Guest Introduction

Shawn Hamm is a cybersecurity leader with three decades of IT experience who is currently making the deliberate move from Director of Cybersecurity into the CIO seat. With a background spanning hands-on technical work, consulting, security leadership, and hiring, he brings a practitioner's perspective to both the technology and the human side of organizational leadership. His work today focuses on building AI-ready teams, driving adoption from the ground up, and creating environments where the full range of talent in the room has a genuine opportunity to excel.

Here's a Glimpse of What You'll Learn

• Why Shawn sees the transition from cybersecurity director to CIO as a natural evolution rather than a departure from his roots, and what made him take the leap
• How deploying open source AI on his own hardware at home, and breaking it repeatedly, taught him things no training course would
• Why a colleague he expected to be the email guy turned out to have 32 active agents running his entire workday, and what that story reveals about who actually leads AI adoption
• Why the Microsoft Copilot internal study found that only 15% of users became power users, and why the differentiator was people skills rather than technical skills
• How Shawn is building an internal AI council and monthly agent showcase to spread adoption organically across his organization
• Why the genie in the lamp analogy is the most honest explanation of how agentic AI actually works and where most people go wrong with it
• What the women in tech conversation looks like from the perspective of two fathers of daughters in the industry, and why Shawn believes the fix starts with raising the standards for young men

In This Episode

Shawn opens with a refreshingly honest framing of his own transition. Moving from cybersecurity director to CIO was not a pivot away from what he knows, it was the next seat at the table, with broader authority and broader responsibility. He acknowledges that the jump can feel intimidating for security professionals who have spent years becoming deeply competent in their lane, but his approach is consistent with how he handles everything: start with a solid foundation, do not rush the advanced stuff until you understand the basics, and treat failure as a data point rather than a verdict. That philosophy runs through every part of this episode and gives it a coherence that is rare when a conversation covers as much ground as this one does.

The most memorable story Shawn tells is the one he did not expect to tell. He decided to inventory how people in his organization were actually using the Copilot licenses they already had. He made phone calls, asked questions, and mostly found people using it for email. Then he got to a colleague he had already written off as the email guy, a bit older, not exactly a technology enthusiast by reputation. That man had 32 agents running, had worked through every level of the Microsoft training curriculum from beginner to developer, and was receiving a morning briefing PDF in his inbox by 6:00 AM every day summarizing everything he needed to know to start work. Shawn tells that story with the kind of genuine surprise that lands because it is clearly real. It also sets up his broader argument: AI adoption at the enterprise level is not being led by the people you expect, and the skill driving results is not technical fluency, it is the managerial ability to onboard a new tool the same way you would onboard a new employee. The Microsoft internal study on Copilot proved exactly that. Only 15% of users at a technology company became sustained power users, and the common thread was not their technical background. It was that they treated the tool like an intern, took time to explain the context, the job, and the expectations, and let it get better over time.

The women in technology conversation that takes up the back half of this episode deserves its own mention because it does not happen from the usual angle. Shawn and the host approach it as two fathers of daughters who are going into tech, which grounds the conversation in something personal before it becomes systemic. Shawn is direct that the problem is not women needing to do more. The system is not set up to provide an equal playing field, and the organizations still fighting with one arm tied behind their back because they are not drawing on the full talent available to them are making a strategic mistake. He has built a team where 30% of the IT technical staff is female, he actively targets his nieces for tech conversations, and he talks about Girls Who Code with the kind of firsthand familiarity that comes from a daughter who attended the program. What makes this section work is that Shawn keeps the focus exactly where he says it belongs: not on how women can adapt to a broken system, but on what the men in the room need to do differently.

Guest Introduction:

Ben Wilcox is the CTO and CISO at ProArch, a Microsoft partner organization with 20 years of experience helping companies across healthcare, manufacturing, energy, and independent software development take data to intelligence. In his dual role, Ben leads both the technology and security functions, working directly with clients to build AI-ready foundations, deploy agentic workflows, and secure the environments that support them. He brings hands-on experience across operational technology, data architecture, and enterprise security that spans hundreds of client engagements.

