Guardians of the Data

Ward Balcerzak

5.0 (4)
Technology

Welcome to Guardians of the Data! Join host, Ward Balcerzak, each week as he dives deep into the passions, expertise, and experiences of CISOs, Chief Data Officers, and more. Guardians of the Data is sponsored by Sentra - AI-powered data security platform that discovers and classifies all your data accurately and automatically to achieve enterprise-scale data protection without the fuss.

6d ago

Risk Isn't Static - Guardians of the Data - Veena Nagarajan - Episode #55

If someone tried to onboard a new vendor tomorrow, would your organization know exactly which questions to ask before granting access to sensitive data? For most teams, the answer is a scramble, not a process. In this episode, Ward sits down with Veena Nagarajan, interim CISO of a healthcare organization with 15 years in cybersecurity, to unpack why data protection has become as much about disciplined process as it is about technology. Veena walks through how she screens new solutions before they ever touch the environment, why a lean ten question risk assessment beats a bloated 100 question form nobody finishes, and how ongoing reassessment, not a one time checkbox, is what actually keeps organizations safe. She also opens up about her journey from India to becoming a healthcare CISO, and the mentors who shaped the way she leads. Takeaways: Start every new solution with a short, focused risk questionnaire. Ten well chosen questions about hosting, data elements, and exposure will tell you more than fifty scattered ones ever could.Know your regulatory baseline before you assess risk. Whether it's HIPAA, PCI, or SOX, identifying which frameworks apply first helps you pinpoint your organization's true crown jewels.Risk assessment isn't a one time event. Reassess after a vendor moves from proof of concept to production, since environments and exposure change fast.Defense in depth still wins. Layer email security, EDR, DLP, and network detection together, because the human clicking a bad link remains the most common entry point.Don't let perfect automation be the enemy of consistency. A well maintained spreadsheet process beats a fancy automated one that nobody checks. What matters most is doing it regularly.Quote of the Show: "It doesn't matter if it's manual or automatic. What matters is keeping it regular and consistent. That is the key." - Veena Nagarajan Links: LinkedIn: https://www.linkedin.com/in/veena-nagarajan/ Ways to Tune In: Transistor: https://podcast.guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Aug 6

Denial of Wallet - Robert Whetstine - Guardians of the Data - Episode # 54

What happens when your AI gets bored? According to this week's guest, it starts making its own decisions, and not always the ones you'd want. Robert Whetstine, known across the industry as the Bow Tie Security Guy, joins Ward Balcerzak to unpack the wave of risk headed toward every organization running AI in production. From a looming explosion in CVEs to a brand new attack called denial of wallet, Robert makes the case that AI isn't replacing the fundamentals of security, it's making them non-negotiable. The conversation moves from technical war stories to Robert's own path from homelessness to Fortune 500 executive, tying together a career built on embracing discomfort and doing the basics better than anyone else. Takeaways: Shift from a vulnerability management mindset to an exposure risk model. Know your crown jewels, monitor them closely, and be able to answer in minutes whether a new CVE actually touches your environment.Don't let AI agents get bored. Chatbots without real guardrails will drift outside their instructions the longer a conversation runs, so build in controls rather than trusting the model to police itself.Budget for token costs the way you'd budget for cloud sprawl. A reckless query or a denial of wallet attack can rack up tens of thousands in charges, so plan for a multiplier, not a flat rate.Treat an unrestricted AI model like a brilliant but unsupervised junior engineer. Lock down RBAC, log everything through a third party, and never take an AI's own explanation of its behavior at face value.Protect your team from hustle culture before it protects your company from anything else. Burnout erodes judgment fast, and the basics, like tabletop exercises and clear data retention policies, only get done by people who aren't running on empty.Quote of the Show: “If you're not actively preparing for your token cost to have a five X multiplier in the next five years, you're going to be drastically surprised.” - Robert WhetstineLinks: LinkedIn: https://www.linkedin.com/in/bowtiesecurityguy/ Youtube: https://www.youtube.com/@bowtiesecurityguy Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Jul 30

