AI Risk Management That Scales with Adoption

WEBVTT
00:00:00.000 --> 00:00:02.899
Welcome to Compliance Pointers, where we take
00:00:02.899 --> 00:00:05.780
an in -depth look into the latest news, trends,
00:00:06.000 --> 00:00:08.439
and challenges surrounding information security,
00:00:08.839 --> 00:00:12.320
privacy, and marketing compliance. Let's dive
00:00:12.320 --> 00:00:15.939
in with your host, Jordan Eisner. Hello, and
00:00:15.939 --> 00:00:18.519
welcome to another episode of Compliance Pointers,
00:00:18.679 --> 00:00:22.839
sponsored by Compliance Point, of course. And
00:00:22.839 --> 00:00:28.890
who do we have on the podcast today? I'm sure
00:00:28.890 --> 00:00:32.229
the leader in guest appearances on Compliance
00:00:32.229 --> 00:00:35.049
Pointers, Brandon Breslin. I don't know. I've
00:00:35.049 --> 00:00:37.990
seen Matt Cagle a lot recently on some of these.
00:00:37.990 --> 00:00:40.270
Well, he's a host. He doesn't count. He's one
00:00:40.270 --> 00:00:42.609
of the ranks of hosts. That's a good point. That's
00:00:42.609 --> 00:00:46.130
a good point. So, hey, I'm loving that we're
00:00:46.130 --> 00:00:48.490
putting so many of these episodes out there.
00:00:48.549 --> 00:00:50.850
I love it. And you're liking it so much that
00:00:50.850 --> 00:00:54.149
you're recommending topics as you did with this
00:00:54.149 --> 00:01:00.539
one today. Yep, yep. Getting our subscriber count
00:01:00.539 --> 00:01:03.579
up there. I like it. Yeah, right. Hopefully,
00:01:03.640 --> 00:01:06.500
hopefully with some of these new topics. Yeah.
00:01:06.780 --> 00:01:09.439
And so what we're talking about today, and this
00:01:09.439 --> 00:01:13.180
is timely because we came into this podcast to
00:01:13.180 --> 00:01:17.900
talk about OpenAI, ServiceNow, partnerships around
00:01:17.900 --> 00:01:23.120
AI, how relevant ISO 42001 can be on some of
00:01:23.120 --> 00:01:27.120
that. But then just recently. We're seeing these
00:01:27.120 --> 00:01:31.799
layoffs, UPS, Dow, Amazon, and they're leaning
00:01:31.799 --> 00:01:35.640
into AI. And they're saying the quiet part out
00:01:35.640 --> 00:01:38.920
loud, I guess, is, hey, we're eliminating however
00:01:38.920 --> 00:01:40.819
many thousand jobs because we're going to use
00:01:40.819 --> 00:01:45.840
AI. Yeah, exactly. So I think that's timely too
00:01:45.840 --> 00:01:49.319
today. And we can talk about how some of that
00:01:49.319 --> 00:01:53.420
intertwines. does that make 42001 more relevant
00:01:53.420 --> 00:01:56.140
does it make other ai certifications or frameworks
00:01:56.140 --> 00:02:00.719
more relevant than they already are or do you
00:02:00.719 --> 00:02:05.400
expect that organizations will i don't know i
00:02:05.400 --> 00:02:07.359
guess rally to those more so than they would
00:02:07.359 --> 00:02:10.800
have before so but before we get i guess into
00:02:10.800 --> 00:02:14.419
that for our listeners in case and and watchers
00:02:14.419 --> 00:02:17.360
if you don't know brandon he's the director of
00:02:17.360 --> 00:02:20.930
our assurance services group so That covers information
00:02:20.930 --> 00:02:25.210
security, really readiness and audit work against
00:02:25.210 --> 00:02:29.729
common InfoSec framework. So PCI from the payment
00:02:29.729 --> 00:02:37.189
card industry, SOC2, ISO 27001, 27701, 42001,
00:02:37.189 --> 00:02:42.050
and some extensions and adjacents, and HITRUST.
