Cyber Supply Chain Risk Associated with Adoption of AI - What CFO’s Need to Be Asking About These Technologies

Miguel Delgado - Carnegie Mellon University
Stan Waddell - Carnegie Mellon University

As higher education institutions face pressures to reduce cost, increase efficiency, and relook at traditional business models, they are reexamining their relationship and use of third-party vendors. What they are finding is they can achieve the benefits of increasing their use of third-party vendors for many aspects of university operations. However, with the shift, they are introducing risk into their institutional risk profile, particularly as many of these third-party vendors explore how to infuse their solutions with AI.

So often the decisions around the infusion of third-party vendors are made amongst institutional leadership (President’s Cabinet), and the CFO/CBO is a key decision-maker. However, the ability to keep up with the risks around AI, particularly as it relates to cyber risks within the supply chain of university, is a constant struggle for the CFO/CBO.

This presentation intends to focus on the key questions that CFO/CBO should be asking when making decisions around the use of third parties within their higher education institution. This presentation includes industry leaders both from within the institution, and those that support it, to collectively provide key insights into the questions that should be asked to truly understand the “nutritional facts” of the AI used within the third parties they are considering contracting with.

This unique composition of presenters relies on the backgrounds and experiences that would be of interest and value to CFO/CBO’s. These leaders, particularly in the CIO/CISO space, come with strong command of cybersecurity supply chain risk and technologists that can effectively communicate complex IT/cyber-related issues to a non-technical audience and engage them for an interactive discussion.

Learning Objectives

  1. List the key cyber risks associated with the increased use of third-party vendors that are infusing their solutions with AI.
  2. Learn about common AI/LLM model cybersecurity risks and how not all AI/LLM models are created equally in terms of risk.
  3. Demonstrate the ability to ask critical questions related to cyber security risk and the use of AI when deciding upon whether to utilize third parties within their higher education institution.

CPE Available

  • 1 Credit: Information Technology