Walter Haydock: Welcome to the Deploy Securely Podcast, where we go deep on the cybersecurity, privacy, and compliance implications of using artificial intelligence. Today I'm joined by Dan Van Beek, who's responsible for governance, risk, and compliance and market access. Dan, thank you for joining us.
Dan VanBeek: Thanks for having me, Walter.
Walter Haydock: To begin with, can you say a little bit more about market access?
Dan VanBeek: Sure. So yeah, market access is a fintech company focused primarily on electronic bond trading. we provide technology trading solutions that connect institutional participants and really help make those markets more efficient. I work on the security side of the organization, so obviously I tend to look at that mission through the lens of trust and resilience and you know, making sure we can adopt technology responsibly.
Walter Haydock: Awesome. Awesome. Can you drill down into your specific responsibilities as it relates to GRC and security?
Dan VanBeek: Yeah, sure. So like you mentioned, I lead governance, risk, and compliance within our information security team. my responsibility is really span security governance and risk management, regulatory and security compliance, third-party risk management from cyber lens, client assurance, security awareness training. So all those related areas. a big part about how I try to approach the role is really turning governance into repeatable systems instead of just a series of manual reviews. You know, if we're solving the same problem repeatedly, I really want to understand how we can standardize it, automate the parts that make sense, and then, you know, spend our time on decisions that actually require judgment.
Walter Haydock: Definitely want to solve it once and then use it forever. I'm I'm a big fan of that approach.
Dan VanBeek: Absolutely.
Walter Haydock: On that on that note, can you talk about how AI is helping market access, how you're using it at the company?
Dan VanBeek: Yeah, sure. So a lot of the ways that we think about it kind of depends on the category that the AI is in. So we we talk about the categories a lot. you know, just like a lot of organizations, we're dealing with AI coming from a bunch of different directions. It could be functionality in third-party products, AI tools that employees want to use, internally developed AI capabilities, or, you know, potentially AI incorporated into our products and services. So from a governance perspective, that really means AI isn't one technology initiative owned by any one team. It's it's a capability that is appearing throughout the technology environment. So it's it's really all over the place.
Walter Haydock: Very common story for a lot of enterprises today. So with that development and with the spread of AI throughout the organization, can you talk about some of the challenges in governing it in terms of the processes you had in place?
Dan VanBeek: Yeah, so you know, a lot of the s existing security processes that we've done for years now, they're designed around fairly well understood categories. You know, is it a new vendor? Is it a new application? Is somebody requesting access to data? AI cuts across all those boundaries now. you can have a vendor that we've already approved, add new AI functionality. an existing AI application that you maybe already approved suddenly introduces a new model or a feature. employees can build something without going through a traditional SDLC process. and you know, two systems can say they're both using AI, but you know, they've got completely different risk profiles. So the challenge became less about creating just you know another questionnaire that seven different people have to answer, and more about figuring out how AI governance really fits into the processes we already have.
Walter Haydock: And you talked about a lot of different pathways and ways to deploy artificial intelligence combined with no code, low-code development platforms, vibe-coded things, maybe. You didn't say that, but you know, potentially something that
Dan VanBeek: I've done it.
Walter Haydock: you might experience. So how did this complexity impact the problem in managing AI? And how did you think about it?
Dan VanBeek: Yeah, so I think we we finally got to the point where we can't assume that there's going to be one intake path or control set that works for all these different pieces. you know, third party AI could still come through our our traditional TPRM process, but it raises questions about vendor assurance, contractual responsibilities, data handling, what the vendor can actually demonstrate related to the AI piece. and then, you know, internally developed AI, you know, we can we can have more direct control over it, but we also have more responsibility for the life cycles. So some of those processes need to change. Citizen development AI, you know, using Copilot, using any of the other harnesses, that creates discovery and ownership challenges because it can be so quick to get something out. And then you know developing in our product introduces a whole different set of considerations entirely. So what we needed was a common governance model around all of those, not necessarily one bespoke process that fits all of them. that's close to what we got, but really it was the governance model that backed that up that could recognize all those differences without creating four or more completely independent governance programs.