00:02:45.520 --> 00:02:47.659
That's just one piece of that, right? To be able
00:02:47.659 --> 00:02:49.819
to audit against those frameworks, work with
00:02:49.819 --> 00:02:52.819
organizations to certify that they're in good
00:02:52.819 --> 00:02:54.520
standing with controls. You have to have technical
00:02:54.520 --> 00:02:57.680
expertise. You need to understand, you know,
00:02:57.699 --> 00:03:00.039
what's out there from an enterprise all the way
00:03:00.039 --> 00:03:01.620
down level and what's being leveraged at these
00:03:01.620 --> 00:03:03.500
organizations from a systems and application
00:03:03.500 --> 00:03:06.180
standpoint. And that's inclusive of AI now, right?
00:03:06.319 --> 00:03:09.259
So that's why he's such a good guest on this
00:03:09.259 --> 00:03:12.639
podcast today to talk about these things. this
00:03:12.639 --> 00:03:14.539
stuck out to you brandon you saw these partnerships
00:03:14.539 --> 00:03:18.439
you saw these announcements um what's the big
00:03:18.439 --> 00:03:23.219
important signal here for you yeah uh i think
00:03:23.219 --> 00:03:25.099
the and i was just thrown off i think my clock
00:03:25.099 --> 00:03:26.900
just behind me just broke i don't know if you
00:03:26.900 --> 00:03:29.919
saw on the back of it the hand just fell and
00:03:29.919 --> 00:03:33.020
that's powered by ai not powered by ai exactly
00:03:33.020 --> 00:03:37.240
um so i i think the big signal is that we're
00:03:37.240 --> 00:03:41.740
we're seeing a massive shift in you know not
00:03:41.740 --> 00:03:46.699
only just tasks, but enterprise -wide infrastructure
00:03:46.699 --> 00:03:53.020
changes that used to be relied on by the traditional
00:03:53.020 --> 00:03:55.680
entry -level employees, but also the middle -level
00:03:55.680 --> 00:03:57.979
management, are being completely replaced by
00:03:57.979 --> 00:04:02.379
AI. I think that there's a massive shift coming
00:04:02.379 --> 00:04:06.180
through of seeing, especially for executives,
00:04:06.439 --> 00:04:08.759
looking at every single thing that's done in
00:04:08.759 --> 00:04:12.280
the organization. all delivery lines right of
00:04:12.280 --> 00:04:15.060
where can we start to eliminate positions and
00:04:15.060 --> 00:04:17.879
where can we replace that with you know a more
00:04:17.879 --> 00:04:20.939
automated tool or artificial intelligence that
00:04:20.939 --> 00:04:24.180
doesn't you know um that doesn't uh you know
00:04:24.180 --> 00:04:27.000
have issues right in that in that actual delivery
00:04:27.000 --> 00:04:30.759
of the process um i i think that there's of course
00:04:30.759 --> 00:04:33.339
still kinks to be worked out but i think that
00:04:33.339 --> 00:04:35.519
there's it's we're already seeing that shift
00:04:35.519 --> 00:04:39.069
um and we can talk about that service now You
00:04:39.069 --> 00:04:41.009
know, partnership that you mentioned that that
00:04:41.009 --> 00:04:44.089
came out in the beginning of last week. You know,
00:04:44.089 --> 00:04:47.370
some of these integral workflows are being already,
00:04:47.490 --> 00:04:51.170
you know, radically changed from AI that used
00:04:51.170 --> 00:04:54.990
to just be manually created. So even just down
00:04:54.990 --> 00:04:56.949
to like support tickets and change tickets. Right.
00:04:56.990 --> 00:05:02.069
So it's really interesting to see. Yeah. And
00:05:02.069 --> 00:05:07.819
so I guess for. For our listeners who tune into
00:05:07.819 --> 00:05:10.079
this podcast, they're probably saying, okay,
00:05:10.160 --> 00:05:12.839
yep, seen that, right? That's all in place. But
00:05:12.839 --> 00:05:17.660
what I'm here for is how does this shift change,
00:05:18.220 --> 00:05:21.259
right, risk and assurance conversations for organizations?
00:05:23.560 --> 00:05:27.800
Yeah, I think it opens Pandora's box for managing
00:05:27.800 --> 00:05:30.959
risk, right? When you're talking about, you know.
