AI Security & Infrastructure — individuals, teams & regulated data

AI Practicum · hosted by JP James

How to join

Or add it to Google Calendar · Outlook · Apple Calendar. Every option includes the Teams link and the agenda.

Full Teams link

9:00–9:30 AM ET

How ChatGPT and Claude handle your data: business vs. personal plans, training settings, chat history, connectors and two-factor sign-in.
Two kinds of local: local files (Claude Cowork or OpenAI Codex work on folders on your laptop, while the model still runs in the provider’s cloud) and a local model (Ollama or LM Studio, where nothing leaves the laptop).
Prompt injection: when an email, document or web page tells your agent what to do, and the rules that stop it.
A personal security prompt every agent you use should follow, in a local-files and a local-model version.

9:30–10:00 AM ET

One gatekeeper agent for every password release and security action, with a one-time code (OTP) or two-factor approval; financials, outbound messages and confidential files also need a master passphrase.
Payment fraud and deepfakes: invoices, bank-detail changes and payments are approved through a channel separate from email, with a call-back to a known number, never on an email, call or video alone.
A security-scan skill that inventories email, files, messages and agent access into one encrypted, two-factor location, and expiring secure links instead of attachments.
Offboarding and a kill switch: remove a person’s and an agent’s access in one step, and stop every agent at once when something goes wrong.
Staff using personal AI accounts: an AI acceptable-use policy you can adapt, and the prompts to propagate across every agent.

10:00–10:30 AM ET

Running models inside Amazon Bedrock, Microsoft Azure AI Foundry or Google Cloud so the whole ecosystem stays enclosed in your own cloud account.
Gating models and systems to closed virtual machines reachable only from specific laptops, IP addresses and physical locations, still behind two-factor, with walled, controlled outbound file transfer.
Vendor terms to check: training on your data, retention, zero data retention, data processing agreements, and business associate agreements (BAAs) for HIPAA.
When you need it (PII, account and routing numbers, HIPAA data), and when a regulated third-party vendor is the better answer.