How do you plan for AI system failure?

Maria Haight: It doesn't mean you have to be

Maria Haight: on the bleeding edge for everything,

Maria Haight: but just listen and learn and watch.

Maria Haight: It does feel overwhelming some days.

Maria Haight: I get that as a CISO.

Maria Haight: And my head spins certain days, and I think, "My gosh.

Maria Haight: How am I ever going to manage this for our company?"

Maria Haight: So don't feel like you're behind.

Maria Haight: I think there's plenty of time to still jump in, learn, listen,

Maria Haight: and be willing to share your stories, too,

Maria Haight: because that's how we all grow together.

Johnny Hand: Welcome to AI Security Brief,

Johnny Hand: where we're unpacking emerging AI threats,

Johnny Hand: vulnerability research, and the strategic decisions

Johnny Hand: that security leaders are making right now.

Johnny Hand: I'm Johnny Hand.

Dustin Childs: And I'm Dustin Childs.

Dustin Childs: This episode, we look at the readiness gap that opens

Dustin Childs: after an AI initiative receives governance approval.

Dustin Childs: Our guest today talks about how that approval

Dustin Childs: and initial risk assessment are really,

Dustin Childs: really the first half of the job.

Dustin Childs: We still have the operational questions that follows.

Johnny Hand: Who monitors the capability?

Johnny Hand: What happens when it fails?

Johnny Hand: And can the organization recover the process that it replaced?

Johnny Hand: Yeah, I'm really excited about this episode

Johnny Hand: because Maria Haight is the Global Information Security

Johnny Hand: Officer at Joyson Safety Systems.

Johnny Hand: And I actually didn't get to record this episode with you

Johnny Hand: because I was traveling overseas.

Johnny Hand: But coincidentally, I ran into Maria a couple of days later

Johnny Hand: at another event, had a great conversation around AI security

Johnny Hand: and also some of the topics that you talked about

Johnny Hand: And for Maria, you know, she works in a very complex,

Johnny Hand: highly regulated industry.

Johnny Hand: And when it comes to AI adoption, she has to account

Johnny Hand: for not only the supply chain complexity,

Johnny Hand: but regulatory obligations, operational resilience,

Johnny Hand: and business continuity.

Johnny Hand: She's also faced with a challenge

Johnny Hand: that many security leaders are faced with right now,

Johnny Hand: where the boardroom really wants to go fast on AI adoption,

Johnny Hand: but we have to make sure that it's governed well,

Johnny Hand: that there's security and that we're compliant

Johnny Hand: in how we deploy these systems.

Dustin Childs: Yeah, Maria has a methodology for kind

Dustin Childs: of scoring this, but it's not a scorecard for any one company.

Dustin Childs: It's a practical set of principles

Dustin Childs: that security leaders can apply throughout their AI journey.

Dustin Childs: I really enjoyed our conversation, and we touched

Dustin Childs: on a whole different lot of topics.

Dustin Childs: So let's go ahead and kick things off.

Dustin Childs: So welcome, Maria, to the AI Security Brief.

Dustin Childs: You know, when a government board signs off

Dustin Childs: on an AI initiative, everybody treats that as the finish line,

Dustin Childs: but you're arguing that it's not.

Dustin Childs: It's barely halftime, and the band is still warming up.

Dustin Childs: What's the operational work in the months that follow

Dustin Childs: for most organizations that are not --

Dustin Childs: that they aren't planning for?

Maria Haight: Yeah, there's a number of things, Dustin.

Maria Haight: And, you know, what I first think about is even

Maria Haight: when we get approval, there really needs

Maria Haight: to be an understanding of that use case very well,

Maria Haight: as well as if it's going to be a PoC,

Maria Haight: which is usually how we start off, because we want

Maria Haight: to make sure that this tool is doing what the audience expected

Maria Haight: it to do, that there's a timeframe in that,

Maria Haight: and then there's monthly check-ins.