Here's a Glimpse of What You'll Learn:

• Why data quality is the foundational problem that determines whether AI agents succeed or create chaos
• How ProArch helped a critical infrastructure client turn a six-figure reactive problem into millions in first-year ROI using machine learning
• Why machine learning is the unsung hero of the AI era, especially in security, and how it differs from simply bolting an LLM onto a legacy product
• How voice cloning and AI-powered social engineering are changing the threat landscape and what the defensive response looks like
• Why tabletop exercises need to include finance, not just the security team, and how they surface controls gaps that technology alone cannot fix
• Why tool sprawl and legacy systems that do not talk to each other will be the critical failure point as AI-powered attacks accelerate
• What zero trust looks like when agents are part of the workforce and why identity and accountability have to extend to non-human identities

In This Episode

Ben opens by drawing a line that cuts through a lot of the noise around AI adoption: your agents can only act on the quality of data they have access to, and if that data foundation is broken, the consequences of agentic AI are not just poor reports, they are bad actions taken at machine speed with no human in the loop to catch them. That framing sets the tone for the whole conversation. Before any organization can meaningfully benefit from AI agents, it needs asset visibility, data governance, and identity accountability extended to non-human systems. Ben is direct that most organizations are not there yet, and that the governance frameworks needed to treat agents like accountable digital employees are still being built in real time across the industry.

The critical infrastructure case study Ben walks through is one of the most concrete AI ROI stories the podcast has featured. A piece of equipment roughly 15 years old was generating six-figure outages with no predictive visibility, just a reactive cycle that could stretch beyond 72 hours depending on parts availability. ProArch pulled time series data from the client's historian system, mapped the operational curve for normal equipment behavior, identified the anomaly signatures that preceded every past failure, and built a model that could predict future failures before they happened. The result was the ability to either intervene proactively or schedule planned outages before unplanned ones could occur. The project cost just over six figures. The first-year ROI was five to six million dollars. Ben uses this example not just to illustrate what machine learning can do in an operational context, but to make a broader point: the organizations hearing that AI ROI is not there are often looking at the wrong kind of AI for the wrong kind of problem.

That brings him to what he calls the unsung hero of the current moment: machine learning as distinct from LLMs, and why the security industry in particular needs to be thinking about the two differently. Bolting a large language model onto a legacy email security product does not make it smarter, it opens a prompt injection surface that nobody has fully solved. Machine learning that understands user behavior, writing patterns, access norms, and anomalous traffic is what actually changes the defensive equation. Ben is equally direct about where LLMs do belong: surfacing insights in language a non-technical user can act on, finding decade-old vulnerabilities in codebases in minutes, and helping close the gap between how fast attackers are moving and how fast security teams can review and respond. His closing advice on breach preparedness follows the same logic: get finance in the tabletop, understand what controls you would have done differently, and do not wait for something expensive before you ask whether a passkey would have stopped it.

Guest Introduction:

Sean Murphy is the Senior Vice President and Chief Information Security Officer at BECU, the 4th largest credit union in the United States and the largest community-based credit union in the country, with approximately $30 billion in assets. With more than 7 years at BECU, Sean leads a security organization of 60 professionals spanning risk management, identity and access management, security operations, platform engineering, and disaster recovery. His career spans the U.S. Air Force and military medicine, civilian healthcare, and now financial services, giving him a cross-sector lens on cybersecurity accountability that is rare at the executive level.

Here's a Glimpse of What You'll Learn

• Why Sean reframes the "they only have to be right once" threat model and how layered defense changes the math entirely
• How AI-powered email security tools are doing what traditional gateways never could, and why bolting an LLM onto a legacy product is not the same thing
• Why Sean believes the good guys ultimately win the AI security battle and the one condition that has to be met first
• The direct call to action Sean is making to security manufacturers about their responsibility in the AI era
• His three-principle framework for building and defending a security product portfolio to a board
• Why the CISO peer network remains one of the most underrated and most reliable tools for evaluating new security technology
• What Sean's cross-sector background in healthcare and the military taught him about who actually bears the cost when cybersecurity fails

In This Episode

Sean arrives at this conversation with something most CISOs do not have: a career that has moved through military medicine, civilian healthcare, and now critical financial infrastructure. That arc shapes how he thinks about cybersecurity accountability, not just as a technical discipline but as a protection of real people who cannot absorb the consequences of getting it wrong. At BECU, the $30 billion in assets under management belongs to the members. Sean makes that point directly and returns to it throughout the conversation. When cybersecurity fails at an institution like this, it is not an organizational metric that suffers. It is someone's savings, someone's mortgage, someone's financial life. That is the weight he carries into every board presentation and every product decision.

