Securing the Realm

Bruno Lecoq spent 20 years at Microsoft before founding BEMO, where he runs compliance and AI governance for small and medium businesses. In this episode he explains why blocking AI tools fails in practice - staff use them regardless - and what governing that use looks like: zero trust for smaller organisations, keeping AI costs under control as Microsoft's pricing shifts, and continuous compliance.

We also talk about where security teams go from here as AI picks up more of their work, and the new risks that arrive with the tools, deepfakes included. Bruno's examples come from his own clients - AI changing how departments work with each other, and how companies oversee what staff do with it.

Chapters

• 00:00 Introduction to BEMO and Cybersecurity
• 01:16 Understanding AI and Its Impact on BEMO
• 03:04 The Rapid Evolution of AI
• 04:33 AI's Impact on Work Environment and Governance
• 05:59 Organizational Changes and Convergence of Departments
• 09:36 Cross-Department Collaboration and Automation
• 13:19 Software Engineering and Security Concerns
• 16:45 Red Teaming and Agent Security Testing
• 20:57 Identity Management and Agent Actions
• 23:14 The Impact of the emdash
• 24:14 Security Challenges and Deep Fakes
• 25:28 Ensuring Authenticity in Hiring
• 26:27 Conditional Access and Verified ID Face Check
• 27:13 The Importance of Security and Compliance
• 30:15 The Significance of CMMC Compliance
• 31:17 The Role of Trust in the AI Era
• 37:23 The Digital Divide and Regulatory Challenges
• 39:08 Small to Medium Business Security and AI Adoption

Nema Sobhani, a data scientist at Avanade, discusses the concept of agents in AI and their impact on human activities. He explores the definition of agents, their role in the enterprise, and the ethical and social implications of their use. The conversation delves into the evaluation and governance of AI models, as well as the philosophical and practical considerations of human-AI interaction.

Takeaways

• Agents as AI entities are empowered to perform tasks autonomously, and they will increasingly become integral to various business functions, disrupting the org-chart.
• The evaluation and governance of AI models are crucial in ensuring their ethical, and responsible use in enterprise settings and as a key part of AI governance.

Chapters

• 00:00 Introduction to Agents in AI
• 07:58 Ethical and Social Implications of Agents
• 16:24 Evaluation and Governance of AI Models
• 26:20 Human Activities and the Role of AI

The conversation delves into the evolving landscape of AI and securing it, focusing on regulatory and legal drivers, the commoditization of AI, security & governance challenges, open source and commodification, and the nature of observability. Each chapter explores these themes in depth, providing valuable insights into the current state of AI technology and its impact on various industries.

Takeaways

• Regulatory and legal drivers to Agentic Security
• Are models being commoditised?
• Security and governance challenges
• Open Source
• Observability and security

The conversation delves into the future of AI, discussing its accessibility, the concept of ambient computing, and the ethical governance of AI. Kevin McDonnell shares his insights and a one of his own take aways from the app that started the series!

🎄 Welcome to a festive "Securing the Realm"! Josh McDonald and Chris Lloyd-Jones are joined by Dr Diana Wolfe and Fergus Kidd to explore the shift from vibe coding to vibe engineering - balancing AI speed with structure, security, and governance. Expect insights, holiday puns stretched to breaking point, and plenty of laughter! 🎅

Key takeaways:

• AI accelerates coding but can introduce chaos
• Testing and security are non-negotiable for AI-generated code
• Democratising expertise risks uncritical AI use

#AI #VibeEngineering #FestiveTechCalendar2025

Diana Wolfe joins Chris and Josh to discuss the new paper "The Architecture of AI Transformation: Four Strategic Patterns and an Emerging Frontier" co-authored by Diana Wolfe, Alice Choe and Fergus Kidd; and discussing the transformative potential of AI in organizations, exploring the concept of agentic AI and its implications for leadership and collaboration. They cover the challenges of paradigmatic lock-in, the importance of individual augmentation, and the need for effective governance in AI deployment. Diana shares insights from her research, emphasizing the balance between automation and human creativity, and the necessity for organizations to adapt and evolve in the face of technological advancements.