Walter Haydock: Yeah, you definitely don't want four four four different policies and four different ways of doing business. It's not necessarily better than one. So less is less is more when it comes to governance sometimes. In terms of the top three challenges that you saw from a security and responsible AI perspective, can you enumerate those and tell me how you think about them?
Dan VanBeek: Yeah, so the first one is almost always data. what the information what what information the system can access, where that information goes, who can see it once it's once it's being used and and used in content and output, how it's used, and then whether the boundaries are actually understood. we're a global organization, most organizations are nowadays, and where that data goes, what information is being used is is always going to be one of the Top three concerns and it's the first one that comes to mind. I'd say second after that is is authority and in some ways autonomy. what the AI can actually do. very different risk profile between something that summarizes information and something that goes and takes an action. Doesn't matter what system it's in, could be taking an action in, you know, Google workspace and building something for you, or it could be touching your firewall and making a rule change for you. Either way, that authority and that autonomy. It's it's it's affecting business processes at the end of the day. So those are always going to be a security concern. And then third, it's it's probably change over time. you can do an assessment on day one, you can do assessment at year one, which a lot of us do regularly when we're doing application risk profiles. But in between that time, if you get to that second one, models change, vendors change, functionality, permissions expand, people find new use cases for the same tool. you know, agentic capabilities have new dependencies, whatever, whatever it may be. The governance process really has to deal with what happens after that initial approval. And I don't I'm not even talking about drift of what happens when the actual AI output starts drifting depending on what you're using it for. we we have to have a governance process that deals with that and and the data and the authority piece of it as well.
Walter Haydock: On the change over time side of things, you've got the plan changes, the new model releases, the new vendor capabilities. But then you have, like you said, the the drift. There's compliance drift over time. Documents kind of start making references that don't necessarily make sense anymore. People start forgetting how they're supposed to be doing things. And then the systems themselves might drift. You know, you might have a capability that works one day and then the next day it's returning you know, out of out of bounds responses. So Definitely a a big problem all around. In terms of your AI risk posture and how you viewed it at market access, you know, if you didn't do anything to tackle it, you just followed the same business as usual approach, how about it impact things from an organizational perspective?
Dan VanBeek: Yeah, you would end up with probably one or two, at least one of two bad outcomes. either the organization is implicitly accepting risk that it doesn't really understand because your governance can't keep up, or governance becomes the bottleneck and slows down legitimate adoption of of good tools, useful tools, things that the organization needs. And you know, on that first point of the accepting risk. That's that's not just putting it in your risk register and saying that this was implicitly accepted, even if you got that far. You would most likely get that voiced on you by some regulator globally. They would come back and say, no, but you didn't do anything, and that's worse. You guys accepted the risk. You could have done something, you should have done something, and because you didn't, you accepted the risk implicitly, and that's not okay. you know, neither of those really is a good security outcome. whether you're accepting the risk because you can't keep up or that you're being bottlenecked and slowing everything down. you know, we needed to be able to distinguish quickly and, you know, rel in a relatively straightforward way if what is in front of us needed a deeper review or stronger controls or a different decision. And that's that's the path we went down is that this is coming at us. We we need a process that is going to do this quickly enough for us in the right way and make sure that we don't end up with one of those two bad outcomes.
Walter Haydock: Yeah, it's kind of a Scylla and Charybdis to use an Odyssey reference. You're you're stuck between two different bad options and you gotta go straight and narrow down the middle. So definitely understand that. As far as the stack aware engagement, I think that's a good segue to talk about it. Were there things that we surfaced that gave you some visibility or highlighted some issues that you hadn't seen previously? Can you talk more about the initial diagnostic?
Dan VanBeek: Yeah, let's see. Really a lot of the value that we got out of it and that you helped surface throughout was was finding a way to help us see all the pieces coming together as a system. I I think I mentioned earlier all the pieces that can go into a process like this and the reiterating that they all need to work together, that you know, security, vendor risk, development, governance processes, the the entire risk process in general, not just the vendor part of it. they they really have to work together for this because it's much different than just doing a cyber risk evaluation on a new vendor or an internal application. and you you helped us just see that the the harder question was really how should AI move through all of those teams, all those systems without creating gaps or unnecessary duplication in the process. So, you know, really honestly having someone come in with an outside perspective, someone who's seen it done before at different organizations and in different ways. you know really challenged a lot of the assumptions that we had about where information should be collected, it who really needed to see that information and where those decisions should happen. That was that was probably some of the biggest value that I we got out of it.
