What does AI security actually look like inside real organizations? 

In this episode of ClearTech Loop, Jo Peterson talks with Todd Smith, SVP and Director of Customer IAM and Threat Intelligence at Ameris Bank, about shadow AI, non human identities, and what AI defense looks like in environments where identity, fraud, and security are tightly connected. 

They unpack why shadow AI is both an IT and security issue, why blocking AI tools is not a long term strategy, and how organizations are trying to bring more visibility and control to environments where AI adoption is already happening across teams. 

Todd explains how shadow AI creates real risk through data leakage, IP exposure, and regulatory pressure, especially when employees turn to unapproved tools to move faster. The conversation also highlights the role of training, as organizations shift from simply restricting behavior to helping employees understand how to use AI safely. 

The discussion then moves to non human identities, where Todd describes the operational challenge of managing identities that do not follow a clean lifecycle. These identities can accumulate over time, often without clear ownership, creating a growing need for discovery, cleanup, and better control moving forward. 

From there, Jo and Todd explore AI defense from a practical standpoint. Instead of starting with external threats, the conversation focuses on understanding what is happening inside the environment first, including how AI interacts with data, identity, and access. That internal visibility becomes the foundation for any broader defense strategy. 

This episode is especially relevant for CIOs, CISOs, security leaders, and identity leaders working through the realities of AI adoption, governance, and risk in enterprise environments. 

Timestamps 

00:00 Introduction to Todd Smith and episode context 
01:40 Shadow AI: IT problem, security problem, or both? 
04:50 Discovery, visibility, and managing shadow AI 
07:55 Security as the “Department of Education” 
10:45 Non human identities and lifecycle challenges 
13:20 AI defense: starting inside the environment 

Guest Bio 

Todd Smith is SVP and Director of Customer IAM and Threat Intelligence at Ameris Bank. His work spans identity, fraud, threat intelligence, and AI security in financial services environments. He has held leadership roles across Ameris Bank, SoFi, Barclays, Citi, and the FBI, focusing on identity, cyber fraud, and intelligence driven security operations. 

Additional Resources 

• National Institute of Standards and Technology AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework 
• National Institute of Standards and Technology Cybersecurity Framework (CSF): https://www.nist.gov/cyberframework 
• MITRE ATT&CK Framework: https://attack.mitre.org/ 
• Season 1 ClearTech Loop: https://www.buzzsprout.com/2248577 

Follow ClearTech Loop 

Follow ClearTech Loop for more conversations on AI security, cybersecurity leadership, AI governance, and enterprise technology strategy. 

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

What does AI security actually look like inside real organizations? 

In this episode of ClearTech Loop, Jo Peterson talks with Thomas Bryant, Director of Technical Marketing at Pure Storage and independent analyst and consultant at THB3, about shadow AI, non human identities, and what leaders should really mean when they talk about AI defense. 

They unpack why shadow AI is both an IT and security issue, how CISOs and CIOs are approaching identity and governance, and why AI defense is increasingly becoming a resilience question rather than just a detection one.  

In this conversation, Thomas explains why shadow AI is not just a security problem. It is also an IT, tooling, and governance problem, especially when organizations are trying to help employees move faster without exposing enterprise data through non approved tools. He also shares how leaders are using discovery, inventory, and training to bring more structure to environments where AI adoption is already ahead of visibility.  

The discussion then shifts to non human identities, where Thomas argues that organizations need to think differently about bots, scripts, and AI agents that can outnumber humans at massive scale. From there, Jo and Thomas dig into AI defense as a broader operational challenge centered on adversarial AI, faster response, resilience, and recovery when humans cannot keep up on their own. This episode is especially relevant for CIOs, CISOs, security leaders, IT leaders, and enterprise technology teams trying to balance AI adoption with governance, accountability, and resilience.  

