GOTD - AI Compilation
===

Speaker: [00:00:00] Welcome to Guardians of the Data. I'm your host, ward Balza. Each episode will explore the passions, expertise, and real world experiences of security leaders who are helping the future of data security and governance. Guardians of the data is made possible by support from Centro. To learn more about our AI powered data security platform, please visit sentra.io.

Let's dive in.

Ward Balcerzak: in your professional opinion, what's the biggest data security challenge organizations are facing?

Dana Kilcrease: you know, so the easy answer to this is gonna be AI, right? This is what everybody's gonna say, and then that's kind of the overarching theme that, that's kind of stretching across everything right now. But maybe digging in a little bit deeper, I think I would say probably, you know, velocity, right, is really that underlying thing that's happening, where all of the security issues that we've been facing forever, um, the speed at which we're, we're forced to address these issues has been increasing, uh, you know, as AI's come onto the scene. Um, and it's really amplified a [00:01:00] lot of the gaps that we've always had, right? So whether it's, you know, just issues with tooling that we've had, to maybe we don't have the, the proper exposure to our boards or other things of that nature, right? So anything that we've been dealing with for a long period of time, all of a sudden these gaps and these technical debts are just growing exponentially, and it's difficult for us to keep up because the resources aren't growing along with the threat,

brent-bigelow_1_04-09-2026_104312: You know,

I think it's an age old one and, always get pauses from people, but unstructured data,

It, it's like asset management, right? It's not been solved., It continues to grow. And I had a wonderful, I, I get together in several CISO groups. yesterday, You know, everyone was talking about things that are about 37 CISOs in the room, and it was, uh, all these different things.

And I said, You know, we, we still haven't solved for what I call the, the simple things like, [00:02:00] uh, asset management, You know, how can you protect what you don't know, have unstructured data? And they all threw up the mantras of, not, not all of them, but You know, AI was a common theme, right?

Hmm.

So we don't know is, is AI like eating all this unstructured data, You know, and, and consuming it.

Uh, it, it is just a funny conversation to watch people go. Hmm, a good point.

Jason Torres: that comes up probably just as much as AI in most conversations. But yeah, I mean, data is still the thing that runs every business, literally every business. And, you know, when you look at it, the, uh, still the number one data security, um, issue I would say is...

Well, there's probably two, but I'm gonna go with the first one. One, knowing what all your data is and where it resides. Um, I think that, uh, that is still a, a number one indicator for, uh, for most organizations. You know, , not talking directly about mine, it's [00:03:00] just, you know, my, uh, my knowledge and insights and talking to all kinds of security and, you know, non-security professionals all throughout the world. Knowing where that that data is and then, you know, who's attached to that data. You know, I think that's still, uh, two things still run, uh, in my mind, you know, neck and neck, hand in hand, you know, overall.

Ward Balcerzak: You can't go to any conference without there being a talk about these two letters. Good old, good old AI, right? Good old AI

Jason Torres: AI.

Ward Balcerzak: in all the shapes and forms. And when, and when I say AI,

it on

I'm, I'm including co-pilots and all of that good stuff.

So, how do you recommend folks combat that? 'Cause I think you laid out some good things, right? You know, ha- have a pulse, have the guardrails, keep track, and I think that's still valid, right? Even, even with AI. But I personally feel like AI just made it worse, right? Like it's accelerated the pace at which this, this randomness happens and, [00:04:00] and data decides to fly around.

So how are you keeping up?

Jason Torres: I'm a, a positive person, so, it's kinda one of those things I, I go back to within my team, um, that I have currently. I like to do icebreakers and, hey, try to understand people more and more in a, in a remote world. And, you know, one of the questions I had this week was, uh, you know, "What's your, your favorite movie quote?"

And, you know, it goes back to, uh, to Star Wars, to, you know, Return of the Jedi, when Luke's talking to, to Vader, and, uh, you know, basically tells him, "Hey, there's, there's good in you. There's still good in you." And, you know, I like to look for the good in, in all situations. I mean, yeah, of course, there's always the bad, the crazy, the ugly, whatever you wanna, to tag it.

But, you know, AI, I look at it as a way to, to help. Uh, know, i- is it easy? You know, is it making things, uh, extremely, uh, you know, satisfying and, and easy processes? No. I mean, there's, there's complexities around it, [00:05:00] but when you look at AI from any asset, from a, data security, perspective, yeah, I mean, data is being created through it, but again, it goes back to setting up the foundational guardrails, to keep things going to where, InfoSec is not a, place of a, of no, it's a place of go.

And go in terms of, hey, we can build it, we can grow it, and we can, support it. But yeah, we've gotta have the foundations in place, AI governance committees are a phenomenal way to, to start and set up that baseline. What are the expectations from a top-level leadership perspective in terms of utilizing AI, what data's going to that AI, and then what are the expected outcomes to help the business, utilizing that AI?

