PayPal CISO: AI Security Effectiveness Depends on the Surrounding Framework, Not Model Size
PayPal SVP and CISO Shaun Khalfan argues that smaller, specialized models with the right context and guardrails can outperform larger general-purpose models, citing a jump from 3 CVEs to roughly 230 after building a dedicated framework.
PayPal CISO: AI Security Effectiveness Depends on the Surrounding Framework, Not Model Size
In an ebook published by PYMNTS on November 9, 2026, titled Payment Leaders Rethink What Works in 2026, PayPal Senior Vice President and Chief Information Security Officer Shaun Khalfan wrote that while AI models themselves matter, their practical value depends more on the "surrounding framework" built around them—namely, pre-embedded skills, workflows and business context.
Khalfan said PayPal's security research shows that, given the right context and guardrails, smaller specialized models can outperform larger general-purpose models. The framework filters out irrelevant code, prioritizes security-sensitive areas, understands how data flows through applications, and spot-checks final results with a second model.
According to his disclosure, before the framework was built, a team of 25 engineers reported 3 CVEs in a year; after introducing the framework, the team has obtained about 230 CVEs in widely used open-source software, with a single popular framework yielding about 20 findings, including six to seven severe remote code execution vulnerabilities. Khalfan said that in the fourth quarter he will invest not only in model access but also in the processes and context that make models work effectively.
Source: https://www.pymnts.com/opinion/2026/smarter-security-takes-more-than-a-bigger-ai-model/
Provenance & status
- Byline
- OceanAlt Editorial
- First published
- 2026-11-11
- Last updated
- 2026-11-11
- Content type
- Newsflash
- Source material
- View original ↗
Related reading
Paste a payee address before you pay and see whether it's on a sanctions list, through a mixer, or tagged for fraud.
This judgement can sit inside your own product
One line of code; it touches neither your CSS nor your JS. The same pre-settlement judgement can appear in your articles, on your wallet's confirmation screen, or as an endpoint your agent calls before it pays.