Walter Haydock: Awesome. Awesome. So in terms of the other valuable things that you found, can you tell me the top one or two that you that you thought from from our work together?
Dan VanBeek: Yeah, I I mean, I don't know if it's an other or if it's just the rest of the story, but helping us turn, you know, a super broad AI risk problem into a more structured lifecycle. we we were all, and I say we as all the different risk partner teams, we're looking at it from the lens we are most comfortable with naturally. and there is always ways to go farther down one path, farther down a security path, farther down a technology path. than we potentially needed to. So coming together and seeing it as a structured life cycle was was a big benefit. And the other piece was honestly the practical implementation work. Easy to produce a framework that looks good on paper or hell have one of the AI tools do it for you. But the useful question is really what happens when somebody actually wants to use AI on Monday morning? Where do they go? What information do they need? What information do we need about what they want to use? who needs to review it, what needs to happen next? getting to that level of detail in the implementation side of things was really
Walter Haydock: Awesome. Awesome. Good to hear that. And can you talk about the business impact of those things? Materializing, getting help with them.
Dan VanBeek: Yeah. I mean it we talked about it early on, even even before we got too involved that the outcome that we're aiming for with an AI governance problem program is less friction. You know, we we want lower risk activity to not have to go through a super long process just because it says AI in the title. we wanna put our attention to where the risk actually warrants our attention. And there's also a consistency benefit to that too. You know, a business owner, somebody who wants to use a new AI tool, they shouldn't get a completely different answer depending on if they went to security first or risk first or legal first. they they need to have the same response from the process, the program. and when we do require something from that business owner, we should be able to explain why we need more information from them about their system, why we think it is higher risk than something that was lower risk that got approved faster. all of that's better for the business and honestly better for the governance team too, trying to work together.
Walter Haydock: I think that goes back to what we were talking about earlier, where you don't want to have four governance or intake processes with different organizations because you'll get different outputs and you'll have people gaming the systems saying, okay, well, I think this team will be a little easier on the review than that team and I'll go with them. And then you kinda turn the whole process on its head. So I definitely, definitely hear you there. In terms of the personal impact for you, can you talk about, you know, what this did in terms of the research you had to do, the one-off decision making, the ability to structure the process.
Dan VanBeek: Yeah. So I mean it definitely was a a learning experience going through all this, seeing the different requirements from a global standpoint, understanding what is potentially coming down the pipe in different industries, different regulators and and globally, since we are a globally regulated company. So having that insight and being able to get that as basically a regular feed from you and your services. that was simply a great learning opportunity. and from there, you know, the partnership working together, understanding what the business process needs to be to make the business more efficient. it was it was super awesome. So you know we're moving towards that. we're we're still working on the implementation on our side, making sure that we're doing it the best way that works for us. But you know what we really didn't want was every AI request to land with my team or somebody else's team and require us to research the technology, interpret the requirements, have to go figure it all out every single time something comes up. and you know, we really constructed that governance process in a way that made us not have to reconstruct it every single time, which often happens with something like this. So yeah, the more that knowledge that you know we can put into the process, the more my role, the risk partners' role, the AI governance team's role can shift towards exceptions and genuinely managing actual difficult risk decisions that impact the business, you know, instead of operating every single decision personally. so you know, there's there's a lot of benefits there.
Walter Haydock: Awesome. So if another security or risk leader told you that he or she could figure out AI governance themselves, what would you tell them in response to that statement?