The conversation sharpens quickly when Sean pushes back on one of the most repeated framings in security: that defenders have to be perfect every day while attackers only have to be right once. He does not dismiss the underlying tension, but he reframes it in a way that changes the strategic posture entirely. If your architecture gives an adversary a single opportunity to get through, then yes, that framing holds. But the answer is not to accept it as fixed. The answer is layered defense built across protection, detection, response, and recovery, where attackers have to win at multiple levels before they reach anything critical. Sean is specific about what this looks like in practice, drawing on AI-powered email security as a concrete example of the model working. Tools that use machine learning to evaluate URL age, flag anomalous behavior, and move suspicious content before a user ever sees it represent what security has always needed to be able to do. The distinction he draws matters: that is fundamentally different from slapping an LLM onto a traditional email gateway and calling it AI-powered, which introduces prompt injection risk without solving the underlying problem.

Where this episode breaks real ground is in Sean's argument about manufacturer accountability. It is a point he admits he was not planning to make when the conversation started, but once it surfaced he developed it with clarity and conviction. Organizations that are not in the business of cybersecurity cannot be expected to carry the full defensive burden when the products being shipped into their environments arrive with vulnerabilities baked in. Sean draws the parallel to law enforcement: communities are not expected to police themselves simply because a police force exists, and yet organizations are routinely penalized when vendor-originated vulnerabilities result in a breach. His ask is not to absolve defenders of responsibility. It is to hold manufacturers to a higher standard, specifically that they use AI proactively to find and fix vulnerabilities before publishing them, rather than waiting for researchers or attackers to surface them first. He closes with three principles for how he builds and defends his own product portfolio: platform consolidation over niche products, objective industry benchmarking through tools like the Gartner Magic Quadrant, and the CISO peer network, where honest conversations about what actually worked and what nearly caused a breach drive some of the most reliable buying decisions in the industry.

Guest Introduction

Shannon Brewster is the CISO at YipitData, a market research firm providing real time analytics and competitive intelligence, including Spendhound, a product that helps IT professionals track SaaS spend, benchmark pricing, and manage contract renewal cycles. Shannon joined in December 2025 and also leads the enterprise IT organization. She is a board member of ISC2 and came to this episode fresh from RSA, where she left with a sharper sense of urgency about how quickly the AI security landscape is shifting and how far most organizations still have to go to meet it responsibly.

Here's a Glimpse of What You'll Learn

• Why Shannon believes organizations face a binary choice right now: go all in on AI responsibly or risk being left behind, and why insecure AI is just as dangerous as no AI
• Why the 85 percent rule, five CIS controls that mitigate the vast majority of organizational risk, matters more now than ever as a foundation before any AI strategy can work
• How the Agentic Trust Framework from the Cloud Security Alliance applies zero trust principles to AI agents and why it gives security leaders a structured way to govern agent behavior, permissions, and incident response
• Why constraints on AI agents are not a slowdown but rocket fuel, enabling better performance, fewer hallucinations, and a smaller blast radius when something goes wrong
• Why the taxonomy problem in AI security is more urgent than most people realize and why the industry cannot build effective frameworks until it agrees on what to call things
• How the zero day vulnerability landscape is forecast to explode and why the only realistic defense is AI-powered behavioral anomaly detection that does not wait for a patch
• Why the shared responsibility matrix concept from cloud adoption needs an equivalent for AI and why the industry is currently filling that gap with applied logic rather than defined standards
• Why an agentic SOC is not just an exciting idea but a practical necessity as human response timelines become incompatible with the speed of AI-powered attacks

In This Episode

Shannon opens with a position that cuts through most of the debate around AI adoption timelines: organizations can either go all in on AI with a security-first approach and be positioned to outperform, or they can wait and risk falling behind in ways that become existential. She frames the risk symmetrically, insecure AI adoption is roughly as dangerous as avoiding it entirely, which is why the starting point she returns to throughout the conversation is the foundation. The 85 percent rule, five CIS controls covering asset inventory, vulnerability management, and privileged account management, still mitigates the vast majority of how organizations get compromised. If that foundation is weak, entering the AI era from that starting point creates compounding exposure that no amount of advanced tooling can fully compensate for.

