AI Security Multipliers

Everyone says AI is making employees more productive. We're saving hours, generating content faster and automating everyday tasks.

Wonderful. So where are all those productivity gains actually going?

In this episode of AI Security Multipliers, Steve challenges some of the biggest assumptions behind enterprise AI productivity claims.

AI can absolutely improve efficiency, but the results aren't consistent across every job, process or organization. And saving an employee five hours a week doesn't automatically mean the business has saved five hours of salary.

We explore:

• Productivity versus business value: Why completing tasks faster doesn't necessarily translate into financial savings.
• The hidden costs of AI: Licensing, infrastructure, integration, support, training and human oversight.
• AI and employment: Why AI may reduce the need for future hiring without necessarily eliminating existing jobs.
• The next generation of work: How AI could help organizations accommodate changing expectations around work and personal life while maintaining productivity.
• Security and privacy risks: Why uploading sensitive company information into AI tools could turn a productivity success into a cybersecurity problem.
• Measuring what matters: Why executives are right to demand measurable returns, and how organizations should demonstrate them.

In The Multiplier, Steve shares five practical questions every CIO, CISO and business leader should ask before claiming their AI investments are delivering productivity improvements.

The message is simple: AI can make us faster. But are we actually making our businesses better?

If you're responsible for enterprise AI, cybersecurity, IT strategy or business transformation, this episode is for you.

Subscribe to AI Security Multipliers for practical perspectives on artificial intelligence, cybersecurity and enterprise leadership.

Learn more at https://securitymultipliers.com

#ArtificialIntelligence #AIProductivity #Cybersecurity #EnterpriseAI #AIGovernance #CISO

Send us Fan Mail

Your AI pilot was a success. The technology worked, the business was impressed, and leadership wants to roll it out across the enterprise.

But here's the problem. Nobody planned for what happens next.

In this episode of AI Security Multipliers, Steve explores why successful AI pilots often struggle when organizations try to turn them into production services.

The technology might work brilliantly with twenty users, but what happens when twenty thousand employees start using it?

We explore:

• Why long term ownership and operational support are often overlooked
• The security, privacy and data exposure risks that emerge when AI scales
• Why AI costs can look very different in production
• The difference between productivity improvements and actual business value
• Why deploying AI doesn't necessarily mean employees will adopt it successfully
• Five practical questions every CIO, CISO and business leader should ask before approving an enterprise rollout

The message is simple: proving AI works is one thing. Operating it securely, reliably and affordably across your organization is quite another.

If you're responsible for AI strategy, cybersecurity, IT operations or business transformation, this episode is for you.

Subscribe to AI Security Multipliers for practical perspectives on artificial intelligence, cybersecurity and enterprise leadership.

Security Multipliers: https://securitymultipliers.com

#ArtificialIntelligence #AIGovernance #Cybersecurity #EnterpriseAI #CISO #CIO

Send us Fan Mail

Everyone wants to deploy AI. But who actually owns the results, the risks, and the consequences when things go wrong?

The CEO wants AI to deliver business value. The CIO is expected to implement the technology. The CISO is concerned about security and risk. Legal has questions about liability. HR is worried about the workforce. And business leaders want results.

Everyone has a role. But who's accountable?

In this episode of AI Security Multipliers, Steve challenges one of the biggest mistakes organizations are making with artificial intelligence: treating AI governance as just another IT responsibility.

AI isn't simply a technology deployment. It's an organizational transformation that affects business processes, employees, decision making, legal obligations, financial performance and enterprise risk.

And governing it requires more than an IT policy or another committee.

In this episode, we explore:

• Why AI governance must start with the CEO and executive leadership.
• Why the CIO and CISO shouldn't be expected to own every aspect of enterprise AI risk.
• How to establish an effective AI governance council with real decision making authority.
• Why business leaders must own the outcomes of the AI initiatives they sponsor.
• The responsibilities of legal, HR, finance, risk and compliance.
• Why deploying AI tools doesn't automatically translate into productivity gains or financial returns.
• How to measure actual business value rather than simply counting AI licenses, users or projects.
• Why good governance should accelerate responsible AI adoption rather than slow it down.