Dan VanBeek: On what part of the dinner we're at. I'd I'd probably say that we can, and that they can figure it out themselves. I I don't think AI governance requires some secret knowledge that only consultants have, no offense, Walter. but there's definitely a difference in figuring out the requirements and building something that actually works inside your organization. whether you've been in an organization forever or you're new there and you want to make some big changes, you've got to connect. Policy, risks, security, privacy, third-party risk management, development processes, if you're putting it in your software, what your inventory is gonna be if you even have a asset inventory in the first place, evidence, approvals, you know, whatever else already exists. You're connecting all of that. And you have to do it while the technology and the requirements are still changing. there's there's new regulations coming out every day, there's new harnesses popping up. There's, you know, we were talking about MCP at one point, now everybody's talking to GenTic, and who knows what we're gonna be talking about three months from now. that's where the outside help is is really valuable. is somebody who can challenge our assumptions, be the expert in the room, since most of us aren't coming into this as AI governance experts, let alone AI experts, and you know, bringing the experience from other environments too, other peer organizations and you know, your former customers, your current customers that have done this, and work through the implementation details with us. that really shortened the learning curve and it's gonna shorten the learning curve for anybody. So and on the on the same note, I also wouldn't outsource ownership of the program. There's gonna be plenty of people that think they can do that too. at the end of the engagement, your organization still's gotta understand the decisions. They've gotta operate the process and they've gotta, you know, evolve it as the technology changes. So you know, can they figure out governance themselves? Sure. Are they gonna change it seventeen ways to Sunday between now and, you know, a year, two years, three years from now? They absolutely will. And they'll probably get it wrong a bunch along the way. It takes forever to do.
Walter Haydock: I think that's some some well well taken advice there and appreci appreciate that. In terms of, you know, you you've been you've been posting a fair amount on AI governance and security on LinkedIn and really appreciate the contributions to the community. Want to see if there's anywhere that you want to point folks, you know, blog, your LinkedIn profile, any any cool deliverables or or things like that where you'd like to get input or or people to check out.
Dan VanBeek: Yeah, sure. I mean, I appreciate the shout out. one of the things I've been playing around recently is what I'm I'm just calling a control plane at this point. and really I'm not I'm not doing it to try to push a product or go anywhere with it. It's more to try to figure out how much of this we can automate in an open way because a lot of things with GRC, especially you know, GRC engineering in general, we're we're building bespoke processes and automating them because it's it's very key to our company, but there's a lot of learnings a lot of things that can be reused across the industry, across our peer groups. And so for me, it's more of, you know, what's a what's a framework that allows us to do this in a standard way? And you know, a control framework is one of the ways it'd be great if we could all agree on controls that apply to everybody. ISO 42001 is a great start. I think AI UC is looking at stuff. Agent Baseline is doing things. it's all great. We're all going to come together at some point, be a nice big happy family. but How can we make those implement quicker in our environment? And that's kind of what I'm exploring with control plane. And really, you know, in simplest terms, it's it's kind of a risk decision engine. And it takes whatever framework you want, whatever controls you want, and then you can query against what you know about an individual AI system and say if you know if it's just a chat bot, it does this, that, and the other, what kind of controls should I put in place? And it goes through a risk engine and decision making process to say you should probably definitely need to do this. And then maybe you should ask these other questions about the system. And then you can I mean that's that's where it stops right now. and then where it goes from there is is how you you keep that flowing long term, how you measure drift potentially, how you reassess systems against you know control effectiveness for one, but also any new controls that come in place, and help you create that inventory. of systems that you likely need internally. that's that's kind of where I'm going with it. It's it's not meant to be you know, an enterprise tool. It's not meant to replace the services that any consultant like yourself offers because you do a a much better job with much more bro wider range of things than I do. but to me it's it's just that, you know, how how can we think about this in a different way and how can we share this across the the industry so that we can kind of coalesce what AI governance really is. So yeah, kinda went on a soapbox there. But that's what I've been working on recently. So a nice little pet project that I've been thinking about.
Walter Haydock: Awesome. Well, I I gave you the soapbox, so I'm happy that you that you took advantage of it. And yeah, I I appreciate you coming on the show. And anything else to share with our audience before we leave? Or should we wrap it up?
Dan VanBeek: No, I think we should wrap it up. This was awesome, Walter. Thank you very much. And you know, looking forward to continue working with you and all the services that you've been giving us so far.
