AI and Payment Security. Challenges, Impact and Strategy. A Recap of an Interview with PCI

I recently had the pleasure of sharing my thoughts on the rapid advancement of AI in an interview with PCI. The conversation gave me a chance to reflect on some of the most important shifts we are seeing in how organizations approach AI, particularly around security, governance, and trust.

In this blog, I would like to revisit and summarize the key points I shared in that discussion.
I’d like to invite you to read the full copy of the interview on PCI page.
 

AI Strategy Evolution

AI systems are becoming some of the most sensitive environments for enterprise data. To address this, we have repositioned our portfolio to provide the security layer beneath  AI workloads, both on-premises and in the cloud. We are also exploring air-gapped AI infrastructure to help prevent intellectual property from being exposed or leaked.

Using AI in highly regulated industries and security products, such as HSMs, presents unique compliance challenges. We are addressing these requirements by working closely with compliance laboratories and internal auditors.

We also announced a technology partnership with the VAST Cosmos community. By integrating our Enterprise Secure Key Manager with VAST’s AI operating system, we help protect the sensitive data that powers modern AI platforms.

Find out more about our integration with VAST Cosmos
 

AI Governance with Respect to Data Privacy and Security

AI governance starts with a strong root of trust. Effective governance requires control, and control begins with protecting encryption keys. Our HSMs provide a hardware-based root of trust that enables secure AI governance through proven encryption technologies.

Since early 2024, we have been actively monitoring the EU AI Act, recognizing its role in establishing safeguards for the safe and responsible use of AI. To support data privacy, our FIPS 140-3 Level 3 certified HSMs and key management solutions keep cryptographic keys securely inside tamper-resistant hardware. As AI models and agents gain access to increasing amounts of enterprise data, protecting these keys becomes an essential part of AI governance.
 

Biggest Challenges Brought by AI

AI has significantly expanded the attack surface for sensitive data, while advances in AI capabilities have outpaced the security architectures of many organizations.

The biggest challenge we see is the growing cryptographic attack surface. Enterprise data, whether public or confidential, is increasingly accessed by AI models and autonomous AI agents. As a result, larger volumes of valuable data are exposed to a wider range of potential attacks. This rapid growth in AI-generated and AI-accessed data also increases the complexity of managing and securing it. Encryption keys that once protected data accessed primarily by people must now also protect data used by autonomous systems, creating a much larger governance and security challenge.
 

Our Advice for Organizations Scaling AI Systems

We see four key areas that organizations should focus on when beginning to scale their AI systems.
 

Prioritize Security

Many organizations are repeating the mistakes made during early cloud adoption by moving quickly to deploy AI before establishing the right security controls. Build a strong foundation for key management, data protection, and access governance before scaling AI across your organization.

Treat AI as Critical Infrastructure

The data used to train and operate AI models including training data, inference inputs, and model weights is among your organization's most valuable assets. It should be protected with HSM-grade security rather than software-only controls.

Adopt Crypto Agility

AI and post-quantum cryptography (PQC) are evolving rapidly. Choose solutions that can adapt to new standards and algorithms over time. As the industry moves beyond today's first generation of PQC, organizations will need the flexibility to support future cryptographic developments.

Start with a CBOM

Centralized key management is difficult to implement after AI workloads are spread across multiple data stores and cloud environments. Establish a Cryptographic Bill of Materials (CBOM) and centralized key management early to create a strong foundation for governance and visibility.

Utimaco’s Role in Securing AI Lifecycle

We work with global organizations to provide the foundational security infrastructure they need to scale AI safely and confidently. In close collaboration with regulators, customers, and leading AI ecosystem partners, we help shape and implement the trust layer that enables secure, responsible adoption of AI ensuring innovation can move forward without compromising control, compliance, or integrity.

Download our AI and Quantum resources including Digital Trust Report here

Watch the Webinar here

About the Author

Manish Upasani

Head of Product Management, Utimaco