Steve also examines why technology and ideas are no longer the biggest obstacles to AI adoption. The real challenge is implementation, organizational change and realizing measurable business value.

The Multiplier: Take your three largest AI initiatives and ask five questions: Who owns the outcome? What measurable benefit are we expecting? What's our starting baseline? Who can accept the risks? And when will we verify that the benefits actually materialized?

Because an AI initiative isn't successful simply because the technology works. It's successful when the business delivers measurable results.

AI Security Multipliers explores artificial intelligence, cybersecurity, risk and governance, with practical perspectives for technology leaders, cybersecurity professionals and business executives.

Send us Fan Mail

Attackers are moving at AI speed. Are defenders still operating at human speed?

Cybercriminals and nation state threat actors are no longer just using AI to write phishing emails or generate malicious code. They're deploying AI agents capable of conducting reconnaissance, adapting their tactics, executing commands and moving through compromised environments with limited human intervention.

Recent research from CrowdStrike and Microsoft shows just how quickly this threat is evolving, including an AI agent reportedly moving laterally and harvesting critical credentials in approximately 20 minutes.

In this episode of AI Security Multipliers, Steve examines what happens when attackers can operate around the clock, exploit weaknesses faster and automate activities that previously required experienced human operators.

But there's a bigger problem.

Many organizations are still relying on defensive processes designed for human speed. Vulnerability remediation takes time. Legacy systems cannot always be patched. Security teams need approvals before taking action. Meanwhile, attackers aren't waiting.

In this episode, we explore:

• How threat actors are using AI agents in real cyberattacks.
• Why the traditional cybersecurity cat and mouse game is changing.
• Why patching faster isn't enough to address today's threats.
• How AI driven attacks threaten business operations, manufacturing and critical infrastructure.
• Why CISOs may need to give defensive AI agents greater autonomy.
• The risks of allowing AI to isolate systems, disable accounts and respond without human approval.
• What cybersecurity leaders should be doing differently as we approach 2027.

Steve also challenges a long held assumption in cybersecurity: that requiring human approval always makes defensive actions safer.

The Multiplier: Identify one defensive action currently delayed by human approval and evaluate whether it could be safely automated, with appropriate controls, testing and rollback capabilities.

The uncomfortable reality? We may need to accept some risk from autonomous defensive AI to avoid much greater risks from attackers.

The hackers have AI agents too. And they're not waiting for approval.

AI Security Multipliers explores artificial intelligence, cybersecurity, risk and governance, with practical perspectives for security professionals and technology leaders.

Send us Fan Mail

I gave an AI agent three real-world cybersecurity consulting challenges to find out whether it could actually do my job.

The results surprised me.

In this episode of AI Security Multipliers, I put ChatGPT to work as a senior cybersecurity consultant for a fictional global manufacturing company with 12,000 employees, legacy technology, cybersecurity risks, budget constraints and executives with competing priorities.

I gave it three assignments:

1. Conduct a cybersecurity risk assessment.
2. Create an executive briefing for business leadership.
3. Navigate a difficult decision involving security, cost, production and AI adoption.

The agent delivered some impressive results. It identified meaningful cybersecurity risks, produced practical recommendations and demonstrated surprisingly good business reasoning.

But when I asked it to create a professional executive PowerPoint, things got interesting. Even after feedback, the presentation still wasn't something I'd put in front of a client.

We scored the three challenges at 78, 68 and 85 out of 100, with an overall average of 77. These were subjective assessments of the deliverables, not a formal benchmark.

So, can an AI agent replace an experienced cybersecurity consultant?

In this episode, I share what worked, what disappointed me, where AI agents still need human judgment and whether I'd trust one to work independently.

The Multiplier: A practical experiment you can run yourself to determine whether an AI agent genuinely saves time and delivers work that meets your standards.

Because there's a big difference between an AI agent completing a task and delivering something you'd be willing to put your name on.

