Kizilelma Warns AI Pilots Stall as Firms Bypass Risk Governance
Ai4
Enterprise AI deployments fail at scale because organizations skip risk frameworks during sanitized pilots, exposing legacy infrastructure to automated threats.
## Background
Published on YouTube by the Ai4 channel on August 17, 2026, this presentation features Tolgay Kizilelma, Director of the MS in Cybersecurity Program at Dominican University of California. According to the description, the session provides a practical blueprint for accelerating AI adoption while maintaining governance, security, privacy, and trust to deliver measurable business value.
## TL;DR
Tolgay Kizilelma explains why enterprise AI initiatives frequently stall when transitioning from low-friction proofs of concept ('less') to full-scale production ('more'). Scaling requires high-level governance, strict data quality, and aggressive use-case prioritization to filter hundreds of brainstormed ideas down to high-impact implementations. Because AI probabilistic layers amplify existing legacy vulnerabilities and introduce new threats around vector databases and prompt injection, organizations must ensure robust foundational hygiene. Ultimately, modern CISOs must evolve from defensive gatekeepers into strategic business enablers who guide organizations safely toward value creation.
## Atmosphere & style
The talk combines an approachable, conversational speaking style with pragmatic executive authority, opening with self-deprecating humor and playful audience interactions around prompt injection. Kizilelma cuts through generative AI hype using vivid analogies, such as warning against moving luxury furniture into an untidy bedroom. Watching the session feels like attending a grounded, eye-opening executive briefing that balances sobering cautionary advice on governance with empowering strategic clarity.
## Key takeaways
- [00:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=4s) Artificial intelligence dates back to 1956, but generative AI created an urgent push toward rapid proofs of concept and experimental pilots.
- [02:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=163s) The primary barrier to scaling AI is governance rather than conventional IT constraints like infrastructure, data availability, or staffing.
- [02:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=163s) The 'less versus more' dilemma causes pilots to fail when transitioning from isolated scopes and public data to cross-departmental friction, sensitive enterprise data, and complex risk assessments.
- [06:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=364s) AI adoption requires balancing traditional IT enablement and security controls with qualitative imperatives such as fairness, bias, explainability, trust, and safety.
- [06:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=364s) Organizations must adhere to a structured AI lifecycle and roadmap to prevent wasted capital and workforce fatigue on initiatives with zero ROI.
- [09:31](https://www.youtube.com/watch?v=8Z0ScINggaY&t=571s) Enterprises should use a use-case pyramid to filter out non-viable ideas and focus resources on the top high-impact use cases aligned with core business pain points.
- [09:31](https://www.youtube.com/watch?v=8Z0ScINggaY&t=571s) Model accuracy is directly governed by rigorous data engineering, cleansing, and normalization to avoid amplifying garbage-in, garbage-out outcomes.
- [13:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=823s) Deploying probabilistic AI on unpatched legacy infrastructure amplifies existing security vulnerabilities to automated adversary scanning.
- [13:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=823s) The shift toward vector databases and unstructured data introduces novel threat vectors like prompt injection and data poisoning alongside traditional identity and encryption needs.
- [16:24](https://www.youtube.com/watch?v=8Z0ScINggaY&t=984s) While human-in-the-loop oversight is currently critical, it may eventually become viewed as an operational bottleneck if human acceptance rates consistently reach near-total alignment with AI outputs.
- [16:24](https://www.youtube.com/watch?v=8Z0ScINggaY&t=984s) Modern CISOs must evolve from defensive technical gatekeepers into proactive business enablers that align security, privacy, and architecture with strategic value creation.
## Detailed walkthrough
### [00:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=4s) The Starting Point: Moving from Proof of Concept to Enterprise Scale
Tolgay Kizilelma begins his talk with a lighthearted introduction about his name, joking that while people hear "tall guy," he is only 5'9", "like a short guy." Turning to the audience, he gauges where everyone sits on the AI adoption journey. He asks how many attendees have already kicked off AI projects, efforts, or initiatives, seeing hands go up for about 60% of the room. He then rephrases the prompt to ask how many have *not* started anything at all—and when zero hands go up, he jokes, "See that's prompt injection 100%. 60% 100% it's the same question."
