Production data in testing is still common, and Tricentis' CISO wants it gone
Tricentis CISO Erika Dean urges keeping production data out of test environments and describes red-teaming that caught a prompt injection gap.
In a Help Net Security interview, Tricentis CISO Erika Dean recommends keeping production data out of QA and testing environments, even in finance and healthcare, where weaker QA controls create risk. Her team red-teamed an agentic chatbot before launch, found a prompt injection gap, and held the release for a week until it was fixed. She says vendors who cannot explain data residency, retention, and model training use are disqualified regardless of product quality.
- Production data in QA often lacks production-grade controls, notably in finance and healthcare.
- Red teaming caught a prompt injection gap that delayed an AI release by one week.
- Vague answers on data residency and retention are a hard disqualifier for AI vendors.
From the original article
5 min read at helpnetsecurity.com
In this Help Net Security interview, Erika Dean, CISO at Tricentis , talks about keeping production data out of test environments and why she thinks the alternatives are good enough now. She explains how her team caught a prompt injection gap in red-teaming and held a release for a week until it was fixed.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.