Standard Chartered Uses OpenAI to Redefine Cyber Defense

Standard Chartered is redefining the 'defender's window' to focus on identifying exploits at a faster pace than attackers.

Reuben Athaide from Standard Chartered notes that attackers target attack paths across systems, APIs, IDs, and trust boundaries rather than isolated repositories or assets, which many traditional security programs examine.

The primary objective was to determine if Frontier AI could provide risk insights that traditional security approaches are unable to detect, emphasizing the critical role of context in evaluating security threats across complex banking architectures with numerous microservices and repositories.

Standard Chartered enhances the quality of AI-generated security findings by feeding comprehensive contextual data into the model, beyond just codebase access.

This includes architecture diagrams, deployment models, dependencies, connected services, and the original solution intent of the software, proving more critical than the specific model choice itself for improving AI results.

Standard Chartered implements a cross-functional approach, involving both application security and development teams, to validate AI-generated findings against actual code, architecture deployments, and live environments, ensuring accuracy and actionability for developers.

By integrating security into an enterprise-wide practice, Standard Chartered aims to increase remediation efficiency and ensure that all software engineers actively participate in preventing vulnerabilities rather than merely viewing them as a backlog task.

The objective is to enhance remediation efficiency and achieve better security outcomes, with developers learning from root causes to prevent future vulnerabilities.

Using frontier AI for remediation ensures that security becomes an integral part of the development process, rather than an additional backlog task.

The 'shifting left' approach gives developers early access to security testing within virtual environments, allowing them to witness evidence of exploitability.

By prioritizing issues based on actual exploit risk, the bank builds developer trust and accelerates safe deployment processes.

Organizations must establish strong foundational elements before deploying advanced AI to maximize its effectiveness.

Reuben Athaide emphasizes the need to reduce technical debt and architectural complexity, limit programming languages for cleaner environments, and ensure solid identity and access controls, as AI will amplify existing conditions.

While there were few 'out of the ordinary' findings, Reuben Athaide noted that the consistency of the results provided validation for their existing security expectations, effectively addressing these SDLC weaknesses.

Standard Chartered employs a hub-based development model to enhance coordination across its global markets.

The security team's strategy focuses on empowering developers with the necessary tools for self-service security practices, while maintaining appropriate checks throughout the process.

Standard Chartered seeks to transition from individual repository scanning to scalable, bulk security testing within sandboxed environments.

Reuben Athaide emphasizes understanding the 'blast radius' if an application is breached, and Matt Weaver confirms upcoming access to OpenAI's 'defense factory' to address enterprise-scale threats.

Reuben Athaide highlights that manual, repository-by-repository security scanning is not sustainable or scalable for a large banking institution.

The bank requires the capability to conduct bulk security scans within a sandboxed environment to effectively manage its extensive enterprise infrastructure.

Enterprise applications are intricately interconnected, which significantly increases the complexity of security management.

The critical objective is to determine the 'blast radius' if a single component is compromised, allowing for defense strategies that anticipate how a breach could propagate across various systems.

Matt Weaver from OpenAI confirms that efforts are underway to provide Standard Chartered access to the defense factory project in the near future.