AI Governance Under Board Scrutiny at a Regional Insurer
Meridian Mutual is a regional health insurer with 2,400 employees, 3.1 million members, and a security team of 19 (seven openings). The board risk committee has asked the CISO for an AI security strategy after the claims division put three generative-AI use cases into production through external LLM APIs. Eleven more pilots are queued, including one that summarizes clinical notes. A red-team exercise last month extracted synthetic PHI through a prompt-injection chain and found a live API key in a data-science notebook. The CIO wants a centralized AI gateway in 90 days; the chief actuary argues that gateway review will delay a pricing model due next quarter. Compliance cites HIPAA, state insurance data rules, and a new internal policy requiring security review before any production AI. The IT budget is flat, and the board wants a few meaningful metrics, not a dashboard.
1. What should the CISO do in the first 90 days, and in what order? Justify the sequence against the competing demands.
Read the worked answer
Sequence: contain, inventory, control the choke point, then scale. First, freeze new production AI deployments except low-risk pilots, revoke and rotate the exposed API key, and require a data-flow review for the three production use cases. Reason: a known exploit chain and live credential create immediate loss potential, and the insurer cannot govern what it has not inventoried. Second, build a complete AI use-case inventory with owner, data classification, model or vendor, and human oversight. Tier by data sensitivity and autonomy. Third, stand up the gateway as the mandatory egress and logging point, but do not make it a 90-day big-bang. Start with API-key vaulting, DLP, prompt and response logging, rate limits, and allow-listed vendors. Fourth, publish an AI security policy and an exception process with compensating controls. Fifth, give the actuary a fast lane: if the pricing model uses de-identified data and no member PHI, approve with conditions and post-implementation review. This respects the CIO deadline without allowing unmanaged PHI flows.
2. Propose three to five board-level metrics that would show whether the AI security strategy is reducing risk rather than just activity.
Read the worked answer
Board metrics should be exposure and outcome based, not counts of meetings. Use: (1) percentage of production AI use cases with completed data-flow and risk-tier review, target 100%; (2) number of AI use cases handling regulated data without approved gateway or DLP controls, target zero; (3) prompt-injection and red-team pass rate for tier-1 use cases, with trend; (4) mean time from detection to revocation of exposed AI credentials; (5) aging exceptions above risk tolerance. Add a simple risk statement: no member PHI leaves approved environments without logging and DLP. Avoid vanity metrics such as number of policies or training completions unless tied to a control gap. The board should be able to see whether risk is moving down and whether exceptions are accumulating.
3. How should the CISO resolve the CIO-versus-actuary conflict over the 90-day gateway?
Read the worked answer
Use risk tiering and decision rights, not escalation by title. Define a fast lane for low-risk use cases: no PHI, no automated decisions, approved vendor, logging on. The pricing model may qualify if the data is de-identified and tested. For the three production cases, require gateway onboarding within 30 days with temporary compensating controls. The CISO owns security standards and the right to stop unmanaged PHI flows; the CIO owns delivery; the actuary owns model validity. If they disagree on residual risk, document it in a risk acceptance with a named business owner and expiration. If the actuary refuses, escalate to the risk committee with quantified exposure, not a generic policy objection. This preserves speed while keeping accountability.