Senior Advisor, Cybersecurity & Risk
“Strategy is about where you want to go; implementation and audit readiness are about making sure you actually arrive without breaking the business.”
Seeing through the auditor’s lens teaches you that compliance is about proving
operational reality, not writing policy books. It shifts audit readiness from a reactive
“checkbox panic” to upfront scope precision, proactive gap remediation, and the design
of workflows that automatically generate clear evidence. Understanding exactly how an
auditor samples, tests controls, and evaluates risk allows you to streamline the entire
process, preventing audit findings before the external team even steps foot in the room.
As an ISO 42001 Lead Auditor, the biggest gap I see is organizations prioritizing rapid AI
innovation while failing to dedicate the necessary resources for actual governance.
Companies frequently miss establishing documented processes to monitor their AI
models post-deployment—leaving critical blind spots in model drift, bias, and lifecycle
management. They treat certification as a one-time technical checklist rather than
building the continuous, resource-backed AI Management System (AIMS) the standard
requires.
A leader should establish a year-round control monitoring plan rather than treating
compliance as an annual scramble. This requires holding control owners directly
accountable for executing their controls in daily operations and for conducting regular,
continuous testing throughout the year. By sampling evidence quarterly and embedding
control checks into everyday workflows, leaders ensure the management system stays
active, effective, and audit-ready.
The data tells a story that contradicts conventional wisdom about cybersecurity threats.
Verizon’s 2025 DBIR reveals surprising patterns:
What’s really happening: Attackers are exploiting edge devices, chaining vulnerabilities, and using stolen credentials at unprecedented scale. The human element still drives roughly 60% of breaches through credential theft, password reuse, and misconfigurations.
What CISOs must do: Rebalance security roadmaps to address dual-front resilience—strengthening help desk defenses, accelerating patch cadence, and implementing zero-day monitoring alongside traditional awareness training.
2024 marked a decisive pivot in how attackers compromise organizations and the old playbook won’t cut it.
Key findings from FBI IC3, Verizon DBIR, and Mandiant M-Trends:
The trust exploitation trifecta:
What matters now: Supply chain compromises like Snowflake and MOVEit proved that vendor credential abuse creates enterprise-wide disasters. Organizations must align identity, vulnerability, and fraud strategies while treating resilience as a leadership challenge—not just a technical problem.
Your CISO isn’t padding the budget—they’re trying to keep you from becoming the next headline.
Why SIEM and SOAR matter to your business:
Without modern detection capabilities, organizations don’t discover breaches until operations go dark or their data appears for sale. Attackers typically dwell in systems for 11 days before detection, and without SIEM/SOAR, that extends to weeks or months.
The real cost comparison:
Upfront investment: Licensing, staffing, training
vs.
Cost of doing nothing:
Weeks offline
Millions in losses
Brand reputation damage
Trust that’s nearly impossible to rebuild
What executives need to do now:
Bottom line: Firewalls won’t save you from compromised credentials or insider threats. SIEM and SOAR surface what traditional controls miss.
Your CISO is thinking “here we go again” when they hear about AI investments and they have good reasons.
Three critical security questions before you invest:
The reality check: Only 25% of companies see ROI from AI investments, often because they deploy without addressing data quality, volume, and relevance requirements.
Smart organizations assess whether their data infrastructure can support AI securely before procurement—ensuring security leaders are involved early rather than after contracts are signed or data is exposed.
AI data poisoning is the emerging threat most organizations aren’t prepared for.
What it is: Adversaries intentionally introduce corrupt data into AI training or operational pipelines to manipulate model outputs and influence critical decisions in national defense, healthcare, and finance.
Essential defenses:
Proactive security measures:
Bottom line: Organizations must implement multi-layered defenses and real-time monitoring before AI systems impact critical operations.
The White House wants speed and innovation—but security can’t be an afterthought.
Three pillars with security implications:
What organizations must do: Navigate the tension between rapid deployment and robust security controls. Focus on real-world risks around data protection, privacy, and operational resilience rather than hypothetical threats.
Strategic opportunities:
Reality check: Companies in priority sectors may gain partnership opportunities while inviting heightened scrutiny. Security governance must support innovation rather than blocking progress.