He emphasizes that artificial intelligence itself has been around since 1956, but generative AI has catalyzed a rush of immediate activity. Most organizations kick off their journey out of sheer urgency, spinning up quick, dirty, and experimental proofs of concept (PoCs) or pilots just to see if the technology works. However, where an organization starts is rarely indicative of where it will end up. The ultimate destination is enterprise scaling: achieving genuine readiness, realizing productivity gains, elevating workforce competencies, and capturing real value propositions. Bridging that chasm between isolated pilots and full-scale operationalization is where organizations encounter their steepest hurdles.
- AI development roots trace back to 1956, but GenAI has shifted the timeline from gradual experimentation to urgent proof-of-concept deployment.
- Initial pilots serve as rapid, low-friction technical validations, whereas enterprise scaling demands governance, workforce enablement, and long-term value capture.
---
[02:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=163s) The Dilemma of "Less vs. More" and Why Pilots Fail to Scale
When AI initiatives hit roadblocks, organizations tend to blame the usual suspects: infrastructure constraints, data availability, staffing shortages, or lack of executive sponsorship. Kizilelma clarifies that while traditional IT challenges certainly exist, the fundamental barrier is governance. If governance is not established at the highest tier, guardrails fail, and possessing the latest model architecture becomes useless.
The core trap is what he describes as "less versus more." In the pilot phase, everything involves "less": teams work with a small, tightly scoped set of requirements, limited personnel, a couple of departments, and non-sensitive, public data. In that sanitized bubble, the model outputs beautiful visuals, answers test prompts accurately, and impresses leadership. Executives then issue the mandate: deploy it and scale it across the entire enterprise.
Suddenly, the organization is confronted with "more":
- **Scope expansion**: Dozens of departments become involved, multiplying inter-departmental meetings, cross-functional dependencies, and resource contention.
- **Sensitive data**: Production requires real, confidential, proprietary enterprise data rather than sanitized public test sets.
- **Unaddressed risk**: Enterprise-wide risk assessments—completely bypassed during the pilot—must suddenly be conducted at scale.
Because organizations skip foundational strategy and roadmapping during the excitement of the initial pilot, the entire effort stalls when transitioned to enterprise reality.
[06:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=364s) Striking the New Balance: Trust, Bias, and the Adoption Blueprint
Historically, enterprise IT balanced technological enablement on one side against security, privacy, and risk controls on the other. AI fundamentally disrupts that equation by introducing a suite of qualitative and ethical imperatives: fairness, bias, explainability, trust, and safety. Every organization must define what this new equilibrium looks like within its specific cultural and operational context before moving forward.
Kizilelma stresses the concept of the lifecycle. Whether structured linearly or cyclically, an AI lifecycle spans early design and planning, business use-case evaluation, data gathering, testing, deployment, and ongoing operations. Skipping any stage in this sequence causes the entire framework to break. He references the classic Technology Adoption Model: organizations naturally fall across a spectrum ranging from early adopters to followers and laggards. While waiting to see how the market shakes out is acceptable, operating without a defined roadmap and strategic objectives is disastrous. Blind execution without strategic alignment burns financial funding and drains workforce capacity on initiatives that yield zero return on investment.
---
[09:31](https://www.youtube.com/watch?v=8Z0ScINggaY&t=571s) Prioritizing the Use-Case Pyramid and Data Quality
To illustrate disciplined prioritization, Kizilelma introduces a use-case pyramid. An enterprise might brainstorm 200 prospective AI use cases:
- Approximately 100 fall completely outside the pyramid because they deliver no tangible business value and should be discarded immediately as waste.
- Inside the pyramid, another 100 viable use cases compete for attention.
- Given limited budgets and human resources, the organization must aggressively filter those down to the top five high-impact use cases.
Selection must hinge on solving acute operational pain points, aligning with strategic enterprise goals, optimizing risk, and ensuring compliance.