Maria Haight: So that's been a bit of a change for us is looking

Maria Haight: for a monthly report back on, are we progressing

Maria Haight: in the way we thought?

Maria Haight: Was the six months that we allocated you going

Maria Haight: to give you enough time to show the output

Maria Haight: of your use cases being positive or negative?

Maria Haight: And then really sticking to it.

Maria Haight: Sometimes those PoCs sort of linger for periods

Maria Haight: of time beyond intention, and then we've lost, you know,

Maria Haight: why we came into this, and maybe we should be looking somewhere

Maria Haight: else now.

Maria Haight: So there's that.

Maria Haight: I would also say, too, one of the big things, even as you come

Maria Haight: in for approvals, is making sure we're not bringing in tools

Maria Haight: or processes that are redundant.

Maria Haight: I think that's a big thing.

Maria Haight: I think a lot of companies are starting to lose this --

Maria Haight: you know, the slide rule on that is that this sounds great, but,

Maria Haight: "Oh, we're doing that somewhere else, too.

Maria Haight: Why don't we piggyback you into them, and, you know,

Maria Haight: and drive that forward?"

Maria Haight: So, okay, good question.

Maria Haight: Now, we got through all that.

Maria Haight: What do we need to be thinking about?

Maria Haight: One of the things that I think is really important is your data

Maria Haight: protection, for sure, and then it's the monitoring

Maria Haight: of that environment.

Maria Haight: Whether we're being able

Maria Haight: to visualize utilization, great; users, great.

Maria Haight: But what about agents, and what data are they actually using

Maria Haight: and are they integrating into?

Maria Haight: Everyone comes in with a use case.

Maria Haight: It doesn't always mean that's where we stay, right?

Maria Haight: Because new things are learned through the tool

Maria Haight: and through workflows and what the agent can do,

Maria Haight: and then it starts morphing.

Maria Haight: And that's where we have to keep an eye on things.

Maria Haight: So I think having good tools that give you the visibility

Maria Haight: into that growth is very key.

Maria Haight: And then there's the backup of that data.

Maria Haight: Any data that we're using to model needs

Maria Haight: to be backed up, right?

Maria Haight: Technology is not perfect.

Maria Haight: Things do go wrong.

Maria Haight: And so we have to think about that piece, too,

Maria Haight: in case we have to start over.

Dustin Childs: Yeah, the backing

Dustin Childs: up of the materials is very interesting.

Dustin Childs: As someone who actually started his career on mainframes,

Dustin Childs: and the large part of my job was hanging tapes for backups.

Dustin Childs: It's near and dear to my heart.

Dustin Childs: There's a human continuity risk, too, isn't there?

Dustin Childs: I mean, are there people

Dustin Childs: who remember the old manual process still

Dustin Childs: around when the AI fails?

Dustin Childs: And I always -- I go back to the TV show Pitt -- "The Pitt."

Dustin Childs: I don't know if you're familiar with it.

Dustin Childs: In the second season, no spoilers,

Dustin Childs: but there is a computer failure, and they have --

Dustin Childs: all the doctors and nurses have to go back to written forms.

Dustin Childs: And the young doctors are very struggling to do anything

Dustin Childs: without a computer in front of them.

Dustin Childs: The old doctors are much more adapt to the change.

Dustin Childs: But how are we making sure that should the AI fail,

Dustin Childs: there's a person who still remembers how

Dustin Childs: to do these things?

Dustin Childs: How do you plan for that loss of institutional knowledge?

Maria Haight: Yeah, that's been, you know,

Maria Haight: something that we've brought forth without having

Maria Haight: to learn the hard way yet.

Maria Haight: I've certainly heard some horror stories where AI got put

Maria Haight: into production and were off and running and success,

Maria Haight: and then all of a sudden, you know, the NVIDIA chip fails or,

Maria Haight: you know, whatever is going on fails,

Maria Haight: and now we're dead in the water

Maria Haight: And if that is production-ready right now,

Maria Haight: you've got a serious business consideration to get around.

Maria Haight: And where are those people,

Maria Haight: and do they even remember the process?

