Most organizations are racing to adopt AI without considering the security implications. Justin Greis, former leader of McKinsey's cybersecurity practice and founder of an AI-powered consulting firm Acceligence, explains why this approach creates risk and how security leaders can change the conversation.

Companies are deploying AI at different maturity levels. Some distribute AI tools to business units and wait for use cases to emerge. Others push boundaries with advanced algorithms. Few consider the associated risks. The right stakeholders often aren't in the room when AI decisions are made, either because organizations want to move fast or because security teams are underfunded and focused on daily operations. Technology companies are making AI capabilities available at unprecedented speeds, leaving organizations uncertain about securing and deploying these tools responsibly.

Security should be the foundation of trust, not an afterthought. McKinsey research found that customers make buying decisions based on product security when companies can demonstrate testing and rigor. A secure, certified product materially influences purchasing choices compared to alternatives without visible security standards.

Greis emphasizes that compliance certifications like SOC 2 or ISO represent minimum requirements, not security maturity. Organizations secure enough to meet business objectives naturally achieve compliance. The goal is translating business initiatives into security requirements that exceed baseline standards.

The Chief Information Security Officer position has shifted from back-office administrator to business enabler. AI has accelerated this change by converging infrastructure, technology, and cybersecurity into unified platforms. CISOs now have opportunities to demonstrate how they understand business context and can help organizations move faster and safer.

The challenge for security leaders is communication and relationship building. Years of underfunding forced CISOs to focus on survival rather than strategy. As security functions reach parity with other departments, more leaders can engage at the executive and board level. This shift requires CISOs to develop storytelling skills that contextualize security metrics for business audiences rather than overwhelming boards with technical details.

As AI agents begin making decisions without human oversight, organizations face new risks. The push to remove humans from decision loops creates efficiency but introduces vulnerabilities, particularly when AI accesses data it shouldn't process or makes decisions affecting vulnerable populations. Companies need frameworks to identify where human oversight remains necessary and mechanisms to monitor those boundaries.

Organizations implementing AI successfully have thought through secure development lifecycles, DevSecOps, and product operating models. Those starting from scratch face larger organizational changes to incorporate security, privacy, and responsible AI practices into development workflows.

LinkedIn: https://www.linkedin.com/in/justingreis/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Kevin Powers, Faculty Director of the Masters of Legal Studies in Cybersecurity Risk and Governance at Boston College Law School, began his professional and academic journey when he volunteered for a task force exploring cybersecurity education at Boston College. Rather than developing a purely technical curriculum, he advocated for an interdisciplinary approach that would integrate law, business, and risk management. "Cybersecurity is not just a technical issue," Powers explained during the podcast episode. Working with stakeholders from the White House, FBI, major financial institutions, and technology companies, the team built a curriculum designed to produce well-rounded cybersecurity professionals.

The program launched in 2015 and recently transitioned to BC Law School, offering 10 courses taught entirely by practitioners actively working in the field. Students include FBI agents, financial compliance officers, and executives from Fortune 50 companies, with an average age of 33.

A central theme of Powers' program is bridging the communication divide between technical teams and business leadership. With recent SEC regulations and requirements like New York's DFS Part 500 mandating board-level cybersecurity oversight, organizations need professionals who understand both technical controls and business implications.

"Boards are recognizing cybersecurity as a core business function," Powers noted, emphasizing that every company operating on networks faces operational risk when systems go down. The program prepares students to communicate cyber risk in business terms and develop governance frameworks aligned with regulatory requirements like CMMC 2.0, FedRAMP, and the NIST Cybersecurity Framework.

The program has evolved rapidly to address artificial intelligence governance. Powers redesigned his coursework after discovering AI tools could complete assignments in minutes, shifting 70% of grading to oral presentations that emphasize critical thinking over output.