At the center of these selected use cases sits data fitness. Model performance is directly proportional to data quality, integrity, timeliness, and accuracy. Without rigorous data engineering—encompassing ETL, data cleansing, and normalization—generative models will simply amplify "garbage in, garbage out."
Furthermore, once models enter production, operations diverge from deterministic software engineering. Because generative and predictive architectures are susceptible to data drift over time, they require constant observability, drift monitoring, and safety guardrails. While human-in-the-loop (HITL) oversight is currently essential, Kizilelma notes a provocative long-term shift: over the next 5 to 10 years, as organizational trust matures, human intervention may actually become viewed as a latency bottleneck and an error-prone operational barrier, prompting automated AI governance to take precedence.
---
[13:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=823s) Legacy Infrastructure, Vector Databases, and Modern Security Realities
Deploying AI models does not replace legacy systems; it layers complex probabilistic architectures on top of existing firewalls, servers, networks, and applications. If an organization has failed to remediate its baseline legacy vulnerabilities or implement zero-trust access controls, adopting AI will not fix those problems. Instead, AI exposes those hidden vulnerabilities to external threats. Adversaries use automated tooling to scan and map an organization's asset inventory and exploit vectors in seconds—tasks that previously required days or weeks of manual probing.
Simultaneously, enterprise data management has evolved far beyond traditional relational SQL databases and structured spreadsheets into unstructured video, audio, text embeddings, and vector databases:
- **Novel infrastructure**: Vector indexes and embeddings introduce uncharted architectural surfaces that still require basic controls like identity access management and robust encryption.
- **Emerging threat models**: Security teams must defend against generative-specific threats, including prompt injection, training-data poisoning, and inference manipulation, alongside conventional vulnerabilities.
- **Hygiene as a prerequisite**: Adopting AI before cleaning up internal data and access controls is likened to moving luxury furniture into a messy, disorganized bedroom without tidying up first.
---
[16:24](https://www.youtube.com/watch?v=8Z0ScINggaY&t=984s) The Trajectory of Adoption and the Modern CISO's Mandate
From an executive vantage point, market trajectory remains decisively upward. As long as the perceived business value of AI outweighs current operational and regulatory risks, enterprises will continue to accelerate adoption. Kizilelma predicts this trajectory will climb steadily until a catastrophic event occurs—"a plane will crash," forcing a temporary six-to-twelve-month pause while governments enact reactive laws and regulations, after which the upward trend will inevitably resume. Organizations cannot afford inaction, but their strategy must reflect their maturity and size, whether they are a 4-person team or a 1,000-person enterprise.
On operational governance, he revisits the tension surrounding human-in-the-loop workflows. If an enterprise finds its human operators accepting automated AI recommendations 95% of the time, the remaining 5% human friction point ceases to be a safeguard and instead becomes an impediment to speed and productivity.
He concludes with a call to redefine executive leadership: the Chief Information Security Officer (CISO) cannot operate merely as a defensive technical gatekeeper. The modern CISO must step up as a proactive business enabler. By synthesizing cybersecurity, privacy, regulatory compliance, and underlying IT architecture, the CISO helps leadership capture real value without exposing the business to catastrophic risk.
- CisOs must transition from rigid technical managers to cross-functional business executives aligned with value creation.
- A strategic roadmap with built-in guardrails allows organizations to pivot and self-correct when unexpected technical or ethical complications emerge.
