AI Security Multipliers

What happens when the artificial intelligence your business depends on suddenly stops working?

AI is rapidly becoming embedded in everything from cybersecurity operations and customer service to software development, finance, and everyday business processes. Organizations are embracing AI automation and autonomous AI agents to improve productivity, reduce costs, and accelerate decision-making.

But there's a question very few organizations are asking:

What happens when the AI stops working?

In this episode of AI Security Multipliers, Steve explores the growing operational risks of enterprise AI dependency and why traditional business continuity and disaster recovery plans may not be prepared for an extended AI outage.

Drawing on his personal experience during Hurricane Katrina, Steve shares how a seemingly resilient data center in New Orleans became unavailable when its backup generator ran out of fuel, while critical offsite backup tapes remained inaccessible.

It's a powerful reminder that having a disaster recovery plan doesn't necessarily mean you can recover.

Through a fictional enterprise-wide AI outage, we explore:

• AI dependency: How organizations are becoming increasingly reliant on AI services and autonomous agents.
• Business continuity: Why traditional disaster recovery plans may overlook critical AI dependencies.
• Third-party risk: How multiple enterprise applications can depend on the same underlying AI provider.
• AI vendor lock-in: Why switching AI models, platforms, and agents may be harder than expected.
• Cybersecurity resilience: What happens when security operations teams lose their AI investigation and response capabilities.
• Workforce readiness: The risks of losing the human expertise needed to operate when automation fails.
• AI governance: Why business leaders, CIOs, CISOs, and enterprise risk teams must jointly manage AI resilience.
• Practical recovery planning: How to identify AI dependencies, establish fallback capabilities, and test organizational readiness.

We also explore a potentially more dangerous scenario: What if AI doesn't stop working, but starts producing incorrect results while appearing perfectly healthy?

This isn't an argument against AI adoption. It's an argument for making sure the organizations we're building remain resilient as AI becomes increasingly essential.

Because the real question isn't whether your AI provider can recover from an outage.

It's whether your business can survive while it does.

The Multiplier: A practical exercise to test what would happen if a critical AI service disappeared for 24 hours—or an entire week.

AI Security Multipliers explores artificial intelligence, cybersecurity, AI governance, enterprise risk, and the practical challenges of adopting AI responsibly.

Topics: AI business continuity, AI disaster recovery, agentic AI, AI outages, operational resilience, cybersecurity, enterprise AI risk management, third-party risk, AI governance, business impact analysis, AI vendor dependency, and autonomous AI agents.

Send us Fan Mail

AI Is About to Break Your Cybersecurity Operating Model

Artificial intelligence is transforming cybersecurity. But are we actually changing how security operates, or simply making our existing processes faster?

Every cybersecurity vendor seems to have AI. AI powered SIEM, endpoint security, vulnerability management, threat intelligence and security operations. But adding AI to existing tools doesn't automatically transform cybersecurity.

In Episode 12 of AI Security Multipliers, Steve explores why artificial intelligence could fundamentally disrupt the cybersecurity operating model — and why that might be exactly what the industry needs.

We examine how AI could reshape Security Operations Centers (SOCs), automate incident investigation, transform vulnerability management, accelerate incident response and challenge traditional security team structures.

But there's a bigger question: What happens when AI can perform work in seconds that previously required hours of human effort?

Do we still need traditional Tier 1, Tier 2 and Tier 3 SOC structures? How do we develop future cybersecurity professionals if AI performs the entry-level work? And how do we govern autonomous security systems capable of taking action at machine speed?

We also explore the implications for security architecture, identity, governance, human oversight and cybersecurity performance metrics.

The real opportunity isn't simply to automate existing security processes. It's to redesign them around better security outcomes, clear accountability and the right balance between human judgment and AI autonomy.

Because automating a bad process doesn't make it a good process. It just makes the bad process faster.

Topics covered: AI in cybersecurity, cybersecurity operating models, AI security operations, SOC automation, AI agents, agentic AI, vulnerability management, incident response, autonomous security, security architecture, AI governance, cybersecurity transformation, CISO leadership, Zero Trust and the future of cybersecurity.

Send us Fan Mail

AI Is Eating the Career Ladder

AI is making organizations more productive. But could it also be destroying the talent pipeline that creates tomorrow’s experts?

Artificial intelligence is automating entry-level work, reducing costs, and helping businesses achieve more with fewer people. For executives, the productivity gains are compelling. But there’s a problem that may not become obvious for another five or ten years.

If we stop hiring and developing junior employees today, who replaces our experienced professionals when they retire, leave, or get promoted?

In this episode of AI Security Multipliers, Steve explores one of the most overlooked consequences of AI adoption: the potential erosion of the career ladder.