Looking ahead, Powers identified cloud security and data sovereignty as critical concerns. Many organizations mistakenly believe SaaS platforms automatically back up their data, leaving them vulnerable during incidents. The CDK Global attack on car dealerships illustrated how unprepared businesses can be when cloud services fail.

Beyond academics, Powers emphasizes creating networks. Graduates maintain connections with government agencies, financial institutions, and technology companies, facilitating collaboration across sectors. The program hosts the annual Boston Conference on Cybersecurity, which draws hundreds of attendees including CISOs from major sports franchises and law enforcement leaders.

For organizations navigating increasingly complex regulatory landscapes, Powers' message is clear: cybersecurity expertise must extend beyond technical skills to encompass governance, compliance, and strategic business alignment. As cyber threats evolve, professionals need frameworks like NIST to demonstrate reasonable security practices to regulators while protecting operational continuity.

LinkedIn: https://www.linkedin.com/in/kevin-powers-54893a8/

Boston College School of Law: https://www.bc.edu/bc-web/schools/law.html

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Cybersecurity experts Heather Noggle and Dr. Arun DeSouza discussed Kiteworks' Data Security and Compliance Risk: 2025 Annual Survey Report, which introduces the industry's first quantitative risk scoring algorithm. The comprehensive study of 461 organizations reveals that 46% now operate in high- to critical-risk territory, with the median enterprise scoring 4.84 on a 10-point scale—dangerously close to the high-risk threshold of 5.0.

The experts analyzed a counterintuitive finding about third-party risk management: Organizations managing 1,001-5,000 external partners face the highest security risk (average score 5.19), surpassing enterprises with over 5,000 third-party relationships. Dr. DeSouza explained this "danger zone" phenomenon: "By nature, managing over 5,000 means you're a much bigger organization with more resources ... Many times you've got a platform-based approach." These larger enterprises can monitor risks in real time, while mid-sized partner ecosystems struggle with enterprise-level complexity on mid-market budgets—resulting in 24% experiencing 7+ annual security incidents.

Industry-specific findings revealed surprising risk disparities. Energy topped the risk charts due to legacy IoT devices and 30-year-old technologies vulnerable to exploitation. Technology ranked second, which Noggle attributed to the "overconfidence factor" and rapid employee turnover. "Tech companies are losing people so fast, they want to implement things so fast. That to me is a perfect storm," DeSouza noted. Conversely, heavily regulated sectors like life sciences demonstrated lower risk scores due to compliance-driven security investments.

The report exposed a dangerous "confidence paradox" where organizations claiming to be "somewhat confident" in data governance showed 19% higher risk scores than those acknowledging uncertainty. "Without governance you can't manage," Noggle emphasized, adding that overconfidence breeds complacency in rapidly evolving threat landscapes.

AI governance emerged as a critical vulnerability. While 64% of enterprises track AI-generated content (up from 28% in 2024), only 17% have deployed technical governance frameworks. The stakes are high—the IBM Cost of a Data Breach Report found that 97% of AI-related breaches lacked proper controls, with AI breaches costing $670,000 more than average. DeSouza warned about inherited risks like "Echo Leak," a zero-click vulnerability exploiting AI's use of historical data, demonstrating that organizations must secure not just AI models but their entire operational environment.

Poor data visibility creates cascading failures: Organizations unable to count their third parties showed 46% correlation with unknown breach frequency, while 31% of those with 5,000+ partners take over 90 days to detect breaches. As Noggle noted, "If we're back at identify and we're at detect, detect should not be that difficult if identify is done well."

Heather Noggle LinkedIn: https://www.linkedin.com/in/heathernoggle/

Arun DeSouza LinkedIn: https://www.linkedin.com/in/arundesouza/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Dr. Rick Goud brings a unique perspective to the data sovereignty conversation, combining medical informatics expertise with entrepreneurial technology innovation. As co-founder and Chief Innovation Officer of Zivver, a secure digital communications platform acquired by Kiteworks in 2025, Goud's journey began with an unexpected twist – missing out on medical school in the Netherlands' lottery system led him to medical informatics, where he discovered his passion for solving healthcare's data security challenges. His background as a strategy consultant in healthcare, where he witnessed firsthand the alarming frequency of sensitive patient data being shared through insecure channels, sparked his mission to create solutions that balance robust security with user-friendly functionality.