## Notable quotes
> [00:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=4s) tall guy — Tolgay Kizilelma
> [00:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=4s) like a short guy. — Tolgay Kizilelma
> [00:04](https://www.youtube.com/watch?v=8Z0ScINggaY&t=4s) See that's prompt injection 100%. 60% 100% it's the same question. — Tolgay Kizilelma
> [02:43](https://www.youtube.com/watch?v=8Z0ScINggaY&t=163s) less versus more — Tolgay Kizilelma
> [09:31](https://www.youtube.com/watch?v=8Z0ScINggaY&t=571s) garbage in, garbage out. — Tolgay Kizilelma
> [16:24](https://www.youtube.com/watch?v=8Z0ScINggaY&t=984s) a plane will crash — Tolgay Kizilelma
## Mentioned
Tolgay Kizilelma, Dominican University of California, Ai4, Technology Adoption Model, Chief Information Security Officer (CISO)
## Video description
Tolgay Kizilelma - Director of MS in Cybersecurity Program, Dominican University of California
AI initiatives often fail not because of technology, but because organizations lack a clear path from vision to value. This session provides a practical blueprint for accelerating AI adoption while maintaining security, governance, and trust. Attendees will learn what successful AI programs have in common, how to align AI initiatives with business objectives, and how to navigate the journey from strategy, use-case selection, and risk assessment to implementation, deployment, and ongoing oversight. The presentation will highlight key security, privacy, governance, and operational considerations that enable organizations to deliver measurable business value, meet stakeholder expectations, and scale AI safely and responsibly.
Tolgay Kizilelma argues that enterprise AI initiatives stall not from technical limitations, but from a failure of top-tier governance and strategic planning when transitioning beyond isolated proofs of concept. To successfully bridge this divide, organizations must prioritize data quality, secure underlying infrastructure, and transition the Chief Information Security Officer (CISO) from a defensive gatekeeper into a proactive business enabler.
The "Less vs. More" Pilot Scaling Trap (2:43)
While initial generative AI proofs of concept can be deployed quickly to test viability, Kizilelma highlights that isolated pilots operate under conditions of "less": limited personnel, narrow scope, a couple of departments, and non-sensitive public data. In this sanitized environment, models easily produce polished results without triggering enterprise-grade scrutiny or cross-functional friction.
Failure occurs when leadership mandates a full enterprise rollout, confronting the initiative with conditions of "more." Scaling introduces cross-departmental dependencies, proprietary data integration, and unaddressed operational risks that were bypassed during early experimentation. Without strategic roadmapping and top-tier governance established prior to deployment, initiatives inevitably stall when forced into complex organizational realities.
Disciplined Use-Case Selection and Data Engineering (9:31)
Rather than pursuing every conceptual application, Kizilelma recommends filtering prospective initiatives using a use-case pyramid. Out of an initial brainstorm of 200 use cases, he notes that approximately 100 deliver no tangible value and should be discarded, while the remaining 100 viable options must be aggressively filtered down to roughly five high-impact priorities that solve acute operational pain points within budgetary limits.
Once selected, model performance relies on rigorous data engineering, cleansing, and normalization to prevent generative models from compounding low-quality inputs. Because machine learning systems diverge from deterministic software engineering, they require continuous observability to counter data drift. Kizilelma projects that over the next 5 to 10 years, human-in-the-loop oversight may shift from an essential safeguard to an operational latency bottleneck, particularly when human operators agree with automated recommendations 95% of the time.
Legacy Vulnerabilities and Emerging AI Threat Surfaces (13:43)
Deploying generative architectures does not replace legacy IT infrastructure; it layers probabilistic models over existing servers, firewalls, and networks. Kizilelma emphasizes that failing to remediate baseline vulnerabilities or implement zero-trust controls leaves internal weaknesses exposed, especially as adversaries use automated tools to scan enterprise assets in seconds. Adopting AI before resolving existing security deficiencies is comparable to placing luxury furniture into an untidy room.
Simultaneously, the transition to vector databases, unstructured media, and text embeddings introduces novel architectural exposure. Alongside conventional security standards like identity access management and encryption, security teams must now defend against generative-specific risks, including prompt injection, training-data poisoning, and inference manipulation.
Redefining the Modern CISO as Business Enabler (16:24)
Kizilelma observes that market adoption will continue to accelerate as long as perceived business value outpaces regulatory and operational risks. He predicts this upward trajectory will proceed steadily until an inevitable catastrophic failure—a metaphorical "plane crash"—forces a temporary six-to-twelve-month pause while governments enact reactive legislation, after which adoption will inevitably resume.