The agentic AI governance thread is where Shannon brings her most structured thinking. She references the Agentic Trust Framework developed by Josh Woodruff and published through the Cloud Security Alliance as the clearest articulation she has seen of how to apply zero trust principles to AI agents. The framework covers identity, behavior, data governance, segmentation, and incident response, and it maps cleanly to a progression model she describes as treating agents like employees: interns get read-only access, they earn expanded permissions through demonstrated performance, and a principal agent going rogue is immediately an all hands on deck situation. Her insight on constraints lands as one of the most quotable moments in the episode. Constraints on agents are not security friction. They are rocket fuel. They reduce hallucination, sharpen purpose, and contain the damage when something inevitably goes sideways.

The conversation closes on the zero day problem, which Shannon frames as the most structurally urgent challenge facing security teams right now. AI is enabling vulnerability discovery and exploitation at rates that make traditional patch timelines obsolete. By the time a patch exists, the exploit is already in the wild. The only realistic defense, she argues, is behavioral anomaly detection powered by machine learning that does not wait for a signature, a patch, or a human analyst to catch up. She connects this to the broader vision of an agentic SOC, where investigations that currently take hours or days compress into minutes, and where the speed mismatch between attack and response is finally addressed not by hiring more analysts but by deploying agents that can operate at the same velocity as the threat.

Guest Introduction

Barninder Khurana is the Chief Information Officer at Patriot Growth Insurance Services, a full service national insurance agency operating across 29 states with approximately 2,100 employees and 160 locations, ranked as a top 25 insurance agency in the United States. Three months into his CIO role at the time of recording, Barninder brings a career that started in 1997 with a single phone call to his father in India, a decision made without spreadsheets, pros and cons lists, or GPT searches, that set him on a path in computer science he has not looked back from since. His perspective on AI, technology leadership, and human development is grounded in decades of practical experience and sharpened by the conversations he is having right now, including a recent talk at NYU where computer science juniors and seniors asked him the question every technologist is wrestling with: what do we do now?

Here's a Glimpse of What You'll Learn

• Why Barninder's first rule of navigating AI adoption is to start with the business problem and work backward, and why CIOs who start with the technology will always end up distracted
• Why signing a five year contract with any security tool right now is doing your organization a disservice regardless of how good that tool looks today
• How AI has completely eliminated a ten year old insurance industry problem around manual application intake that intelligent OCR could never fully solve
• Why the people in your organization are the ones who hold the context that AI cannot generate on its own, and why upskilling them is the most durable competitive advantage available
• How Barninder compressed three weeks of resume screening work into 45 minutes and why the most important judgment call still sat entirely with him
• What he told NYU computer science students whose world was shifting underneath them and why continuous learning remains the one principle that has not changed across a century of technological disruption
• Why security is not a single solution but a multi-layered system, and why the physical and digital versions of that principle are more similar than most people realize
• Why voice authentication at banks was always a bad idea and how AI-powered voice cloning has now made that exact vulnerability fully exploitable

In This Episode

Barninder opens with a principle that sounds simple but cuts through most of the noise around AI adoption in enterprise technology: start with the business problem. Not the product, not the trend, not the board's excitement about a new buzzword. The problem. In a market where a hundred new AI tools appear daily and every vendor claims to be the complete solution, that discipline is what separates CIOs who build durable programs from those who spend years chasing distractions. His security philosophy follows the same logic. Security is not a single solution. It is a layered system, fence, door, lock, camera, interior detection, and the digital version maps directly to that physical model. The tools need to work together and they need to be continuously reassessed because the attack vectors are constantly shifting in ways that a five year contract cannot anticipate.

The insurance industry example he brings is one of the clearest demonstrations in this episode of how AI is solving problems that previous technology simply could not. For a decade, the challenge of hand coding insurance applications into systems produced a partial solution in intelligent OCR that worked only when the form template stayed static. The moment the template changed, the solution broke. AI-powered document intake tools have now made that problem disappear entirely, with configurable accuracy thresholds and optional human review built in. That shift, from a fragile solution to a resilient one, is the model Barninder applies across every technology decision he makes.

The conversation closes with a perspective on people and disruption that is honest about the fear and clear about the path forward. Disruption is real, it has always happened, and it will not stop. The buggy drivers were displaced by railways. The handmade watch market shrank and then became premium. The cycle repeats. What does not change is the advantage held by people who keep learning. Barninder makes this concrete in the most literal way possible, demonstrating that three weeks of resume screening work now takes 45 minutes with the right script and the right tools. But the judgment call at the end, who is the right person for this team, still belongs entirely to him. That is the balance. AI supercharges the human. It does not replace the context that only the human carries.

