Future of Data Security

Qohash
  • 5.0 (1)
  • Technology
  • Updated Biweekly

Welcome to Future of Data Security, the podcast where industry leaders come together to share their insights, lessons, and strategies on the forefront of data security. Each episode features in-depth interviews with top CISOs and security experts who discuss real-world solutions, innovations, and the latest technologies that are shaping the future of cybersecurity across various industries. Join us to gain actionable advice and stay ahead in the ever-evolving world of data security.

  1. Sep 23

    EP 43 - Generate:Biomedicines's Tom Doughty on the exploit discovery gap going negative

    The gap between an exploit's first use and its public disclosure has gone negative. Agentically deployed attacks now reach their target before the vulnerability behind them is ever publicly reported, a shift most security programs are still catching up to. Tom Doughty, Chief Information Security Officer at Generate:Biomedicines, walks Jean through what that shift demands from a security team, from agentic countermeasures to a different approach to non-human identity, plus what changed when he moved a 25-year financial services security career into an AI-native biotech (generatebiomedicines.com) built on machine-generated molecules. Topics discussed: Agentic exploits outpacing public vulnerability disclosure Redefining crown jewels beyond financial services norms Governing non-human identity and agent access Third party and supply chain risk in agentic workflows Frontier model providers walking back zero data retention Stratifying compute spend across model tiers Differentiating vendors beyond the AI interface layer Hiring for inventiveness and objective-driven thinking Get in touch with your host, Jean Le Bouthillier:  LinkedIn  Listen to more episodes:  Apple  Spotify YouTube

    EP 43 - Generate:Biomedicines's Tom Doughty on the exploit discovery gap going negative

  2. Sep 9

    EP 42 - Gopuff's Ravi Nori on why boards push AI at scale while security still lags behind

    Gopuff runs 200-plus AI agents and 100-plus MCP servers across three public clouds, and Ravi Nori is the one securing all of it. The Head of Cyber Security at Gopuff brought a defense-industry classification ethos to a cloud-native retail platform where customer data sits at the top of the priority chain. Ravi walks Jean through Gopuff's three AI deployments, the shadow AI sprawl he uncovered during an environment scan, and why agent security now spans three surfaces: desktop, browser, and cloud. He also breaks down how boards push for AI adoption while security lags behind. Topics discussed: Applying defense data classification to retail customer dataDeploying AI agents as customer service chatbots at scaleBuilding an AI-powered natural language search feature for mobileDiscovering shadow AI tool sprawl across employee endpointsSecuring agents across desktop, browser, and cloud surfacesManaging AI token economics and cost spikes through access controlsAddressing board pressure for AI adoption while security lagsTranslating security risk into business language for non-technical audiences Get in touch with your host, Jean Le Bouthillier:  LinkedIn  Listen to more episodes:  Apple  Spotify YouTube

    EP 42 - Gopuff's Ravi Nori on why boards push AI at scale while security still lags behind

  3. Aug 26

    EP 41 - iMerit Technology's Georgeo X. Pulikkathara on the 82 non-human accounts created for every human one

    What if the file itself decided who gets access, carried its own encryption, and refused unauthorized requests? Georgeo X. Pulikkathara, Global CIO and CISO at iMerit Technology, sees that future arriving fast. With 34 years in IT security and active service as a Colonel in the US Army Reserve, Georgeo breaks down 40-minute AI-enabled breaches, the flood of non-human accounts, and why human oversight remains the one control that will never go away. Topics discussed: 34 years in IT security and Army Reserve serviceiMerit Technology's AI data solutionsAI-enabled attacks and the 40-minute breachNon-human accounts flooding enterprise networksHuman-in-the-loop oversight for AI systemsSelf-protecting data with built-in encryptionQuantum-resistant encryption and post-quantum securityCompetency, character, and commitment in security teams Get in touch with your host, Jean Le Bouthillier:  LinkedIn  Listen to more episodes:  Apple  Spotify YouTube

