AI security threats: from attack reality to boardroom decisions

In this session, we connected attack reality and governance. ING Belgium started us off with operational reality, illustrating how techniques such as prompt injection are already being used to manipulate AI systems, bypass controls, expose data, and influence automated decisions. Then Yoshi Parlevliet explored how to modernise GRC operating models to keep pace with fast-evolving AI security threats.

User story: Breaking the brain: exploiting insecure LLMs

As generative AI becomes deeply embedded in business processes, ‘prompt injection’ has surfaced as a significant and often misunderstood security threat. We explored how real-world attacks have successfully manipulated chatbots, AI copilots and LLM-powered integrations to bypass safeguards, expose sensitive data, and influence automated decisions.

Thiago Dimbarre, Offensive Security Engineer, ING Belgium

From spreadsheets to signals: can your GRC keep up with AI?

Boardrooms are increasingly asking “are we in control of AI security threats?” and then discovering that the honest answer is not available on demand. The governance, risk and compliance models most organisations rely on were not built for a threat landscape evolving at machine speed. Annual audits, spreadsheet risk registers, and point-in-time assessments cannot keep pace with AI-enabled attacks, an expanding digital surface and a regulatory environment tightening through NIS2. Using practical examples, we explored what it takes to close the gap, and how decision-makers and technical experts can evolve their GRC operating models to ensure risk and compliance move at the same speed as the (AI) threats they face.

Yoshi Parlevliet, independent GRC practitioner