combine identity governance with data classification so access decisions reflect both who is acting and what data is involved.
Q: Why do AI browsers create new identity and access risk?
A: Because they turn the browser from a passive display layer into a system that can interpret content and execute actions.
Q: How can organisations prove their AI controls are actually working?
A: Look for evidence that policy decisions are logged, sensitive prompts are being redacted or blocked when required, and approved AI interactions are traceable by identity and business context.
Practitioner guidance
- Map AI access paths to regulated data Inventory every AI system, prompt path, and downstream service that can touch customer, payment, or risk data, then classify where regulated data can flow without human review.
- Right-size entitlements for AI-enabled workflows Reduce access to the minimum fields and records needed for each role, and pair that with masking so analysts and copilots do not see unnecessary sensitive data.
- Automate evidence for PCI, GDPR, and AI controls Use continuous testing and automated reporting to prove access restrictions, masking, and remediation outcomes across overlapping control obligations.
What's in the full article
Securiti's full article covers the operational detail this post intentionally leaves for the source:
- Specific BFSI use cases for AI discovery, classification, and auto-remediation across hybrid environments
- Examples of how policy-based controls reduce exposure in financial analyst and customer-service workflows
- The compliance automation model used to generate auditor-ready evidence across overlapping regulations
- Practical ways to shrink AI risk by removing duplicate, redundant, and stale data
👉 Read Securiti's analysis of DataAI security for financial services →
DataAI security in BFSI: what changes for IAM and control teams?
Explore further
18/08/2026 3:31 pm
AI governance debt is now an identity problem as much as a data problem. In BFSI, the controls that determine whether AI can safely reach customer and transaction data are the same controls that determine whether access is defensible. Classification without entitlement governance still leaves regulated data exposed, and audit automation without lifecycle control only documents the gap. The practical conclusion is that AI risk management must sit alongside identity and data governance, not outside it.
A question worth separating out:
Q: Who is accountable when AI-driven testing exposes a critical flaw in a regulated environment?
A: Accountability sits with the teams that own the control boundary, not just the team that wrote the code. In regulated environments, security, engineering, and identity governance leaders must define who can approve emergency change, who can override guardrails, and how those actions are audited.
👉 Read our full editorial: DataAI security in financial services needs tighter governance