From cybersecurity analysts and software developers to accountants, engineers, and business professionals, many of today’s senior experts developed their skills through the very entry-level tasks AI is beginning to automate.

We explore:

• Why AI productivity gains could create a long-term talent shortage.
• How automating junior roles could weaken organizational succession planning.
• Why practical experience and professional judgment can’t simply be replaced by AI generated answers.
• The danger of confusing AI assisted productivity with genuine expertise.
• How cybersecurity teams could lose their pipeline of future security engineers, incident responders, and CISOs.
• Why organizations need to reinvent apprenticeships, mentoring, and early-career development.
• How AI could actually accelerate professional development when used correctly.

This isn’t an argument against AI automation. It’s an argument for thinking beyond immediate cost savings and redesigning how organizations develop their people.

Because eliminating unnecessary work is progress. Eliminating the opportunities that create tomorrow’s experts could be a very expensive mistake.

The question isn’t whether AI can replace entry-level tasks. It’s how we’ll develop the next generation of experienced professionals when those tasks disappear.

Topics: Artificial intelligence, AI job displacement, entry-level jobs, future of work, AI automation, cybersecurity careers, workforce transformation, talent development, succession planning, AI productivity, AI governance, career development, mentoring, organizational resilience, and the future of cybersecurity.

Send us Fan Mail

Generative AI can produce extraordinary answers.

Detailed. Confident. Professional.

And sometimes completely wrong.

The most dangerous AI answer isn't necessarily the obviously ridiculous one. It's the wrong answer that sounds exactly like the right one.

In this episode of AI Security Multipliers, Steve explores AI hallucinations and why they become much more serious when generative AI moves beyond chatbots and starts influencing real business decisions.

What happens when an AI assistant invents a customer interaction? When an AI security tool incorrectly summarizes an incident? Or when an autonomous AI agent acts on information that simply isn't true?

We look at why confidence doesn't equal accuracy, how automation bias can cause people to stop questioning AI generated answers, and why RAG and grounding can improve accuracy without magically creating truth.

The episode also explores the growing connection between AI accuracy and information governance. If your enterprise data is outdated, contradictory or poorly managed, grounding an AI in that information may simply allow it to produce the wrong answer more convincingly.

And as AI agents gain the ability to take action, the stakes become even higher. An incorrect answer can become an incorrect decision — and an incorrect decision can become an automated action.

The answer

Send us Fan Mail

Where will artificial intelligence be one year from now? Five years from now? Ten years from now — and what happens beyond that?

Predicting technology is notoriously difficult, so this episode isn't really about prediction. It's about direction.

In this episode of AI Security Multipliers, Steve looks beyond the next model release and explores how AI could reshape technology, work, cybersecurity and governance over the next decade.

In the near term, AI may simply become normal — embedded into the applications and technology we already use, while AI agents increasingly move from answering questions to actually performing work.

Five years from now, those agents could form a genuine digital workforce, changing jobs, management and the way organizations operate. That raises some difficult questions: What happens to entry-level work? How do people develop expertise when AI performs many of the tasks traditionally used to learn it? And what happens when managers aren't just managing people, but potentially dozens or hundreds of AI agents?

By 2036, AI may no longer feel like a separate technology at all. It could simply become infrastructure — with software increasingly understanding our intent and applications disappearing behind the outcomes we're trying to achieve.

And then there's the bigger question: what happens when useful intelligence itself becomes cheap and widely available?

We also explore what this future could mean for cybersecurity, identity, autonomous systems, Zero Trust, AI governance, AGI and the relationship between human and machine intelligence.

The goal isn't to correctly predict 2036.

It's to build organizations capable of adapting when we get there.

Topics include: future of AI, artificial intelligence, AI agents, agentic AI, enterprise AI, AI jobs, future of work, AI workforce, AI cybersecurity, AI governance, AGI, digital workers, autonomous AI, identity security, Zero Trust and the future of technology.

Send us Fan Mail

AI is creating new cybersecurity risks — and naturally, an entire industry is emerging to sell us new tools to manage them.

AI security posture management. AI gateways. AI firewalls. Agent security. Runtime protection. Model security. AI governance platforms.

Some of these technologies will be essential. But before adding another platform, another dashboard and another acronym to the security stack, there's a question worth asking:

How much of your AI security problem can you solve with the tools you already own?

In this episode of AI Security Multipliers, Steve looks beyond the AI security hype to examine how many enterprise AI risks are actually familiar cybersecurity problems wearing a very clever new interface.

Excessive AI access is still an identity problem. Sensitive data being shared with AI is still a data protection problem. An overprivileged AI agent is still a privileged access problem. An insecure AI workload is still a cloud security problem. And AI generated malicious code executing on a laptop is still something endpoint security should care about.