Again, I mean, you gotta have the, that in place, along with policies, overall understanding, education around it. [00:06:00] That's where you're, you're gonna get the most foundational and, you know, thought-provoking discussions to guide things going forward. By just throwing AI out there and saying, "Yeah, we're using it," it's, uh, it's the Wild Wild West.

Eh, that's, uh, that's a recipe for disaster,

brent-bigelow_1_04-09-2026_104312: CEOs are saying, I don't care. I want you using ai.

Yep.

So if you are one of those, you um, know, people that either is an owner of unstructured data or You know, inherited it, how are you gonna keep that from getting ingested? And then knowing what's in there. Um, You know, I, I, I don't know any discovery hasn't come up a whole lot yet. Um, but there's so much unknown in unstructured data. That's why I think it's just such a great one to, noodle on because you can't get your hands around it. You can't measure it, but You know, it's growing and that's the beauty of [00:07:00] it.

It's, like, well, the ocean's going up because stuff's melting. Well Unstructured data's no different. It continues to grow, and you never see people cutting storage on data that they don't know. They just add in some more gigs or terabytes

squadcaster-6gb2_3_04-09-2026_094313: Or petabytes these days.

anand_1_03-03-2026_110353: Now what happens is AI everywhere, so you don't need to know anything.

AI will do it for you. Well, uh, it is not true to an extent. It helps, but it is not true. Uh, AI can, in my humble opinion, people may disagree with me. In my humble opinion, uh, AI cannot replace a clean human brain, at least not in the next century. The most complex machine that ever inventor or discovered or created, whatever [00:08:00] that is, right term to put it.

Is the human brain. It, it's not like a AI thing. It's not like the, the, the flying machine, the rockets, the uh, uh, the planes. And I, I've wondered ponded, how a thousand people can get, get on a, a flight and fly 40,000 feet high with, uh, tons and tons of their baggage. I wonder about it. It's great technology, but defeating that is the human brain.

And again, I've read somewhere, I'm not with conviction to say this. Um, the average human brain usage is about 5% or less. Imagine if a human brain can be utilized for a hundred percent of its capacity. It'll be chaotic for the universe. It's that much capable, but we are not feeding it properly.

Dana Kilcrease: I've taken the approach of taking a step back, taking a deep breath, and really focusing on the [00:09:00] fundamentals, right? What are those, those first principles that we've always had to deal with? Um, and, and really making sure that we're, uh... it's very easy to see the shiny new thing and have to follow that.

but for the past, you know, 18, 24 months, there have been so many shiny new things that it's on a weekly basis there's something new we can point our, attention at. but going back to those fundamentals, those first principles, making sure that, you know, you might not have that newest thing accounted for, but as long as you have other pieces of that kill chain hardened and identified, you're in a good place.

And you're, you might not be 100%, and security's never gonna be a perfect practice, but getting those pieces in place is really gonna pay dividends down the line. And especially because this technology's not going to slow down, and resources aren't going to all of a sudden explode and become abundant in our environment.

Just making sure, like, you have those endpoints protected, you have those processes in place, you have that incident response plan in place [00:10:00] so that you have those resiliency measures is really what it comes down to. So when something does happen, the blast radius is as minimal as possible

Dameon Sherman: It's a problem these days because we have all these tools that are collecting data at record speed, right? We're ingesting this data. You know, because if you, if you think of it, think of all the... With AI and even prior to AI, one of the things that has happened to our society is the interconnection, right?

Interconnectivity. And because of that, you are gonna be faced with a record and a collection of data. Now, how much of that data is useful data? How much, you know, what's the risk to that data? So right, you're identifying it. And also, what is it that's operational data, data that you can use, data that's meaningful, not, you know.

Because the reason why you need to do that, because if you don't do that, you're gonna increase your storage costs, right? Because you're gonna be storing a lot of stuff that you don't need to store, right? So you're gonna look at it [00:11:00] and says, "Okay, is this a bunch of erroneous things that I'm collecting?"

So then, you know, so in data quality, what you're doing, right, you identify the data that's of importance. You identify the, the data that's useful. You identify through all of that, that's gonna drive the protection mechanism, right? Would you, uh, uh, ca- uh, catalog or store non-sensitive data that's out in the public domain that, you know, is just public data.

Why are we storing that data? Is that, you know, is that a waste of our time? But the other thing is to what protection mechanisms are you gonna have around that data now. If it's sensitive data or, you know, or, you know, in the government sense, classified data, it's a little different case, right? Because then you need to separate the data, right?