00:05:31.470 --> 00:05:34.649
Yeah, well, sorry to interrupt your talk track
00:05:34.649 --> 00:05:37.810
there. And I should let you finish that thought
00:05:37.810 --> 00:05:39.649
and you will finish that thought. But maybe when
00:05:39.649 --> 00:05:41.069
you do finish that thought, I'd be interested
00:05:41.069 --> 00:05:44.550
in, I think it does and doesn't at the same time,
00:05:44.550 --> 00:05:46.209
right? Because humans are some of the biggest
00:05:46.209 --> 00:05:48.990
risk factors within organizations. But sorry,
00:05:49.170 --> 00:05:51.509
go ahead. No, it's a great point. It's a great
00:05:51.509 --> 00:05:54.790
ad because it is. interesting to think about,
00:05:54.870 --> 00:05:57.589
you know, humans, what's the old saying, right?
00:05:57.649 --> 00:06:00.470
Humans are, you know, the weakest point of security,
00:06:00.709 --> 00:06:05.069
right? If there's an opportunity for a control
00:06:05.069 --> 00:06:07.629
to fail with a human intervention, it's probably
00:06:07.629 --> 00:06:10.470
going to fail at some point, right? So I think
00:06:10.470 --> 00:06:13.689
there is that factor. But when you're incorporating
00:06:13.689 --> 00:06:16.990
any new technology, not even AI, right? Just
00:06:16.990 --> 00:06:19.290
let's look at over the last few decades of...
00:06:19.480 --> 00:06:21.139
newer technologies that have been introduced
00:06:21.139 --> 00:06:23.699
there's new risks that are introduced however
00:06:23.699 --> 00:06:26.800
while new risks are introduced there are new
00:06:26.800 --> 00:06:29.319
pillars that can be achieved or new business
00:06:29.319 --> 00:06:31.759
opportunities that can be expanded into at a
00:06:31.759 --> 00:06:35.100
at a rapid rate and and with ai it's a force
00:06:35.100 --> 00:06:37.379
multiplier at this point right there there are
00:06:37.379 --> 00:06:39.699
new ventures that businesses can tap into new
00:06:39.699 --> 00:06:42.720
opportunities that businesses can tap into that
00:06:42.720 --> 00:06:45.819
have never been explored at this scale right
00:06:45.819 --> 00:06:48.560
we're not talking about 2x 3x we're talking about
00:06:48.959 --> 00:06:52.540
10x, 100x, 1000x productivity and opportunities
00:06:52.540 --> 00:06:55.879
from a business scale, reaching customers, reaching
00:06:55.879 --> 00:06:58.240
delivery timelines that have never been able
00:06:58.240 --> 00:07:00.920
to be achieved at rapid pace, right? There's
00:07:00.920 --> 00:07:03.879
so many things that have been unlocked now with
00:07:03.879 --> 00:07:07.279
AI. So I think there's kind of two paths, right?
00:07:07.339 --> 00:07:10.740
There's the There's the output and scale opportunities
00:07:10.740 --> 00:07:13.959
with AI, but then there are the risks, some mitigated
00:07:13.959 --> 00:07:16.300
that I mentioned, like even taking humans out
00:07:16.300 --> 00:07:18.860
of the equation that you brought up, I think.
00:07:18.959 --> 00:07:20.980
And then there's also introducing new risks of
00:07:20.980 --> 00:07:24.560
ensuring your data is locked down. If you're
00:07:24.560 --> 00:07:27.879
going out to the internet to have search capabilities
00:07:27.879 --> 00:07:31.220
and things like that, that your data is not exfiltrated
00:07:31.220 --> 00:07:36.000
out or sent out or you're only reaching out to...
00:07:36.730 --> 00:07:38.790
outside of the boundaries, but your data cannot
00:07:38.790 --> 00:07:41.370
get out of those boundaries, right? So kind of
00:07:41.370 --> 00:07:45.509
a one -directional process. I think that's a
00:07:45.509 --> 00:07:48.410
big factor that a lot of people forget when they're
00:07:48.410 --> 00:07:51.250
developing different sandboxes and things like
00:07:51.250 --> 00:07:54.949
that to ensure that the data cannot be exfiltrated
00:07:54.949 --> 00:07:59.129
out of that instance. So I think that's a big
00:07:59.129 --> 00:08:02.699
risk. I think when it comes to... deployments,
00:08:02.740 --> 00:08:05.699
right? Having something, I know we've touched
00:08:05.699 --> 00:08:08.319
on this a little bit in some of our other podcasts
00:08:08.319 --> 00:08:11.620
is the governance piece, right? Organizations
00:08:11.620 --> 00:08:14.019
need to get to a point now where you're assigning
00:08:14.019 --> 00:08:17.680
roles and departments to manage the new AI tools
00:08:17.680 --> 00:08:20.600
that are out there, which is kind of ironic because
00:08:20.600 --> 00:08:24.300
there's layoffs happening. However, with AI,
00:08:24.379 --> 00:08:26.839
they're introducing new opportunities, right?
