Deploy Securely

Walter kicks off a recurring series with Steve Dufour, talking about:

- Trump's "Big Beautiful Bill" moving through the Senate and how a key AI-related provision was just removed.
- Some key court decisions related to generative AI training on copyrighted material
- ISO/IEC 42005:2025, which gives guidance on AI impact assessments
- Ways to (avoid) automating yourself out of a job

The basics of healthcare can often be a nightmare:

- Finding the right doctor
- Setting up and appointment
- Getting simple questions answered

While these things might seem like an inconvenience, on the grand scale they cost a lot - of money, and unfortunately, lives.

That’s why the Embold Virtual Assistant (EVA) is such a breakthrough.

A generative AI-powered chatbot with access to up-to-date doctor listings and performance ratings, it’s literally a lifesaver.

StackAware was honored to conduct a pre-deployment AI risk assessment and penetration test for EVA on behalf of our client Embold Health.

Following up on our previous discussion, I sat down again with Steve Dufour and Mark Blackham to discuss the product’s development and rollout.

We chatted about:

- EVA’s performance metrics
- Cybersecurity, compliance, and privacy issues
- The future of AI governance and product development in healthcare

Bonus: Steve and I also presented on this work at HITRUST’s Collaborate Conference. Here is our deck: https://docs.google.com/presentation/d/1EedOula8X81WxzVkQim1amiDZWMM8Lh0

Need your own AI risk assessment and governance program build-out?

Book a call at contact.stackaware.com.

On this episode of the Deploy Securely podcast, I spoke with Kenny Scott, Founder and CEO of Paramify.

Paramify gets companies ready for the U.S. government's Federal Risk and Authorization Management Program (FedRAMP). And in this conversation, we talked about:

- Paramify "walking the walk" by getting FedRAMP High authorized
- How AI is impacting FedRAMP authorizations
- The future of AI regulation

I was thrilled to have a leading voice on AI governance and assurance on the Deploy Securely podcast: Patrick Sullivan.

Patrick is the Vice President of Strategy and Innovation at A-LIGN, a cybersecurity assurance firm. He’s an expert on the intersection of AI and compliance, regularly sharing expert insights about ISO 42001, the EU AI Act, and their interplay with existing regulations and best practices.

We chatted about what he's seen from his customer base when it comes to AI-related:

- Cybersecurity
- Compliance
- Privacy

Check out the full episode!

I spoke with Matt Adams, Head of Security Enablement at Citi, about:

- The EU AI Act and other laws and regulations impacting AI governance and security
- What financial services organizations can do to secure their AI deployments
- Some of the biggest myths and misconceptions when it comes to AI governance

While using AI securely is a key concern (especially for companies like StackAware), on the flipside, AI has been supercharging security and compliance teams.

Especially when tackling mundane tasks like security questionnaires, AI can accelerate sales and build trust.

I chatted with Chas Ballew, CEO of Conveyor, about:

- How AI can help with customer security reviews
- What sort of controls Conveyor has in place
- What Chas thinks the future will look like
- The regulatory landscape for AI

Here are some resources Chas mentions in the show:

Deepmind Solving International Mathematical Olympiad problems
https://deepmind.google/discover/blog/ai-solves-imo-problems-at-silver-medal-level/

Prof. Geoffrey Hinton - "Will digital intelligence replace biological intelligence?" 
https://www.youtube.com/watch?v=N1TEjTeQeg0

Jim Keller on Lex Fridman
https://www.youtube.com/watch?v=G4hL5Om4IJ4

Drive sales, improve customer trust, and avoid regulatory penalties with the NIST AI RMF, EU AI Act, and ISO 42001.

Check out the full post on the Deploy Securely blog: https://blog.stackaware.com/p/eu-ai-act-nist-rmf-iso-42001-picking-frameworks

No sector is more in need of effective, well-governed AI than healthcare.

The United States spends vastly more per person than any other nation, yet is in the middle of the pack when it comes to life expectancy.

That’s why I was so excited to work with Embold Health to measure and manage their AI-related cybersecurity, compliance, and privacy risk.

Recently I had the pleasure of speaking with their Chief Security and Privacy Officer, Steve Dufour, and Vice President of Engineering, Mark Blackham on the Deploy Securely podcast.

We went in depth on how they:

• Deliver value with AI
• Protect patient data and their intellectual property
• Are thinking about the future of AI (governance) in healthcare

Need your own AI risk assessment and governance program build-out?

Book a call at https://contact.stackaware.com.

*** Show notes ***

At 20:58, Steve refers to the Society for Information Management (https://www.simnet.org/home).

At 34:10, Walter refers to an article about intellectual property risk management and AI (https://blog.stackaware.com/p/intellectual-property-artificial-intelligence).

1) Early-stage AI startups often grapple with customer security reviews, making certifications like SOC 2 or ISO 27001 essential. However, ISO 42001 might be more suitable for AI-focused companies due to its comprehensive coverage.

2) Larger corporations using AI to manage sensitive data face scrutiny and criticism. These companies can validate their AI practices through ISO 42001, offering a certified risk management system that reassures stakeholders

3) In heavily-regulated sectors like healthcare and finance, adopting and certifying AI technologies is complex. ISO 42001 helps these enterprises manage risks and maintain credibility by adhering to industry standards.

Check out the full post on the Deploy Securely blog: https://blog.stackaware.com/p/iso-42001-ai-management-system-company-types

Want more AI security resources? Check out https://products.stackaware.com/