Future of Data Security

EP 21 — Sendbird's Yashvier Kosaraju on Creating Shared Responsibility Models for AI Data Security

Sendbird had AI agents take backend actions on behalf of customers while processing sensitive support data across multiple LLM providers. This required building contractual frameworks that prevent customer data from training generic models while maintaining the feedback loops needed for enterprise-grade AI performance.
 
CISO Yashvier Kosaraju walks Jean through their approach to securing agentic AI platforms that serve enterprise customers. Instead of treating AI security as a compliance checkbox, they've built verification pipelines that let customers see exactly what decisions the AI is making and adjust configurations in real-time.
 
But the biggest operational win isn't replacing security analysts: it's eliminating query languages entirely. Natural language processing now lets incident responders ask direct questions like "show me when Yash logged into his laptop over the last 90 days" instead of learning vendor-specific syntax. This cuts incident response time while making it easier to onboard new team members and switch between security tools without retraining.
  
Topics discussed:
 
Reframing zero trust as explicit and continuously verified trust rather than eliminating trust entirely from security architectures.
Building contractual frameworks with LLM providers to prevent customer data from training generic models in enterprise AI deployments.
Implementing verification pipelines and feedback loops that allow customers to review AI decisions and adjust agentic configurations.
Using natural language processing to eliminate vendor-specific query languages during incident response and security investigations.
Managing security culture across multicultural organizations through physical presence and collaborative problem-solving approaches rather than enforcement.
Addressing shadow AI adoption by understanding underlying problems employees solve instead of punishing policy violations.
Implementing shared responsibility models for AI data security across LLM providers, platform vendors, and enterprise customers.
Prioritizing internal employee authentication and enterprise security basics in startup scaling patterns from zero to hundred employees.

EP 20 — MoonPay's Doug Innocenti on The Gut Instinct Gap in AI Security Operations

What happens when you scale a crypto company across 160+ countries while maintaining the same security standards as Wells Fargo? At MoonPay, it meant rethinking how traditional banking security translates to high-velocity fintech environments. Doug Innocenti, CISO, breaks down how his team achieved PCI, SOC 2 Type 2, and regulatory licenses like BitLicense and MiCA without slowing product development. The secret is the ability to test multiple security tools in parallel and pivot quickly when something isn't working.
 
But velocity alone isn't enough, he cautions Jean. Doug's approach to AI in security reveals a critical insight: although AI-powered tools can dramatically reduce SOC response times and automate incident analysis, the "gut instinct gap" remains. His team uses AI to enable faster decisions, not replace human judgment — especially when patterns don't match what the algorithms expect to see. 
 
Topics discussed:
 
Maintaining bank-level security posture while enabling startup velocity through security-first architecture and platform design principles.
Scaling compliance across 160+ countries using pre-built infrastructure that accommodates PCI, SOC 2, BitLicense, and MiCA requirements.
Implementing parallel security tool testing to accelerate vendor evaluation and avoid bureaucratic delays in enterprise environments.
Adopting next-generation DLP solutions like DoControl that use AI-powered business intelligence for dynamic data boundary creation.
Balancing insider threat monitoring with external threat defense through compensated controls and rapid reaction capabilities.
Managing AI adoption risks while embracing acceleration benefits through defensive technology investment and vendor selection criteria.
Using AI-enhanced SOC and SIEM operations to reduce incident response times while preserving human judgment for pattern recognition.
Building transparent security culture where all employees become security professionals rather than maintaining background security operations.

EP 19 — Cribl's Myke Lyons on Data Hierarchies That Cut Security Costs

Myke Lyons brings an unconventional background to cybersecurity leadership, having trained as a chef before discovering his passion for breaking and rebuilding IT systems. As CISO at Cribl, he applies culinary principles like mise en place to security operations while solving the fundamental economics problem facing every security team.
 
The math is unforgiving, he tells Jean: data volumes grow at 28% annually while security budgets remain flat. Myke's solution involves intelligent data hierarchies that route critical authentication logs to expensive SIEM systems while automatically sending regulatory compliance data to cheaper cold storage, reducing costs by 70-80% through format optimization.
 