Walter Haydock: Awesome. Well, Dan, thank you very much for your time and to our audience. This has been the Deploy Scurly Podcast. We'll see you next time.
Dan VanBeek: Thanks for having me, Walter.
Walter Haydock: To begin with, can you say a little bit more about market access?
Dan VanBeek: Sure. So yeah, market access is a fintech company focused primarily on electronic bond trading. we provide technology trading solutions that connect institutional participants and really help make those markets more efficient. I work on the security side of the organization, so obviously I tend to look at that mission through the lens of trust and resilience and you know, making sure we can adopt technology responsibly.
Walter Haydock: Awesome. Awesome. Can you drill down into your specific responsibilities as it relates to GRC and security?
Dan VanBeek: Yeah, sure. So like you mentioned, I lead governance, risk, and compliance within our information security team. my responsibility is really span security governance and risk management, regulatory and security compliance, third-party risk management from cyber lens, client assurance, security awareness training. So all those related areas. a big part about how I try to approach the role is really turning governance into repeatable systems instead of just a series of manual reviews. You know, if we're solving the same problem repeatedly, I really want to understand how we can standardize it, automate the parts that make sense, and then, you know, spend our time on decisions that actually require judgment.
Walter Haydock: Definitely want to solve it once and then use it forever. I'm I'm a big fan of that approach.
Dan VanBeek: Absolutely.
Walter Haydock: On that on that note, can you talk about how AI is helping market access, how you're using it at the company?
Dan VanBeek: Yeah, sure. So a lot of the ways that we think about it kind of depends on the category that the AI is in. So we we talk about the categories a lot. you know, just like a lot of organizations, we're dealing with AI coming from a bunch of different directions. It could be functionality in third-party products, AI tools that employees want to use, internally developed AI capabilities, or, you know, potentially AI incorporated into our products and services. So from a governance perspective, that really means AI isn't one technology initiative owned by any one team. It's it's a capability that is appearing throughout the technology environment. So it's it's really all over the place.
Walter Haydock: Very common story for a lot of enterprises today. So with that development and with the spread of AI throughout the organization, can you talk about some of the challenges in governing it in terms of the processes you had in place?
Dan VanBeek: Yeah, so you know, a lot of the s existing security processes that we've done for years now, they're designed around fairly well understood categories. You know, is it a new vendor? Is it a new application? Is somebody requesting access to data? AI cuts across all those boundaries now. you can have a vendor that we've already approved, add new AI functionality. an existing AI application that you maybe already approved suddenly introduces a new model or a feature. employees can build something without going through a traditional SDLC process. and you know, two systems can say they're both using AI, but you know, they've got completely different risk profiles. So the challenge became less about creating just you know another questionnaire that seven different people have to answer, and more about figuring out how AI governance really fits into the processes we already have.
Walter Haydock: And you talked about a lot of different pathways and ways to deploy artificial intelligence combined with no code, low-code development platforms, vibe-coded things, maybe. You didn't say that, but you know, potentially something that
Dan VanBeek: I've done it.
Walter Haydock: you might experience. So how did this complexity impact the problem in managing AI? And how did you think about it?
Dan VanBeek: Yeah, so I think we we finally got to the point where we can't assume that there's going to be one intake path or control set that works for all these different pieces. you know, third party AI could still come through our our traditional TPRM process, but it raises questions about vendor assurance, contractual responsibilities, data handling, what the vendor can actually demonstrate related to the AI piece. and then, you know, internally developed AI, you know, we can we can have more direct control over it, but we also have more responsibility for the life cycles. So some of those processes need to change. Citizen development AI, you know, using Copilot, using any of the other harnesses, that creates discovery and ownership challenges because it can be so quick to get something out. And then you know developing in our product introduces a whole different set of considerations entirely. So what we needed was a common governance model around all of those, not necessarily one bespoke process that fits all of them. that's close to what we got, but really it was the governance model that backed that up that could recognize all those differences without creating four or more completely independent governance programs.
Walter Haydock: Yeah, you definitely don't want four four four different policies and four different ways of doing business. It's not necessarily better than one. So less is less is more when it comes to governance sometimes. In terms of the top three challenges that you saw from a security and responsible AI perspective, can you enumerate those and tell me how you think about them?