Maria Haight: So we've been developing sort of lessons learned around each

Maria Haight: of our tools and how we did things and why we did it

Maria Haight: so that we could map it back if we needed

Maria Haight: to go back to a manual process.

Maria Haight: And so that's almost sitting

Maria Haight: as documentation alongside our agents today.

Maria Haight: But that's been our road.

Maria Haight: I think, you know, having good processes documented to begin

Maria Haight: with is always a good thing, regardless,

Maria Haight: because that may even help you with your better AI development.

Maria Haight: If you're just going off cuff, right,

Maria Haight: you may already be missing things or forgetting things.

Maria Haight: So I think understanding that process

Maria Haight: up front is always a good thing for any of us, but even more

Maria Haight: so if you're going to turn into an AI capability.

Dustin Childs: You know, on this podcast,

Dustin Childs: we talk about how security leaders should deal

Dustin Childs: with their boards, and especially

Dustin Childs: when you have a divided board.

Dustin Childs: So let's paint the picture of a divided board

Dustin Childs: where one member is pushing to accelerate AI

Dustin Childs: and the others are insisting on cautioning compliance first.

Dustin Childs: How real is that dynamic,

Dustin Childs: and where does the security leader end up standing in that,

Dustin Childs: at least to be successful?

Maria Haight: Dustin, we actually see

Maria Haight: that through our governance board approval process,

Maria Haight: because you've got all the different hats in there.

Maria Haight: You've got legal.

Maria Haight: You've got compliance.

Maria Haight: You've got data security.

Maria Haight: You've got InfoSec.

Maria Haight: You've got IT.

Maria Haight: And so we all bring those lenses to it.

Maria Haight: We definitely have, you know, technology people

Maria Haight: within our company that are really pushing us,

Maria Haight: and thank goodness for that.

Maria Haight: And I would definitely say our leadership wants us

Maria Haight: to push AI first to find efficiencies, to be able to get,

Maria Haight: you know, better product out, higher quality product out.

Maria Haight: But I think even when we're going through approval process,

Maria Haight: we're pushing each other a little bit.

Maria Haight: Something might come up, such as data, right?

Maria Haight: That's just the easiest one.

Maria Haight: What data are we talking about?

Maria Haight: And can we use that data in this way?

Maria Haight: You've got to look at your contracts.

Maria Haight: If you are looking to use customer data in some capacity

Maria Haight: in AI, some customers are saying,

Maria Haight: "I don't want you to do that."

Maria Haight: And so you've got to be careful if this is what you're planning

Maria Haight: to do and how you're going to do it, and that you make sure

Maria Haight: that they're involved in it.

Maria Haight: I think the next thing is certainly compliance in HR

Maria Haight: from a perspective of PII data.

Maria Haight: That's a big one, right?

Maria Haight: Especially if you're under GDPR and what we're going to do

Maria Haight: with that PII, because right now, we've really tried

Maria Haight: to hold a line and saying, "No PII data is allowed."

Maria Haight: The sensitive data

Maria Haight: or confidential data has dependencies on how it's going

Maria Haight: to be used and who the audience will be of the recipient

Maria Haight: of the data from the agent.

Maria Haight: So I think we've tried to not be that group because usually IT

Maria Haight: or InfoSec is the office of no.

Maria Haight: We've tried not to be the group of no.

Maria Haight: It's the group of how to.

Maria Haight: Or, "We really don't want this, but can we do it this way?"

Maria Haight: Or, "Could we sample the data first?

Maria Haight: Show us the output.

Maria Haight: Show us what you're going to --

Maria Haight: you know, how you're going to use it.

Maria Haight: And then we'd like you to come back again,

Maria Haight: and then we could talk about actually using the data

Maria Haight: that you're looking for that we thought maybe would be too

Maria Haight: sensitive for this particular use case."

Maria Haight: So trying to not be that, you know, no stamp,

Maria Haight: and instead the how-to stamp.