00:08:26.899 --> 00:08:29.699
New roles that need to be established. I think
00:08:29.699 --> 00:08:32.700
some of the smaller organizations are using the
00:08:32.700 --> 00:08:36.700
network security teams or server security teams
00:08:36.700 --> 00:08:41.980
or even the CISO role to govern the process for
00:08:41.980 --> 00:08:43.740
AI. I think it varies based on organization.
00:08:44.120 --> 00:08:45.899
But it is something that you have to be thinking
00:08:45.899 --> 00:08:47.940
about of the governance perspective of that.
00:08:48.480 --> 00:08:54.320
Yeah. How are you and I guess I should say just
00:08:54.320 --> 00:08:57.340
you and how you manage the team, how are you
00:08:57.340 --> 00:08:59.940
keeping up? Right, with AI and just how quickly
00:08:59.940 --> 00:09:01.940
it's changing, how fast, how quick it's being
00:09:01.940 --> 00:09:04.519
adopted across so many organizations. I mean,
00:09:04.580 --> 00:09:06.440
year -over -year audits are not the same anymore,
00:09:06.539 --> 00:09:09.080
I would expect, for most of your organizations.
00:09:09.440 --> 00:09:15.139
So how is that factoring into how you look at
00:09:15.139 --> 00:09:18.740
the year, you look at the 100 -plus, maybe even
00:09:18.740 --> 00:09:21.740
close to 200 audits that we do a year as a business?
00:09:22.159 --> 00:09:26.080
Yeah. What are you anticipating and manage off
00:09:26.080 --> 00:09:30.539
of with your team? Well, I think if we're talking
00:09:30.539 --> 00:09:35.539
in an audit vacuum, if you will, or maybe let's
00:09:35.539 --> 00:09:37.259
just focus on the audit realm. Audit vacuum.
00:09:37.480 --> 00:09:43.740
Yeah, the audit vacuum. The process of moving
00:09:43.740 --> 00:09:48.159
away from the year -over -year audits is, as
00:09:48.159 --> 00:09:51.299
you mentioned, moving closer towards the security
00:09:51.299 --> 00:09:53.679
as a continuous process, the continuous compliance,
00:09:53.899 --> 00:09:57.070
the continuous orchestration. as organizations
00:09:57.070 --> 00:10:01.450
deploy these you know tools or even let's say
00:10:01.450 --> 00:10:05.889
just a basic llm right it will start to um radically
00:10:05.889 --> 00:10:08.330
shift the culture of the organization for us
00:10:08.330 --> 00:10:12.049
to move from uh you know oh this is a one -time
00:10:12.049 --> 00:10:13.870
thing this is a one -time audit this is a one
00:10:13.870 --> 00:10:16.779
-time process too constantly evolving, constantly
00:10:16.779 --> 00:10:20.360
shifting of understanding, okay, what is the
00:10:20.360 --> 00:10:21.940
data that we have out there? What needs to be
00:10:21.940 --> 00:10:23.600
harvested? What needs to be mined? What needs
00:10:23.600 --> 00:10:26.279
to be protected? So constant validation becomes
00:10:26.279 --> 00:10:28.059
more and more important. What needs to be re
00:10:28.059 --> 00:10:30.519
-audited, exactly. And then you can look at it
00:10:30.519 --> 00:10:32.500
from a controls perspective, what needs to be
00:10:32.500 --> 00:10:37.539
continuously developed or refined, right? And
00:10:37.539 --> 00:10:40.720
I think the LLMs are... actually pretty good
00:10:40.720 --> 00:10:43.240
at that when it comes to you know incorporating