Dan VanBeek: Yeah, so the first one is almost always data. what the information what what information the system can access, where that information goes, who can see it once it's once it's being used and and used in content and output, how it's used, and then whether the boundaries are actually understood. we're a global organization, most organizations are nowadays, and where that data goes, what information is being used is is always going to be one of the Top three concerns and it's the first one that comes to mind. I'd say second after that is is authority and in some ways autonomy. what the AI can actually do. very different risk profile between something that summarizes information and something that goes and takes an action. Doesn't matter what system it's in, could be taking an action in, you know, Google workspace and building something for you, or it could be touching your firewall and making a rule change for you. Either way, that authority and that autonomy. It's it's it's affecting business processes at the end of the day. So those are always going to be a security concern. And then third, it's it's probably change over time. you can do an assessment on day one, you can do assessment at year one, which a lot of us do regularly when we're doing application risk profiles. But in between that time, if you get to that second one, models change, vendors change, functionality, permissions expand, people find new use cases for the same tool. you know, agentic capabilities have new dependencies, whatever, whatever it may be. The governance process really has to deal with what happens after that initial approval. And I don't I'm not even talking about drift of what happens when the actual AI output starts drifting depending on what you're using it for. we we have to have a governance process that deals with that and and the data and the authority piece of it as well.
Walter Haydock: On the change over time side of things, you've got the plan changes, the new model releases, the new vendor capabilities. But then you have, like you said, the the drift. There's compliance drift over time. Documents kind of start making references that don't necessarily make sense anymore. People start forgetting how they're supposed to be doing things. And then the systems themselves might drift. You know, you might have a capability that works one day and then the next day it's returning you know, out of out of bounds responses. So Definitely a a big problem all around. In terms of your AI risk posture and how you viewed it at market access, you know, if you didn't do anything to tackle it, you just followed the same business as usual approach, how about it impact things from an organizational perspective?
Dan VanBeek: Yeah, you would end up with probably one or two, at least one of two bad outcomes. either the organization is implicitly accepting risk that it doesn't really understand because your governance can't keep up, or governance becomes the bottleneck and slows down legitimate adoption of of good tools, useful tools, things that the organization needs. And you know, on that first point of the accepting risk. That's that's not just putting it in your risk register and saying that this was implicitly accepted, even if you got that far. You would most likely get that voiced on you by some regulator globally. They would come back and say, no, but you didn't do anything, and that's worse. You guys accepted the risk. You could have done something, you should have done something, and because you didn't, you accepted the risk implicitly, and that's not okay. you know, neither of those really is a good security outcome. whether you're accepting the risk because you can't keep up or that you're being bottlenecked and slowing everything down. you know, we needed to be able to distinguish quickly and, you know, rel in a relatively straightforward way if what is in front of us needed a deeper review or stronger controls or a different decision. And that's that's the path we went down is that this is coming at us. We we need a process that is going to do this quickly enough for us in the right way and make sure that we don't end up with one of those two bad outcomes.
Walter Haydock: Yeah, it's kind of a Scylla and Charybdis to use an Odyssey reference. You're you're stuck between two different bad options and you gotta go straight and narrow down the middle. So definitely understand that. As far as the stack aware engagement, I think that's a good segue to talk about it. Were there things that we surfaced that gave you some visibility or highlighted some issues that you hadn't seen previously? Can you talk more about the initial diagnostic?
Dan VanBeek: Yeah, let's see. Really a lot of the value that we got out of it and that you helped surface throughout was was finding a way to help us see all the pieces coming together as a system. I I think I mentioned earlier all the pieces that can go into a process like this and the reiterating that they all need to work together, that you know, security, vendor risk, development, governance processes, the the entire risk process in general, not just the vendor part of it. they they really have to work together for this because it's much different than just doing a cyber risk evaluation on a new vendor or an internal application. and you you helped us just see that the the harder question was really how should AI move through all of those teams, all those systems without creating gaps or unnecessary duplication in the process. So, you know, really honestly having someone come in with an outside perspective, someone who's seen it done before at different organizations and in different ways. you know really challenged a lot of the assumptions that we had about where information should be collected, it who really needed to see that information and where those decisions should happen. That was that was probably some of the biggest value that I we got out of it.