State governments are racing to adopt AI—but security challenges threaten to derail modernization efforts.
The opportunity:
The security reality:
State agencies face significant adoption barriers:
What organizations must provide: Help establish governance frameworks enabling secure innovation, implement anomaly detection for AI systems, address workforce readiness, and build capacity that survives administration transitions—all while meeting heightened public expectations for digital-first services.
CMMC is no longer “coming soon”—it’s here, and prime contractors are already asking for proof.
What you need to know:
CMMC (Cybersecurity Maturity Model Certification) is the DoD’s framework for enforcing cybersecurity across 220,000 defense supply chain entities. Final rule became effective December 2024, with Phase 1 beginning September 2025.
Three certification levels:
What prepared suppliers are doing RIGHT NOW:
Reality check: Prime contractors want SPRS scores, System Security Plans, and verifiable control documentation today—not when the RFP arrives.
The “Department of No” isn’t a personality problem—it’s a system problem you can fix.
Why CISOs default to “no”:
Many security leaders were trained for rigor over agility, coming from IT infrastructure or GRC backgrounds. They learned to prevent loss rather than enable innovation. Their cautious behavior is often reinforced by cultures that punish security incidents but rarely reward calculated risk-taking.
How each executive can unlock better partnerships:
The result: When executives lean in with these approaches, CISOs become strategic partners rather than gatekeepers blocking progress.
Attackers are using automation and AI to accelerate breaches and scale credential theft like never before.
The 2025 DBIR shows AI’s impact on attack evolution:
The modernization imperative: Organizations must counter AI-enhanced threats with stronger vulnerability intelligence, automated threat detection, and risk-tiered verification systems.
Bottom line: Technical controls must evolve at the same pace as attack automation. Security teams need to balance traditional human-focused defenses with advanced technical acceleration strategies.
Cloud and SaaS became critical blind spots in 2024, with attackers exploiting weak identity controls at scale.
The cloud vulnerability landscape:
What organizations must do immediately:
The convergence threat: AI-enhanced phishing combined with automated credential stuffing has created faster, more targeted attacks. Security programs must integrate human-centric and exploit-centric defenses, prioritize third-party risk visibility, and implement threat hunting mapped to MITRE ATT&CK.
You can’t stop what you can’t see—and most organizations are flying blind.
The visibility gap: SIEM and SOAR platforms transform scattered technical noise (user logins, network behavior, system alerts) into real-time visibility across your digital ecosystem. This early warning system detects when threat actors are already inside your network, moving laterally, escalating privileges, or quietly exfiltrating data.
The speed imperative: Attackers move faster than legacy processes or overworked analysts can respond. SIEM surfaces meaningful threats quickly, while SOAR automates response playbooks—isolating affected systems, resetting credentials, and notifying responders.
Speed translates to business outcomes:
The 11-day problem: Once attackers breach systems, it typically takes 11 days before organizations realize they’ve been compromised. Without modern detection capabilities, those 11 days often become weeks or months of undetected access.
AI success starts with business fundamentals, not technology trends.
The smart approach:
Apply this filter:
The ROI leaders: Companies achieving $3.70 per dollar spent on AI do so by defining clear objectives, ensuring data readiness, starting with scalable use cases, and preparing for organizational change.
Bottom line: Strategic AI deployment supports people rather than replacing them, strengthening human connection while improving operational efficiency.
Most AI failures happen before the technology is even deployed—because the data foundation is broken.
The three data requirements for AI success:
1. Volume
Most AI models need substantial historical data to learn patterns. Organizations with only dozens of records or limited timeframes will struggle to achieve meaningful results.
2. Quality
Duplicates, inconsistent labeling, and manual entry errors create “garbage in, garbage out” scenarios where AI hallucinates patterns or produces unreliable outputs.
3. Relevance
Even clean data must be the right data for your use case. Wanting to personalize customer emails but only having transaction history won’t work.
The smart approach: Work backward from desired outcomes to identify necessary data sources rather than forcing AI onto existing datasets. Assess your data infrastructure before making technology investments.
America’s AI Action Plan reshapes the regulatory landscape—with major implications for compliance.
