The AI Security Problem Most Organizations Still Aren’t Talking About

Hi, I'm Joan Goodchild with CSO, and we are here today at the CSO Cybersecurity Conference and Awards in Nashville. And I am excited to be joined by Lamont Orange. He is the Chief Trust Officer with Cyera. Welcome, Lamont.

Thank you for having me. I look forward to the conversation. Yeah.

Great. So let's start with talking about the topic everybody wants to discuss these days. We're talking about AI security. What do you think are the core components or principles of an AI security program?

So when you think about AI, first of all, it's the biggest word ever right now. And when you think about that, you have to think about a couple of things. It boils back down to visibility. You have to understand what AI models and what AI is doing.

And I like to say AI is also a data game.

It's continuing to reinforce some things that we all always knew within our security programs, that we have to understand our data, we have to know where it is and not answer questions as we think it should be here, which is what we've done many throughout the history, I'll say, of security.

Data was hard. And AI, again, is just that exclamation point or that crossing of that T and dotting that I.

That says you have to be more in tune to where your data is because that is the new attack surface, and you have to figure out how to control it and reduce it.

So what do you think is the AI security problem that's hiding in plain sight, something that CISOs aren't talking about yet, but they should be?

So that's an interesting question, because I think we talk about a lot of things, and I will say that I think we're talking about all the agents, we're talking about all the identities. We're even moving and crossing the line to a lot of agentic curiosity.

But I think something that doesn't get as much airtime is now we have AI operating as a human, as a non human, and we also have things around ephemeral workloads. And we're not talking about the tie back to quantum computing.

I think Quantum actually has a problem now versus the solution. It was many years ago when Quantum was going to take over the world. It was looking for something to do, and now I think it does have something to do.

What's one relatively simple control that can materially reduce your AI security risk?

I think understanding your attack surface. And there's not just one control because it's so vast and expands, but you have to start with the basics. Getting foundational things correct is very important now.

And I don't like the term hygiene, but I think they're foundational pieces that understanding the attack surface, reducing as much as possible, understanding what your capabilities are to respond and detect when something is not appropriately working and then go back to being able to enable these tools.

We're at a point, we've hit this inflection point where we don't say anything, can't say no, we are even past yes. But at this point it's like yes, go. And so we have to be prepared to do that. And also we know we can't cover everything.

So we have to understand again, going back to the core component of visibility and understanding the tax surface, then you can start to shrink it and then you can start to manage it.

What about AI security decisions? You know, in your opinion, how do you think those should be made? CISO led or a group approach like an AI governance committee,.

Different for every industry and every company. Sometimes it's cultural and how those decisions are made. But I think definitely it should have a CISO involved. You should also have the CDAO involved and I think you should involve the privacy side as well.

And I think those become your core members or chairs of said committee. And then there's a smaller group that would be consumers of the AI technologies and that's how you would kind of govern that approach.

And then I think everything else comes through policy and understanding how this works with a business objectives and that comes from those department head or functional leads there.

If a CISO has 1/4 of Runway to get ahead of AI risk, what do you think is the first move? What's the move that people are making right now? That they should stop.

Enabling, enabling blindly right now. I think what we learned is that when if we had that one quarter to go and we know that the business is going to have a tough conversation with us one way or the other.

I think we get to the tough conversation just by blindly enabling. If we don't know what we're getting into, we're bound to get into something. And it's not if, it's just when and at the rate of AI, the velocity so fast, it'll show up pretty quick.

So I think again, getting your house in order to understand what's needed and that's the discussion that should be had if you have that quarter.

These are the things that I need in order to be able to enable this capability to help us whatever the benefit is that was discussed.

But I need these things to Enable it and have that conversation sooner than later.

So when you think about all the different opportunities and players out there, what would you say the differentiators are?

So I think we are in the age of platforms and we are also in the age of, I'd say, terminology and market confusion. So I think you need to, I think we need to look at differentiators as technology leaders around the platform that absolutely connects.

So have a great integration story. I think we should also look at some of the core tenets of giving us the visibility across all of our data assets, no matter where they live, if it's structured, if it's unstructured, or if it's semi structured data.

So I think we got to look at that holistic view. We have lived by niche tool, by niche tool, which adds a lot of complexity to our environments at the speed that AI is moving.

Simplicity is the key and being able to be very simplistic and actually be able to provide those guardrails and control. So look for platforms that provide you the complete vision and then look at the execution. I'd say cadence and history.

Let history be your, your witness of what can happen in the future. Can you execute to actually make this platform something that we can use and something that we understand that there's other muscles and, and tissue that you have in your environment.

So we have to be able to exercise those and use them. And I think that'll be key to our success.

All right, we'll keep an eye on it then. All right.

All right.

Lamont Orange, thank you very much for joining us today. It was a pleasure. Thank you.

Apprec.

Okay, and thanks to you for watching. For now, I'm Joan Goodchild with CSO. We'll see you next time.