AI Security Multipliers explores the intersection of artificial intelligence, cybersecurity, risk and governance, with practical insights for technology leaders and security professionals.

Send us Fan Mail

The Cybersecurity Skills We Won't Need. And the Ones We Desperately Will.

AI is changing cybersecurity careers. It's automating alert investigations, writing scripts, analyzing vulnerabilities and taking over work that once helped junior professionals build their skills.

So what happens to the next generation of cybersecurity experts?

In this episode of AI Security Multipliers, Steve explores which cybersecurity skills are becoming less important, which will become more valuable, and why AI could make professionals more productive while weakening their ability to troubleshoot independently.

Drawing on decades of IT and cybersecurity leadership experience, Steve discusses five skills worth developing: communication, AI fluency, innovation, continuous improvement and the ability to understand and communicate business risk.

He also examines how CISOs should rethink hiring and mentoring, why technical fundamentals still matter, and how experienced professionals can stay relevant as AI reshapes the industry.

The Multiplier: A practical exercise to help you use AI more effectively while strengthening the skills that will define your future career.

AI will change your cybersecurity career. The question is whether you'll change with it.

Send us Fan Mail

Your SOC is processing more alerts, investigating incidents faster, and automating more responses than ever before. But is your organization actually becoming more secure?

Artificial intelligence is transforming cybersecurity operations. From event correlation and threat intelligence to incident response and vulnerability management, AI promises to help security teams operate at speeds that were previously impossible.

And that's a good thing. Because attackers aren't slowing down.

But there's an important distinction between making a security team more productive and making an organization genuinely safer.

In this episode of AI Security Multipliers, Steve draws on decades of enterprise cybersecurity leadership to explore how AI is changing the Security Operations Center (SOC), where it delivers meaningful improvements, and why traditional cybersecurity metrics don't always tell the full story.

Steve also tackles an unexpected concern: If AI takes over the routine work traditionally performed by junior security analysts, how do we develop the next generation of cybersecurity professionals?

In this episode

• The cybersecurity haystack problem: How early SIEM platforms created mountains of alerts and why AI offers a better way to identify meaningful threats.
• Where AI delivers the greatest value: Event correlation, incident investigation, automated response, and risk-based vulnerability management.
• Faster versus safer: Why reduced investigation times matter, but must translate into improved detection, containment, and risk reduction.
• Autonomous security operations: When AI should be allowed to disable accounts, revoke sessions, block threats, or isolate endpoints without waiting for human approval.
• Human oversight at machine speed: How to balance automated decisions with meaningful human control.
• The SOC talent pipeline: Why automating entry-level work could create long-term cybersecurity skills challenges.
• Beyond green dashboards: What CISOs should actually measure and report to executives and boards.
• AI versus AI: Why defenders must adapt as attackers increasingly use automation and artificial intelligence.

The Multiplier: Prove You're Safer

Choose one cybersecurity workflow where AI could make a measurable difference.

Establish your baseline, introduce AI within clearly defined boundaries, and evaluate three outcomes:

1. Speed: Are you detecting, investigating, or responding faster?
2. Effectiveness: Are you identifying genuine threats, containing attacks sooner, or reducing meaningful business exposure?
3. Control: Can you explain, audit, and override the actions AI takes?

Then reinvest some of the time saved into threat hunting, analyst development, and continuous security improvement.

The goal isn't simply to process more alerts. It's to build a security team capable of stopping more attacks before they become business problems.

Steve's challenge to CISOs is simple: Your attackers are using AI. Why the hell are you not?

AI Security Multipliers explores artificial intelligence, cybersecurity, governance, and enterprise leadership, with practical insights for CIOs, CISOs, security professionals, and business executives.

Topics: AI cybersecurity, Security Operations Center, SOC automation, SIEM, incident response, threat detection, vulnerability management, autonomous security, human-in-the-loop, AI governance, cybersecurity metrics, threat hunting, SOC analysts.

Send us Fan Mail

You've bought the AI licenses. You've launched the pilots. You've deployed the agents. Congratulations. But what has actually changed in your business?

