Szandra Steinle

Introduction

My professional background is defined by the intersection of offensive security experience, strategic information security leadership, AI systems security, and cybersecurity in highly regulated industries.

Throughout my career, I have worked on the security of complex IT environments from both technical and leadership perspectives. I built my experience through vulnerability assessments and offensive security activities, and later applied this knowledge to the development of enterprise information security strategies, risk management processes, and security controls.

I previously worked at a multinational insurance company, first as a cybersecurity expert and later as CISO, where I was responsible for the organization's cybersecurity and information security governance. This role provided direct experience in addressing the strict regulatory, data protection, operational resilience, and cybersecurity requirements of the financial sector.

Today, my work focuses on the cybersecurity of AI systems and enterprise technology environments, with particular emphasis on AI security validation, risk assessment, secure integration, and the resilience of financial and other highly regulated industries.

Areas of Expertise

My professional and research activities lie at the intersection of AI security, enterprise cybersecurity, and the security of highly regulated industries.

I focus particularly on enterprise AI system security, AI risk assessment, the secure adoption of generative AI solutions, security assessments of models and AI-based services, and cybersecurity and information security considerations throughout the entire AI lifecycle.

My areas of expertise also include cybersecurity in the financial and insurance sectors, information security in highly regulated and safety-critical industries, operational resilience, offensive security, and strategic cyber risk management.

AI Security Research

Early professional interest in language model security: as early as 2018, I was interested in the security of conversational agents and early language models, well before the widespread adoption of generative AI.

I was particularly interested in the risks arising from human-machine interactions, the integrity of language models, and vulnerabilities in human-machine interfaces. In 2018, I also proposed this area as a potential thesis research direction.

During my master's studies, my research focused on artificial intelligence-based cyberattacks. In my thesis, I examined the role of AI systems in cyber warfare, automated attack capabilities, and the risks arising from predictive models.

As part of my research, I analyzed, among other topics, the potential for hiding malicious code within neural networks, as well as AI-based, context- and behavior-dependent decision-making mechanisms that could enable targeted malware activation.

I currently conduct research related to AI security at Eötvös Loránd University. My research interests focus on the security properties, vulnerabilities, and cybersecurity risks of AI systems.

Enterprise AI Security and AI Risk Management

From February 2023, at the beginning of the rapid enterprise adoption of generative AI, I participated in the secure deployment of AI solutions as a member of the first dedicated AI task force within a highly regulated enterprise.

As a cybersecurity expert, I was responsible for the secure and regulatory-compliant integration of AI technologies into the organization's business and technology environment.

My responsibilities covered security considerations throughout the entire AI lifecycle, including risk assessments of internally developed solutions and third-party models, security evaluations of AI services, the integrity of training and input data, and the cybersecurity validation of models.

Today, as a co-founder of Qyntar, I work on enterprise AI system security, AI risk assessment, and secure AI adoption, with particular focus on organizations deploying artificial intelligence under strict regulatory, data protection, and operational security requirements.

Cybersecurity in Highly Regulated Industries

A significant part of my professional experience is connected to highly regulated enterprise environments. I previously worked at a multinational insurance company, first as a cybersecurity expert and later as CISO, where cybersecurity risk management had to meet business, technological, data protection, and regulatory requirements simultaneously.

In the financial and insurance sectors, cybersecurity is closely connected to operational resilience, third-party risk management, data protection, regulatory compliance, and the protection of critical business processes.

Similar challenges arise in other highly regulated and safety-critical industries, where the failure or compromise of a technology system can result in significant business, operational, or safety consequences.

The adoption of AI introduces an additional layer of risk in these environments. Traditional cybersecurity controls must be supplemented with measures addressing model, data, third-party, and AI-specific risks, while maintaining the pace of innovation.

In my advisory work, I therefore place particular emphasis on how AI systems can be deployed securely in organizations operating under strict regulatory and reliability requirements.

Mission of the AI Security InfoHub

The AI Security InfoHub was created to present artificial intelligence security issues in a way that is professionally grounded while remaining accessible.

My goal is to build a structured knowledge space that connects the technical, enterprise, cybersecurity, and regulatory dimensions of AI security and helps distinguish between risks that can already be demonstrated today, emerging threats, and longer-term hypothetical scenarios.

My publications cover vulnerabilities in AI systems, enterprise AI risks, security controls, cyber threats, regulatory issues, and the critical evaluation of findings from AI security research.

My goal is for the discussion around AI security to be technically grounded, relevant to business decision-making, and proportionate to real-world risks.