Michael Davis is the global chief security architect at JPMorgan Chase, where he helps bring new technologies into the bank and scale them across the firm. His work includes AI security and quantum computing, as well as defensive capabilities and technology for the bank and its customers.
From security research to enterprise architecture
Davis led a team investigating security threats at McAfee before founding the security consulting firm Savid Technologies in 2005. He later became president of managed IT and cloud services provider External IT and CTO of CounterTack, where he was responsible for advancing its endpoint security platform. He also contributed to Hacking Exposed and Hacking Exposed: Malware and Rootkits. His early career combined security research, consulting, and product development.
At JPMorgan Chase, Davis treats technology adoption as a practical engineering problem. He describes teams that take promising but rough new capabilities, develop examples and use cases, and make them usable by the rest of the organization. Those teams help bridge the distance between an experiment and technology that other teams can put to work at scale.
Designing safer AI systems
Davis approaches AI security as a problem involving the whole system: the model, its tools, its environment, and the software that checks its work. His approach to agent security includes several related ideas:
Judge actions in context. A yes-or-no permission check cannot capture everything that matters about an agent’s tool call. Drawing on robotics, Davis proposes considering the agent’s state, changes in its environment, the quality of its decisions, and uncertainty about its next action. If an agent starts writing files unusually quickly, for example, a system could temporarily restrict network access and let a safe action be retried.
Test whether software does the right thing. Davis favors building software in smaller increments and checking how components behave together. An agent can complete a tool call yet use the wrong parameters or make calls in the wrong order. He points to mutation testing—deliberately changing code to see whether tests catch the change—as a way to expose weak tests.
Treat memory as a security and maintenance decision. Persistent agent memory needs rules for updating, removing, and auditing information. Davis argues that many workflows can instead maintain the necessary information in the prompt, skill, or initial context. Accumulated memory can also give an agent access to old data that a just-in-time permission would no longer grant.
Give developers more ways to mitigate vulnerabilities. Davis has observed models find vulnerabilities more readily than they produce complete fixes: a proposed patch can miss affected code or introduce an operational problem. Deployment adds another challenge when applications use the same dependency in different ways. He wants machine-readable mitigation options, including removing unused vulnerable code, so developers can choose an appropriate response.
A panel on intent-based authorization follows the problem from coarse API permissions to missions, resource budgets, external enforcement and audit logs.
A mission and transaction history can distinguish a legitimate payment from an accidental duplicate that a broad payment scope would permit.
▶ Watch ↗