The podcast reveals a fundamental tension in European data sovereignty: While Europe boasts the world's strongest data protection laws like GDPR and the upcoming EU Data Act, organizations remain heavily dependent on foreign cloud infrastructure. Goud explains that the challenge extends beyond mere infrastructure – it's the absence of true European alternatives for essential software services that creates vulnerability. He highlights recent incidents, including a French Microsoft executive's court admission that Microsoft cannot prevent U.S. government access to data without customer notification, and the shocking case of a Dutch criminal court judge whose email was blocked by Microsoft at the behest of American authorities. These examples underscore how data sovereignty encompasses not just data protection, but also continuity of service and freedom from foreign interference.

When addressing the economic realities of data sovereignty, Goud advocates for a pragmatic, risk-based approach rather than wholesale abandonment of U.S. cloud services. He emphasizes that organizations should start by identifying their specific risks – whether it's human error (the leading cause of data breaches), email interception, weak passwords, or phishing attacks. The solution often lies in implementing encryption layers where organizations maintain control of their own keys, effectively rendering data unreadable even if accessed by unauthorized parties. This approach allows organizations to continue using familiar tools like Microsoft 365 and Gmail while adding crucial security layers for sensitive information, avoiding the massive costs and behavioral changes required by complete infrastructure migration.

The conversation concludes with practical advice for organizations beginning their data sovereignty journey. Goud recommends starting with "low-hanging fruit" – simple security measures that can be implemented quickly, such as activating DANE (DNS-based Authentication of Named Entities) for email encryption, which despite being available for a decade, sees adoption rates of only 15% to 20%. He stresses the importance of email and file security as the primary risk points where data leaves organizational boundaries. Rather than embarking on multi-year infrastructure overhauls, organizations should focus on immediate, achievable improvements while building partnerships with trusted vendors and peer organizations facing similar challenges. This collaborative approach ensures organizations aren't navigating the complex data sovereignty landscape alone.

LinkedIn: https://www.linkedin.com/in/rickgoud/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

Scott McCrady's path to becoming CEO of SolCyber started in the server rooms of the early 2000s. Back then, he was installing Nokia security appliances and building some of the first security operations centers for major corporations. McCrady spent years at companies like Symantec and FireEye, where he learned that keeping businesses safe requires more than just technical know-how. He built Symantec's security services across Asia Pacific, managing teams in multiple countries and learning how different businesses approach security challenges. Later at FireEye, he helped launch their partner strategy during the rise of nation-state attacks. Today, he runs SolCyber with a simple mission: help companies protect themselves from identity-based attacks that bypass traditional security tools.

McCrady explained something that might surprise you: hackers don't break into networks the way they used to. Twenty years ago, they looked for open ports and vulnerable servers. Ten years ago, they targeted employee laptops and phones. Today? They steal usernames and passwords, especially administrative accounts. Insurance companies tell McCrady that nine out of ten breaches happen because someone's login credentials got compromised. The problem gets worse because IT teams often give employees more system access than they need. Why? Because it's easier than figuring out the exact permissions each person requires. McCrady shared a real example: a company with 500 employees had over 70 administrative accounts. Some hadn't been used in nine months, then suddenly started browsing the internet—a clear sign that hackers had taken control.

McCrady works with organizations that can't answer simple questions like "Where are all our security logs stored?" or "Who can access our customer data?" These aren't startups or small businesses—these are established companies with IT departments and security budgets. They have data scattered across different systems, some going to one security vendor, some to another, and some not being monitored at all. While vendors push artificial intelligence and machine learning solutions, most businesses just need help organizing what they already have. As McCrady put it, they need to get their house in order before worrying about advanced threats.

