Compliance velocity in banks comes from showing work, not better AI.

The concrete claim. Cisco's Al Chen says his team has cut AI production timelines at five major banks from about a year to a few weeks. The lever is not a better model or a slick deployment tool. It is a repeatable process that gives compliance and risk teams verifiable evidence instead of trust. For engineering leaders, that reframes the compliance problem as an engineering problem with infrastructure, tests, and ownership.

The CVE trap. Banks scan container images with tools like Sysdig, Wiz, or Prisma and expect answers on every CVE. With multiple image versions across multiple banks, plus open source transitive dependencies, a simple package bump is not enough. Chen's team builds agent harnesses, which he calls Harbor tasks, to try to exploit the patched version and prove the vulnerability is actually closed. That exploit evidence, not the scanner output, becomes the currency for security review.

The DR gap. Most AI observability tools store traces in ClickHouse, and ClickHouse has no managed cross-region failover. Chen describes a bank-specific pattern: a primary region, a backup job to a bucket, a restore job into a disaster recovery region, and replicas inside the region. The trap is that a green backup status says nothing about data correctness. Teams need row-count checks and replica convergence checks to catch stale data, bad disks, or migration lag.

The leakage side door. UI redaction is not enough. LLM-as-judge prompts often ask for reasoning so a human can verify the agent's work, and that reasoning can un-redact PII or MNPI in stored traces. Chen's fix is to have the judge read raw data but suppress reasoning when a sensitivity check fails, or run a second judge on redacted input. The cost is an extra LLM call per request, which is the price of defensible data isolation.

The organizational cost. Chen says the signals that push deployment from weeks to months are mostly human and organizational: image approval processes, GPU sourcing, security reviews, custom LLM gateway or RBAC configurations. That should temper the "weeks" headline. Vendors who claim fast production are not accounting for your infrastructure, your security posture, or your cluster's quirks. The technology is ready; the internal alignment around evidence is the real schedule.

What to watch. The strongest takeaway is that "showing your work" is becoming a compliance discipline, not a soft skill. The talk is thin on numbers: no count of exploit tests run, no timeline comparison table, and it sits inside a vendor context, so discount the marketing. Still, the patterns are concrete enough to audit against your own deployment, and the LLM judge trace leak is easy to verify in any team already running evals.