What changed:
The global compliance challenge:
U.S. deregulation clashes with stricter international governance:
What this means for business: Organizations operating globally must prepare for compliance friction. The Bipartisan House Task Force Report offers 66 findings and 89 recommendations guiding congressional action. Federal modernization around AI adoption, cross-agency data sharing, and digital-first services creates opportunities while introducing new expectations around transparency, accountability, and risk controls.
The policy window for AI acceleration is open NOW—but strategic deployment requires more than speed.
Critical decisions business leaders face:
What separates winners from the rest:
Secure the foundation:
Build strategically:
Bottom line: Organizations that translate strategy into action while protecting mission-critical systems, design governance supporting innovation, and prepare teams for AI integration will achieve resilient and responsible deployment.
National AI initiatives are driving state modernization—but compliance complexity is exploding.
The compliance landscape:
Federal guidance is accelerating state AI adoption while creating new requirements:
State-level actions:
Persistent challenges:
Reality check: Organizations must navigate complex compliance while helping agencies meet evolving obligations across fragmented systems.
State government modernization creates massive opportunities—if you can address the unique operational challenges.
The scale of the challenge:
Where organizations can add value:
Define and execute:
Transform constraints into advantages: Address budget cycles misaligned with continuous tech evolution, competing agency priorities overriding enterprise objectives, change resistance from embedded processes, talent retention where public compensation can’t compete with private offers, and complex vendor management.
Bottom line: Success requires accelerating AI adoption with governance frameworks enabling secure innovation while transforming resource constraints into strategic advantages.
Universities face a dual challenge: open access to enable research, learning, and knowledge-sharing and high-value data that attracts sophisticated attackers.
Recent attacks reveal the gap:
The stakes are higher than perceived: One breach exposes entire donor pipelines, alumni networks, and student financial data to identity theft and fraud. Education ranks among the most-targeted industries, yet most institutions lack corporate-grade security capacity.
What leadership must address: Build social-engineering awareness across all user groups, strengthen incident reporting workflows, implement role-based training for high-risk staff, and deploy technical controls like MFA and email filtering. The human element drives 60% of breaches.
1. This Is a Visibility Problem.
Rising memory costs quietly reduce security visibility before organizations realize they’ve accepted more risk. The real impact is what teams stop collecting, detecting, and proving.
2. Security Falls Behind AI by Default.
AI and data platforms are refreshed aggressively. Security infrastructure isn’t. That misalignment creates blind spots where new, high-risk workloads run faster than the controls meant to protect them.
3. Cloud Offload Expands Risk Even When Nothing Changes.
Pushing logs to cloud providers to avoid hardware costs often expands third-party and compliance exposure without updating scope, contracts, or evidence expectations. Risk grows quietly while responsibility stays internal.
4. The Real Decision Is Economic.
Organizations will pay either by designing for constrained visibility or by discovering gaps during incidents, audits, or insurance disputes. Treating memory as a security design constraint preserves detection, response, and provability without waiting for budgets to catch up.
This Is a Time-Boxed Advantage
Your Existing Compliance Work Can Compound
Static Compliance Is Becoming a Liability
This Is an Economic Decision
The real question is whether delaying federal readiness by 18–24 months costs more than accelerating now. Think about deal pipelines, partner eligibility, and revenue timing.
About half of your employees use personal AI apps to perform work. Departments bypass IT and Security because the approved path is slower than the unapproved one.
Key findings:
The middle ground CIOs are looking for:
Centralized AI is safer, but too slow. Decentralized AI is fast, but breeds shadow IT and audit exposure. Both governance models depend on the same asset: a curated AI service catalog with tiered ownership.
Stand up the catalog in 60 days:
Tier ownership to risk:
Hard limits for regulated data:
Sensitive data (e.g., CUI, PHI, PII) must stay on Tier 1. Department-level purchasing of generative AI for regulated data creates contract breach risk and audit failure under CMMC, HIPAA, PCI, and SOC 2. Central logging is the audit artifact.
What CIOs and CISOs must do:
Treat shadow AI as an operational opportunity. CIOs who write policy spend months. CIOs who ship a catalog do it in weeks.