Topics discussed:
 
The fundamental economics challenge of increasing annual data growth versus flat security budgets and how intelligent data hierarchies solve this by routing critical logs to expensive systems while storing compliance data in cheaper cold storage.
Smart data pipeline architecture that eliminates vendor lock-in by enabling simultaneous testing of multiple security technologies on identical datasets while maintaining complete data ownership across any storage platform.
Building security culture through partnership rather than punishment, including automated nudges for personal account security and micro-bonus rewards for completing security training.
AI agent implementation for automated phishing response that performs tier-two-level analysis, hunts across email environments, and provides cohesive incident summaries with risk ratings for security analysts.
The evolution from manual security operations to AI-powered automation, with predictions that full tier one analyst capabilities will be available within months for organizations with comprehensive security telemetry.
Data format optimization strategies that reduce log storage costs by 70-80% through UNIX timestamp conversion and elimination of redundant vendor-specific wrapper formats that create unnecessary data bloat.
Mise en place principles from professional kitchens applied to security incident response, treating procedures like recipes with clear preparation steps and proper tooling to reduce response time and improve consistency.
The importance of establishing data architecture early in security programs to avoid complicated remediation of poor data decisions that become exponentially more expensive to fix over time.
LLM integration for security operations including query writing assistance, pipeline creation, sensitive data redaction, and context-aware threat intelligence that reduces analyst toil and improves detection capabilities.

Ask Jean – Why Doesn't 100% Data Coverage Equal 100% Protection?

Welcome to a special edition of Future of Data Security, where our host Jean Le Bouthillier answers the top questions our listeners have asked us. In today's episode, Jean addresses why 100% data coverage doesn’t equal 100% protection. 
 
Would you like to have Jean answer one of your questions in a future episode? Email podcast@qohash.com with your question and a short summary of why you're looking for an answer!
 
 

Ask Jean – How Does Data Visibility Transform Crisis into Calm?

Welcome to a special edition of Future of Data Security, where our host Jean Le Bouthillier answers the top questions our listeners have asked us. In today's episode, Jean addresses how data visibility can turn crisis into calm. 
Would you like to have Jean answer one of your questions in a future episode? Email podcast@qohash.com with your question and a short summary of why you're looking for an answer!

EP 18 — GW Law’s Robert Kang on Why Moving Too Slow With AI Creates Shadow Adoption

Robert Kang, Professorial Lecturer of Cybersecurity & National Security, The George Washington University Law School, has been building enterprise cybersecurity programs since 2009, making him one of the “OG” practitioners when most organizations didn't even have dedicated cyber counsel. His unique perspective comes from protecting both critical infrastructure and social media platforms, highlighting how the same governance, risk management, and compliance framework applies across radically different threat landscapes. 
 
In his conversation with Jean, he shares why organizations face equal risks from implementing AI too quickly or prohibiting it entirely, and how complete AI prohibition drives employees to use personal accounts for business purposes, eliminating organizational oversight entirely. Robert's systematic approach to building relationships with law enforcement agencies before crisis situations emerge provides a practical framework most organizations ignore. From free services like InfraGard to subscription-based programs like the National Cyber Forensics Training Alliance, these partnerships deliver both threat intelligence and confidential channels for sharing information with federal agencies. 
  
Topics discussed:
 
The fundamental differences between protecting critical infrastructure versus social media platforms while using identical governance, risk management, and compliance frameworks.
Why complete AI prohibition creates shadow adoption risks where employees use personal accounts for business purposes, eliminating organizational oversight and control.
Building systematic relationships with law enforcement agencies through programs like InfraGard and the National Cyber Forensics Training Alliance before crisis situations emerge.
The evolution of enterprise cybersecurity legal programs from non-existent in 2009 to essential business functions requiring dedicated counsel and executive sponsorship.
How anticipating technology trends years in advance, rather than reacting to current adoption, positions cybersecurity professionals ahead of emerging threats.
Training methodologies for technology lawyers that combine legal knowledge with technical understanding of AI, cybersecurity, and privacy frameworks.
Essential certification pathways for legal professionals entering technology risk management including CC, CIPP, and AIGP credentials.
Government threat-intelligence-sharing programs ranging from free public services to subscription-based personalized assistance for specific industries.
Why law schools must teach both the law of AI and the technology of AI to prepare students for the transformed legal profession.

Ask Jean - What's The Fastest Way To Reduce Data Security Risk?

Welcome to a special edition of Future of Data Security, where our host Jean Le Bouthillier answers the top questions our listeners have asked us. In today's episode, Jean addresses the fastest way to reduce data security risk.   
Would you like to have Jean answer one of your questions in a future episode? Email podcast@qohash.com with your question and a short summary of why you're looking for an answer!
Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 
 
Listen to more episodes: 
Apple 
Spotify
YouTube 

EP 17 — Modern Health’s Michael Hensley on Healthcare Security Beyond HIPAA Compliance Checkboxes

The healthcare industry's digital transformation has created unprecedented opportunities for patient care delivery, but it's also introduced complex security challenges that extend far beyond traditional compliance frameworks. Michael Hensley, Director of Cyber Security at Modern Health, brings a unique perspective to protecting private — and heavily regulated — health data while maintaining the innovation velocity essential for startup success. Healthcare security teams must balance regulatory requirements with business agility, creating frameworks that protect patients without stifling innovation. 
 