Timestamps 

00:00 Introduction to Thomas Bryant and the episode theme 
01:39 Shadow AI: IT problem, security problem, or both? 
03:04 Discovery, standardization, and training around shadow AI 
05:07 NHIs, onboarding, and machine identity management 
07:18 Super agents, governance, and traceability 
11:09 AI defense, adversarial AI, and resilient security  

Guest Bio 

Thomas Bryant is Director of Technical Marketing at Pure Storage and an independent analyst and consultant at THB3. He has held leadership roles across Pure Storage, Commvault, VMware, and Dell, with a focus on technical marketing, infrastructure, cloud, AI, and cybersecurity. His work centers on helping technical teams make complex technology easier to understand and act on.  

Additional Resources 

• Thomas Bryant on LinkedIn: https://www.linkedin.com/in/thomashbryant/  
• Season 1 ClearTech Loop: https://www.buzzsprout.com/2248577  
• Thomas Bryant Podcast (2024): https://podcasts.apple.com/us/podcast/the-resilience-rundown/id1730107130  

Follow ClearTech Loop for more conversations on AI security, cybersecurity leadership, AI governance, and enterprise technology strategy 

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

When ransomware strikes, even the most prepared organizations can find themselves scrambling—security hunting for indicators while IT races to spin up restores. It’s a recipe for confusion and downtime.

Chris Bevel, Practice Lead for Cybersecurity and AI at Commvault, joined Clear Tech Loop to break down how ResOps—the fusion of security and operations—creates a new model for smarter cyber resilience and faster, more coordinated recovery.

Breaking Down the Silos

Security and IT operations share the same goal: keep the business running. But during a cyber incident, they often work from separate playbooks. Security investigates threats; operations restores systems. The result is fragmented workstreams, miscommunication, and delayed recovery.

ResOps bridges that divide. By aligning both teams under a unified, pre-tested recovery framework, organizations can respond to ransomware and other cyberattacks with speed and precision. The goal isn’t just to get systems back up—it’s to restore them safely and confidently.

AI That Drives Real Decisions

Not all artificial intelligence earns its keep. As Bevel explains, “AI doesn’t replace people—it helps them see more clearly and decide faster.”

Commvault’s AI-powered analytics connect signals across identity behavior, configuration drift, and privilege escalation. Individually, these alerts seem routine. When correlated, they reveal hidden attack patterns—insights that help teams detect and respond before damage spreads.

This AI-driven cybersecurity approach turns scattered data into actionable intelligence, helping organizations reduce risk and make confident recovery decisions under pressure.

Recovery as Code: From Chaos to Confidence

Traditional disaster recovery plans often live in outdated documentation or inside a single engineer’s mind. Recovery as code modernizes that approach, defining every restoration step as structured, repeatable, and testable code.

By treating recovery like infrastructure, teams can ensure cyber recovery that’s not just fast but reliable and verifiable. Clean data, validated systems, and resilient configurations—these are the new success metrics for post-ransomware recovery.

Securing Active Directory: The Core of Cyber Resilience

In nearly every ransomware event, Active Directory (AD) is the prime target. Once compromised, attackers can move freely across the network. Bevel recounts a cautionary tale from HIMSS: a company restored all systems, only to discover the attacker still had persistence through AD.

True identity resilience means validating every object, setting, and credential before declaring victory. Commvault extends this rigor beyond on-prem environments with protection for hybrid identity platforms like Okta, ensuring secure recovery across both cloud and data center ecosystems.

The Future of Cyber Recovery: Practiced, Unified, Intelligent

ResOps isn’t a tool—it’s a mindset shift. It’s about rehearsing before the crisis hits, connecting teams around shared playbooks, and letting AI surface what humans might miss.

As organizations face increasingly complex ransomware threats, this convergence of security and operations represents the next evolution of cyber resilience.

Commvault will showcase these ResOps and cyber recovery innovations at RSA. For anyone who’s experienced the chaos of an uncoordinated incident response

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

What does AI security actually look like inside real organizations? 

In this episode of ClearTech Loop, Jo Peterson talks with Matt Sharp, Chief Information Security Officer at Xactly, about shadow AI, non human identities, and what leaders should really mean when they talk about AI defense. They unpack why shadow AI is both an IT and security issue, how CISOs and CIOs are approaching identity and governance, and why AI defense now spans productivity tools, SaaS platforms, internal environments, and third party risk.  

