AI Security for Finance Leaders: How to Protect Your Company’s Data

AI can accelerate reporting, analyse financial data and automate routine workflows. But as it gains access to company systems, finance leaders need to ask two questions: where does our data go, and what can the AI do with it?

Staff training and acceptable-use policies matter. Stronger protection comes from enforcing those policies through the technology itself.

Private language models, controlled connections to business systems and security gateways can help companies build that protection into their AI environment.

Private LLMs: greater control over where data is processed

A large language model, or LLM, is the engine behind many AI assistants. Companies can use a provider’s hosted service or deploy a model on their own infrastructure or in a controlled private cloud.

A privately hosted model can be useful for sensitive finance work involving payroll, acquisition plans, commercially sensitive forecasts or client information.

However, open source does not automatically mean private. An open-source model running on an external provider’s servers still processes information outside the company’s environment. What matters is the complete deployment: hosting, storage, connections, logs and access.

Private hosting also brings responsibility. Someone must maintain the infrastructure, install updates, manage permissions and monitor security. External services, telemetry and support arrangements need checking before assuming that information stays entirely within the environment.

The cost of control: compute, speed and scale

Running your own model also means paying for the computing capacity behind it. A model may be available to download without a licence fee, but operating it is not free.

The fast responses we have become accustomed to from hosted AI services depend on substantial infrastructure. Providing comparable responsiveness internally can require significant investment in graphics processing units (GPUs), memory and supporting systems, particularly for larger models and multiple simultaneous users.

A model that works comfortably for one person may slow down when the whole finance team uses it during month-end. Larger documents, longer reasoning tasks and automated workflows making repeated requests can increase demand further.

For finance leaders, the assessment should cover:

• Capacity: how many people and automated processes will use the model at once?
• Speed: does the task require an immediate answer, or could it run overnight?
• Quality: can a smaller model perform the task reliably?
• Utilisation: will dedicated infrastructure be used throughout the month or mainly at peak periods?
• Total cost: what will hardware or cloud compute, support, security, resilience and maintenance cost?

Greater control over processing can come with higher costs or slower responses if the infrastructure is undersized. That is a deployment trade-off, rather than a rule that secure AI must be slow.

A private environment might suit sensitive batch processing, while an approved enterprise service handles less sensitive interactive work. Any division should follow the company’s data policy and be enforced through the workflow.

The right comparison is the cost of delivering a reliable, controlled process at the required speed, not simply the price of obtaining the model.

MCP: connecting AI to finance systems with controlled access

Model Context Protocol, or MCP, provides a standard way for AI applications to connect to tools and information.

For finance, those connections could allow an assistant to retrieve approved management accounts, query financial records or prepare a draft journal.

The important distinction is that MCP provides connectivity; it does not automatically provide security.

Each connection needs its own controls. The company should define:

• Which identity the connection uses.
• Which records it can access.
• Whether it can read information or make changes.
• Which actions require approval.
• How activity is recorded and access revoked.

A reporting assistant might need to read the approved trial balance and budget. It should not automatically receive access to payroll, supplier bank details or every company document.

Permissions should be enforced by the connected service and underlying finance system. Telling an AI assistant “do not change bank details” is weaker than giving it no ability to make that change.

The NCSC’s secure AI guidance includes least privilege and controls over information sent to external services. These principles apply equally to AI connections and automated workflows.

AI gateways and firewalls: checking what enters and leaves

An AI gateway sits between an application and the model services it uses. Depending on its capabilities, it can inspect requests and responses, apply security rules, restrict destinations and record activity.

Products described as “AI firewalls” may offer controls such as sensitive-data detection, redaction and screening for malicious instructions. Finance leaders should assess the specific capabilities rather than relying on the label.

For example, a gateway could be configured to block detected bank account details from being sent to an unapproved external model, or flag an attempted bulk export for investigation.

These controls provide another layer of protection, but detection is imperfect. Confidential information may not follow an obvious pattern, and malicious instructions can be difficult to identify.

A gateway should therefore complement restricted permissions, network controls and approval requirements.

Protect against instructions hidden inside documents

AI agents may read invoices, emails, websites and other material supplied by third parties. That content can contain instructions designed to redirect the agent. This is known as prompt injection.

Imagine an invoice containing a hidden instruction to send the supplier ledger to an external email address. The invoice should be treated as information to process, not as authority to change the workflow.

The NCSC identifies prompt injection and data poisoning as AI security risks.

The practical defence is to limit what the agent can do even if it is misled. Restrict its tools, data access and external destinations. Require approval for sensitive actions, and validate requests before the underlying system executes them.

Keep financial authority outside the model

An AI agent may decide which step to attempt next. It should not decide its own permissions.

For sensitive activities, retain approval controls in the workflow or finance system:

Activity	Appropriate control
Drafting variance commentary	Read approved data and retain references for review.
Preparing journals	Validate the draft and require authorised approval before posting.
Changing supplier bank details	Use the established verification and approval process.
Preparing payment proposals	Restrict access and retain payment authorisation controls.
Distributing board reports	Use approved recipients and require release approval.

This preserves segregation of duties as automation expands. An agent should not gain broader authority simply because it handles several steps in a process.

What a protected reporting workflow could look like

Consider an automated month-end reporting process.

Approved financial data enters a restricted reporting location. An AI assistant retrieves it through a read-only connection. Automated checks confirm that the period is correct and totals reconcile to the approved source.

The model drafts commentary and prepares the reporting pack. Failed checks go to an exception queue. A finance reviewer verifies the analysis and authorises distribution to a predefined recipient group.

The system records the source-data version, checks, actions and approval. The assistant has no permission to amend the ledger or send the pack to arbitrary addresses.

Protection is built into the process, alongside the checks needed for reliable financial reporting.

Use the controls already available

Companies do not necessarily need to build an entirely new AI platform.

For organisations using Microsoft 365, existing identity, document-permission and data-protection capabilities may provide part of the foundation. Microsoft Purview supports controls that can warn or block sensitive information being shared with third-party AI sites in supported endpoint and browser configurations.

Underlying permissions still matter. Microsoft 365 Copilot respects existing access controls, so overly broad document access needs addressing as part of deployment.

The appropriate setup depends on licences, configuration, data sensitivity and the systems involved.

Start with one controlled finance use case

Senior finance leaders should define the business rules: which information is sensitive, which actions carry financial authority and where approval is required. IT and security teams can then translate those rules into enforceable controls.

Start with a contained task, such as drafting commentary from approved monthly results. Test accuracy, access restrictions, attempted data leakage and the handling of exceptions before expanding. Measure performance and cost under realistic workloads, including month-end peaks.

Private hosting gives greater control over processing location. Restricted MCP connections limit how AI reaches business systems. Gateways inspect traffic. Finance-system permissions and approval workflows control authority.

Together, these components can make AI protection a repeatable part of the company’s infrastructure.

Put AI to work in your finance team, securely

Board North helps finance teams reduce manual work, improve reporting and use AI with confidence, supported by practical training and appropriate controls.

Join our mailing list below for practical AI and automation updates for finance leaders. To explore how your team could save time, get in touch to discuss where automation could make the biggest difference.

#AI #Models #Finance #CFO #FD #FP&A #FC