The Host Gets Hosted - Ward Balcerzak - Guardians of the Data - Episode # 53

What happens when the interviewer becomes the interviewee? For Guardians of the Data's one year anniversary, Kraig Faulkner, Field CTO at InfoLock, flips the script and puts host Ward Balcerzak in the hot seat. Ward finally answers the question he has asked every guest all year: what is the biggest challenge organizations face in data security? His answer is blunt. From people, process, and technology to agentic AI oversight and a bold prediction about the future of SOC analyst roles, Ward pulls back the curtain on twenty years building data security programs at organizations like Allstate and Fidelity National Financial. Takeaways: Prioritize, strategize, and focus. Most organizations skip straight to buying a tool without appointing a leader or dedicating real resources, and that shortcut is why data security programs stall before they start.People and processes come before technology. Ward ranks people first, processes a close second, and technology last, since governance and documentation often matter more than the tool doing the work.Data security is bigger than DLP. Encryption, tokenization, activity monitoring, and data cataloging all belong under the same strategic umbrella instead of sitting scattered across disconnected teams.AI did not create new risk, it exposed the risk that was already there. Years of neglecting data at rest and access hygiene are now surfacing the moment a copilot lets employees search everything at once.Treat agentic AI like any other technology rollout. Give it a full architectural and security review, build in a UAT stage, and do not let it skip the same tollgates every other system has to pass through.Quote of the Show: “AI didn't introduce new risks. It exposed the risk that we swept under the rug or neglected for years.” - Ward BalcerzakLinks: Ward’s LinkedIn: https://www.linkedin.com/in/ward-balcerzak/ Kraig’s LinkedIn: https://www.linkedin.com/in/kraigfaulkner/ Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Jul 23

Compiled for Your Protection - Guardians of the Data - Episode # 52

What if the biggest threat to your data security program isn't a hacker, but your own classification policy? In this special compilation episode, Ward Balcerzak brings together some of the sharpest voices from across Guardians of the Data, including Tobias Simpson, Hans Vargas, Trevor Dolan, Matthew Gonzales, Joshua Copeland, Luis Valenzuela, Ketan Gotmare, Kevin Feck, and Dr. Sergio, for a rapid fire tour through the ideas that defined the show this season. From the real risk of misclassifying data to the business case every CISO needs to make in the boardroom, this episode strings together the moments that stuck with listeners most, plus a sobering look at how far social engineering has come with deepfakes, and lookalike domains. Takeaways: Misclassifying data is a bigger risk than leaving it unclassified. Several guests point to department level tabletop exercises as the fastest way to find each team's actual crown jewels before rolling out a blanket policy.Treat data classification like a partnership, not an audit. Approach owners with empathy and make it clear you're there to help them find what matters, not to punish them for how they've stored it.A real governance program rests on five pillars: leadership buy-in, an honest maturity assessment, clear policy frameworks, ongoing training, and the right team structure. Fix the most urgent pain points first, then document the rest as a roadmap so the gaps are defensible later.Boards don't respond to cyber risk, they respond to business risk. Translate technical exposure into dollars, downtime, and operational impact, or the conversation stalls before it starts.Security leaders are caught in a velocity versus control paradox, expected to move as fast as the business while still verifying everything. At the same time, social engineering has caught up with AI, from cloned voices to deepfaked video, making code words and manual verification more essential than ever.Quote of the Show: "Unless you can talk business risk, not cyber risk, and you can talk real dollars and cents to the business, you're gonna fail every single time." – Joshua Copeland Guest’s Linkedins: https://www.linkedin.com/in/luisvalenzuela28323623/ https://www.linkedin.com/in/trevor-dolan-91a1ab12/https://www.linkedin.com/in/hansvargas/https://www.linkedin.com/in/tobias-simpson-mism-706b57a8/https://www.linkedin.com/in/matthew-c-gonzales-64012a8/https://www.linkedin.com/in/joshuacopeland/https://www.linkedin.com/in/ketangotmare/https://www.linkedin.com/in/kevin-feck-756ab91/https://www.linkedin.com/in/dr-sergio-e-sanchez/ Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Jul 16

Stop Chasing Shiny Objects - Dana Kilcrease - Guardians of the Data - Episode #51

