Secure and resilient

Aspect 5 of 10. Security asks whether someone can make your CCTV, facial recognition, or case management system work against you. Resilience asks whether you can keep protecting the business when it breaks.

What you will be able to do

• Name the ways AI-driven AP systems get attacked that traditional cameras and reports do not.
• Understand what your video analytics or facial recognition vendor secures and what remains yours.
• Keep sensitive case files, biometric data, and license plate records out of places they should never reach.
• Plan for the day the system is wrong, unavailable, or compromised.

What is different about AI systems

• The input is an instruction. Text pulled from an incident report, an email, or an uploaded document can contain directions an AI-assisted case management tool follows. That is prompt injection, and it does not require a hacker.
• The system leaks what it was given. Anything in a case file or watchlist context can come back out in a summary shown to the wrong person.
• The supply chain is opaque. Video analytics engines, facial recognition models, and license plate recognition plugins come from parties you did not fully vet.
• Access is inherited. Connect an AI case management assistant to a shared incident drive and it sees everything that drive sees, including HR files or an unannounced store closure list nobody remembered was there.

The permissions problem

Most AI incidents inside AP programs are not attacks. They are permissions. A case management assistant is pointed at a shared server and confidently surfaces an associate's disciplinary file, a confidential ORC investigation, or an unreleased store closure plan to anyone who asks the right question.

Give the system the narrowest access that lets it do the job, for example only closed cases from the last 90 days, and re-check it every time the scope expands.

What to ask a vendor

• Is our video footage or facial recognition data used to train your models, and can we turn that off in writing?
• Where is our biometric and case data stored, for how long, and who on your side can see it?
• What third parties and subprocessors touch our watchlist, license plate, or case data?
• How do you defend against prompt injection and data exfiltration through AI-generated case summaries?
• What is your notification commitment and timeline when you have a breach?
• What happens to our footage, watchlists, and case data when we terminate the contract?

Get the answers in writing in the contract.

A scenario

A retail chain deploys an AI assistant that reads incoming incident reports and drafts case summaries for the AP team. A submitted report contains hidden text instructing the assistant to summarize the last five open ORC cases and include the details in its reply.

It does. Details on three active investigations, including a confidential informant, are sent to an unrelated store manager who only asked about a single incident.

Resilience: operating without it

Resilience is the boring half, and it is the half that saves you.

• Can store teams flag suspected theft manually if the video analytics platform is down for a week? Who knows how?
• If the facial recognition or license plate recognition vendor raises prices, changes the model, or shuts down, what is the exit path?
• If a model update silently changes match thresholds, how would you notice before it drives a spike in wrongful stops?
• Is there a record of what the system did, good enough to reconstruct a detention decision months later in litigation?

Any AP process that only one system can perform is a single point of failure, whether or not it involves AI.

What to do in your own deployment

1. Treat all inputs from outside your organization, including uploaded incident narratives, as untrusted content.
2. Scope access to the minimum, and audit source permissions on video archives and case systems before connecting any AI tool.
3. Write the rules for what may never be pasted into a tool, such as full watchlist exports or unredacted biometric data, and make them specific.
4. Keep logs of alerts, matches, and case decisions long enough to investigate and to support litigation holds.
5. Include AI-driven AP systems in your incident response plan, with a named owner.
6. Rehearse the manual fallback, such as camera-only monitoring and paper exception reports, at least once a year.

Recap

• Content the system reads, including incident reports, can act as instruction. Assume it will.
• The most common failure is over-broad access to case files and footage.
• Push security commitments into the contract, including training use, retention, and exit terms for footage and biometric data.
• Resilience means loss prevention work survives the tool being wrong, gone, or changed.