00:10:43.240 --> 00:10:45.279
it just depends on the security and how close
00:10:45.279 --> 00:10:47.639
you want it to get to your data right so so your
00:10:47.639 --> 00:10:51.700
audits maybe might still be at least they haven't
00:10:51.700 --> 00:10:54.879
shifted totally in that you know they still might
00:10:54.879 --> 00:10:58.279
be a one -time like audit point in a year but
00:10:58.279 --> 00:11:00.580
more of the controls more of what you're evaluating
00:11:00.580 --> 00:11:02.620
more of what you're even recommending for subsequent
00:11:02.620 --> 00:11:06.100
years is that continuous monitoring some sort
00:11:06.100 --> 00:11:08.100
of continuous checks need to start to take place
00:11:08.730 --> 00:11:11.490
no doubt no doubt and a lot of the security tools
00:11:11.490 --> 00:11:14.009
that are purchased on even whether they're off
00:11:14.009 --> 00:11:17.210
the shelf or custom a lot of them have uh you
00:11:17.210 --> 00:11:21.470
know ai modules built in who you know some organizations
00:11:21.470 --> 00:11:23.490
devil is what they're using on the back end a
00:11:23.490 --> 00:11:25.570
lot of them are just lms but a lot of them are
00:11:25.570 --> 00:11:29.570
are more in -depth um you know true agent -based
00:11:29.570 --> 00:11:33.269
um taking workflows to a new level right um so
00:11:33.269 --> 00:11:36.990
i think uh when it comes to control development
00:11:36.990 --> 00:11:40.250
control refinement we're going to see that that
00:11:40.250 --> 00:11:43.110
more continuous process that it's not the oh
00:11:43.110 --> 00:11:45.750
it's time to review our processes it's the beginning
00:11:45.750 --> 00:11:48.149
of the year or it's the middle of the year right
00:11:48.149 --> 00:11:51.970
we're we're now shifting to continuously updating
00:11:51.970 --> 00:11:54.049
those and then continuously ensuring that they're
00:11:54.049 --> 00:11:56.419
up to date which i think from a security perspective
00:11:56.419 --> 00:11:59.820
significantly improves the posture of the organization
00:11:59.820 --> 00:12:03.700
increases the maturity level of of you know the
00:12:03.700 --> 00:12:05.960
security realm if you will or the security department
00:12:05.960 --> 00:12:08.120
whatever the size of the organization is i think
00:12:08.120 --> 00:12:10.960
when it comes to control you know validation
00:12:10.960 --> 00:12:13.960
it's it's if it's always up to date the audit
00:12:13.960 --> 00:12:17.019
is not a big deal right when it comes i think
00:12:17.019 --> 00:12:19.600
where a lot of organizations struggle is if they
00:12:19.600 --> 00:12:22.480
have a one -time process for managing their program
00:12:22.480 --> 00:12:25.419
or checking their program, right, ensuring their
00:12:25.419 --> 00:12:28.039
controls are relevant, they're up to date. If
00:12:28.039 --> 00:12:30.919
you only have that one time, then you end up
00:12:30.919 --> 00:12:33.559
having stale processes for when the audit rolls
00:12:33.559 --> 00:12:36.360
around, you're having to talk with the team of,
00:12:36.399 --> 00:12:38.559
oh, wait, wait, who manages that? Who's handling
00:12:38.559 --> 00:12:40.980
that, right? What's still, what's out of date?