In this episode of ClearTech Loop, Jo Peterson sits down with Matt Sharp for a grounded conversation on three issues reshaping enterprise AI governance: shadow AI, NHIs, and AI defense. Matt brings a practical view from inside a real operating environment, where AI adoption is moving fast and governance, identity, and risk have to keep up. In the conversation, he explains why shadow AI is not just a security problem. It is also an IT, tooling, and governance problem, especially when organizations are trying to steer employees toward approved AI tools while protecting enterprise data.  

The conversation then shifts to non human identities, where Matt argues that AI agents are being layered into authorization models that organizations never fully solved in the first place. From there, Jo and Matt dig into AI defense as a broader enterprise challenge that now touches browser extensions, IDEs, local models, SaaS platforms, and third party risk. This episode is especially relevant for CIOs, CISOs, security leaders, IT leaders, and enterprise technology teams trying to balance AI adoption with governance, visibility, and accountability.  

Timestamps 

00:00 Introduction to Matt Sharp and the episode theme 
02:29 Shadow AI: IT problem, security problem, or both? 
05:54 Why collaboration between security and IT matters 
07:21 NHIs, authorization, and the limits of role based access control 
12:11 What AI defense means in practice 
15:33 Platform strategy, budget pressure, and what comes next in AI security  

Guest Bio 

Matt Sharp is the Chief Information Security Officer at Xactly. He focuses on security, trust, and AI governance in environments where AI is becoming core to the business and product. He is also a venture advisor at YL Ventures and the author of The CISO Evolution.  

Additional Resources 

• Matt Sharp: A CISO’s approach to creating AI governance framework: https://www.securitypalhq.com/blog/matt-sharp-a-cisos-approach-to-creating-ai-governance-framework  
• The CISO Evolution by Matt Sharp: http://amazon.com/CISO-Evolution-Knowledge-Cybersecurity-Executives/dp/1119782481  
• Season 1 ClearTech Loop: https://www.buzzsprout.com/2248577  

Follow ClearTech Loop for more conversations on AI security, cybersecurity leadership, AI governance, and enterprise technology strategy. 

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

In this episode of the ClearTech Loop podcast, Jo Peterson sits down with Gerry Gadoury to talk about what AI security leadership actually requires as the threat landscape changes faster and the business pressure around AI keeps rising. 

This is not a conversation about one more security tool. Gerry brings the discussion back to risk judgment, executive alignment, and the human side of security leadership. As AI lowers the barrier for attackers and accelerates the pace of change, security leaders need to focus on real risk, not theoretical panic, while helping the business make better decisions under pressure. 

Subscribe to ClearTech Loop on LinkedIn: https://www.linkedin.com/newsletters/7346174860760416256/ 

Key Quotes 

• “Do real risk assessments. Don't look so much for the Boogeyman. Look for the person actually knocking on your door.” 
• “When you mandatorily push it downhill, I think people are going to resist.” 
• “The AI landscape changes fundamentally by quarter.” 

Three Big Ideas from This Episode 

1. Real risk matters more than theoretical panic 
   AI security starts with identifying what is likely, material, and relevant to the business instead of getting lost in every hypothetical scenario. 
2. Security cannot just be pushed downhill 
   Runbooks and playbooks matter, but they do not replace executive alignment. Security works better when leaders understand the concerns, reduce resistance, and align around outcomes before a crisis hits. 
3. The CISO role is becoming more business critical 
   As AI changes the risk environment, CISOs need to think more like risk officers by balancing technical controls, business priorities, and leadership judgment. 

Additional resources 

• Destination Employer: Attract, Recruit, and Retain the Top Talent in Your Market by Gerry Gadoury: https://www.amazon.com/dp/B0CR352P8M/ref=cm_sw_r_cp_ud_dp_MCV88SEER4A2FGQQ6H73 
• NIST AI Risk Management Framework and AI Resource Center: https://airc.nist.gov/ 
• ClearTech Loop Season 1: https://www.buzzsprout.com/2248577  

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

In this episode of the ClearTech Loop podcast, Jo Peterson sits down with Fernando Montenegro to talk about what the CISO role actually looks like right now as generative AI spreads across the enterprise.  