To navigate this environment, Kizilelma asserts that the modern CISO cannot operate strictly as a defensive gatekeeper who blocks implementation. Instead, CISOs must become proactive business enablers who synthesize cybersecurity, privacy, IT architecture, and compliance to capture value while establishing guardrails that allow organizations to self-correct during technical or ethical complications.
Kizilelma concludes that while market momentum toward AI adoption is inescapable, technical execution cannot outrun foundational strategy. The open challenge for organizations lies in managing the transition from manual, human-governed safeguards to scalable automated controls without exposing legacy infrastructure to catastrophic failures or unmanageable risk.
[0:04] Tolgay Kizilelma: tall guy
[0:04] Tolgay Kizilelma: like a short guy.
[0:04] Tolgay Kizilelma: See that's prompt injection 100%. 60% 100% it's the same question.
[2:43] Tolgay Kizilelma: less versus more
[9:31] Tolgay Kizilelma: garbage in, garbage out.
[16:24] Tolgay Kizilelma: a plane will crash
Original transcript
[0:04] My name is tall guyma tall guy like a short
guy. I'm not that tall just 5'9 but that's the
[0:10] pronunciation. So we're going to be talking
about our journey road map right I'm hoping
[0:14] everybody's on on this road map the journey
and all we want to do is really get from here
[0:19] to there and of course when we get there
something a new journey begins. It's the
[0:24] AI journey right? [clears throat] So where you
start sometimes right it's not a good indication
[0:32] of where you're going to end up with. Let me
ask before we start [clears throat] how many of
[0:37] you here I mean there's some good crowd have done
some started some doing some something about the
[0:43] AI projects efforts initiatives how many of you
have started that let me see the hands okay like
[0:51] uh 60% something okay let me actually
ask ask in a different way how many of
[0:55] you have not started doing anything about
the AI efforts projects pilots PC's none
[1:04] See that's prompt injection 100%. 60% 100%
it's the same question right so we're on a
[1:12] journey obviously and most of the time I think
our journey starts with the need we understand
[1:19] there's something oh AI and by the way it's not
AI it's the geni AI has been there since 56 we
[1:23] all know that so we want to do something about it
it's a reality so we start doing most of the time
[1:29] with the proof of concept pilot of course we have
to deal with strategy all that but the immediate
[1:36] action is let's do something quick and dirty
right fast experimental see if it works see if the
[1:42] technology works how many of you in that position
done some pilot proof of concept anybody no couple
[1:51] of hands okay so on the other hand what we're
trying to get that destination is the enterprise
[1:59] scaling right that's where we want to put
everything into good use the AI take advantage of
[2:05] the um the value proposition from AI, productivity
gains, workforce capability, competency, all those
[2:11] things, right? And that's really where enterprise
readiness comes into play. And what we're going to
[2:18] discuss is really how do we go from our starting
point where we do some pilism proof of concept
[2:24] because we understand that's the right thing to do
and going there, putting it, deploying it, right?
[2:30] everything in between so that our enterprise our
workforce start using it right at that scale. So
[2:35] that's really the question and it doesn't happen
overnight. There are challenges obviously.
[2:43] So the usual suspects suspects about this there
are challenges. We talk about you know the uh the
[2:51] technology element. We talk about you know data
resource issues sponsorship the things that you
[2:57] would basically come up with just like any other
project. Oh we have these issues these are the
[3:03] challenges but just like [snorts] everything else
data is at the core of it. We understand garbage
[3:09] in garbage out. Um governance is important right?
So we want to make sure we address that because
[3:17] everything else we do is implicated by that.
There's an implication. If you don't do the
[3:22] governance at the highest level, we can't do the
rest properly. We don't have if you don't have
[3:27] the guardrails, it doesn't matter if you have
the latest technology. And some really think,
[3:32] oh, it's a technology issue. Obviously,
that's not the case. So the challenges we
[3:37] think there just like traditional challenges,
they are there. But guess what happens? It's
[3:44] really others. It's really the issue of the less
versus the more because we are so excited to do
[3:52] something about the AI genai. We just start
doing maybe do some prep work, assessment,
[3:59] all that with the help of our vendor with some
pilot P right some readiness assessment but all
[4:07] that work right in terms of the data limited
data resources have a couple of people couple
[4:14] of department timeline it's just requirements
are very scope right it's all small versus
[4:22] you're trying to okay that works We tested the
technology. You didn't use your data. It's not
[4:30] the sensitive confidential. You just use public
data. You made sure yeah it creates nice visuals.