So what actually works? McCrady keeps it simple with five must-haves. First, turn on multi-factor authentication everywhere, even though software companies charge extra for it. Second, add email security beyond what Microsoft or Google provides because business email compromise is how most attacks start. Third, install endpoint detection software that catches modern malware. Fourth, run security awareness training so employees recognize phishing emails (and to keep your cyber insurance valid). Fifth, buy cyber insurance now while it's affordable. McCrady's company, SolCyber, packages these essentials into what they call "foundational coverage"—basically, outsourced security for businesses that need protection but can't afford a full security team. For larger companies, they handle the complex stuff like managing security logs from dozens of systems and responding to attacks in real-time.

LinkedIn Profile: https://www.linkedin.com/in/scottmccrady/

SolCyber Website: https://solcyber.com/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

This Kitecast episode features Chris Pogue, Director of Digital Forensics at CyberCX, a cybersecurity veteran with 25 years of experience. Chris brings unique insights from his extensive background spanning penetration testing, executive leadership, and military instruction. As an adjunct professor at Oklahoma State University, he teaches both international business and digital forensics, emphasizing the critical importance of communication between technical and non-technical stakeholders.

Chris introduces CyberCX as "the biggest cybersecurity company you've never heard of"—a pure-play security firm with 1,500 professionals globally. Founded in Australia through the acquisition of 24 boutique security firms, CyberCX stands apart by focusing exclusively on cybersecurity expertise without the distractions of hardware sales or software development. With specialized teams including 200 penetration testers and 40 incident responders, they offer comprehensive security solutions tailored to each client's unique risk profile.

The conversation reveals alarming trends in the threat landscape, including the surprising resurgence of SQL injection attacks targeting forgotten systems and unpatched vulnerabilities. Chris explains that once an exploit is announced, threat actors typically begin targeting it within 24 to 48 hours, yet organizations often take 60 to 90 days to implement patches. The podcast also explores how ransomware tactics are evolving from simple data encryption to targeting operational technology and critical infrastructure, creating more leverage by disrupting business continuity rather than just threatening data exposure.

Third-party risk management emerges as a critical concern, with Chris noting that the traditional "castle and moat" security model has become obsolete in today's interconnected business environment. He describes how Business Email Compromise attacks frequently move laterally across supply chains, with compromised trusted partners becoming vectors for invoice fraud and malware distribution. The conversation also touches on the emerging role of AI in creating more convincing phishing campaigns and voice synthesis attacks.

Drawing on decades of experience, Chris offers this compelling perspective on security investment: "In my career, I have yet to find an organization who under-invested in cybersecurity and was thankful that they did later." With data breach costs averaging $4.5 million globally and $9 million in the United States, the economic argument for proactive security becomes increasingly clear. Don't miss this eye-opening discussion on the frontlines of cybersecurity defense.

LinkedIn Profile: https://www.linkedin.com/in/christopher-pogue-msis-6148441/

CyberCX: https://cybercx.com/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

In this insightful episode, cybersecurity experts Mike Crandall and Arun DeSouza join host Patrick Spencer to analyze Kiteworks' Top 11 Data Breaches in 2024 Report. Rather than just focusing on the number of records breached, the report introduces a sophisticated algorithm with seven key factors to score breaches on a scale of 1-10. This method provides a more comprehensive understanding of breach severity by evaluating financial impact, data sensitivity, regulatory compliance implications, ransomware involvement, supply chain impact, and attack vector sophistication. National Public Data topped the list with a score of 8.93, followed by Change Healthcare and Ticketmaster, both scoring 8.7.