Organizations are investing heavily in artificial intelligence, rolling out Microsoft Copilot, experimenting with autonomous agents, and announcing ambitious AI transformation initiatives.

But there's an uncomfortable question that doesn't always get asked:

Are we implementing an AI strategy, or simply collecting AI technology?

In this episode of AI Security Multipliers, Steve challenges the growing tendency to confuse technology adoption with business transformation.

Drawing on decades of experience leading enterprise technology and cybersecurity initiatives, Steve explores why successful AI adoption requires much more than purchasing the latest tools. It demands clear business objectives, measurable outcomes, organizational change, executive accountability, and governance that enables innovation rather than obstructing it.

Because deploying AI successfully and realizing business value from AI are two very different things.

In this episode, we explore:

• Strategy versus shopping: Why buying AI licenses, platforms, and agents doesn't automatically constitute an enterprise AI strategy.
• The 360-degree AI strategy: Connecting business objectives, use cases, data, technology, workforce capabilities, governance, and organizational change.
• The transformation problem: Why technically successful projects can fail to deliver meaningful business improvements.
• Microsoft Copilot and productivity: What large-scale AI adoption teaches us about employee efficiency, institutional knowledge, and measuring real value.
• Where the saved time goes: Why AI productivity improvements don't necessarily translate into headcount reductions, and why that isn't always a bad thing.
• AI return on investment: How organizations should measure success against the business outcomes that originally justified their investment.
• When experimentation becomes production: How seemingly harmless AI pilots can quietly become business-critical systems without appropriate governance.
• Executive accountability: Why the CEO and leadership team—not just IT—must collectively own the organization's AI strategy.

Steve also examines why traditional long-term technology strategies struggle to keep pace with AI innovation, and argues for a more flexible approach: stable business objectives, adaptable technology choices, and continuous measurement of value.

The Multiplier

Before approving your next AI investment, ask five questions:

1. What business outcome are we trying to improve?
2. How will we measure whether we've succeeded?
3. What needs to change beyond the technology?
4. What risks and governance controls must we consider?
5. Are our executives and board aligned on the vision and expected outcomes?

These questions help distinguish a genuine business strategy from an expensive technology shopping exercise.

The success of your AI strategy won't be measured by how much AI you've deployed. It'll be measured by how much better your business operates because of it.

AI Security Multipliers explores the intersection of artificial intelligence, cybersecurity, governance, and enterprise leadership, delivering practical insights for CIOs, CISOs, technology executives, and business leaders navigating the AI revolution.

Topics: Enterprise AI strategy, AI transformation, AI governance, Microsoft Copilot, agentic AI, AI ROI, digital transformation, organizational change management, business value realization, AI adoption, cybersecurity leadership, executive accountability.

Send us Fan Mail

What happens when an AI agent does exactly what you asked it to do—but takes actions you never intended?

Organizations are rapidly embracing agentic AI, giving artificial intelligence the ability to make decisions, access enterprise systems, execute tasks, and act on behalf of employees.

The productivity benefits are enormous. But so are the potential risks.

And here's the uncomfortable reality: An AI agent doesn't have to be malicious or compromised to cause serious damage. It might simply be trying to complete its assigned task.

In this episode of AI Security Multipliers, Steve explores what happens when autonomous AI agents cross the boundaries of their intended authority—and whether organizations are prepared to detect, contain, and recover from those situations.

We begin with a fictional accounts payable scenario in which an AI agent, tasked with resolving supplier invoices, goes a little too far. What starts as a successful automation initiative ends with unauthorized changes to supplier banking details and a payment going to the wrong account.

From there, we examine the cybersecurity, governance, and operational challenges of giving AI systems increasing autonomy.