Guest Introduction

Fletus Poston III is the Director of Security and Systems Architecture at 3D Systems Corporation, one of the world's leading additive manufacturers. In his role, he oversees the overall architecture for both the cybersecurity and IT functions, including infrastructure, cloud, and the governance models that tie them together. 3D Systems builds commercial 3D printers from the board level up, produces its own materials including plastics and metal powders, serves the personal healthcare market with surgical guides and aids, and has recently entered the DoD and aerospace space, currently pursuing CMMC Level 2 certification. Beyond his industry role, Fletus is an adjunct professor at Appalachian State University teaching an AI business cybersecurity course, giving him a dual perspective as both a practitioner shaping enterprise architecture and an educator preparing the next generation of security professionals.

Here's a Glimpse of What You'll Learn

• Why AI governance in enterprise environments starts with knowing what SaaS products are doing with your data before the AI button even appears in the interface
• How MCP servers, API gateways, rate limiting, tokenization, and caching are becoming the new vocabulary of AI architecture governance
• Why machine learning and LLMs serve fundamentally different functions and why confusing the two leads to the wrong tool being applied to the wrong problem
• How deepfake voice cloning and AI-assisted identity fraud are already being weaponized in hiring processes, wire transfers, and social engineering at scale
• Why the energy infrastructure challenge is one of the most underappreciated constraints on AI development and what mobile and space-based data centers mean for the future
• How to create a challenge phrase system that defeats deepfake voice and video calls in both personal and professional contexts
• Why the acceleration of AI model capability is now measured in days rather than months and what that means for governance frameworks trying to keep pace
• Why human safety must remain the first principle in any security architecture and why slowing down by three seconds is still some of the best advice in the field

In This Episode

Fletus opens from a vantage point that most security leaders do not occupy simultaneously: practitioner, architect, educator, and manufacturer all at once. His perspective on AI governance is grounded not in abstract frameworks but in the operational reality of a company that builds printers, produces materials, serves surgical teams, and is now entering the DoD supply chain. In that context, the question of where your data goes when a SaaS product adds a new AI button is not theoretical. It is a compliance and contractual issue that most organizations have not yet accounted for, and Fletus is among the clearest voices in the industry on why that needs to change. He draws a direct line from API gateway concepts that security teams have understood for years to the new vocabulary of AI governance: tokenization, rate limiting, caching, MCP servers, and hybrid model decisions that now sit at the center of every serious enterprise AI conversation.

The machine learning versus LLM distinction lands differently coming from someone who has been teaching it and living it. Fletus explains that machine learning handles normalization and data analytics, the backbone of every security tool since the early days of cloud adoption. LLMs handle language temperature checks, learning the ambiguity and context of how humans actually communicate. The two are not interchangeable, and organizations that treat them as the same thing will deploy the wrong tool in the wrong place and wonder why they got the wrong result. He pairs this with a candid look at the hardware shift happening in parallel, where the processing power once requiring data centers is now sitting in M series laptops and NPU-equipped devices, bringing AI back to the edge in ways that change both capability and attack surface simultaneously.

The deepfake and identity fraud section of this episode is among the most practically urgent content on the podcast this year. Fletus walks through how North Korean actors embedded themselves in remote workforces using AI-assisted personas, how a deepfake video board meeting in Hong Kong led to an approximately 32 million dollar wire transfer, and why current HR systems and ATS platforms have no reliable way to verify human identity in a world where AI can generate resumes, conduct screening calls, and clone voices at scale. His countermeasures are low-tech and effective: challenge phrases that no AI can answer correctly, geolocation-specific questions that test genuine local knowledge, and the simple physical act of standing up and taking a breath before responding to any urgent financial request. In a landscape of increasingly sophisticated threats, the three-second pause remains one of the most powerful defenses available.

Guest Introduction

Chris Campbell is the CIO at DeVry University, a career-aligned institution focused on delivering education in high-demand technology fields that translates directly into workforce-ready skills. In his role, Chris leads technology, cybersecurity, and digital innovation across the university, with a current focus on integrating AI into both operations and curriculum in ways that prepare working adult students for the jobs they are already heading into. DeVry has made a public commitment to embed AI literacy into every program and every course regardless of discipline, and Chris is the technology leader driving that commitment from the inside out.