This is not a conversation about one more security tool. Fernando frames AI as a forcing function that exposes the social structure of an organization, including incentives, accountability, influence, and how decisions get made. The CISO role has become a bridge role, and the job is more political, more collaborative, and more consultative than it used to be.  

Subscribe to ClearTech Loop on LinkedIn: https://www.linkedin.com/newsletters/7346174860760416256/ 

Zach Lewis Buzzsprout https://www.linkedin.com/newsletters/7346174860760416256/ 

Key Quotes 

1. “They are the translator of security issues to non security decision makers.”  
2. “One of the ways to bring these silos down is to have empathy for the other side, if you will.”  
3. “You solve all of this at the design stage, at the initiation stage, not down the line when people want to release the production.”  

Three Big Ideas from This Episode 

1. AI forces cross functional alignment 
   AI makes silos expensive. When teams have to work together to make AI work, security cannot stay isolated and expect trust to show up later.  
2. Embed security by showing up early 
   There is no perfect universal checklist. The workable move is being there at the beginning, removing friction early, and helping the initiative flourish before deadlines turn everything into a showdown.  
3. The CISO is a translator role now 
   CISOs are playing multiple games at once across the board, the CIO, legal, customers, regulators, and internal teams. Translation is a core operating requirement, not a soft skill.  

Episode Notes and Links 

Listen: In the Player
Watch on YouTube: https://youtu.be/0H4x1-Hu-44
Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/  

Additional resources 

• The Futurum Group, Fernando Montenegro profile
  https://futurumgroup.com/fernando-montenegro/  
• AI and organizational risk management resources, NIST AI Risk Management Framework
  https://www.nist.gov/itl/ai-risk-management-framework  
• 2017 Transformers paper: “Attention Is All You Need” (2017) by Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, Illia Polosukhin. https://proceedings.neurips.cc/paper_files/paper/2017/file/3f5ee243547dee91fbd053c1c4a845aa-Paper.pdf  
• ClearTech Research and ClearTech Loop https://cleartechresearch.com/ 

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

What CISOs miss when security only lives in features 

AI security is still getting framed like a technology problem: new tools, new controls, new dashboards, and new rules. In this episode of ClearTech Loop, Jo Peterson talks with Miri Rodriguez, Cofounder and CEO of Empressa.ai, about why that framing keeps breaking in the real world. 

Miri brings a people first lens to AI adoption and security. She argues that security is not just something you install. It is an environment people are willing to enter. When the environment does not feel secure, adoption either slows or goes underground, and then security teams are left trying to govern what they cannot see. 

This conversation connects three practical leadership threads: using GenAI upstream to understand real adoption patterns, embedding security and privacy without slowing innovation by designing for humans, and building governance that becomes habit instead of paperwork. 

Subscribe to ClearTech Loop on LinkedIn
https://www.linkedin.com/newsletters/7346174860760416256/ 

Key Quotes
“The opportunity is massive when you think about security as an environment, not just a technology or a feature.” 
“The features don’t matter. If you can’t tell me why the features are important in my space.” 

Three Big Ideas from This Episode 

1. GenAI beyond the tool stack
   Generative AI can help security leaders widen the lens on adoption. Before policies and controls, leaders need to understand where people hesitate, where they take shortcuts, and why the secure path gets avoided. 
2. Inclusion is a security control
   Speed without inclusion creates blind spots, and blind spots become risk. Security and privacy do not have to slow innovation, but they do have to be designed in a way people can understand and follow. 
3. Governance is behavior
   If governance does not translate into day to day habits, it is just documentation. Training format matters as much as content, and security sticks when people see it as personal responsibility, not corporate paperwork. 

Additional Resources 

• AI Foundations for Women (Empressa AI)
  https://empressa.ai/ai-foundations-for-women/ 
• Most Tools Weren’t Built with Women in Mind, AI Is Just the Latest
  https://empressa.ai/2025/04/03/most-tools-werent-built-with-women-in-mind-ai-is-just-the-latest/ 
• IABC Catalyst, Building Your Brand With Microsoft Senior Storyteller Miri Rodriguez
  https://www.iabc.com/Catalyst/Article/building-your-brand-with-microsoft-senior-storyteller-miri-rodriguez 

About the Guest
Miri Rodriguez is Cofounder and CEO at Empressa.ai, an AI and storytelling strategist, bestselling author, and Microsoft alum. She focuses on ethical innovation, inclusion, and building trustworthy AI environments where women can connect, learn, and thrive. She is also the author of Brand Storytelling: Put Customers at the Heart of Your Brand Story. 

