Using AI/ML to scale governance, risk management, and audits
summary
Amazon uses Amazon Comprehend plus Lambda, API Gateway, S3 and CloudWatch to auto-extract security text, map it to internal controls and return confidence scores (example: 89% physical security, 45% IAM). A pilot on 543 controls shows 53% time savings, translating to roughly 3,300 hours saved annually across ~140+ third-party certifications and ~225 audits. The pipeline supports bulk uploads, QA via confidence thresholds, and continuous retraining for lowering manual review.
AI-written summary · about
chapters (10)
- 0:00Intro
- 2:26Manual security control mapping process
- 3:48Security control mapping exercise
- 4:35Manual assessment of security controls
- 5:00Amazon Comprehend overview
- 5:36AI/ML security control mapping process
- 7:38Internal high-level architecture diagram
- 8:41AI/ML assessment of security controls
- 10:20Lessons learned for security builders
- 11:41AWS governance and compliance solutions
related talks
55mAccelerating auditing and compliance for generative AI on AWS
56mCloud compliance journey: Compliance and audits
33mCompliance as Code - Lessons Learned From Regulated Organizations
32mContinuously assess controls for risk and compliance
57mUsing AI to automate content moderation and compliance with 
21mIntelligent Workflow Automation with Lambda and AI Models
17mBetter availability and automated code reviews with ML
27mIntroduction to AWS Security