Dustin Childs: You know,

Dustin Childs: you spoke about this a little already, but I really wanted

Dustin Childs: to bring it up because I think this is a very interesting thing

Dustin Childs: that a lot of people don't consider,

Dustin Childs: especially if you're not in that industry.

Dustin Childs: And that's the heavy regulatory load.

Dustin Childs: It can be its own force.

Dustin Childs: How does compliance burden shape not just how --

Dustin Childs: whether you adopt AI, but how you architect the monitoring

Dustin Childs: and controls around it?

Maria Haight: We put a very strong AI acceptable use policy

Maria Haight: together to make it very clear

Maria Haight: from the beginning what those guardrails look like.

Maria Haight: And that's what we lean on.

Maria Haight: So there should be very little speculation around that.

Maria Haight: That helps us, I think, to adhere to compliance, HR,

Maria Haight: InfoSec needs and wants from any AI initiative from the get-go.

Maria Haight: We've trained, Dustin, pretty heavily on that, and we did ask,

Maria Haight: you know, the entire company, not just those power users,

Maria Haight: to read it and understand it and, you know,

Maria Haight: facilitate questions to us if they didn't

Maria Haight: and continue to do so.

Maria Haight: We also then make sure as we give people license access

Maria Haight: to any of our tools that they also get trained on those tools.

Maria Haight: So again, how to use it in the way it was intended and,

Maria Haight: you know, not trying to circumvent anything

Maria Haight: that might be there that the policy does not want us,

Maria Haight: you know, to do.

Maria Haight: And I really think that's been the key,

Maria Haight: is the constant communication and training

Maria Haight: so people don't have to guess.

Maria Haight: Like, we just tell them upfront, "Yes.

Maria Haight: No." It can sometimes be that black and white.

Maria Haight: And I know it does not mean that there are no questions,

Maria Haight: but we want to give direct answers

Maria Haight: to those questions to help our staff.

Dustin Childs: Great.

Dustin Childs: Well, now, Maria, you have a framework, right?

Dustin Childs: The top things people forget

Dustin Childs: when doing an AI risk assessment.

Dustin Childs: Walk us through part of that list.

Maria Haight: When we do an AI InfoSec assessment,

Maria Haight: it really talks a lot not just about the architecture.

Maria Haight: It is also talking about data flows, accessibility,

Maria Haight: third-party utilization.

Maria Haight: We even go into some ethical discussions, too, right?

Maria Haight: We have to make sure that doesn't get lost along the way.

Maria Haight: Then we talk about the backup of data,

Maria Haight: the monitoring, the ownership.

Maria Haight: We do have a business owner for every one of our tools

Maria Haight: that we have approved so that they become the voice

Maria Haight: when we have questions.

Maria Haight: We don't want to be running around

Maria Haight: and having lack of accountability.

Maria Haight: If this person brings forward a tool for utilization,

Maria Haight: they then are the ones that are going to have

Maria Haight: to answer questions or be responsible

Maria Haight: if something is found that needs to be dealt with,

Maria Haight: such as we didn't put a business continuity plan together.

Maria Haight: Well, we need that.

Maria Haight: We need that because now, you're getting ready

Maria Haight: to go into production.

Maria Haight: Before we allow you to go into production,

Maria Haight: we want to make sure you've thought through that.

Maria Haight: And again, that your backups are ready,

Maria Haight: and that we have people able to support you, too.

Maria Haight: This doesn't just all fall in IT's, you know, lap.

Maria Haight: IT didn't build these agents.

Maria Haight: And so you can't just walk away and assume IT is going to run

Maria Haight: in due to a help desk ticket, right?

Maria Haight: And then I think the other thing is the transparency

Maria Haight: of whether this is being successful or not.

Maria Haight: That has to be on the business owner, too.

Maria Haight: And that's critical, I think, even from an analysis,

Maria Haight: is that there's that due diligence that's being done.

Maria Haight: Otherwise, we need to reroute our time, our resources,

Maria Haight: our money to other solutions as well.