    EP 41 - iMerit Technology's Georgeo X. Pulikkathara on the 82 non-human accounts created for every human one

  4. Aug 11

    EP 40 - Avanade's Jon Rohrich on why security teams should start with why before deploying AI

    Gartner predicts 40% of enterprise applications will incorporate agentic AI by year's end, but Jon Rohrich is asking a more basic question: why? Leading Avanade's Canadian cybersecurity practice with nearly 30 consultants, Jon keeps watching proof of concepts succeed, only to collapse when unmodeled risks surface in production. Jon tells Jean why zero trust is the right framework for governing AI agents, how to challenge stakeholders stuck in outdated security programs, and what a candidate's home lab reveals about their real passion for security. Topics discussed: Applying zero trust principles to AI agent access controlWhy proof of concepts collapse at production scaleManaging AI agent identities like human user identitiesBoard pressure to deploy AI without proper threat modelingUsing lab environments to evaluate technical passion in hiringChallenging long-tenured stakeholders to modernize security programsRecognizing and overcoming imposter syndrome in cybersecurity careers Get in touch with your host, Jean Le Bouthillier:  LinkedIn  Listen to more episodes:  Apple  Spotify YouTube

    EP 40 - Avanade's Jon Rohrich on why security teams should start with why before deploying AI

  5. Jul 29

    EP 39 - Podium's Taylor Lobb on why AI agents should read files but never export them

    Giving an AI agent your access does not mean giving it your judgment. The fix is data that knows the difference, so the same document a person can export, an agent can only summarize, never share externally, never train on.   Taylor Lobb, Chief Security Officer at Podium, tells Jean why identity now covers agents and service accounts, how visibility beats blocking shadow AI, and why every agentic workflow needs its own scoped security agent.   Topics discussed: - Extending identity models to agents, APIs, and service accounts - Making data identity-aware so access matches the requester - Beating shadow AI with visibility instead of blocking tools - Pairing every agentic workflow with a scoped security agent - Why build-versus-buy has inverted for AI-native engineering teams - Vendor value shifting from interfaces to proprietary data enrichment - Running security as an enablement and partnership function - Exposing tool data through MCP for internally built systems Get in touch with your host, Jean Le Bouthillier:  LinkedIn  Listen to more episodes:  Apple  Spotify YouTube

    EP 39 - Podium's Taylor Lobb on why AI agents should read files but never export them

  6. Jul 14

    EP 38 — Capital One's Leon Bian on why IAM tells you who but agentic AI needs to know why

    AI is not creating a new data problem. Leon Bian, VP and Head of Product, AI & Data Security (Databolt) at Capital One, argues it is exposing the ones enterprises already had: fragmented data, unclear ownership, weak classification, and broad access controls never designed for agents running at machine speed. At most enterprises, 80 to 90 percent of that data is unstructured, and until recently it was almost entirely outside the scope of protection. Leon tells Jean why three controls most large organizations treat as solved fail the moment agentic AI enters the picture: strong IAM, role-based and attribute-based access, and on-behalf-of-user permissions. IAM tells you who is asking, not whether they should access specific data for a specific purpose. RBAC and ABAC tell you who and what and when, but agentic AI requires a fourth dimension: why. And when agents inherit user permissions accumulated over years, you get permission creep running at machine speed. He also lays out why frontier AI models collapsing the time from vulnerability discovery to exploitation to near zero demands a hardened data layer as the last line of defense, and why using AI to close vulnerabilities is no longer optional. Topics discussed: AI revealing data problems enterprises already had Why strong IAM is a false signal of data security RBAC and ABAC insufficient when agent context determines risk Intent as the missing governance dimension in agentic AI On-behalf-of-user access enabling permission creep at machine speed Frontier models collapsing vulnerability-to-exploitation timelines to near-zero Using AI to close vulnerabilities at machine speed Tokenization preserving data utility and referential integrity where encryption cannot

    EP 38 — Capital One's Leon Bian on why IAM tells you who but agentic AI needs to know why

