Securing and Governing Generative AI: Learnings from Microsoft
summary
Microsoft treats generative AI like any critical platform: require data classification and labeling (now at 95% coverage on SharePoint), centrally inventory AI use across roughly 80,000 Azure subscriptions, and enforce controls via Microsoft Information Protection, Purview, Defender for Cloud Apps and Defender for Endpoint. A responsible AI org, SDL updates, an AI red team and deployment safety board gate rollouts. Example outcomes: internet LLM blocks cause rapid user backlash and are reversed within hours; highly sensitive sets run in isolated model-only environments with sanitized outputs.
AI-written summary · about
chapters (17)
- 0:00Microsoft's AI security approach
- 1:50Generative AI risks overview
- 3:56AI use cases and threat modeling
- 6:45Data classification for AI
- 8:17Governance versus user flexibility
- 10:01Existing security for AI
- 12:11AI services inventory
- 14:22Responsible AI governance
- 17:13Microsoft products vs standards
- 19:24Secure AI development lifecycle
- 23:25Model protection and prompt injection
- 25:16AI red teaming and safety checks
- 27:47Compensating controls for AI
- 29:13Restricting third-party AI access
- 33:03Secure AI for sensitive data
- 35:50Key takeaways for AI security
- 36:44Q&A on AI security standards
related talks
15mAI Guardrails for Enterprise Deployments
27mSafeguarding Generative AI Applications: Navigating Security Challenges and Best Pract...
44mGenerative AI Security — A Practical Guide to Securing Your AI Application
09mSecuring Generative AI Workloads
48mBuilding and using AI models responsibly
45mOverview of Risks, Vulnerabilities and Paths to Safer Use of Generative AI
20mSecuring generative AI: Privacy and compliance considerations
40mSecuring Generative AI: Is it all an Illusion?