Maria Haight: So it really is that full suite, Dustin.

Maria Haight: I'm going to go back to that application model.

Maria Haight: Any business owner that brings an application to IT,

Maria Haight: we've got to think through all those things,

Maria Haight: and this is no different in my mind.

Dustin Childs: Right.

Dustin Childs: Yeah, I'm seeing that a lot of things when it comes to AI

Dustin Childs: and governance, deployment, securing, whatever.

Dustin Childs: It's not that it's a new policy.

Dustin Childs: It's not that it's a new direct.

Dustin Childs: It's the same things that we've been doing

Dustin Childs: if we've been doing security well.

Maria Haight: That's right.

Dustin Childs: We just need to apply them to AI

Dustin Childs: in a way that makes sense.

Maria Haight: That's right.

Dustin Childs: Right?

Maria Haight: Agreed.

Maria Haight: A hundred percent.

Maria Haight: Yep.

Dustin Childs: So of those things that are

Dustin Childs: in your framework, what do you think would make the biggest

Dustin Childs: difference for one of our listeners to fix first and why?

Maria Haight: I would ask you to start backwards,

Maria Haight: not at the beginning

Maria Haight: of development, but think backwards.

Maria Haight: Think in case there was an actual problem with your agent.

Maria Haight: Do I know where the support is coming from?

Maria Haight: Do I have a backup plan?

Maria Haight: Do I have a data plan for fallback if I need to rebuild

Maria Haight: that model in some way?

Maria Haight: It really is that good BCPDR plan.

Maria Haight: Start there before you go into production.

Maria Haight: Now, I know that that shouldn't come before your development.

Maria Haight: Do your development, absolutely.

Maria Haight: And now, we have something that we're ready

Maria Haight: to go mainstream with, and now I want you to go

Maria Haight: to the worst-case scenario and make sure that --

Maria Haight: because I think that often -- too often --

Maria Haight: happens after we've gone live and a hiccup happens,

Maria Haight: and now we're scurrying around.

Maria Haight: So I think that needs to be the lever

Maria Haight: to pull before you're ready to say, "Help us go to production."

Dustin Childs: So find your black swans before you go

Dustin Childs: off flying.

Maria Haight: Find your black swans.

Maria Haight: Yes, perfectly said.

Maria Haight: I want to throw in one other topic,

Maria Haight: Dustin, if you don't mind.

Maria Haight: And I didn't think about it earlier,

Maria Haight: but I'm thinking about it now.

Maria Haight: I think companies need to make sure, as they make contracts

Maria Haight: with LLM providers, that they truly understand what

Maria Haight: of their data could be used for modeling and how far that goes.

Maria Haight: And that there is -- you know, there is a legal understanding

Maria Haight: that you should hold with your LLM provider regarding your

Maria Haight: data, even if it's metadata, where it's being stored,

Maria Haight: how it's being stored, and how it's being utilized

Maria Haight: I think that needs to dig in a little deeper sometimes,

Maria Haight: and people have conversations with.

Maria Haight: And I just, you know, I would just press again on anybody just

Maria Haight: to make sure, because you don't want data leakage.

Maria Haight: This is the worst way to go into --

Maria Haight: you know, public pulls up a brand browser, and they go into,

Maria Haight: you know, LLM of choice, and all

Maria Haight: of a sudden they're just starting

Maria Haight: to see your information show up in the responses

Maria Haight: that was not supposed to be made public, right?

Maria Haight: So I think those are big conversations to have

Maria Haight: with your LLM broker of how

Maria Haight: that data is being utilized, maintained.

Maria Haight: Hopefully, you know, the retention period is something

Maria Haight: that you're -- palatable for you.

Maria Haight: I just don't know if enough people know

Maria Haight: to have those conversations.

Dustin Childs: Yeah, that's a very good point.

Dustin Childs: And we've seen, in the past,

Dustin Childs: how not having those conversations can lead

Dustin Childs: to some major issues when it comes to personal privacy

Dustin Childs: or intellectual property.

