CoreQ Academy1.3 Explain the importance of security throughout the life cycle of AI.
Security has to be designed into every stage of an AI project, from deciding whether AI is appropriate at all, to monitoring the model years after deployment.
Life cycle stages
- Business use case
- Define the problem and whether AI is the right tool, including the risk if the model is wrong.
- Alignment with corporate objectives
- The AI project supports real business goals and fits the organisation's risk appetite and policies.
- Data collection
- Gathering data lawfully and securely.
- Trustworthiness
- Is the source reliable and the data accurate and representative?
- Authenticity
- Is the data genuinely from the claimed source and unaltered? Verify with signatures and provenance.
- Data preparation
- Cleansing, labelling, balancing and removing sensitive data in a controlled environment.
- Model development/selection
- Building or choosing a model (including third-party or open models) with security review of its origin, licence and known weaknesses.
- Model evaluation
- Testing accuracy, bias, robustness and safety, including adversarial and red-team testing, before release.
- Deployment
- Releasing behind access controls, gateways and guardrails with secrets managed securely.
- Validation
- Confirming the deployed model behaves as it did in testing in the real environment.
- Monitoring and maintenance
- Watching for drift, abuse, cost spikes and new vulnerabilities; patching and retraining as needed.
- Feedback and iteration
- Using user feedback and incidents to improve data, prompts and controls, then re-evaluating.
Human-centric AI design principles
- Human-in-the-loop
- A person must approve or act on the AI output before it takes effect, e.g. an analyst confirms before an account is disabled.
- Human oversight
- People supervise the system overall, can intervene and can shut it down.
- Human validation
- People check samples of outputs for accuracy and safety, especially for high-impact decisions.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.3 of the publicly available CompTIA SecAI+ CY0-001 exam objectives (Exam objectives V1, document version 1.1). Not affiliated with or endorsed by CompTIA. Contains no exam questions.