  7. Jun 2

    EP 37 — Digital Turbine's Vivek Menon on Why Shadow AI Has Lapped Shadow IT

    Vivek Menon's board stopped asking about patching schedules and vulnerability counts. Their questions now center on AI risk posture, and the governance tools meant to answer them lag one to two months behind at best. Vivek, CISO and Head of Enterprise Data at Digital Turbine, tells Jean how he runs AI SOC agents that compressed a 10-person workload to 4 while holding headcount flat from this point forward. Vivek also breaks down the agentic AI risks he tracks in active pilots: executives with the most privileged access and the most sensitive data on their laptops are the ones pushing hardest for adoption, sub-agents spawn and drift from original tasks with decreasing oversight, and an employee at his company recently downloaded a malicious tax prep skill from an AI marketplace. He frames the current cost picture as opex capping rather than opex saving, and predicts the CISO role is already converging with data trust into something closer to a Chief Data Trust Officer. Topics discussed: Shadow AI lapping shadow IT as top ungoverned risk Privileged executives as high-risk AI adopters Sub-agent spawning and diminishing task control Malicious AI marketplace skills targeting employees AI SOC agents compressing 10-person teams to 4 AI governance tools lagging months behind board questions Opex capping through older models for 98% of use cases CISO role converging into Chief Data Trust Officer Get in touch with your host, Jean Le Bouthillier:  LinkedIn  Listen to more episodes:  Apple  Spotify YouTube

    EP 37 — Digital Turbine's Vivek Menon on Why Shadow AI Has Lapped Shadow IT

  8. May 20

    EP 36 — ruby's George Al-Koura on why 15 certifications still won't save you in a live SOC scenario

    George Al-Koura refuses to let AI agents run in his production environment. As CISO at ruby, the parent company of Ashley Madison, he's protecting data where a breach doesn't just expose PII but reveals people's most private thoughts and relationships across a global user base. George tells Jean why the hardest data security challenge is still foundational: too many leaders in the space can't distinguish structured from unstructured data, and organizations keep throwing agents at the problem without understanding the manual processes they're trying to automate, which is exactly why they're not seeing ROI on their AI spend. George is also pitching the Canadian federal government on a concept he calls the AI Training Data Bill of Material (TDI BOM), modeled after SBOMs: a compliance process that produces a verifiable report ensuring the provenance of data used to train models. He cites studies showing that corrupting less than half of 1% of a model's training data can compromise the entire model, and if that model runs targeting data for defense systems or critical infrastructure like water treatment, the failure mode goes well past data loss. He's pushing for TDI BOMs to be required in government procurement, starting with critical infrastructure supply chains, as a step toward digital and data sovereignty. On the commercial side, George co-founded Very Data Free, a veteran-founded secure-by-design platform he describes as "eBay for your data," built to let organizations sell or loan proprietary datasets for AI model training. The conversation also covers how the SIEM-era centralized security model was built for log aggregation and breaks down at petabyte-scale file data, and why GenAI is forcing organizations to finally secure unstructured data environments they've been ignoring. Topics discussed: Refusing to let AI agents access production logs and environments AI Training Data Bill of Material as a government procurement requirement Model poisoning risks at sub-0.5% training data corruption thresholds Mapping manual processes before AI automation to prove ROI Centralized SIEM-era architecture failing at petabyte-scale unstructured data GenAI forcing organizations to secure previously ignored file environments AI-generated fake passports and government IDs bypassing identity verification Hiring self-taught operators over certification-heavy candidates for SOC teams

    EP 36 — ruby's George Al-Koura on why 15 certifications still won't save you in a live SOC scenario
See All (47)

About

Welcome to Future of Data Security, the podcast where industry leaders come together to share their insights, lessons, and strategies on the forefront of data security. Each episode features in-depth interviews with top CISOs and security experts who discuss real-world solutions, innovations, and the latest technologies that are shaping the future of cybersecurity across various industries. Join us to gain actionable advice and stay ahead in the ever-evolving world of data security.

Information

You Might Also Like