Dustin Childs: So absolutely, very good point there

Dustin Childs: to have those conversations with your LLM provider.

Maria Haight: Yeah.

Dustin Childs: What's one thing you want our audience to think

Dustin Childs: about or do after they hear this conversation?

Maria Haight: I want them to go back to those

Maria Haight: that are building agents within their environment and make sure

Maria Haight: that they are looking at it from understanding scope,

Maria Haight: that they're understanding data utilization,

Maria Haight: that they're understanding the intended use.

Maria Haight: If it's going to go external, you have a lot more things

Maria Haight: to be thinking about than maybe it's --

Maria Haight: even if it's staying within internal

Maria Haight: for a small population to use.

Maria Haight: Make sure your licensing is understood.

Maria Haight: And the one thing that I have learned through some podcasts

Maria Haight: that I've listened to, too,

Maria Haight: is a token is not a token is not a token, right?

Maria Haight: So the cost of a token and how that is created is very unique.

Maria Haight: Inputs and outputs, data uploading.

Maria Haight: So don't get shocked, right?

Maria Haight: Make sure you are asking those questions, too,

Maria Haight: of your LM providers of how that token is truly created

Maria Haight: so that you get a bill that's expected versus a shocker.

Maria Haight: And now, you've started having this change strategy really

Maria Haight: quick because you didn't anticipate that was going

Maria Haight: to be the burn rate that you were going at.

Dustin Childs: Yeah, tokens used to be --

Dustin Childs: used to just be for the arcade and Chuck E. Cheese,

Dustin Childs: and now that's a very hot topic.

Maria Haight: That's right.

Dustin Childs: Yeah, I've even heard some people jokingly say,

Dustin Childs: "You know, we can donate our PTO.

Dustin Childs: Can somebody donate tokens to us?"

Maria Haight: There you go.

Dustin Childs: I think it's great.

Dustin Childs: So, Maria, one thing I think about when it comes

Dustin Childs: to governance and deploying all these things is you have

Dustin Childs: to educate users how to do this, but at the same time,

Dustin Childs: AI is changing at such a fast pace.

Dustin Childs: There aren't exactly books on AI security

Dustin Childs: because by the time you publish it, it's out of date, right?

Maria Haight: Absolutely.

Dustin Childs: So, where does education fit into your factor?

Dustin Childs: And not only just educating users on what they're doing

Dustin Childs: with the AI agents, but educating your security team

Dustin Childs: on how to interact with this new technology.

Maria Haight: Yeah, that's a great point.

Maria Haight: And it's certainly becoming much larger of emphasis in security:

Maria Haight: how to use AI to improve that.

Maria Haight: Our team happens to -- we're very Microsoft-focused,

Maria Haight: and our team is using Copilot Security as their AI tool

Maria Haight: of choice at the moment.

Maria Haight: And so they're beginning -- familiar with it.

Maria Haight: Again, I've got to tell you, I still think that there's got

Maria Haight: to be some validation.

Maria Haight: So can't just take those answers as is.

Maria Haight: We've got to use that as one potential place for analysis

Maria Haight: and triage, but it shouldn't be your only.

Maria Haight: And again, I think that you have the, you know,

Maria Haight: opportunity to hopefully improve it with you giving it some data

Maria Haight: that may make it better for the next time

Maria Haight: that situation comes up.

Maria Haight: So there is some of that.

Maria Haight: You know, our SOC team, I think, is comfortable, but I don't know

Maria Haight: that I've trained them as well as I could.

Maria Haight: And that's, you know, probably something a lot

Maria Haight: of us could look at.

Maria Haight: I think we get focused, Dustin, on the tools and not so much

Maria Haight: on the training of how to best use those tools.

Maria Haight: So it's a very valid point.

Maria Haight: I think we have focused ourselves

Maria Haight: from a training perspective more on the users

Maria Haight: and specifically users that we've given access to tools

Maria Haight: to make sure they knew how to use the tool.

