From Legacy Systems to Predictive Governance: Harshendra Gite’s Work at the Intersection of AI, Risk and Security

Three patent filings across the United States, Germany and India, twenty-five years in enterprise delivery, and a straightforward proposition: risk programs that can only explain the past are measuring the wrong moment.

Enterprise risk management has a timing problem. The average data breach now costs organizations 4.44 million dollars worldwide, and even after a year of genuine improvement, the average organization still takes 241 days to identify and contain one. That is the strongest performance the industry has recorded in nine years. It is also most of a calendar year, and by the time the incident report is written, scored and tabled at a committee, the loss it describes has long since finished happening.

Harshendra Gite has spent the better part of a decade thinking about that interval. He does not treat it as a measurement problem to be reported more precisely. He treats it as a design problem, and it is the one his recent work is built to close.

Gite came to risk governance the long way around. He started in software engineering and quality engineering in 2001, in the years when reliability was earned through disciplined testing and an intimate familiarity with the systems a business actually ran on. Over twenty-five years he moved through program automation at Wipro, delivery leadership at Cognizant, and eventually to LTM Limited, where he serves as a senior director and delivery partner leading a global engineering organization of more than 250 people and holding oversight of upwards of one hundred million dollars in digital transformation programs. His portfolio has concentrated in insurance, banking and retail, three of the most heavily regulated and operationally exposed corners of enterprise technology.

The turn toward governance came from the work itself. Over recent years Gite led Integrated Risk Management implementations covering enterprise operational risk, policy management, SOX compliance and Audit Management, combining workflow automation, AI-assisted triage, digital evidence management and key risk indicator analytics to cut manual effort by more than forty percent. Sitting that close to controls testing and compliance reporting produced an observation that has organized his work since. The machinery of governance was being modernized aggressively. The posture of governance was not.

“Most risk programs are still built to explain what already happened,” Gite says. “The opportunity with AI is to shift that posture, to give risk and security teams enough foresight that they can act before a vulnerability turns into an incident, not just document it afterward.”

The scale of what is being spent on the retrospective model is considerable. Financial institutions worldwide spend in excess of 206 billion dollars a year on financial crime compliance alone, a figure that has risen consistently and that the great majority of compliance professionals report is still climbing. A substantial share of that spending goes not toward catching criminals but toward processing alerts that turn out to mean nothing. Industry estimates commonly place the false positive rate in traditional transaction monitoring as high as 95 percent, and while the two hours regulators estimate for filing a suspicious activity report sounds modest, independent assessments of the full investigation and review cycle put the real burden per alert far higher.

On explainability in credit decisions: “In credit, being right is not sufficient. You have to be able to say why. If a model improves your accuracy but removes your ability to justify an individual outcome, you have not reduced risk, you have relocated it.”

On the false positive burden: “Every alert an analyst clears without finding anything is capacity you have spent and cannot get back. Precision is not a nice-to-have in this field. It is the difference between a control that works and one that only looks like it does.”

This is the failure mode Gite is most concerned to avoid, because it is the one that better detection tends to make worse rather than better. A model that is merely more sensitive produces more alerts, and more alerts land on the same finite bench of analysts. The bottleneck moves; it does not disappear.

“A prediction is only valuable if it changes what a risk team does next,” he says. “That is why the framework does not stop at flagging an anomaly. It scores the risk in context and helps route it, so the response is proportionate and the right people are looking at it at the right time.”

That principle is now written into intellectual property. In July 2026, a United States utility patent application was filed at the USPTO for an AI-driven continuous risk, governance, compliance, fraud, privacy and security monitoring architecture for open banking ecosystems, with Gite named among its inventors. The application, numbered 19/728,002, describes a system in which monitoring runs continuously across the risk domains that institutions have historically treated as separate functions, and in which a detected signal carries enough context to be routed and acted upon rather than simply logged.

The choice of open banking as the setting is deliberate, because it is where the old control model breaks most visibly. Open banking had roughly 183 million users globally in 2025 and is forecast to exceed 645 million by 2029. In the United Kingdom alone, the ecosystem handled 24 billion API calls during 2025 and processed 351 million payments, a 57 percent increase year over year. Every one of those API calls is a data sharing event that has to be authorized, logged, monitored and, if something goes wrong, explained. Controls designed around quarterly attestation and sampled review were not built for infrastructure that moves at that cadence, and they do not degrade gracefully when asked to.

On why he moved from delivery into governance: “I spent years making sure platforms shipped on time and worked under load. What changed my thinking was watching organizations pass every control test and still get surprised. That tells you the tests were measuring the wrong moment.”

On open banking specifically: “Open banking moved the industry to continuous data sharing, but a lot of the control environment around it is still periodic. You cannot govern a real-time rail with a quarterly attestation and expect the two to line up.”