[4:36] This and that. You ask questions. It answers.
You verify it, validate it to leadership. Yeah,
[4:41] this is working. And they are expecting you. Okay.
Make it happen. Deploy it. Scale enterprise. So
[4:49] what happens now? All the issues the more comes in
more departments more data and data more meaning
[4:57] all your sense of confidential collaboration
partnership from different units right meetings
[5:03] more people more resources risk assessment that
you have you have not done right properly small
[5:08] scope huge enterprise risk assessment implications
complications it's just huge difference and that's
[5:16] really the where the challenges are resource
issues It's one thing to do like you know pilot
[5:23] right on a public data just so that the you know
okay that the tool works platform works is another
[5:28] thing you deploy try to scale it enterprise and
that's really where the challenges are and that's
[5:37] why most organizations really you know can't go
from here to there or the next level because they
[5:44] didn't do the proper design strategy road map
the initial things the things that they should
[5:50] have done early right before designing planning
everything around strategy road map right so those
[5:57] are important to address and that's really what
we're going to kind of cover in a way so there's
[6:04] a balance think about the traditional way of
there's it on the other hand on the other side
[6:11] of the coin what security privacy right risk so
there's that balance and that balance is not like
[6:17] this equal value is more I creates more value
there's security risk associated we do controls
[6:24] whatever so there's this balance somehow [snorts]
now in this this is the old way right now we have
[6:30] new terminology new things new player in the game
due to AI we have trust we we have fairness bias
[6:38] ethics right explanability all those things
that's all on this side so we have to kind of
[6:44] find that new balance so that we can move forward
once we find out that balance what that balance
[6:50] means for our own context. Every organization is
different, right? Culture, people. So, we need
[6:56] to find what that balance looks like in our own
context. And then, right, knowing your strategy,
[7:03] knowing where you want to go, then you start
kind of going through the whole whole process.
[7:12] So the adoption blueprint I always emphasize
I also teach to my students the importance of
[7:20] life cycle it's very important the term itself
life cycle it means it has different stages and
[7:28] elements right phases and it's very important
to understand that maybe it's like linear maybe
[7:33] it's circle or whatever it is very important to
understand the implications of these stages and
[7:38] phases the AI life cycle is no exception you have
to understand where does it start right design
[7:45] planning. So you have some table do all that
work what are we trying to do use cases business
[7:51] use cases um resource issues all those things
where you're going to get the data right your
[7:57] overall strategic goals all those things data data
collection data quality so you have to follow it
[8:07] unless you have that understanding of the concept
or the importance of life cycle things will break
[8:12] you're not going to do this right [clears throat]
So and that road map road map right we're trying
[8:18] to create is very important it's the strategy
it's the vision what are we trying to do I
[8:25] said we're here we want to go there's this thing
called technology adoption model right technology
[8:31] adoption model all of you there you're part of
that some are early adopters some are followers
[8:37] and some just let's wait and see the laggers and
that's okay there's nothing wrong with that but
[8:45] You need to have a plan. If you don't have
that plan, road map, strategical objectives,
[8:51] where am I going? Right? Everywhere it goes to,
right? So, and that's a waste of resources. If you
[8:58] don't know where you're going, you spend money on
the things that you should not be doing. There's
[9:04] no return on investment, no value, right? The
resources, financial funding, all that. You're
[9:11] wasting things you should be spending on other
things. priorities. So that's why the strategy,
[9:18] vision, objectives, you have to have that. It's
like the pyramid, right? At the highest level,
[9:24] that has to be there. It's not the technology
that comes first. It just follows. And of course,
[9:31] we have use cases. We have hundreds of use cases.
Out of the 200, this is a pyramid organization.