Here's a Glimpse of What You'll Learn

• Why DeVry made a formal commitment to embed AI literacy into every program and course regardless of field of study and what that looks like in practice
• Why Chris calls them durable skills rather than soft skills and why critical thinking, problem solving, and human collaboration are the career-long differentiators that AI cannot replace
• How DeVry created an internal AI Labs function to manage prioritization, ROI, and the scaling of AI initiatives without losing focus on student outcomes
• Why the intersection of quantum computing and AI is the one development that concerns Chris most as a security leader and what quantum-resistant encryption means right now
• How DeVry uses AI on both sides of the academic equation, helping students build stronger outputs and helping faculty assess work more effectively while maintaining academic integrity
• Why the power users of AI treat it like an employee rather than a tool and why that distinction determines whether AI delivers lasting value
• Why vibe coding and other AI-assisted development shortcuts still require a foundation of architectural thinking and why fundamentals matter more now not less
• How cybersecurity education is shifting away from manual monitoring toward systems thinking, threat understanding, and working alongside automated tools

In This Episode

Chris opens with a position that should be the default for every higher education institution but still is not: if students are walking into an AI-influenced workforce, then keeping AI out of the classroom is not protecting academic integrity, it is leaving students unprepared. DeVry has gone further than most by making a formal public commitment to embed AI literacy across every program, from accounting to software engineering, not as a standalone course but as a thread running through everything. The framing matters too. Chris does not talk about AI replacing work. He talks about AI redefining it, and that distinction shapes every decision his team makes about how students learn, how faculty teach, and how the university itself operates.

The internal structure Chris has built is worth noting. Rather than letting AI initiatives proliferate without direction, DeVry stood up an organization called AI Labs that routes every AI initiative through a single prioritization and ROI framework. That discipline has allowed them to evaluate tools seriously, adopt what works, and avoid the trap of chasing every new product that claims to be AI-powered. On the security side, Chris draws a sharp distinction between machine learning applied purposefully in products like Darktrace and Abnormal versus traditional security products with an LLM bolted on. He describes the emerging dynamic as an LLM war, where the organization is putting AI in on one side and the threat actors are putting AI in on the other, and the organizations that do not deploy deliberately will find themselves on the losing end of that exchange.

The conversation about durable skills is where Chris brings his most forward-looking thinking. He rejects the term soft skills precisely because it undersells what these capabilities are worth in an AI-powered world. Critical thinking, problem solving, the ability to articulate how you arrived at a conclusion, and the ability to collaborate with both human and agentic workers are the skills that will carry people across their entire career arc regardless of what the technology landscape looks like in five or ten years. DeVry builds these into every level of the curriculum, from certificates through bachelor's degrees, because the institution's defining purpose is relevance. What they teach must align with where the workforce is going, not where it was.

Guest Introduction

Amit Basu serves as both CIO and CISO at International Seaways, one of the world's largest publicly traded tanker companies, listed on the New York Stock Exchange under ticker INSW and headquartered in New York City. The company owns and operates 75 large ocean going tankers that transport crude oil and petroleum products across major global routes. In his dual role, Amit is responsible for the digital infrastructure and cybersecurity protecting both onshore operations and a highly distributed fleet at sea, an environment that includes satellite connectivity, automated navigation systems, cloud-connected operational technology, and crews of 15 to 20 people with no dedicated IT expertise on board. His work sits at the intersection of maritime operations, OT security, AI governance, and geopolitical risk in ways that few technology leaders anywhere in the world can match.

Here's a Glimpse of What You'll Learn

• Why 90 percent of global trade moves by sea and what that means when ships become cyber targets in a geopolitical conflict
• How modern ships have evolved from isolated mechanical vessels into fully connected digital platforms and why that transformation has made them attractive targets for threat actors
• Why AI-powered deepfake voice and video calls represent a particularly dangerous new social engineering threat in maritime environments where crew members are trained to follow commands from senior officers
• How machine learning-based behavioral anomaly detection is being deployed on ships to identify threats in environments with no onsite IT expertise
• Why third-party AI risk is one of the most underexamined exposures organizations face, even when they have not adopted AI themselves
• Why Amit believes the industry has moved past the experimentation phase and is now in an accountability phase where AI must be treated as a production system
• How AI will reshape software development roles and what that means for the next generation of developers entering the workforce
• Why Amit believes AI may ultimately have a greater impact on human civilization than fire or electricity