You'd separate where you're storing that, you know, how you're protecting it, the access controls to it. So those are all part of data quality because if you can't identify the data, because what's gonna lead to data quality? Also, you're gonna tag the data, right? You can identify it, but you wanna [00:12:00] tag it, so you can find the data.

But, you know, it's gonna drive what your security apparatus is gonna look like. So that quality, you know, incorporates a lot of things, a lot of reviews, a lot of understanding, you know, and a lot of definition, you know, what is useful, what is not.

Ward: any thoughts or predictions on where cyber's gonna be kind of going in the next six months? Usually I say, "Hey, any predictions about the next 12, 18 months?" But things are moving so quick, like it doesn't even pay to forecast out that front. So any, a- any big thought for the next six months of cyber?

Dana Kilcrease: Six months? Uh, I don't know. Uh, looking towards the future though, I think that we're most likely going to see a, a few shifts. Um, I think that, that right now we're still at the tail end of that initial explosion of AI's here. We need to find every niche use case for it and have a cybersecurity come out for that. [00:13:00] Um, so I think you're, you're gonna see, uh, somewhat of a collapsing, uh, together of, uh, uh, of companies, right? Where a lot of acquisitions will happen. Um, you're gonna see a lot more push towards more unified or, or s- a holistic approach to a lot of these issues, right? Where you don't have to get these little edge cases. They don't deserve their own products.

anand_1_03-03-2026_110353: The only two fields that I tell to my family, just like to my son and my family, is only two fields that you always, always, always have to be a student.

You can never say that I've learned everything is software field and the medical field. the doctors, or doctors, they're certified and they know what it is, but then there is new disease coming up. There is new technology that actually makes them, uh, learn that so that they can do the, uh, the surgery in a, in a much faster, much efficient, much guaranteed way.

So they, they need to keep on learning. Software, same thing. It was what like, uh, COBOL in 40, 50 years before

ward-balcerzak_14_03-03-2026_100350: [00:14:00] Yep.

anand_1_03-03-2026_110353: whatever the technology, then c then c plus plus, and then Java, object oriented programming, then combination thereof. And then there is, uh, scripting combined and there is Python and now, uh, rust and Scala and like all sorts of, uh, different things.

Eh, there is no inter learning. But then the basics should always be, uh, uh, stuck in the minds of everybody when it comes to data security where employ and simple saying, put a training module one and then two, and then three.

Dameon Sherman: Now, the threat actors are saying, "Oh, no, no, no, no, no." If you have encrypted data, then there must be some sensitive stuff, something you don't want other prying eyes to see. So with, with that said, they're like, "Hmm, you know, let me hold, go ahead and hold onto this information right now till the technology matures, so then I can possibly crack it later."

Or crack, you know, or possibly defeat the crypt, you know, the cryptography, you know, [00:15:00] controls. When I say controls, I'm talking the cryptography technologies and stuff that's built to protect that data. That's what you're looking to do with harvest now. So, you know, if you think of the quantum computing phenomenon, and if you look at what's happening is, with the qubits and the superposition, and not getting into the whole technical, you know, aspects of it and what a quantum computer can do because of the way, you know, it, you know, processes computation com- you know, compared to traditional sequential computations.

You realize that you, it's what used to take years to defeat, and now is just gonna be a matter of, you know, maybe an hour or two hours, you know, depending where the technology goes. Now, one of the things with the quantum computing, I know we are all fixated on the qubits and so on, but I think, you know, the way I'm looking at it, as AI gets better, what happens when you pair AI with quantum?

Because, you know, it's either gonna be AI on steroids, is what some people are [00:16:00] calling it. So, you know, so pairing those two together and looking at how you can defeat, you know, encryption technologies or controls is a real thing.

Jason Torres: that's where we're looking next, at least from, you know, from our team and talking to a lot of other, um, folks that are leading blue teams across all industries, you know, whether it's in the Chicagoland area or throughout the rest of the US and world. But yeah, I mean, how can we utilize AI to, to bring our overall defensive game up?

How can we mature it in terms of what we're trying to do? We've got... have great technology, um, that's in place. We have phenomenal people that are literally working their butts off day in and day out to, to make things better. Um, we've got processes that a lot are manual in nature still. So where I see AI flowing into that is, hey, how can we, how can we accelerate, you know, the overall investigations, you know, bring [00:17:00] things down from, you know, whether it's hours or, or minutes down to, you know, even, even seconds or, you know, a minute or two.

What does it mean to, leverage that AI in that, in that aspect?

Speaker 2: That's a wrap on another episode of Guardians of the Data. Thanks for tuning in for show notes and more Visit Guardians. The data do show Guardians of the data is made possible by support from Centro to see how we help organizations discover and classify all of their data accurately and automatically while quickly achieving scale data protection without the fuss, please visit sentra.io.

Catch you next time.