Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Organizations regulated by the New York Department of Financial Services (NYDFS) must adhere to 23 NYCRR Part 500, a cybersecurity regulation designed to protect sensitive consumer data and financial systems. Among its core requirements, Section 500.7 specifically focuses on access privileges, requiring financial services companies to implement controls that limit access to nonpublic information based on the principle of least privilege.

AI is transforming the way we work. There are immense opportunities for automation, intelligent decision-making, and productivity gains. This transformation is a tremendous opportunity, but it also comes with tremendous responsibility, especially when security is involved. For example, AI systems can now act on behalf of users, access sensitive data across tools, and make decisions without oversight, all of which have security implications.

It’s difficult for organizations to stay secure, compliant, and efficient in an ever-expanding SaaS landscape. Every time an employee joins or leaves the company, or a software vendor is added or removed, IT and security teams must grant and revoke permissions, so the right people have access to the right tools. A mistake in this process could allow an offboarded employee to maintain access to sensitive data years after they left the company, so the stakes are high.