[9:39] These hundred here outside the pyramid, they're
like waste, right? that there are no add values.
[9:46] You don't worry about those within the pyramid.
there are 100 use cases but only five right you
[9:52] have limited resources you have resources for
them right so you have to be able to identify
[9:57] those five through prioritization and by the
way this pyramid right there's this thing um
[10:03] I mentioned about the risk optimization resource
usage compliance value delivered that's important
[10:09] you have to be able to find out what the that five
use cases are for your organization and how are
[10:14] you going to find out what's the business problem
what's the pain point, right? How are you? Is that
[10:20] aligned with your strategic road map? If you don't
do that, you're not going to be able to get there.
[10:25] Risk assessment. Your enterprise is that ready
overall enterprise risk assessment. That's part
[10:30] of the goal, right? Data is right there. I mean,
if data is not fit for purpose, it's not going
[10:38] to create the value you're looking for. So you
want to make sure you have the right data for the
[10:42] uh use cases that you have so it addresses the
right problems the pain points. Um the performance
[10:49] is proportional to the quality of the data and
there's this whole again life cycle about data
[10:54] life cycle quality timeliness accuracy integrity
all the relevant all the right things right so
[11:02] how you build that validate that their technical
part of the AI life cycle the models the training
[11:09] testing putting into uh maintaining operations uh
monitoring maintaining that's important You have
[11:18] to have that continuous monitoring human in the
loop observability because once you put it there
[11:24] it's not like the deterministic models where it's
just going to keep running running. There's this
[11:29] thing data drift which has been out there because
we've been using machine learning for the past 20
[11:32] years but you have to observe right make sure the
outputs are there because there's there's impact
[11:41] for safety humans and all that. So observability
is there but eventually I think we'll get to a
[11:48] point where that human in the loop will become
a risk because a barrier because we're not fast
[11:55] enough we're not uh we're not accurate right yet
we focus on productivity. I I really think at some
[12:04] point in the I don't know next five 10 years we'll
take that human in the loop out of the loop so
[12:10] that AI can do more better because we're going to
have that trust established I don't know we'll see
[12:19] so strategy use case risk right at the end of
the day it's all about business outcomes business
[12:25] value proposition that's why we need to start
there we need to understand what business are
[12:29] we in how are we creating value through service
products, who's our customers, who's our uh uh
[12:36] users, right? And [snorts] we have to again find
out those use cases. Those use cases, right? Drive
[12:43] what type of data we need. Make sure it addresses
the pain uh points, the problems. So, and there
[12:51] are like frameworks, standards, best everything's
out there. We don't have to reinvent the wheel,
[12:55] right? Because we have limited resources. That's
really important. Let's not reinvent the wheel.
[13:03] data and development. So as I mentioned model
performance we're talking about AI AI models
[13:09] input output the performance is proportional
to the quality of the data all the like data
[13:16] quality ETL cleansing normalization all those
things right we have to go through that we have
[13:21] to do it right so AI is dependent on data to
teach important features and make decisions
[13:29] so many of the actually issues that we
experience today that we as barriers or
[13:34] risks. They're related to the issues with data.
Garbage in garbage out right [snorts] so secure
[13:43] deployment that's another important stage
in the pipeline. Remember the AI life cycle,
[13:47] the different phases, different pipelines, design,
data collection, development. At some point,
[13:54] you're going to put into the um production. How
are you going to secure it? Because we have an
[14:01] underlying infrastructure running. Remember, we
still have our traditional IT network, hardware,
[14:07] software, firewall, all that. They're still there.
They didn't go anywhere. On top, we now put AI. AI
[14:14] is running on top. Of course, whether we do
it inhouse, third party, that's irrelevant.
[14:20] We still need to address security. The basics
are still there. Baseline security, zero trust.
[14:28] Have you address those the legacy issues, all the
technical, right? If you have if you haven't done
[14:35] anything about those, should we just expect, oh,
we're going to be fine? No. Now all those problems
[14:42] now they're much easier to surface with AI. All
the unknowns become known right now. It's easier.