We explore how existing capabilities including IAM, MFA, privileged access management, DLP, endpoint security, cloud security, SIEM, Zero Trust and security monitoring can form much of the foundation for securing enterprise AI.

There are genuinely new AI security risks that require new capabilities. But the answer shouldn't be to build an entirely separate cybersecurity stack for AI.

Start with the risk. Map the controls you already have. Identify the real gaps. Then buy technology to fill those gaps.

Because there's a difference between security architecture and shopping.

Topics include: AI security, enterprise AI, generative AI security, agentic AI, AI agents, cybersecurity, AI governance, identity security, IAM, DLP, Zero Trust, SIEM, cloud security, endpoint security, AI security tools, security architecture and cybersecurity tool sprawl.

Send us Fan Mail

AI agents are entering the enterprise — and they aren't just answering questions anymore.

They're accessing information, using applications, calling APIs, operating browsers, making decisions and increasingly taking action on our behalf.

So here's a deceptively simple cybersecurity question:

Who is the agent?

In this episode of AI Security Multipliers, Steve explores what happens when AI agents begin behaving less like traditional software and more like a digital workforce.

We look at why agentic AI creates a new identity and access management challenge, how AI agents differ from traditional service accounts and automation, and what happens when agents begin delegating work to other agents.

We also explore the coming challenge of Shadow Agents, agent lifecycle management, least privilege, Zero Trust, kill switches, accountability and the uncomfortable possibility that enterprises may eventually have far more AI identities than human ones.

Because securing AI agents isn't simply about controlling what information they can access.

It's about understanding who they are, what they're allowed to do, who owns them — and how you stop them when something goes wrong.

Your newest employee might not be human.

But they still need an access review.

Topics include: AI agents, agentic AI, enterprise AI, AI cybersecurity, AI governance, identity security, IAM, non-human identities, machine identities, Shadow AI, Shadow Agents, Zero Trust, least privilege, autonomous AI, AI risk management and the future of work.

Send us Fan Mail

What happens when enterprise AI starts finding information you didn't realize people could access?

In this episode of AI Security Multipliers, Steve looks at one of the uncomfortable realities of tools like Microsoft 365 Copilot: AI may not be creating your data security problem. It may simply be exposing the one you already had.

We explore RAG, enterprise search, excessive permissions, SharePoint sprawl, information governance and why “clean all your data before deploying AI” probably isn't a realistic strategy.

And there's another possibility: AI might actually be one of the best things to happen to information governance in years.

Because AI didn't create decades of bad permissions and forgotten files.

It just made them searchable.

Send us Fan Mail

Microsoft Scout could be one of Microsoft's most important enterprise AI announcements yet.

In this special edition of AI Security Multipliers, Steve takes a closer look at Microsoft Scout — Microsoft's new always-on AI agent for work — and what it could mean for the future of enterprise AI, Microsoft 365, cybersecurity and AI governance.

Unlike a traditional AI assistant or chatbot, Scout is designed to do more than answer questions. It can work across Microsoft 365, files, browsers and enterprise systems, perform multi-step tasks and increasingly take action on behalf of the user.

That capability could fundamentally change how we work. It also raises some important questions.

What happens when AI stops simply answering questions and starts performing work inside the enterprise? What identity should an AI agent have? What data should it be able to access? Which actions require human approval? And how do organizations govern, monitor and secure an increasingly autonomous digital workforce?

Steve explores why identity, Zero Trust, information governance, Microsoft Entra, Purview and cybersecurity become even more important in an agentic AI world — and why Microsoft's existing position across identity, security, data, Microsoft 365 and the enterprise could give it a significant advantage.

The AI model may not be Microsoft's biggest advantage.

Microsoft's biggest advantage may be that it already lives where we work.

Topics include: Microsoft Scout, Microsoft Copilot, AI agents, agentic AI, enterprise AI, autonomous AI agents, Microsoft 365, Microsoft Entra, Microsoft Purview, cybersecurity, Zero Trust, AI governance, information governance and the future of work.

AI Security Multipliers explores how artificial intelligence is changing cybersecurity, governance and enterprise technology — and how organizations can use AI to multiply capability without multiplying risk.

Send us Fan Mail

New to AI Security Multipliers? Start here.

In this short introduction, Steve explains what the podcast is about, why he created it, and the perspective he brings to the rapidly changing worlds of AI, cybersecurity and governance.

No hype. No fearmongering. Just practical conversations about what matters, what’s changing, and how we can use AI to multiply what people and organizations are capable of achieving.

Send us Fan Mail