In This Episode

Amit opens with a framing that most cybersecurity conversations miss entirely. Ninety percent of global trade moves by sea. Every time something is ordered online, every time a gas station charges more per gallon, every time a supermarket shelf goes empty, a ship is almost certainly part of the reason. That context matters because it explains why maritime infrastructure has become an increasingly attractive target for threat actors operating during geopolitical conflicts. Ships that were once isolated mechanical vessels are now connected digital platforms running satellite communications, automated navigation, cloud-connected operational systems, and remote diagnostics, all managed by crews of 15 to 20 people who are expert sailors, not IT professionals. That combination of high value and low IT coverage makes them, in Amit's words, a sitting duck.

The AI threat discussion takes a dimension here that most enterprise security conversations do not reach. Amit describes the challenge of deepfake voice and video calls in a maritime environment where the hierarchy functions almost like a military chain of command. If a crew member at sea receives what appears to be a video call from the company's CEO giving an instruction or redirecting the ship, the cultural expectation is compliance. That social engineering vector, powered by AI that can convincingly clone voice and appearance, is one of the most difficult threats to defend against because it exploits human deference rather than technical vulnerability. Alongside this, sophisticated polymorphic malware is now evading even advanced endpoint solutions, reinforcing why machine learning-based behavioral anomaly detection is the right tool for shipboard environments where traditional signature-based tools cannot keep pace.

Amit frames AI governance with a clarity that reflects both his dual role and his experience operating in a highly regulated, globally distributed environment. He distinguishes between the experimentation phase, which he believes is over, and the accountability phase, which has arrived. Boards and executives are no longer asking when the pilot will be ready. They are asking who is accountable for the outcome. That shift demands that CIOs and CISOs move from innovation framing to production framing, with real governance, real policies, and real human oversight baked in. He also raises a third-party AI risk dimension that deserves far more attention than it currently gets: even organizations that have not deployed AI internally are already having their data processed by AI through the vendors, insurers, legal firms, and supply chain partners they rely on every day.

Guest Introduction

Alex Dalay is the CISO at IDB Bank, a New York-headquartered commercial, private banking, and broker dealer institution with more than 70 years of history. As the security leader of a financial institution that sits squarely in the crosshairs of modern threat actors, Alex brings a perspective grounded in operational reality rather than theoretical frameworks. His approach to security leadership strips away the noise and returns consistently to the fundamentals: know what you have, know who has access to it, and build everything else from there.

Here's a Glimpse of What You'll Learn

• Why asset inventory and identity management are the two foundational elements every security program must get right before any advanced tool can be effective
• How AI has changed offensive security by enabling attackers to evaluate and pivot off responses in real time, a capability that previously required human judgment and gave defenders a meaningful edge
• Why the window between vulnerability disclosure and active exploitation has compressed to near real time and what that demands from security teams right now
• How contextual vulnerability scoring differs from out-of-the-box ratings and why a critical vulnerability in one environment may not be critical in yours
• Why social engineering and credential theft remain the most reliable attack paths and how AI-powered behavioral detection is changing the defender's ability to respond
• Why the race to AGI carries geopolitical stakes comparable to the nuclear arms race and what energy infrastructure has to do with who gets there first
• How Alex thinks about the ethical challenge of training AI to be good, not just intelligent, and why guardrails alone are not sufficient
• What Alex told his 10-year-old son when asked about what jobs will look like by the time he graduates college

In This Episode

Alex opens with a perspective that cuts through the noise immediately: security does not need to be complicated, and the organizations that struggle most are usually the ones that skipped the basics in pursuit of advanced capabilities. Asset inventory and identity management are unglamorous but they are the foundation everything else is built on. If you do not know what is in your environment and who has access to it, no tool, AI-powered or otherwise, will save you. That philosophy of fundamentals-first shapes how he approaches the role of CISO at a financial institution that faces a significantly higher volume of attacks than most industries simply because money is involved.

The AI conversation takes a sharp turn toward the offensive side of the ledger. Alex identifies the most consequential change AI has made to the threat landscape as the ability to evaluate responses in real time during an attack. Historically, automated tools ran scripts and moved on when something failed. Human attackers could pivot off unexpected responses. Now AI can do both, at machine speed. That shift has compressed the window between vulnerability disclosure and active exploitation to near real time in many cases, fundamentally changing how urgently defenders must act. He also draws an important distinction that often gets lost in the noise: a critical vulnerability rating from a vendor like Microsoft assumes the worst-case configuration. Whether it is actually critical in your specific environment requires human and increasingly AI-assisted contextual analysis before you drop everything to patch it.