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

AI is getting embedded into everything, security workflows, engineering workflows, and customer facing products, often faster than organizations can govern it. The upside is real. The risk is in the assumptions leaders are making while they chase speed. 

In this episode of ClearTech Loop, Jo Peterson sits down with Margaret Dawson, Chief Marketing Officer at SUSE, for a slightly different conversation than our usual guest mix. Same three questions, but through a CMO lens shaped by decades of enterprise buying cycles. 

Margaret breaks down how security leaders can use generative AI to move beyond tools and tech, what it actually takes to embed security and privacy without slowing innovation, and how CMOs should talk about AI without getting trapped in AI washing. The throughline is practical: productivity gains are real, but cost, control, and credibility are not automatic. 

Subscribe to ClearTech Loop on LinkedIn:
https://www.linkedin.com/newsletters/7346174860760416256/  

Key Quotes 
“The mistake that we’re making as leaders is we are assuming that the integration of AI is an automatic reduction in cost.” — Margaret Dawson 

“Until all of a sudden, the CFO got a million dollar cloud bill.” — Margaret Dawson 
“Consumers get smarter, very, very fast, especially BtoB Tech customers, and they start to know what’s real and what’s not.” — Margaret Dawson 

“Being very specific on what it is doing for your product, for that customer, tying it back to the business outcome.” — Margaret Dawson 
“People trust their peers more than any vendor or anyone else.” — Margaret Dawson 

Three Big Ideas from This Episode 

1. AI adoption fails when leaders treat it like automatic margin 
   The board level narrative is tempting, but dangerous. AI can improve productivity, but assuming it instantly reduces cost is how organizations create governance debt and business continuity risk. 
2. Speed is possible, but only with guardrails 
   Embedding security and privacy is not what slows innovation. Confusion, rework, and incidents slow innovation. The answer is clear boundaries, clear accountability, and controls that keep pace with adoption. 
3. In marketing, relevance and proof beat hype 
   Buyers calibrate fast. AI messaging has to be specific, tied to outcomes, and backed by customer evidence. Credibility is built peer to peer, not through louder claims. 

Resources Mentioned 

• The Secret to Digital Transformation is Human Connection by Margaret Dawson: https://devops.com/the-secret-to-digital-transformation-is-human-connection/ 
• INTERVIEW: SUSE CMO Margaret Dawson on AI, Kubernetes & Open Source | KubeCon + CloudNativeCon NA 2025: https://www.youtube.com/watch?v=kUcEl3hfvG8  
• ClearTech Loop: AI Security Needs Better Execution with Zach Lewis: https://www.buzzsprout.com/2248577 

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

AI security is getting marketed like it requires a brand-new playbook—new frameworks, new job titles, new spend. 

In this episode of ClearTech Loop, Jo Peterson sits down with Zach Lewis (CIO/CISO and author of Locked Up) for a practical reset: AI doesn’t erase the fundamentals—it punishes you faster when you ignore them. Zach breaks down where GenAI is already helping security programs today (especially tabletop exercises and prioritization), what it actually takes to embed security and privacy into AI models without slowing innovation (data classification, access controls, segmentation, documentation, least privilege), and why adoption fails when leaders treat AI like a tool rollout instead of a behavior change. 

The takeaway is simple and actionable: get the foundations right, use AI to reduce friction where it matters, and build a culture where AI augments people rather than creating fear.  

Subscribe to ClearTech Loop on LinkedIn:
https://www.linkedin.com/newsletters/7346174860760416256/  

Key Quotes 

“Strong AI security… starts with doing the basics well.” — Zach Lewis  

“One of the best use cases I found for it was tabletop exercises.” — Zach Lewis  

“You had a billion alerts… and you’re like, which one’s important?” — Jo Peterson  

Three Big Ideas from This Episode 

1) AI security is data discipline + access discipline 

Before you talk tools, talk foundations: classify data before it touches a model, segment critical workloads, gate access by role and sensitivity, document prompts/sources/model versions, and enforce least privilege with ongoing testing and validation.  

