Experian embeds resilience into AI infrastructure with policy enforcement at machine speed

Organizations deploying AI at scale are learning that the systems supporting their models matter as much as the models themselves. Cyber resilience has emerged as a central concern, requiring companies to tackle underlying challenges including data integrity, permission management and business continuity. This challenge looms especially large in sectors that handle sensitive information, such as financial services. Experian PLC has structured its approach to artificial intelligence around infrastructure resilience, according to Rodrigo Rodrigues, the company's group chief technology officer.

Speed creates risk when foundations are weak. Many teams add AI on top of existing systems that were never designed for it. Data comes from many systems with different rules. Logs are incomplete, backups are slow, access policies are unclear. Everything works, until it doesn't.

Rodrigo Rodrigues, group chief technology officer, Experian PLC

Rodrigues shared these insights during a conversation with Christophe Bertrand at the AI Cybersecurity and Resilience Summit, broadcast live on theCUBE, the livestreaming platform operated by SiliconANGLE Media. The discussion covered how to build cyber resilience frameworks for AI systems, implement zero-trust identity protocols for non-human agents and manage AI workflows across large organizations.

Cyber resiliency requires AI recovery and access controls

A critical insight Rodrigues emphasized is that the mere existence of backups does not guarantee cyber resilience. Experian has adopted the NIST AI Risk Management Framework and woven it directly into its AI operations, transforming governance from a theoretical concept into an enforced reality. The company's pipeline automatically validates data sources, applies quality standards and confirms security measures before any model reaches production. If any control fails to pass, the pipeline halts automatically without human intervention.

Policy enforcement happens at machine speed. We have AI-specific recovery goals — not just for applications, but for data models and pipelines. We test AI recovery the same way we test disaster recovery: scheduled drills, clear recovery objectives, measured results. There's no guesswork, no panic — just execution.

Rodrigo Rodrigues

Rodrigues identified three interconnected vulnerabilities that can cascade into system failures: corrupted training data, compromised backups and AI agents with excessive permissions. Poisoned training data does not necessarily break a model immediately; instead, it causes the model to absorb incorrect patterns and then amplify those errors across its outputs.

AI does not leak data. Access leaks data. AI only reflects the permissions we give it. Identity must be designed for AI, not just for humans — that means applying least privilege to AI services just like users, rotating credentials frequently and monitoring access in real time with automated alerts.

Rodrigo Rodrigues

To enable development teams to move quickly without sacrificing control, Experian created an internal marketplace for AI agents. This registry allows product and engineering groups to locate, test and deploy governed agents that come with built-in quality assurance. The model draws inspiration from how organizations have managed microservices and application programming interfaces, treating agents as versioned components with clear ownership, defined lifecycles and retirement timelines.

https://www.youtube.com/embed/xNLyfVot1d4?feature=oembed

Agentic AI can act on its own — it can scale systems, change routing, update policy. If this goes wrong, the impact is huge. Autonomy requires control. Simulate before execution. Limit agent permissions until you have a strong foundation and have learned how to operate safely.

Rodrigo Rodrigues