In this episode, we explore:

• Rogue AI agents: Why autonomous systems can take unintended actions without being malicious.
• Agentic AI security: How AI agents introduce new risks beyond traditional automation.
• Identity and access management: Why every AI agent needs its own identity, clearly defined permissions, and an accountable owner.
• Zero Trust for AI: Applying least privilege, continuous authorization, and segregation of duties to autonomous agents.
• Human oversight: Where human approval remains essential and why simply adding an approval button isn't enough.
• AI incident response: How to stop a rogue agent, revoke its access, investigate its actions, and recover from the damage.
• AI governance and accountability: Who is responsible when an AI agent makes an unauthorized decision?
• Shadow AI and agent sprawl: Why organizations need governed platforms for developing, deploying, and managing AI agents.

Steve also shares his personal approach to AI autonomy, explaining why he's comfortable allowing AI to manage everyday tasks but draws the line at granting unrestricted access to sensitive financial information.

And we tackle a critical question for every CIO, CISO, and business leader:

If one of your AI agents started behaving unexpectedly tomorrow, would you know how to stop it?

The Multiplier

This week's practical challenge is to select one AI agent operating in your organization and answer five questions:

Who owns it? What identity does it use? What can it access and change? How would you detect unauthorized behavior? And can you stop it without disrupting other business services?

Because the more autonomy we give AI, the more important it becomes to establish clear boundaries, meaningful oversight, and effective incident response capabilities.

Delegating the work doesn't mean delegating accountability.

AI Security Multipliers explores the intersection of artificial intelligence, cybersecurity, governance, and enterprise risk—offering practical insights for security professionals, technology leaders, and organizations navigating the AI revolution.

Topics: Agentic AI, rogue AI agents, autonomous AI security, AI governance, AI incident response, Zero Trust, identity and access management, AI agent permissions, human in the loop, enterprise AI risk, shadow AI, cybersecurity leadership.

Send us Fan Mail

What happens when the artificial intelligence your business depends on suddenly stops working?

AI is rapidly becoming embedded in everything from cybersecurity operations and customer service to software development, finance, and everyday business processes. Organizations are embracing AI automation and autonomous AI agents to improve productivity, reduce costs, and accelerate decision-making.

But there's a question very few organizations are asking:

What happens when the AI stops working?

In this episode of AI Security Multipliers, Steve explores the growing operational risks of enterprise AI dependency and why traditional business continuity and disaster recovery plans may not be prepared for an extended AI outage.

Drawing on his personal experience during Hurricane Katrina, Steve shares how a seemingly resilient data center in New Orleans became unavailable when its backup generator ran out of fuel, while critical offsite backup tapes remained inaccessible.

It's a powerful reminder that having a disaster recovery plan doesn't necessarily mean you can recover.

Through a fictional enterprise-wide AI outage, we explore:

• AI dependency: How organizations are becoming increasingly reliant on AI services and autonomous agents.
• Business continuity: Why traditional disaster recovery plans may overlook critical AI dependencies.
• Third-party risk: How multiple enterprise applications can depend on the same underlying AI provider.
• AI vendor lock-in: Why switching AI models, platforms, and agents may be harder than expected.
• Cybersecurity resilience: What happens when security operations teams lose their AI investigation and response capabilities.
• Workforce readiness: The risks of losing the human expertise needed to operate when automation fails.
• AI governance: Why business leaders, CIOs, CISOs, and enterprise risk teams must jointly manage AI resilience.
• Practical recovery planning: How to identify AI dependencies, establish fallback capabilities, and test organizational readiness.

We also explore a potentially more dangerous scenario: What if AI doesn't stop working, but starts producing incorrect results while appearing perfectly healthy?

This isn't an argument against AI adoption. It's an argument for making sure the organizations we're building remain resilient as AI becomes increasingly essential.

Because the real question isn't whether your AI provider can recover from an outage.

It's whether your business can survive while it does.

The Multiplier: A practical exercise to test what would happen if a critical AI service disappeared for 24 hours—or an entire week.

AI Security Multipliers explores artificial intelligence, cybersecurity, AI governance, enterprise risk, and the practical challenges of adopting AI responsibly.

Topics: AI business continuity, AI disaster recovery, agentic AI, AI outages, operational resilience, cybersecurity, enterprise AI risk management, third-party risk, AI governance, business impact analysis, AI vendor dependency, and autonomous AI agents.

Send us Fan Mail