Alex closes with a wide-angle view of where AI is taking both the profession and society. He draws a comparison to the nuclear arms race, arguing that whichever nation cracks AGI first will hold a form of leverage that reshapes global power. He connects that to an underappreciated dependency: energy. Without the infrastructure to power the data centers that run AI at scale, the United States risks falling behind adversaries who face fewer environmental or political constraints on energy expansion. On the ethical side, he raises a point that goes beyond guardrails. We are racing to make AI intelligent without taking the time to teach it to be good, and the consequences of that gap may be the most important and least discussed challenge in the entire AI conversation.

Guest Introduction

Laurel Cipriani returns to the Cyber Business Podcast for a second conversation that goes deeper and broader than the first. As CIO at AffirmedRX, a transparent pharmacy benefits management company and public benefit corporation legally obligated to put patients ahead of profits, Laurel brings a background unlike almost any other CIO in the industry. She trained in psychology, became a registered nurse, spent years in health administration and clinical quality, and arrived in IT through a path that has given her a perspective on people, culture, and human-centered technology that is genuinely rare at the executive level. She is also an active member of the Digital Economist think tank in Washington DC and is joining the World Technology Congress, a Switzerland-based international think tank, as this episode records.

Here's a Glimpse of What You'll Learn

• How Laurel is rolling out a role-based AI strategy at AffirmedRX where tool access, permissions, and accountability are all determined by what each person actually does
• Why she is considering hiring dedicated AI fact checkers and what that says about the current state of AI output reliability in high-stakes environments
• What the representation gap for women in IT leadership actually looks like from the inside and why culture fit may be more important than credentials in closing it
• How AI is currently reinforcing gender bias through scraped training data and what that means for the next generation of models
• Why Laurel believes AI could eventually help solve the root causes of gender inequality if developed and governed thoughtfully
• How the anonymity of the internet has amplified harmful behavior and why removing it may be more beneficial than most people are willing to admit
• What it means to lead a technology team with compassion as a core value and why that quality is becoming more important as AI takes over more execution work
• Why Laurel believes the most important question for this generation is not whether to use AI but how to use it without losing what makes us human

In This Episode

Laurel opens this return visit with an origin story that sets the tone for everything that follows. From aspiring grief therapist to floor nurse to health informaticist to CIO of a public benefit corporation, her path into technology was never linear and never conventional. What runs through all of it is a single thread: a desire to help people and a belief that technology is most powerful when it is built around human needs rather than the other way around. That philosophy is now embedded in how she is building the AI strategy at AffirmedRX, where every steward in the company will have a clearly defined set of tools, permissions, and accountability structures tied directly to their role. No one gets unfettered access. No output goes unreviewed. And no AI system will ever make a decision without a human signing off.

The conversation on women in IT leadership is honest and specific in ways that broader industry discussions rarely are. Laurel notes that virtually every person on her own team is male, not by design but by the reality of a candidate pipeline that still skews heavily toward men. Her response is not to lower the bar but to raise the profile of culture as the primary filter in hiring, something AffirmedRX does formally through a culture screening call before any other evaluation takes place. She makes the case that as AI raises the floor on individual capability, the differentiator between good teams and great ones will increasingly be how people work together, not what any individual can produce alone. That shift, she argues, naturally favors the holistic, relationship-oriented thinking that women have historically been undervalued for bringing to technical roles.

The deepest thread in this episode is the one that connects AI governance to human development in ways that go well beyond the enterprise. Laurel is conducting original research through the Digital Economist on how AI and internet anonymity are amplifying harmful behavior toward women, how gender bias baked into training data is being reinforced at scale in AI models, and what it would take to actually interrupt those cycles rather than just acknowledge them. Her conclusion is not pessimistic. She believes AI, if governed with the same intentionality she is applying at AffirmedRX, could become the most powerful tool ever built for identifying and dismantling the cultural patterns that have kept inequality in place for generations. Getting there requires the same thing everything else in this conversation requires: humans staying in charge, staying accountable, and refusing to let speed become an excuse for carelessness.