The fraud numbers underneath that traffic explain the urgency. Card fraud losses reached 33.41 billion dollars globally in 2024 against 51.92 trillion dollars in purchase volume. The Nilson Report projects annual losses climbing to 48.50 billion dollars by 2034, with cumulative losses across the decade approaching 407.60 billion dollars. What makes those figures interesting is that the fraud rate is actually falling, from 6.58 cents per hundred dollars of sales to 6.43, precisely because machine learning models have become better at catching fraud in flight. The technique works. The volume simply grows faster than the improvement, which is an argument for pushing detection closer to the transaction rather than for waiting on batch review.

Gite filed separately in Germany, where the Deutsche Patent- und Markenamt registered a utility model in May 2026 under file number 20 2026 103 026.0, covering a computer system for explainable, self-learning credit risk assessment and control monitoring in enterprise financial computing environments. The emphasis on explainability is not incidental. Credit decisions sit squarely in territory where an institution may be required to articulate, to a regulator or to the applicant, why an individual outcome was reached. A model that improves accuracy while surrendering the ability to justify its reasoning is not a net gain in that setting. It is a liability with better metrics.

The most recent filing is in India. On 13 October 2026, Gite filed an application with the Indian Patent Office in New Delhi, numbered 202611122771, titled “A System and Method for Predictive Enterprise Risk Governance Using a Causal Digital Twin and Artificial Intelligence.” He is the sole applicant and inventor, and he also requested early publication under Section 11A(2) of the Patents Act, rather than waiting for the standard eighteen-month period to run.

Where the U.S. application concerns continuous monitoring and the German model concerns explainable credit decisions, the Indian filing addresses what happens after a risk is detected. It describes a networked system that builds a versioned digital twin of an enterprise’s assets, processes, dependencies and controls from event streams that arrive with different clocks and formats. A causal dependency graph then estimates how a failure in one component would spread downstream. Instead of a single risk score, the system produces a range of possible states with confidence bounds, and missing data widens the uncertainty rather than being read as a sign that all is well. Before anything is executed, candidate responses such as isolating a compromised service, throttling a risky transaction channel or rotating an exposed credential are tested on isolated copies of the twin against compiled policy constraints, including dual authorization requirements and jurisdictional data limits. Approved actions run on short-lived, single-use authorization tokens, and each decision is recorded so that an auditor can later replay the exact evidence, model version and constraints behind it. The application contains ten claims and two drawings.

It is the same argument the other two filings make, expressed as architecture. A technically effective response that breaks a segregation-of-duties rule or a retention obligation has not reduced risk, and an automated action that cannot be traced to its evidence cannot safely be adopted in a regulated environment. The design treats prediction, policy and accountability as one system rather than three.

Recent evidence suggests the wider market has not yet internalized this. Sixty-three percent of organizations surveyed by IBM reported having no AI governance policy in place at all. Among organizations that suffered an AI-related security incident, 97 percent lacked proper access controls around their AI systems. Unsanctioned AI use inside the enterprise, the phenomenon commonly described as shadow AI, added an average of 670,000 dollars to the cost of a breach. Thirteen percent of organizations reported attacks that reached their AI models or applications directly, which means AI has already become a target surface in its own right rather than only a defensive instrument.

“The next stage is not just detecting risk faster,” Gite says. “It is building governance into how these systems are designed and deployed in the first place, so predictive intelligence and accountability are moving together rather than one chasing the other.”

What follows from that view is an argument about organizational structure as much as architecture. Gite treats security, fraud, privacy and compliance as one connected discipline rather than four adjacent ones, on the grounds that the same underlying event usually registers in all of them. A fraud signal is frequently also a security signal. Privacy obligations determine what data a detection model may lawfully consume and therefore what it is capable of learning. Cloud architecture shapes both the size of an exposure and the speed of any response to it. When these functions sit in separate towers with separate tooling and separate reporting lines, an institution ends up holding four partial views of a single incident and no clear owner of it.

His research runs along the same seam. Alongside the patent filings, Gite has published peer-reviewed work on zero-trust security architecture for cloud environments, privacy-preserving analytics using homomorphic encryption, real-time edge-to-cloud fraud detection for mobile banking, and explainable detection of prompt injection risk in generative AI systems. The problems differ. The underlying commitment does not, which is that intelligence and accountability have to be engineered together, because they cannot be reconciled afterward.

It is a notably unglamorous position in a market that rewards announcements about capability. Gite is making a quieter claim, which is that the constraint most enterprises will run into over the next several years is not how well their models perform but whether the organization can explain, own and act on what those models produce. On the evidence of the governance figures, that constraint is arriving considerably faster than the industry has prepared for it.