Walter Haydock: Awesome. Awesome. So in terms of the other valuable things that you found, can you tell me the top one or two that you that you thought from from our work together?
Dan VanBeek: Yeah, I I mean, I don't know if it's an other or if it's just the rest of the story, but helping us turn, you know, a super broad AI risk problem into a more structured lifecycle. we we were all, and I say we as all the different risk partner teams, we're looking at it from the lens we are most comfortable with naturally. and there is always ways to go farther down one path, farther down a security path, farther down a technology path. than we potentially needed to. So coming together and seeing it as a structured life cycle was was a big benefit. And the other piece was honestly the practical implementation work. Easy to produce a framework that looks good on paper or hell have one of the AI tools do it for you. But the useful question is really what happens when somebody actually wants to use AI on Monday morning? Where do they go? What information do they need? What information do we need about what they want to use? who needs to review it, what needs to happen next? getting to that level of detail in the implementation side of things was really
Walter Haydock: Awesome. Awesome. Good to hear that. And can you talk about the business impact of those things? Materializing, getting help with them.
Dan VanBeek: Yeah. I mean it we talked about it early on, even even before we got too involved that the outcome that we're aiming for with an AI governance problem program is less friction. You know, we we want lower risk activity to not have to go through a super long process just because it says AI in the title. we wanna put our attention to where the risk actually warrants our attention. And there's also a consistency benefit to that too. You know, a business owner, somebody who wants to use a new AI tool, they shouldn't get a completely different answer depending on if they went to security first or risk first or legal first. they they need to have the same response from the process, the program. and when we do require something from that business owner, we should be able to explain why we need more information from them about their system, why we think it is higher risk than something that was lower risk that got approved faster. all of that's better for the business and honestly better for the governance team too, trying to work together.
Walter Haydock: I think that goes back to what we were talking about earlier, where you don't want to have four governance or intake processes with different organizations because you'll get different outputs and you'll have people gaming the systems saying, okay, well, I think this team will be a little easier on the review than that team and I'll go with them. And then you kinda turn the whole process on its head. So I definitely, definitely hear you there. In terms of the personal impact for you, can you talk about, you know, what this did in terms of the research you had to do, the one-off decision making, the ability to structure the process.
Dan VanBeek: Yeah. So I mean it definitely was a a learning experience going through all this, seeing the different requirements from a global standpoint, understanding what is potentially coming down the pipe in different industries, different regulators and and globally, since we are a globally regulated company. So having that insight and being able to get that as basically a regular feed from you and your services. that was simply a great learning opportunity. and from there, you know, the partnership working together, understanding what the business process needs to be to make the business more efficient. it was it was super awesome. So you know we're moving towards that. we're we're still working on the implementation on our side, making sure that we're doing it the best way that works for us. But you know what we really didn't want was every AI request to land with my team or somebody else's team and require us to research the technology, interpret the requirements, have to go figure it all out every single time something comes up. and you know, we really constructed that governance process in a way that made us not have to reconstruct it every single time, which often happens with something like this. So yeah, the more that knowledge that you know we can put into the process, the more my role, the risk partners' role, the AI governance team's role can shift towards exceptions and genuinely managing actual difficult risk decisions that impact the business, you know, instead of operating every single decision personally. so you know, there's there's a lot of benefits there.
Walter Haydock: Awesome. So if another security or risk leader told you that he or she could figure out AI governance themselves, what would you tell them in response to that statement?
