Practical Lessons From Lloyds’ Agentic AI Security Playbook
Practical Lessons From Lloyds’ Agentic AI Security Playbook
https://www.infosecurity-magazine.com/news/lloyds-agentic-ai-security-playbook/
Publish Date: 2026-06-05 07:30:00
Source Domain: www.infosecurity-magazine.com
Lloyds Banking Group is treating agentic AI not as a theoretical threat or boardroom buzzword, but as an engineering problem to be designed, constrained and tested at scale.
In a candid session at the Open Worldwide Application Security Project’s (OWASP) GenAI Security Summit during Infosecurity Europe, two members of Lloyd’s security function laid out how the UK’s largest bank is operationalizing AI security across product lifecycles, governance and real time defenses, all while keeping regulators and customers front of mind.
Speaking at the summit, Manija Poulatova, director of security engineering and operations at Lloyds Banking Group, started with an honest admission: “We decided the only way we can actually embed security into adoption of AI and agents is to actually understand what is AI and agentic.”
She said the company articulated its AI and innovation roadmap around 11 “bets” and security as the 12th bet, with “the purpose of understanding agentic AI and actually building security controls to secure its use cases.”
“Security teams have been the ‘ministry of no’ for too long, and we want to change the game,” she added.
Kirsty Montignani, head of security data and AI at Lloyds, reinforced the pragmatic posture: “The AI big bets are all low‑risk, high‑value use cases that serve our customers.”
She noted that investments, pensions and customer support were initial priorities because they deliver tangible customer benefit while limiting exposure.
“We wanted to start fresh, and we want to be really precise in our use case,” Montignani added.
Lloyds’ “AI Safe Adoption” Strategy
Montignani further detailed Lloyds’ “AI safe adoption strategy,” which spans the entire lifecycle, from engineers pulling packages and building agents to promotion, runtime observability and decommissioning.
The team created an internal agent marketplace which Montignani described as “a single pane of glass for all…