If you had to guess where your organization's biggest data risk is hiding, would tech debt make your list? In this episode, Ward Balcerzak sits down with Dana Kilcrease, a nearly two decade cybersecurity veteran and current CISO in higher education, to talk about what actually matters when the pace of technology outstrips the pace of resources. Dana makes the case that velocity, not any single threat, is the real challenge facing security leaders today, and that the answer isn't chasing every shiny new tool. It's nailing the fundamentals, building DSPM and DLP into the foundation, and treating AI governance as a partnership rather than a lockdown. Along the way, he shares how a 95 year old institution turned AI anxiety into stronger cross-functional relationships, and offers some blunt career advice for anyone trying to break into cyber. Takeaways: Velocity, not any one specific threat, is the real challenge in security right now. Resources aren't scaling at the same rate as technology or attackers, so leaders have to get comfortable doing more with what they already have.Don't chase every shiny new tool. Go back to first principles, harden your endpoints, lock down your processes, and build a real incident response plan so the blast radius stays small when something does happen.Start data security with visibility. A DSPM foundation paired with DLP tells you where sensitive data lives, where it's overshared, and where policies need to close the gap.Treat AI governance as a partnership, not a policing effort. Sitting down with academic and administrative leaders to hear their concerns first turned a contentious relationship into a collaborative one.Certifications don't replace experience. Get clear on the niche you actually want, whether that's pentesting or research or something else, and build toward that instead of stacking badges for their own sake.Quote of the Show: "Experience trumps everything. If you have the option of taking a certification or getting into the trenches and really learning what this means, get into the trenches by all means and go nuts."- Dana Kilcrease Links: LinkedIn: https://www.linkedin.com/in/danakilcrease/ Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Jul 9

Data Never Sleeps - Andy Soodek - Guardians of the Data - Episode # 50

What if the biggest threat to your data wasn't a hacker, but your own success at collecting it? On this episode of Guardians of the Data, host Ward Balcerzak sits down with Andy Soodek, a privacy strategist and data governance expert with over three decades in the industry, to make a case that reframes the whole conversation: data protection was never a project with an end date. Andy breaks down why consent, data sprawl, and now AI are pulling organizations into a governance cycle that never actually closes, and why the companies still treating it like a checklist are the ones falling furthest behind. Takeaways: Treat data governance as a continuous loop, not a project you complete and shelve. New data, new tools, and new regulations mean the work never truly ends, so build a governance model that evolves alongside your business instead of expecting a finish line.Get intentional about consent and transparency before you collect data, not after. Once that data gets shared with third parties or reused for new purposes, unclear consent turns into unclear liability down the road.Simplify your data classification scheme rather than over-engineering it. Too many tiers create inconsistent access controls and confuse the people who actually need to use the data, so aim for a system that is easy to train on internally and easy to explain to an auditor.Audit your data retention practices honestly. Most organizations are holding far more data than their own policies allow, and old data sitting around past its useful life adds legal exposure with little upside.Build AI governance into your existing risk framework instead of treating it as a separate initiative. As regulations like California's ADMT rules expand, organizations need real explainability and human review built into automated decisions.Quote of the Show: "It's a never-ending governance cycle. You've got to keep up with what you've got going on now, because the next challenge is already on its way." - Andy SoodekLinks: LinkedIn: https://www.linkedin.com/in/andysoodek/ Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Jul 2

Emerging Threats in Data Protection - Anand Thangaraju - Guardians of the Data - Episode # 49

AI has changed the conversation around cybersecurity, but according to Anand Thangaraju, the real challenge has not changed at all: protecting what matters most. In this episode, Ward talks to Anand where he explains why proprietary data has become every organization's most valuable asset and why traditional security approaches are struggling to keep pace. From data lineage and insider risk to agentic remediation and AI driven security operations, he lays out a future where context matters more than tools and where security teams need to understand not just where data lives, but why it moves and who is moving it. Takeaways: Your crown jewels are your proprietary data. In an AI driven world where public information is being commoditized by the minute, the only thing that gives your organization a true competitive edge is what it knows that no one else does. If you do not have a strong grip on that proprietary data, you do not have a fighting chance.Stop waiting for the perfect moment to turn on visibility. One of the most common traps CISOs fall into is holding off on DSPM adoption until every compensating control is already in place. Start building now, because the longer you wait for perfection, the more your data sprawl grows into something that is genuinely unmanageable.Treat data security as a program, not a product. No single tool is going to solve your data security problem. The organizations making real progress are the ones pairing the right technology with the right people, clear policies, and a genuine understanding of what bad actors would actually want from their environment.Build your insider risk and data security programs together. These two disciplines share the same foundation: knowing where your sensitive data lives, who is touching it, and whether that behavior is normal. Tackle them in silos and you are leaving the most important use cases on the table.Before you automate remediation, earn the right to do it. A crawl, walk, run approach is not timidity, it is strategy. Start with alert only mode, study your false positive rate, and give your model time to learn the nuances of your business before you hand it the keys to take action.Quote of the Show: "The model should be almost like a trained security architect or security engineer. It should be able to reason for every single action it's taking." - Anand ThangarajuLinks: LinkedIn: https://www.linkedin.com/in/athangaraju/Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod
Jun 25