2) GenAI can make readiness more real (tabletop exercises) 

Instead of running the same scripted scenario every year, GenAI can generate realistic incidents, inject curveballs, and help teams identify missed actions—turning tabletops into a real maturity-building loop.  

3) Adoption is a leadership problem, not a platform problem 

AI initiatives stall when people are afraid or unsupported. Training, shared use cases, and visible wins (time saved, friction removed) create a safe environment where AI augments work rather than threatening it.  

📘 Zach’s book: Locked Up: Cybersecurity Threat Mitigation Lessons from a Real-World LockBit Ransomware Response   https://www.amazon.com/Locked-Cybersecurity-Mitigation-Real-World-Ransomware/dp/1394357044 

Resources Mentioned  

• ClearTech Loop with Michael Machado AI Risk is Mostly Not New:https://www.buzzsprout.com/2248577/episodes/18535354-ai-risk-is-mostly-not-new-with-michael-machado   
• Locked Up by Zach Lewis is available: https://www.amazon.com/Locked-Cybersecurity-Mitigation-Real-World-Ransomware/dp/1394357044 
• NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework 
• MITRE ATT&CK Framework: https://attack.mitre.org/    

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/  

AI is speeding up both attackers and defenders. The goal is not speed alone. The goal is speed with trust. 

In this episode of ClearTech Loop, Jo Peterson sits down with Stefano Righi, Chief Security Architect at AMI, for a hot take conversation on what AI is changing inside security programs. Stefano breaks down how GenAI can move teams beyond reactive, tool centric security into anticipatory defense through predictive threat modeling, dynamic risk assessment, and orchestration. He also explains what secure by design means for AI systems, including privacy, adversarial resiliency, prompt injection, and data poisoning, plus why human oversight still matters. The conversation closes on firmware security below the operating system and why governance aligned to standards becomes an accelerator, not paperwork. 

Subscribe to ClearTech Loop on LinkedIn:
https://www.linkedin.com/newsletters/7346174860760416256/ 

Key Quotes 

• “Governance may act as a catalyst, not as a brake to innovation, enabling innovation while ensuring trust.” — Stefano Righi 
• “From the very start, we need to pursue secure by design for AI model… build privacy and adversarial resiliency into AI life cycles… mitigate risk like prompt injection and data poisoning without slowing innovation.” — Stefano Righi 
• “Firmware runs under the operating system, and any attack that could happen at such layer could go undetected by any antivirus solution running in the operating system.” — Stefano Righi 

Three Big Ideas from This Episode 

1. Governance accelerates trusted AI adoption 
   Governance is not paperwork. Done right, it enables innovation while ensuring trust, and it must be cross functional rather than owned by security alone. 
2. Secure by design has to include AI systems 
   Privacy and adversarial resiliency belong in the AI lifecycle from the start, with attention to risks like prompt injection and data poisoning, plus human oversight to ensure compliance and prevent misuse. 
3. Firmware is a visibility blind spot below the OS 
   Platform layers from microcode to BIOS to BMC to Root of Trust create real complexity, and attacks below the OS can bypass controls that security leaders rely on for visibility. 

Episode Notes / Links 

🎧 Listen: In player above
▶ Watch on YouTube: https://youtu.be/wXOf6erkQ6k
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/ 

Resources Mentioned 

• ClearTech Loop: The CSA AI Safety Initiative with George Finney https://cleartechresearch.com/the-csa-ai-safety-initiative-with-george-finney/  
• NIST AI Standards: https://www.nist.gov/artificial-intelligence/ai-standards   
• OWASP guidance for AI: https://owasp.org/www-project-ai-security-and-privacy-guide/  
• CSA: How Generative AI is Reshaping Zero Trust Security https://cloudsecurityalliance.org/blog/2026/01/09/how-generative-ai-is-reshaping-zero-trust-security  

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/playlist
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/