LinkedIn Post: https://www.linkedin.com/feed/update/urn:li:activity:7371958936486232064/
Paper: https://arxiv.org/abs/2509.02853

In this episode of "Securing the Realm," we discuss the mystifying world of deepfakes and shallow fakes and their implications for security and media trust. Hosts Josh McDonald and Chris Lloyd-Jones - with special guest Fergus Kidd - guide you through real examples of deepfakes, showcasing the state-of-the-art tools that make them possible. We also take a look back at the evolution of deepfakes, the implications for security and misinformation, exploring how far we've come and the challenges that lie ahead. Join us for a thought-provoking discussion on the future of AI-generated content and the ongoing battle against misinformation, utilising inoculation against misinformation, as well as content provenance.

Key Takeaways:

• Shallow fakes are easier to create than deepfakes.
• Real-time AI avatars can mimic human gestures and speech.
• Detection of deepfakes relies on physiological signals and contextual clues.
• Media literacy is crucial in combating misinformation.
• Inoculation against misinformation can help prepare individuals.
• Content provenance is essential for trust in media.
• The technology is advancing faster than detection methods.
• Education campaigns are necessary for public awareness.
• Corporate targets are more likely to fall victim to deepfake scams.
• The future of AI-generated content poses significant challenges.

In this conversation, Chris Lloyd-Jones and Josh McDonald discuss the use of Foundry Local for securely generating sensitive AI content. They explain the importance of data privacy and security, showcasing a multi-agent workflow that allows for the creation of confidential research documents. The conversation highlights the integrated knowledge sources that track references and contextual information, as well as the ability to enhance model knowledge through RAG search. Chris emphasizes the secure export of content for various applications, underscoring the significance of Foundry Local in his AI toolkit. Josh emphasizes the developer friendly UI. GitHub Repo: https://github.com/SecuringTheRealm/str-foundry-local

Key Takeaways

• Foundry Local allows for secure AI content generation.
• Data privacy and security are paramount in sensitive research.
• The multi-agent workflow enhances efficiency in content creation.
• Integrated knowledge sources provide crucial contextual information.
• RAG search enriches model knowledge about specific entities.
• Content can be exported securely for various uses.
• The system operates entirely on local hardware.
• The technology supports both local and deployment for cloud-based model operations.

In this conversation, Josh McDonald and Chris Lloyd-Jones discuss the importance of securing communications in the realm of agentic AI. They explore the CIA triangle of security—confidentiality, integrity, and availability—and how Microsoft Purview serves as a data security solution. The discussion delves into the Model Context Protocol (MCP) and Agent-to-Agent (A2A) protocols, emphasizing their roles in facilitating secure communication between AI agents. The conversation concludes with a demonstration of MCP in action and reflections on the future of agentic AI.

Key Takeaways

• Securing communication between agents is crucial.
• The CIA triangle of security includes confidentiality, integrity, and availability.
• Microsoft Purview is a comprehensive data security solution.
• MCP connects AI applications to external tools and data sources.
• A2A protocol enhances enterprise communication between agents.
• Data lineage is vital for governance and compliance.
• Generative AI tools can aid in security contexts.
• The integration of MCP with tools like GitHub Copilot is significant.
• Understanding agent flow is essential for security teams.

Check out the repo here: https://github.com/SecuringTheRealm/str-mcp-purview

In this conversation, Chris and Josh explore the latest features of GitHub Copilot, particularly focusing on agentic AI and its implications for software development. They discuss the concept of vibe engineering versus vibe coding, emphasizing the need for subject matter expertise when utilizing AI tools. The duo embarks on a project to recreate a tabletop RPG experience using TypeScript and the semantic kernel, showcasing the capabilities of AI in generating code and managing development tasks. They also address the challenges of debugging and the importance of iterative development in AI-assisted coding.

Key Takeaways:

• The concept of agentic AI is transforming software development. Vibe engineering emphasizes the need for subject matter expertise in using AI tools.
• AI tools can significantly enhance coding efficiency but require oversight.
• Debugging is a crucial part of the development process with AI.
• AI can generate complex code structures from simple prompts.
• Iterative development is essential when working with AI-generated code.
• Understanding the underlying technology is key to effective AI use.
• Future developments in AI will continue to reshape coding practices.