Michael's journey from professional musician to software engineer to cybersecurity leader shaped his understanding that effective security programs prioritize people and processes alongside technology investments. His approach demonstrates how healthcare organizations can build security frameworks that enable rather than restrict innovation, creating speedy review processes for new technologies while maintaining rigorous patient data protection standards. His conversation with Jean also explores the evolving landscape of healthcare cybersecurity, from shadow AI risks to the misconceptions surrounding HIPAA compliance.
 
Topics discussed:
 
The fundamental difference between healthcare cybersecurity and other industries, focusing on real-world patient impact rather than just financial or reputational damage from data breaches.
Common misconceptions about HIPAA compliance, including the regulation's flexibility and how organizations must interpret general requirements based on their specific business models and patient populations.
How telehealth expansion created new security paradigms, enabling rapid service deployment through cloud-native platforms while introducing risks from easy misconfigurations and third-party integrations.
Shadow AI emergence in healthcare environments where employees seek productivity gains through unauthorized AI tools, potentially exposing patient data to non-compliant platforms without understanding regulatory implications.
Organizational strategies for safe AI adoption in regulated industries, including dedicated review processes, governance committees, and internal tool development that unlocks productivity while maintaining compliance.
The evolution from traditional on-premises healthcare security models to cloud-native architectures where services can be deployed with minimal friction but require sophisticated guardrails to prevent data exposure.
Advanced approaches to vendor risk management in healthcare technology, balancing the need for third-party integrations with rigorous security and compliance vetting processes.
Why effective cybersecurity programs treat people and processes as equally important to technology investments, focusing on ownership models and operational sustainability rather than just tool deployment.
Building security teams that enable business objectives through speedy review processes and treating compliance requests as first-class problems rather than obstacles to innovation.

Ask Jean - How Does GenAI Reshape Data Security Risk?

Welcome to a special edition of Future of Data Security, where our host Jean Le Bouthillier answers the top questions our listeners have asked us. In today's episode, Jean addresses how GenAI is reshaping data security risk. 
Would you like to have Jean answer one of your questions in a future episode? Email podcast@qohash.com with your question and a short summary of why you're looking for an answer!
Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 
Listen to more episodes of Future of Data Security: 
Apple 
Spotify
YouTube 

EP 16 — KPMG’s Orson Lucas on Why One-Time Security Investments Tend to Fail

The world of data security has fundamentally changed, yet many organizations still approach it as a one-time project rather than an ongoing journey. In this episode of The Future of Data Security, Orson Lucas, Principal at KPMG, draws on his 20+ years of experience to challenge the "one-and-done" approach that dooms many security initiatives. After witnessing the evolution from obscure privacy regulations to strategic business differentiators, Orson walks Jean through why even the most sophisticated organizations struggle with fundamental data governance and how the rise of AI assistants is creating unprecedented new risks.
 
Orson discusses why privacy is fundamentally a data governance problem, how to balance comprehensive security with practical investment limits, and why the most effective security strategies build on existing technology ecosystems rather than creating parallel systems. He also shares candid insights about how AI assistants like Microsoft Copilot are changing the risk equation by inheriting user permissions to access sensitive data that humans would never realistically browse through.
 
Topics discussed:
 
The critical shift from viewing data security as a one-time project to an ongoing journey requiring continuous investment, as threat landscapes constantly evolve even when controls remain static.
Why fundamental data discovery (what you have, where it is, how it flows) remains the most challenging yet essential foundation for effective security, with organizations often attempting to "boil the ocean" rather than taking a risk-based approach.
The evolution of enterprise security governance structures, with privacy teams increasingly functioning as second-line policy setters while security teams handle operational implementation.
How "hanging access" creates major security vulnerabilities when departed employees leave behind orphaned permissions with no clear ownership, especially in unstructured data environments.
The emerging risk paradigm where AI assistants inherit user permissions but access far more data than humans realistically would, turning theoretical access risks into actual exposure.
Practical strategies for managing shadow AI by creating internal, managed alternatives that provide similar functionality with proper security guardrails rather than simply blocking innovation.
Why effective security strategies often build upon existing technology investments rather than creating parallel systems, using tools like DLP for broader data discovery purposes.
The limitations of viewing data residency as merely a compliance checkbox, with more sophisticated organizations focusing on broader supply chain integrity and provenance issues.
How balanced security partnerships require understanding stakeholder priorities across legal, privacy, security, data governance and marketing teams to achieve organizational alignment.
Approaches for managing third-party risk as vendors increasingly integrate AI features without proper opt-in controls or transparency about data usage for model training.