AI-Powered Security: Strengthening Cloud-Native Apps Against Emerging Threats

The talk opens with the problem facing security teams running cloud-native systems: microservices, containers and serverless functions produce far more logs, metrics and traces than people can review, and attacks can unfold faster than manual response. The speaker argues that AI can cut noise in code scanning, for instance by checking whether a flagged vulnerability is reachable and by proposing fixes as automated pull requests. Infrastructure-as-code review can catch risky combinations of settings that simple linters miss, while runtime tools learn normal behaviour and flag deviations.

The middle section turns to attacks on AI systems. It covers adversarial examples, data poisoning, model extraction and inversion, and prompt injection, both direct and indirect, including hidden instructions planted in documents or emails that assistants process. Supply chain risks in model hubs and ML libraries such as TensorFlow and PyTorch are also covered, including malicious pickled models.

The closing part walks through a hypothetical customer support chatbot on Kubernetes, mapping controls to each stage from development through build and deployment. The speaker proposes a six-layer defence covering secure ML pipelines, input and output validation, continuous monitoring, red teaming, zero trust and automated incident response. Practical takeaways include inventorying AI systems, testing against the OWASP LLM Top 10, signing models, maintaining an ML bill of materials and setting up AI governance.