Where Is Your Grandmother's Data? - David Smith - Guardians of the Data - Episode #48

Most organizations have spent decades classifying data without ever asking the most important question: what are we actually trying to do with that classification? In this episode, David Smith, a cybersecurity leader with 30 years of experience across financial services, biopharma, consulting, and the vendor space, reframes the entire data governance conversation around one deceptively simple idea: custodianship. David argues that AI did not create the data governance crisis. Organizations handed it 30 years of ungoverned data and said go. What AI did was pull the covers off a problem that has been quietly compounding through every layer of abstraction since the mainframe days. Takeaways: Every new layer of data technology, from data warehouses to cloud to AI, breaks the original rules attached to data. The further data gets from its source, the harder it is to enforce how it should be used or protected. Good data governance isn't about corporate policies and DLP rules. It's about custodianship, treating every data set the way you'd treat something precious that belongs to someone you love, and being intentional about who can access it, how it's stored, and what happens if something goes wrong. AI doesn't create data governance problems, it inherits them. When organizations feed decades of ungoverned data into AI systems, they're handing enormous power to a tool that has no way to respect rules that were never properly defined in the first place. Data classification fails most organizations not because the concept is wrong, but because schemas focus too much on what the data is and not enough on what people are allowed to do with it. Traffic Light Protocol is a better model because it defines behavior, not just sensitivity level. Starting a cybersecurity career at the help desk builds skills no technical training can replicate. Learning to solve problems under pressure with frustrated users and outdated systems directly prepares you for the real-world constraints of enterprise security work.Quote of the Show: "AI inherited rather than creating the data governance problem. Organizations handed it 30 years of ungoverned data and said go." - David SmithLinks: LinkedIn: https://www.linkedin.com/in/davidesmithcissp/Personal Website: https://desmithsecurity.com/Ways to Tune In: Transistor: https://guardiansofthedata.show/ Spotify: https://open.spotify.com/show/5gZXInkb12Qrs2Lyv0hstQ Apple Podcasts: https://podcasts.apple.com/us/podcast/guardians-of-the-data/id1826819323 Amazon Music: https://music.amazon.com/podcasts/0754cdde-f1c4-4f6c-92a2-e263f7840eb8/guardians-of-the-dataiHeart Radio: https://www.iheart.com/podcast/269-guardians-of-the-data-285972170/YouTube: https://www.youtube.com/@GuardiansoftheDataPod

Trailer

Guardians of the Data Trailer!

Welcome to Guardians of the Data! Join host, Ward Balcerzak, each week as he dives deep into the passions, expertise, and experiences of CISOs, Chief Data Officers, and more. Guardians of the Data is sponsored by Sentra - AI-powered data security platform that discovers and classifies all your data accurately and automatically to achieve enterprise-scale data protection without the fuss.

5

out of 5

4 Ratings

Welcome to Guardians of the Data! Join host, Ward Balcerzak, each week as he dives deep into the passions, expertise, and experiences of CISOs, Chief Data Officers, and more. Guardians of the Data is sponsored by Sentra - AI-powered data security platform that discovers and classifies all your data accurately and automatically to achieve enterprise-scale data protection without the fuss.

Creator

Ward Balcerzak
Years Active

2025 - 2026
Episodes

56
Rating

Clean
Copyright

© 2026 Ward Balcerzak
Show Website

Guardians of the Data