00:12:41.019 --> 00:12:42.840
That's out of date, right? What's been patched
00:12:42.840 --> 00:12:45.159
or what scans haven't been run, right? All of
00:12:45.159 --> 00:12:48.539
these things. But if you have, you know, AI modules
00:12:48.539 --> 00:12:50.960
built into your security program that are constantly
00:12:50.960 --> 00:12:53.100
checking your control, checking your processes,
00:12:53.299 --> 00:12:56.500
doing recurring tasks for you, right? And I think
00:12:56.500 --> 00:12:58.059
we're moving more into the agent side of the
00:12:58.059 --> 00:13:00.700
house. But having, you know, having some of those
00:13:00.700 --> 00:13:03.399
workflows built out, even having agents run recurring
00:13:03.399 --> 00:13:06.700
tasks for you within your security program that
00:13:06.700 --> 00:13:09.480
used to be security professionals doing for you
00:13:09.480 --> 00:13:12.440
that now can be replaced with AI, I think that
00:13:12.440 --> 00:13:14.299
makes the audit process a lot smoother. Wouldn't
00:13:14.299 --> 00:13:19.090
you agree? Yeah. Well, so let's see if we can
00:13:19.090 --> 00:13:24.870
segue this into 42 ,001 then. Do you feel that
00:13:24.870 --> 00:13:27.730
it calls for more given the nature of it and
00:13:27.730 --> 00:13:31.350
what it's certifying, continuous nature? I mean,
00:13:31.389 --> 00:13:34.269
ISO in general is about auditing a management
00:13:34.269 --> 00:13:38.190
system, not necessarily the ARI. So I guess maybe
00:13:38.190 --> 00:13:39.809
I'm answering my own questions there, but maybe
00:13:39.809 --> 00:13:43.490
you could allude to a little bit how 42 ,001
00:13:43.490 --> 00:13:46.220
is still relevant. It is. With the scenarios
00:13:46.220 --> 00:13:47.879
we're talking about where we're seeing more and
00:13:47.879 --> 00:13:52.379
more wide AI adoption and that maybe the models
00:13:52.379 --> 00:13:54.399
are already certified, but the organizations,
00:13:54.600 --> 00:13:58.299
is it relevant for them to get an AI or 42 ,001
00:13:58.299 --> 00:14:00.340
certification based on how they're leveraging
00:14:00.340 --> 00:14:04.690
it? I would argue that. As adoption for AI increases,
00:14:04.970 --> 00:14:09.470
the necessity for ISO 42001 also increases. Because,
00:14:09.490 --> 00:14:12.370
again, this is a governance framework. It's built
00:14:12.370 --> 00:14:15.649
on the process of as you are developing an AI
00:14:15.649 --> 00:14:18.409
management system on top of your information
00:14:18.409 --> 00:14:20.649
security management system, right, that there
00:14:20.649 --> 00:14:23.669
are attributes, there are controls, there are
00:14:23.669 --> 00:14:26.309
relevant requirements that you need to be thinking
00:14:26.309 --> 00:14:28.269
about when it comes to the boundaries of your
00:14:28.269 --> 00:14:31.929
AI management system that ISO 42001 touches.
00:14:32.590 --> 00:14:35.009
The biggest risk, we've been talking about risk,
00:14:35.149 --> 00:14:38.009
right? The biggest risk for AI adoption is not
00:14:38.009 --> 00:14:40.350
the speed. I think many people think the biggest
00:14:40.350 --> 00:14:43.909
risk is speed. I don't think it's speed. It's
00:14:43.909 --> 00:14:47.210
the lack of awareness of the governance requirements
00:14:47.210 --> 00:14:49.629
that you need to be thinking about when it comes
00:14:49.629 --> 00:14:53.309
to your tool deployment, right? So that starts
00:14:53.309 --> 00:14:55.529
from the build process. If you're building agents,
00:14:55.690 --> 00:14:57.970
if you're building workflows, be thinking about
00:14:57.970 --> 00:15:00.389
the security aspects and the governance elements
00:15:00.389 --> 00:15:03.299
that need to be incorporated. into the development
00:15:03.299 --> 00:15:06.220
of that AI management system, right? When it
00:15:06.220 --> 00:15:07.919
comes to any technology, right? We were talking
00:15:07.919 --> 00:15:09.960
earlier about other, you know, earlier times
00:15:09.960 --> 00:15:13.259
of technology deployment, right? Even the 2000s,
00:15:13.259 --> 00:15:16.539
the 2010s, any technology deployment, you wanted
00:15:16.539 --> 00:15:20.320
to incorporate security and compliance into the
00:15:20.320 --> 00:15:22.799
development, into the SDLC lifecycle, into the
00:15:22.799 --> 00:15:25.419
deployment process, into all of that, you know,
00:15:25.419 --> 00:15:28.980
the A to Z, the soup to nuts process of deploying
00:15:28.980 --> 00:15:32.529
a new service or a new tool. That has not changed
00:15:32.529 --> 00:15:34.690
with AI, right? I think it's just been enhanced
00:15:34.690 --> 00:15:38.830
to a greater level. And there's more things to
00:15:38.830 --> 00:15:41.090
think about, right, when it comes to that build
00:15:41.090 --> 00:15:44.710
process or the deployment process of that tool.
