Future of Data Security

The gap between an exploit's first use and its public disclosure has gone negative. Agentically deployed attacks now reach their target before the vulnerability behind them is ever publicly reported, a shift most security programs are still catching up to.
Tom Doughty, Chief Information Security Officer at Generate:Biomedicines, walks Jean through what that shift demands from a security team, from agentic countermeasures to a different approach to non-human identity, plus what changed when he moved a 25-year financial services security career into an AI-native biotech (generatebiomedicines.com) built on machine-generated molecules.

Topics discussed:
Agentic exploits outpacing public vulnerability disclosure

Redefining crown jewels beyond financial services norms

Governing non-human identity and agent access

Third party and supply chain risk in agentic workflows

Frontier model providers walking back zero data retention

Stratifying compute spend across model tiers

Differentiating vendors beyond the AI interface layer

Hiring for inventiveness and objective-driven thinking

Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify
YouTube

Gopuff runs 200-plus AI agents and 100-plus MCP servers across three public clouds, and Ravi Nori is the one securing all of it. The Head of Cyber Security at Gopuff brought a defense-industry classification ethos to a cloud-native retail platform where customer data sits at the top of the priority chain.
Ravi walks Jean through Gopuff's three AI deployments, the shadow AI sprawl he uncovered during an environment scan, and why agent security now spans three surfaces: desktop, browser, and cloud. He also breaks down how boards push for AI adoption while security lags behind.

Topics discussed:
Applying defense data classification to retail customer data
Deploying AI agents as customer service chatbots at scale
Building an AI-powered natural language search feature for mobile
Discovering shadow AI tool sprawl across employee endpoints
Securing agents across desktop, browser, and cloud surfaces
Managing AI token economics and cost spikes through access controls
Addressing board pressure for AI adoption while security lags
Translating security risk into business language for non-technical audiences

Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify
YouTube

What if the file itself decided who gets access, carried its own encryption, and refused unauthorized requests? Georgeo X. Pulikkathara, Global CIO and CISO at iMerit Technology, sees that future arriving fast.
With 34 years in IT security and active service as a Colonel in the US Army Reserve, Georgeo breaks down 40-minute AI-enabled breaches, the flood of non-human accounts, and why human oversight remains the one control that will never go away.

Topics discussed:
34 years in IT security and Army Reserve service
iMerit Technology's AI data solutions
AI-enabled attacks and the 40-minute breach
Non-human accounts flooding enterprise networks
Human-in-the-loop oversight for AI systems
Self-protecting data with built-in encryption
Quantum-resistant encryption and post-quantum security
Competency, character, and commitment in security teams

Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 
Listen to more episodes: 
Apple 
Spotify
YouTube

Gartner predicts 40% of enterprise applications will incorporate agentic AI by year's end, but Jon Rohrich is asking a more basic question: why? Leading Avanade's Canadian cybersecurity practice with nearly 30 consultants, Jon keeps watching proof of concepts succeed, only to collapse when unmodeled risks surface in production.

Jon tells Jean why zero trust is the right framework for governing AI agents, how to challenge stakeholders stuck in outdated security programs, and what a candidate's home lab reveals about their real passion for security.

Topics discussed:
Applying zero trust principles to AI agent access control
Why proof of concepts collapse at production scale
Managing AI agent identities like human user identities
Board pressure to deploy AI without proper threat modeling
Using lab environments to evaluate technical passion in hiring
Challenging long-tenured stakeholders to modernize security programs
Recognizing and overcoming imposter syndrome in cybersecurity careers

Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 

Listen to more episodes: 
Apple 
Spotify
YouTube

Giving an AI agent your access does not mean giving it your judgment. The fix is data that knows the difference, so the same document a person can export, an agent can only summarize, never share externally, never train on.
 
Taylor Lobb, Chief Security Officer at Podium, tells Jean why identity now covers agents and service accounts, how visibility beats blocking shadow AI, and why every agentic workflow needs its own scoped security agent.
 
Topics discussed:
- Extending identity models to agents, APIs, and service accounts
- Making data identity-aware so access matches the requester
- Beating shadow AI with visibility instead of blocking tools
- Pairing every agentic workflow with a scoped security agent
- Why build-versus-buy has inverted for AI-native engineering teams
- Vendor value shifting from interfaces to proprietary data enrichment
- Running security as an enablement and partnership function
- Exposing tool data through MCP for internally built systems

Get in touch with your host, Jean Le Bouthillier: 
LinkedIn 

Listen to more episodes: 
Apple 
Spotify
YouTube