Dan VanBeek: On what part of the dinner we're at. I'd I'd probably say that we can, and that they can figure it out themselves. I I don't think AI governance requires some secret knowledge that only consultants have, no offense, Walter. but there's definitely a difference in figuring out the requirements and building something that actually works inside your organization. whether you've been in an organization forever or you're new there and you want to make some big changes, you've got to connect. Policy, risks, security, privacy, third-party risk management, development processes, if you're putting it in your software, what your inventory is gonna be if you even have a asset inventory in the first place, evidence, approvals, you know, whatever else already exists. You're connecting all of that. And you have to do it while the technology and the requirements are still changing. there's there's new regulations coming out every day, there's new harnesses popping up. There's, you know, we were talking about MCP at one point, now everybody's talking to GenTic, and who knows what we're gonna be talking about three months from now. that's where the outside help is is really valuable. is somebody who can challenge our assumptions, be the expert in the room, since most of us aren't coming into this as AI governance experts, let alone AI experts, and you know, bringing the experience from other environments too, other peer organizations and you know, your former customers, your current customers that have done this, and work through the implementation details with us. that really shortened the learning curve and it's gonna shorten the learning curve for anybody. So and on the on the same note, I also wouldn't outsource ownership of the program. There's gonna be plenty of people that think they can do that too. at the end of the engagement, your organization still's gotta understand the decisions. They've gotta operate the process and they've gotta, you know, evolve it as the technology changes. So you know, can they figure out governance themselves? Sure. Are they gonna change it seventeen ways to Sunday between now and, you know, a year, two years, three years from now? They absolutely will. And they'll probably get it wrong a bunch along the way. It takes forever to do.
Walter Haydock: I think that's some some well well taken advice there and appreci appreciate that. In terms of, you know, you you've been you've been posting a fair amount on AI governance and security on LinkedIn and really appreciate the contributions to the community. Want to see if there's anywhere that you want to point folks, you know, blog, your LinkedIn profile, any any cool deliverables or or things like that where you'd like to get input or or people to check out.
Dan VanBeek: Yeah, sure. I mean, I appreciate the shout out. one of the things I've been playing around recently is what I'm I'm just calling a control plane at this point. and really I'm not I'm not doing it to try to push a product or go anywhere with it. It's more to try to figure out how much of this we can automate in an open way because a lot of things with GRC, especially you know, GRC engineering in general, we're we're building bespoke processes and automating them because it's it's very key to our company, but there's a lot of learnings a lot of things that can be reused across the industry, across our peer groups. And so for me, it's more of, you know, what's a what's a framework that allows us to do this in a standard way? And you know, a control framework is one of the ways it'd be great if we could all agree on controls that apply to everybody. ISO 42001 is a great start. I think AI UC is looking at stuff. Agent Baseline is doing things. it's all great. We're all going to come together at some point, be a nice big happy family. but How can we make those implement quicker in our environment? And that's kind of what I'm exploring with control plane. And really, you know, in simplest terms, it's it's kind of a risk decision engine. And it takes whatever framework you want, whatever controls you want, and then you can query against what you know about an individual AI system and say if you know if it's just a chat bot, it does this, that, and the other, what kind of controls should I put in place? And it goes through a risk engine and decision making process to say you should probably definitely need to do this. And then maybe you should ask these other questions about the system. And then you can I mean that's that's where it stops right now. and then where it goes from there is is how you you keep that flowing long term, how you measure drift potentially, how you reassess systems against you know control effectiveness for one, but also any new controls that come in place, and help you create that inventory. of systems that you likely need internally. that's that's kind of where I'm going with it. It's it's not meant to be you know, an enterprise tool. It's not meant to replace the services that any consultant like yourself offers because you do a a much better job with much more bro wider range of things than I do. but to me it's it's just that, you know, how how can we think about this in a different way and how can we share this across the the industry so that we can kind of coalesce what AI governance really is. So yeah, kinda went on a soapbox there. But that's what I've been working on recently. So a nice little pet project that I've been thinking about.
Walter Haydock: Awesome. Well, I I gave you the soapbox, so I'm happy that you that you took advantage of it. And yeah, I I appreciate you coming on the show. And anything else to share with our audience before we leave? Or should we wrap it up?
Dan VanBeek: No, I think we should wrap it up. This was awesome, Walter. Thank you very much. And you know, looking forward to continue working with you and all the services that you've been giving us so far.
Walter Haydock: Awesome. Well, Dan, thank you very much for your time and to our audience. This has been the Deploy Scurly Podcast. We'll see you next time.
