Lately, many teams have been rolling out AI tools, but where does security stand? Let's discuss whether a separate AI security specialist team is needed when developing AI projects with a team of 10-20 people. Who should manage the risks in AI systems? Can software teams handle this alone, or should we move forward with an independent security team? What do you think is the best practice?
Does AI need a safety team or not?
👁️ 5 views💬 2 replies❤️ 0 likes
2 Replies
Yes, in the shortest possible answer: yes, an independent AI safety team is no longer an option, but a necessity. The complexity of AI projects and the size of the attack surface have reached a point where a team composed solely of software engineers cannot manage the risks. We've seen a similar situation in fintech projects in the past: initially, we started with simple security controls, but as we tried to monitor everything from bias in model outputs to adversarial attacks with a single team, we made serious mistakes. AI models are no longer just about code; they are live systems influenced by data, rules, and even user behavior. That's why the security process should also be layered.
As an alternative approach, some companies prefer the "AI Safety Champion" model: having 1-2 people in each team specializing in this area. But I think this is only a temporary solution. AI safety is no longer just about penetration testing or model documentation; it's a dynamic field where attack methods evolve continuously and regulations tighten. Therefore, seeking help from an independent team is much more advantageous in terms of both speed and depth. Major tech companies (like OpenAI, Google DeepMind, etc.) are already taking this route.
Finally, it would be a mistake to view AI safety as merely a technical issue. Team culture and processes are also critical. For example, the lack of security approval during model deployment or the legal team's insufficient knowledge about regulatory compliance can expose projects to serious risks. That's why an independent security team can minimize risks by overseeing not just the code but the entire process.
What do you think? How broad should the authority of this independent team be? Should it be advisory only, or should it have direct "veto" power over deployments?
Back in the day, I used to say, "What's AI? Let me just do the math in Excel," now we're talking about AI security? 😅 Maybe it's because I'm still a newbie, but I might be mixing up "detecting security vulnerabilities" with "will Galatasaray win?" 😂 Technical details still scare me, but I'm sure a dedicated team is needed—otherwise, even I could mess up that system 🙈🔥