A significant finding discussed by the experts is the shift in industry targeting patterns, with financial services overtaking healthcare as the most breached sector. The conversation emphasizes how credential theft continues to plague organizations despite sophisticated controls. Five of the top 11 breaches resulted from credential compromises, including attacks that bypassed multifactor authentication. Arun highlights that despite years of security awareness training, approximately 25% of incidents remain attributable to human error. He warns of the growing sophistication of social engineering with AI-generated phishing that will soon include voice modulation and deepfakes, making attacks increasingly difficult to detect. Mike recommends leveraging AI defensively to detect anomalous behaviors that humans might miss.

Both experts stress the critical importance of data protection and classification. Arun advocates for AI-powered data characterization and governance platforms that can proactively identify sensitive information requiring protection. Mike emphasizes the need for proper data classification, noting that organizations often struggle to differentiate between critical and non-critical data. He recommends data minimization strategies including cold storage for inactive data to reduce the potential attack surface. The experts agree that building enterprise-wide risk awareness requires collaboration across departments rather than treating security as an isolated IT function.

The panel concludes that organizations must prioritize zero-trust architecture implementation, adopt data minimization strategies, and enhance incident response capabilities. Arun frames this as a comprehensive coalition of "people, process, and technology safeguards all working together." Mike adds a sobering perspective for businesses that might not see themselves as targets: "These weren't the 11 hacks of 2024. These were the top hacks... there are literally hundreds of thousands, if not millions more. And that's you."

Top 11 Data Breaches in 2024 Report: https://www.kiteworks.com/top-data-breaches-report

Arun DeSouza LinkedIn: https://www.linkedin.com/in/arundesouza/

Mike Crandall LinkedIn: https://www.linkedin.com/in/crandallmike/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.

This insightful Kitecast episode features Dominic Bowen, Partner and Head of Strategic Advisory at 2Secure in Stockholm, Sweden. With over 20 years of experience supporting business leaders, boards, and executives, Dominic brings valuable perspective from his work across cybersecurity, generative AI, risk management, and crisis response. His background spans strategic leadership positions in humanitarian organizations, military service with Special Operations Command, and law enforcement—providing him unique insights into risk management across diverse environments.

Many risks facing organizations today are predictable, not "black swan" events. Dominic emphasizes that effective risk management begins with understanding the business environment before identifying, analyzing, and mitigating threats. Companies that neglect this approach face potential disruptions, as demonstrated by European and North American businesses that expanded into China without adequate risk assessment or those slow to withdraw from Russia after its invasion of Ukraine. Businesses must recognize that events like inflation spikes, terrorist attacks, or regional conflicts aren't unpredictable—proper planning and preparation can help organizations navigate these challenges.

Cybersecurity represents one of the most pressing concerns for business leaders globally. Dominic notes that cyber threats have evolved into warfare weapons, with European officials warning businesses and citizens to prepare for heightened threats. This reality is demonstrated by the Russian attacks on Ukrainian financial institutions before the 2022 invasion and ongoing attacks against energy infrastructure throughout Europe. For businesses, this necessitates not just regulatory compliance but leveraging security frameworks as competitive advantages that enable boards and executives to move forward confidently despite increasing threats.

Artificial intelligence offers transformative benefits for risk management—when properly implemented. Organizations can gain significant advantages through AI-powered predictive analytics, automated threat detection, improved decision-making capabilities, and scenario development. Those organizations leveraging AI for fraud detection, identifying insider threats, and recognizing suspicious transactions position themselves ahead of competitors who fail to adopt these tools.

Effective risk management requires methodical approaches regardless of organizational context. Whether operating in conflict zones, developing humanitarian responses, or expanding business operations, Dominic emphasizes that the process remains consistent: understand the environment before attempting to identify or mitigate risks. Organizations that invest time in thoroughly understanding cultural, linguistic, political, and historical contexts before implementing risk mitigation strategies achieve substantially better outcomes.

LinkedIn Profile: https://www.linkedin.com/in/dominic-bowen/

2Secure: https://2securecorp.com/

Check out video versions of Kitecast episodes at https://www.kiteworks.com/kitecast or on YouTube at https://www.youtube.com/c/KiteworksCGCP.