00:15:45.350 --> 00:15:48.129
That's a great analogy. I was thinking exactly
00:15:48.129 --> 00:15:49.470
what you're talking about, the sales development
00:15:49.470 --> 00:15:51.690
lifecycle and having some of that built -in security.
00:15:51.990 --> 00:15:54.889
And so I think I like how you put that. It's
00:15:54.889 --> 00:15:57.830
not the speed. It's the lack of governance, right?
00:15:57.950 --> 00:16:00.529
And the security mindset as you're building out
00:16:00.529 --> 00:16:02.429
or adopting or creating these agents or doing
00:16:02.429 --> 00:16:05.370
whatever you're doing with the AI. But I still
00:16:05.370 --> 00:16:07.909
think there's perhaps still a gap there. And
00:16:07.909 --> 00:16:12.330
it's like, well, who knows how to do that? Right?
00:16:12.690 --> 00:16:18.029
You might. If I'm building an agent for the sales
00:16:18.029 --> 00:16:23.269
compliance point, I could absolutely build something
00:16:23.269 --> 00:16:25.350
that's maybe... not secure because i don't know
00:16:25.350 --> 00:16:27.330
so i guess a big component there is education
00:16:27.330 --> 00:16:30.250
and training and if you're an organization that
00:16:30.250 --> 00:16:35.629
wants to adopt it take the added step of getting
00:16:35.629 --> 00:16:40.470
some sort of education a training awareness on
00:16:40.470 --> 00:16:43.710
how to input or incorporate security into the
00:16:43.710 --> 00:16:47.250
build out yes that's a great point the the education
00:16:47.250 --> 00:16:50.850
and the training is fundamental right and When
00:16:50.850 --> 00:16:53.169
it comes to any technology, you want the technology
00:16:53.169 --> 00:16:55.750
to empower the process or to enhance the process.
00:16:55.809 --> 00:16:57.970
When you're developing a process, right, you
00:16:57.970 --> 00:17:00.710
want training and education to be incorporated
00:17:00.710 --> 00:17:03.700
directly in that. before you get to the deployment
00:17:03.700 --> 00:17:05.319
process, right? So let's say you're doing user
00:17:05.319 --> 00:17:07.460
testing or let's say you're doing a pilot testing.
00:17:07.579 --> 00:17:11.039
You want to start educating the necessary individuals
00:17:11.039 --> 00:17:13.819
that are going to be both using the tool and
00:17:13.819 --> 00:17:16.240
managing the tool. And this applies to anything,
00:17:16.440 --> 00:17:18.700
right? Not just AI. This applies to any tool
00:17:18.700 --> 00:17:21.440
deployments, right? When you're looking at secure
00:17:21.440 --> 00:17:23.920
development and security focused development
00:17:23.920 --> 00:17:26.480
of any tool, right? You want to incorporate the
00:17:26.480 --> 00:17:28.940
users and the administrators or the people that
00:17:28.940 --> 00:17:31.400
are managing the tool. right there from the get
00:17:31.400 --> 00:17:33.119
-go, right from the beginning, so that they are
00:17:33.119 --> 00:17:36.579
aware of the tool's capabilities, but also the
00:17:36.579 --> 00:17:38.900
kicker, the guardrails. And we're talking about
00:17:38.900 --> 00:17:41.799
risks. The guardrails are just as important,
00:17:41.920 --> 00:17:43.599
if not more important, than the capabilities
00:17:43.599 --> 00:17:46.420
of the tool. Because when you're talking about
00:17:46.420 --> 00:17:48.480
data security, data protection, and a lot of
00:17:48.480 --> 00:17:51.839
these governance elements that ISO 40001 focuses
00:17:51.839 --> 00:17:55.509
on, the guardrails are... critical, right? You
00:17:55.509 --> 00:17:57.869
have to ensure that your data is protected. And
00:17:57.869 --> 00:17:59.849
that all starts with the guardrails that you
00:17:59.849 --> 00:18:02.569
develop within the tool, because it's great if
00:18:02.569 --> 00:18:04.170