Maria Haight: And it's something our AIGB just talked about recently.

Maria Haight: Even the tool that we have used mostly within our environment,

Maria Haight: we've done a tremendous first-round training,

Maria Haight: but we realize now there needs to be a round two training.

Maria Haight: Now, I'm past that, right?

Maria Haight: And now, I'm doing these other things, and we want to come back

Maria Haight: and help facilitate a little bit more knowledge there,

Maria Haight: as well as all of these tools keep having more features

Maria Haight: and functionalities.

Maria Haight: And I am sure, you know,

Maria Haight: our audience is not reading those release notes.

Maria Haight: And so, you know, do we, again, have ownership on that?

Maria Haight: And I said, again, that's why we have

Maria Haight: to have those tool business owners.

Maria Haight: Those business owners have to own that.

Maria Haight: It can't just be an IT thing or an InfoSec thing.

Maria Haight: We really need them to know their product well

Maria Haight: and continue to educate as well.

Maria Haight: But I would say you're right, Dustin.

Maria Haight: From a security perspective, there should be more there.

Maria Haight: And I'm not sure I know what that looks like at the moment,

Maria Haight: other than even us getting to understand better how

Maria Haight: to use the tools that we have available to us today.

Dustin Childs: Maria, what's a piece of hard-won wisdom

Dustin Childs: about AI security that you wish more CISOs would take seriously

Dustin Childs: right now, even if it's not a popular opinion?

Maria Haight: Yeah.

Maria Haight: First of all, I'm going to go out on a limb, even with,

Maria Haight: you know, Mythos scared the crap out of all of us this year.

Maria Haight: I don't think this is something we have to be scared of.

Maria Haight: I really think this is something that we'll be able

Maria Haight: to utilize for our benefit.

Maria Haight: And, you know, I also think, too, it feels like we can't keep

Maria Haight: up at the moment, right?

Maria Haight: It's changing so fast.

Maria Haight: But, you know, I think with great networking,

Maria Haight: with lots of third parties

Maria Haight: such as yourselves putting podcasts out,

Maria Haight: there is a way to stay in the loop.

Maria Haight: It doesn't mean you have to be

Maria Haight: on the bleeding edge for everything.

Maria Haight: But just listen and learn and watch.

Maria Haight: It does feel overwhelming some days.

Maria Haight: I get that as a CISO.

Maria Haight: And my head spins certain days, and I think, "My gosh.

Maria Haight: How am I ever going to manage this for our company?"

Maria Haight: But I do think we're all in the same boat together

Maria Haight: and that there is opportunity.

Maria Haight: And just talk and reach out.

Maria Haight: And I think you're going to find, more often than not,

Maria Haight: most of the people that you are talking

Maria Haight: with are feeling the same rub, and they want,

Maria Haight: you know, to help each other.

Maria Haight: So don't feel like you're behind.

Maria Haight: I think there's plenty of time to still jump in, learn, listen,

Maria Haight: and be willing to share your stories, too,

Maria Haight: because that's how we all grow together.

Dustin Childs: And, Maria, I want to thank you

Dustin Childs: for a great conversation today.

Dustin Childs: I really enjoyed it,

Dustin Childs: and we really appreciate you sharing your insights

Dustin Childs: and the full picture of AI security, and can't wait

Dustin Childs: to have you back on the show sometime in the future.

Maria Haight: Thank you, Dustin.

Maria Haight: Appreciate your time.

Maria Haight: Have a great day.

Dustin Childs: Well, Johnny, I really enjoyed

Dustin Childs: that conversation with Maria.

Dustin Childs: What are your thoughts?

Johnny Hand: Oh, man, I loved the episode,

Johnny Hand: to be honest with you.

Johnny Hand: And many of these things that you guys talked

Johnny Hand: about is exactly what I got to talk about whenever I was

Johnny Hand: with her at that event.

Johnny Hand: So it's really good reinforcement.