[14:51] And guess what? That's not good for you. It's good
for the attackers, hackers third party before they
[14:56] had to spend whatever hours, days, weeks. Now
like 10 times, right? At the click of something
[15:02] they find out about all your stuff about your
inventory, assets, vulnerabilities. you can do
[15:08] so too on this side but now instead of 10 you have
thousands of things to deal with resource issues
[15:18] so understanding the traditional versus this
new world we live in right the AI world that's
[15:25] important education awareness obviously has to
has to be there so you have to deal with that
[15:34] there's this data databases SQL Excel Well,
we know that we're comfortable database,
[15:40] relational database when structured. Now, there's
unstructured video audio. There's this thing
[15:44] called vectors. Now, vector databases, embeddings,
right? Encoding, vector indexes, new concepts.
[15:54] How do you secure them? Access, encryption,
they still apply. Zero trust fundamentals,
[15:59] they're still there. You have to do them. You
have to do them first. You can't do AI without
[16:07] doing that. It's like you have this messy room or
disorganized [snorts] like my son. You have to do
[16:14] some cleanup first, right? So operating monitoring
improving we do face different issues now. Think
[16:24] about like five years ago the things that you
were dealing with. Of course again AI has been
[16:29] there since 50 60s. Machine learning we've
been using for the past a good 20 30 years.
[16:33] Right? Your email spam filtering, that's machine
learning. But now it's different things. We
[16:40] didn't have to worry about font injection,
data poisoning, new concepts, new threats,
[16:49] new attack vectors on top of everything we were
supposed to do, which we didn't. So we have more
[16:55] work to do. But from a business perspective,
the value we create for our stakeholders,
[17:01] there's always that balance, right? Remember
the balance through it, technology, AI is here.
[17:08] The value we create, all the associated risks,
security, privacy, compliance, ethics, they're
[17:14] here. It's not like this. As long as this is this
is the case, business will pursue AI because they
[17:22] get more value, right? compared to the risk it's
the trend is trajectory going upwards till one day
[17:28] something will happen a plane will crash [snorts]
oh right we have to put controls laws regulations
[17:35] there's a short period of you know pause 6 month
a year whatever and it's going to go up again so
[17:41] we have to be aware of that we have to recognize
the trend is upwards we're not going backwards you
[17:47] have to take an action you have to know what that
action is for your own context your organization
[17:53] your resources, your capability, right? Are
you four people, thousand people organization,
[17:59] it's different. Maturity is different, right?
Uh [sighs] let's see. So observability,
[18:10] human in the loop, obviously depending on the
risk, we have to have human human in the loop,
[18:15] human out of the loop, on top of the loop. As
we gain more trust, build that relationship,
[18:21] I think we're going to get take ourselves out
of the loop because we're going to you do it.
[18:25] You do it more because you're a barrier. We're not
good at decision-m takes more time, not accurate.
[18:33] It's only as we get to that level of establishing
trust. Out of the 100 times, if you're accepting
[18:40] or implementing 95% of what AI machine is saying,
what's the point? We're doing it 95% of the time.
[18:47] 5% of the time we're creating additional barriers.
That's my personal perspective. Obviously,
[18:51] in the next five, 10 years, that's what where I
think we're going. But human in loop has to be
[18:56] there. The the CISO's role no longer a technology
leadership, right? It's a business enabler. It
[19:03] has to be it has to be a business executive
bringing cyber, security, privacy, compliance,
[19:09] IT has to have all those understandings and
bring it all together and create that balance.
[19:17] and act as a business enabler. There's really
no other way, right? And of course, there are
[19:23] other roles or sponsored chief data officer.
I don't know. Anyway, the key takeaway, know
[19:31] your context. AI is here. There's that technology
adoption model. Everybody's journey is different.
[19:37] Make sure you have a plan. Make sure you know your
road map. Make sure you have a strategy so that
[19:43] you don't go back sideways. And if you're going
sideways, you have the guardrails. You can make
[19:46] corrections. Know about AI, learn about AI, right?
Fundamentals don't change. Thank you. [applause]
