AI models matter, but their real value depends on the harness around them, PayPal SVP, Chief Information Security Officer Shaun Khalfan writes in a new PYMNTS eBook, “Payments Leaders Rethink What Works in 2026.”

Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

I started the year hearing the same concern across the industry. Without access to the newest, most powerful cyber-capable models, companies would fall behind in finding and remediating vulnerabilities.

The assumption was understandable. Finding vulnerabilities at scale is hard, and the strongest model would surely deliver the strongest security results. Access to it, many believed, would determine who stayed ahead.

Our security research added an important nuance. Models matter, but their real value also depends on the harness around them, the skills, workflows and business context baked in from the start. With that foundation, a smaller, specialized model can outperform a much larger general-purpose model.

A larger AI model may have broader general knowledge, but it does not inherently know our architecture, our risk priorities or the controls required in a regulated environment. A smaller model with the right context and guardrails can be more precise, faster and more useful.

The harness filters out irrelevant code, prioritizes security-sensitive areas and builds an understanding of how data moves through an application. It then searches for vulnerabilities, tries to disprove each potential finding and uses a second model to spot-check the final results. The system also applies the security knowledge and patterns we have built over time, so it is not starting from scratch with every question.

Source link