Johnny Hand: I do like the honesty that we're talking about here,

Johnny Hand: that once you start a project, right, and you're trying

Johnny Hand: to get approval for AI governance,

Johnny Hand: that that's just the starting point, right?

Johnny Hand: It's not a proof of operational readiness.

Johnny Hand: It's not a proof of impact.

Johnny Hand: Also, when it comes to the capabilities,

Johnny Hand: if you're developing these AI capabilities,

Johnny Hand: you have to have an ownership aspect of this.

Johnny Hand: And especially if you're replacing those human processes,

Johnny Hand: right?

Johnny Hand: So now, you have to look at monitoring.

Johnny Hand: You have to look at disaster recovery

Johnny Hand: and business continuity responsibilities.

Johnny Hand: You can't just set it and forget it.

Dustin Childs: Yeah, Maria really talked

Dustin Childs: about the contingency plan that must protect more

Dustin Childs: than the AI model itself, and I really agree with that.

Dustin Childs: You have to preserve the source

Dustin Childs: and training materials the capability depends on,

Dustin Childs: along with the knowledge needed to validate,

Dustin Childs: rebuild, or replace it.

Dustin Childs: And you have to ask yourself, "Are the people

Dustin Childs: who really understood the original manual process,

Dustin Childs: are they still available

Dustin Childs: if the AI system becomes unavailable or unreliable?

Dustin Childs: Are you going to be left in a situation like "Space Cowboys,"

Dustin Childs: where you're calling in your retired senior citizens

Dustin Childs: who are the only ones

Dustin Childs: who understand how the old process worked?"

Johnny Hand: That's a great reference.

Johnny Hand: I also think that there's something more

Johnny Hand: to operational readiness, right?

Johnny Hand: Whenever the boardroom says "Go," right, it's not done.

Johnny Hand: There's a lot to be done, so a lot to be --

Johnny Hand: left to be done there.

Johnny Hand: And, you know, we have to translate

Johnny Hand: that as leaders between, you know, how do we move quickly

Johnny Hand: but also have compliance and security in those aspects.

Johnny Hand: And with Maria, you know,

Johnny Hand: she works in a very complex industry.

Johnny Hand: She has a lot of third-party dependencies

Johnny Hand: and business impact downline.

Johnny Hand: So I think her approach to how she's putting

Johnny Hand: in those contingency planning is really, really smart.

Dustin Childs: Yeah.

Dustin Childs: I love the practical next step that she provides,

Dustin Childs: which is to revisit the AI risk assessment after approval

Dustin Childs: and identify the operational step the team is most likely

Dustin Childs: to have missed.

Dustin Childs: You need to confirm who's monitoring the ownership,

Dustin Childs: recovery, continuity, data preservation,

Dustin Childs: and human fallback before scaling the capability.

Dustin Childs: And I think it's great she emphasizes this,

Dustin Childs: and I totally agree with her.

Dustin Childs: This should be an ongoing readiness discipline rather

Dustin Childs: than a one-time governance episode.

Dustin Childs: So I love exactly all the points that she hit.

Johnny Hand: And that does it

Johnny Hand: for another episode of AI Security Brief.

Johnny Hand: We want to thank you for joining us, and our goal is always

Johnny Hand: to host conversations that get you thinking differently

Johnny Hand: about security.

Johnny Hand: And if it does, consider subscribing

Johnny Hand: so you don't miss what's next.

Dustin Childs: AI Security Brief is mixed and produced

Dustin Childs: by Elliott Peltzman, with original music by Amneajynx.

Dustin Childs: Our show producers are Melany Gallant and Alyssa Gonneau.

Dustin Childs: Our executive producer is Jennifer Eiben,

Dustin Childs: with content strategy by Ma'ayan Plaut.

Dustin Childs: Additional production help by Liz Stokes.

Dustin Childs: Video editing by Sarelle Joppy and Brigitte Criqui-Wild.

Johnny Hand: Thank you so much for listening.

Johnny Hand: We'll see you next time on the AI Security Brief.

Johnny Hand: [ Music ]