PayPal’s CISO on how generative AI can improve cybersecurity

VentureBeat recently sat down (virtually) with Assaf Keren, CISO and VP of enterprise cyber security at PayPal. Keren’s career at PayPal spans eight years and includes a broad base of experience building security products, managing security infrastructure and creating and leading security services.

Before PayPal, Keren founded two cybersecurity startups, served as head of security product management at Verint and was CISO for the Israeli e-Government Division (Ministry of Finance).

PayPal’s AI-driven cybersecurity strategy is paying off

For their latest quarter (FY Q2 2023), PayPal reported $7.3 billion in revenue, up 7% year-over-year, or 8% on a foreign currency-neutral (FXN) basis. Solid gains in transaction growth of 5% and a 37% increase in value-added services revenue contributed to a strong quarter. PayPal ended the calendar year 2022 with $27.5 billion in revenue and has a trailing twelve-month (TTM) revenue run rate of $28.5B.

PayPal’s total payment volume grew 11%, supported by 10% transaction growth, while tight expense control drove an 11% decline in non-transaction costs. Despite a $1.2 billion impact from loans originating for the pending BNPL sale, PayPal generated strong free cash flow and returned $1.5 billion to shareholders. Overall, PayPal showed healthy volume and user engagement growth, significantly improved profitability, and progress on strategic initiatives.

Known for the depth of their expertise using AI, machine learning (ML) and speed of training and deploying deep learning models to harden cybersecurity and reduce fraud, PayPal’s 11% reduction in losses in the latest quarter amidst growing volumes indicate AI is delivering value at scale. Achieving a double-digit reduction in losses through improved risk management indicates that the company’s AI-powered cybersecurity defenses, fraud detection models and AI-powered risk management are reducing transaction losses.

The following is an excerpt of VentureBeat’s interview with Keren.

VB: How can generative AI bolster security without negatively impacting the customer experience?

Keren: While gen AI may be used by attackers for malicious purposes such as generating false identities or creating malware variants that evade traditional security measures, it will also empower security-forward organizations like PayPal to explore gen AI-driven defense mechanisms, such as next-generation automated threat detection systems and response capabilities. We have always put security at the center of what we do and build products with security in mind by design. With gen AI, there will be opportunities to augment our capabilities, remove friction and drive greater customer value.

VB: What are the risks associated with using gen AI, and how can those be mitigated for platforms handling a large amount of private data?

Keren: Gen AI, like any new technology, must be carefully evaluated and deployed with safety and responsibility as top priorities. Important factors like data quality, intellectual property, security, privacy and compliance are key considerations. To mitigate risks, it’s important for technology leaders to examine these dimensions scrupulously before deploying gen AI to protect customers and preserve their trust. Changing the ways we think about testing and offensive security to include attack patterns such as prompt injection, checking for bias and identifying where the models hallucinate will allow gen AI to be deployed in a way that is beneficial to customers.

VB: Can gen AI help with fraud detection? If so, how can you validate its accuracy?

Keren: Yes, and in a sense, it already is. PayPal has been an early adopter of AI, and we have been building our AI capabilities and expertise for over a decade. We’ve been employing transformer-based deep learning for years, which is the key technology behind large language models (LLMs) like ChatGPT. Today, we use AI and ML across broad domains in our business, including fraud reduction, customer protection, personalized services, risk management and global commerce empowerment.

VB: Can you share the results PayPal is achieving using AI for fraud detection?

Keren: It’s led to tremendous impact: from 2019 to 2022, at a time when our annual payment volumes nearly doubled from $712 billion dollars to $1.36 trillion dollars, we cut our loss rate by nearly half, in part thanks to our advances in AI algorithms and technology.

Today, with our advances in AI, we are able to rapidly adapt to changing fraud patterns to protect our customers. PayPal’s deep learning models can be trained and pushed to production within 2 to 3 weeks and even quicker for simpler algorithms. This allows us to train models with the latest production data, incorporate new fraud patterns and integrate feedback from internal agents and PayPal customers.

VB: How does the rapidly changing financial technology landscape influence gen AI strategy adoption?

Keren: As a company with close to 430 million active accounts and 35 million merchants on our two-sided network, we see tremendous potential in the power of AI to create the next generation of checkout and commerce. Today, PayPal holds over 200 petabytes of payments data — data that is key to our competitive advantage that holds tremendous insights and potential to power better commerce experiences for consumers and merchants.

We are actively assessing gen AI and its potential impact on our business and the competitive landscape, and we are enabling internal teams to consider where gen AI can enhance efficiency, increase our security, improve the customer experience, protect our customers and grow our business.