you have all these capabilities with a tool,
00:18:04.190 --> 00:18:06.869
but once your data is leaked out, that puts all
00:18:06.869 --> 00:18:11.269
of that to shame. Yeah. Well said. I think that's
00:18:11.269 --> 00:18:14.210
a good point to end, unless you got anything
00:18:14.210 --> 00:18:18.930
else you want to add. No, I think just to go
00:18:18.930 --> 00:18:21.470
back to your first comment, as I think about
00:18:21.470 --> 00:18:25.069
some of these layoffs, UPS, Amazon, some of these
00:18:25.069 --> 00:18:28.009
other ones that are out there, it really is interesting
00:18:28.009 --> 00:18:32.369
to see how the landscape is changing. And I think
00:18:32.369 --> 00:18:38.069
to the society at large, to those that are charged
00:18:38.069 --> 00:18:41.269
with governance right now, I would say be careful
00:18:41.269 --> 00:18:46.640
with not the speed, but again, the... guardrails
00:18:46.640 --> 00:18:49.259
that you're putting in, the risks that you are
00:18:49.259 --> 00:18:52.200
developing your tool with, right, that need to
00:18:52.200 --> 00:18:54.920
be thought about. So just when you're developing
00:18:54.920 --> 00:18:58.299
a new tool, if you're thinking about using a
00:18:58.299 --> 00:19:02.180
new AI model or developing a new AI model, be
00:19:02.180 --> 00:19:04.920
careful of the risks. The capabilities are there.
00:19:05.000 --> 00:19:08.250
We know that, right? Be cognizant of some of
00:19:08.250 --> 00:19:10.769
these requirements, whether it's an ISO 42001
00:19:10.769 --> 00:19:12.829
or some of these other frameworks that are out
00:19:12.829 --> 00:19:15.490
there, right, that are continuing to come out
00:19:15.490 --> 00:19:17.210
in the marketplace. I know there's, you know,
00:19:17.230 --> 00:19:20.250
the NIST AI RMF. If you're doing HITRUST, there's
00:19:20.250 --> 00:19:22.069
HITRUST AI controls. There's so many out there
00:19:22.069 --> 00:19:25.390
now that are relevant to your organization. But
00:19:25.390 --> 00:19:28.529
just, you know, be cognizant of what needs to
00:19:28.529 --> 00:19:32.049
be, you know, considered when you're deploying
00:19:32.049 --> 00:19:36.039
a new tool. Yeah. That's great. This has been
00:19:36.039 --> 00:19:38.819
really good. I think listeners are going to get
00:19:38.819 --> 00:19:42.819
a lot out of it. I would say if they're seeking
00:19:42.819 --> 00:19:45.220
those things, education, consultant, advisory
00:19:45.220 --> 00:19:47.599
on how to build that security from the get -go
00:19:47.599 --> 00:19:51.359
or how to ready for an audit against ISO, for
00:19:51.359 --> 00:19:55.900
instance, 42001, to get a management system in
00:19:55.900 --> 00:19:58.380
place and then ultimately certified, please don't
00:19:58.380 --> 00:20:01.190
hesitate to reach out. The easiest place to find
00:20:01.190 --> 00:20:03.750
us is compliancepoint .com. There's an email
00:20:03.750 --> 00:20:07.170
distro that should be easy to spot on there,
00:20:07.289 --> 00:20:09.910
but if you can't for some reason, it's connect
00:20:09.910 --> 00:20:12.529
at compliancepoint .com. You can email into that,
00:20:12.549 --> 00:20:17.089
and that's monitored pretty much all business
00:20:17.089 --> 00:20:22.130
hours of the day. Yeah, you send an email into
00:20:22.130 --> 00:20:24.329
that. You'll hear from us usually within five
00:20:24.329 --> 00:20:27.609
minutes, and hopefully we can provide some value
00:20:27.609 --> 00:20:30.490
for you. Brandon, thanks. I'm sure I'll be talking
00:20:30.490 --> 00:20:33.170
to you again on this podcast and all our listeners
00:20:33.170 --> 00:20:35.690
and viewers. Be well. Yeah, I appreciate you
00:20:35.690 --> 00:20:37.069
having me on, Jordan. Thanks again.