We’re collecting more data than ever before. Data governance regulations are not going away or getting any easier. How the heck are we supposed to keep up?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Dan Walsh, CISO, Datavant. Joining us is our sponsored guest, Ash Hunt, vp, Strategy, EMEA, Cyera.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Cyera

Full Transcript

Intro 

0:40.427 

[David Spark] We’re collecting more data than ever before. Data governance regulations are not going away or getting any easier. How the heck in this Age of AI are we supposed to keep up? 

[Voiceover] You’re listening to Defense in Depth. 

[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of the CISO Series. And joining me as a guest co-host for this episode, and he’s done this many times before. It is the CISO for Datavant, none other than Dan Walsh. Dan, thank you so much for joining us.

[Dan Walsh] Thanks for having me, David.

[David Spark] All right. He’s brief, but he won’t be that brief during the show. Will you, Dan? 

[Dan Walsh] I most certainly will not be. I’m saving it. 

[David Spark] He’s saving it up. No, that’s good. He told me he only has a certain number of words he can say during a podcast.

[Dan Walsh] That’s right. That’s right. 

[David Spark] Well, you’re wasting them. You’re wasting them. Don’t waste them. 

[Dan Walsh] All right. [Laughter] 

[David Spark] Our sponsor for today’s episode is Cyera. Secure your data wherever it lives. More about that and their DataSecAI event coming up in November in Dallas. We’ll be talking about that also. And they’re responsible for our guest today. But first, let’s talk about our topic, Dan.

So, traditional data governance models were never perfect, all right. And that was before we started drowning in the glut of AI-produced data. And we’ve spent years investing in tools to govern data, but I’m going to ask you, Dan, do we need to start from square one as we embrace AI?

Because it seems things are really shifting a lot. Or is there still value in the more traditional approaches? We’re still early into the shift of AI. I mean, we all know it’s happening, but we’re going to have to do something. Dan, what works? What’s not working?

[Dan Walsh] So, I think it depends, David, on the organization that a security individual finds themselves in. I think if you’re in a company that has decades and decades of data, there’s probably a lot of sprawl. It’s probably very messy. It’s probably all over the place.

I think what AI is going to do is really accelerate and highlight the messiness that is there versus Web 2.0, as an example. It really depends on the organization. If you’re starting off from more of a greenfield environment, then you just start with the fundamentals, but if you’re in an environment where there’s a lot of existing data, I think this AI is posing a real problem.

[David Spark] Yes. And everyone, like in one of these shifts, would love to be greenfield, but… [Laughter] 

[Dan Walsh] That’s right.

[David Spark] …that is usually not the case. All right. Well, to help us with this discussion, thrilled that he’s here, is the VP of strategy for EMEA at Cyera, our sponsored guest, none other than Ash Hunt. Ash, thank you so much for joining us. 

[Ash Hunt] Pleasure. Great to be with you guys. 

How do we approach governance? 

3:17.489 

[David Spark] Ross Young of CISO Tradecraft said, “Data governance is extremely hard. Let’s say someone joins the accounting team and has access to emails, share folders, SharePoint, OneDrive, and accounting applications. Three years later, they move to the procurement team and don’t require access to any of these things.

Most organizations would struggle to remove access to all of these things except the accounting applications. As a result, if a bad actor can phish this person on the procurement team, they could get access to accounting data and cause additional harm.

There hasn’t been great solutions to this problem, and managers have no desire to review thousands of millions of share folders, SharePoint sites, and OneDrive account permissions.” I will tell you, it’s hard for just one individual to do that. 

And Raj Singh, CISO North America for Sagility said, “Traditional data governance isn’t obsolete, but it’s incomplete. Role-based access controls and data catalogs help us pass audits, but they don’t stop developers from submitting up shadow AI models on sensitive data.

We need governance that scales. That means using automation to continuously classify data sets, flag when regulated data shows up in an AI training pipeline, and alert when access patterns drift from policy. But automation alone isn’t enough. Human oversight is still needed to make judgment calls, especially around ethical use and regulatory exposure.

So, Dan, both Ross and Raj’s comments here is, “Yeah, we have a system. It falls short.” 

[Dan Walsh] That’s right. I mean, I think the fundamental problem that we’re seeing is that people treat data like it’s a house pet. Maybe they don’t name it, but they certainly are hesitant to delete it. I think in some companies that are regulated, there’s a confusion as to what actually needs to be retained, but then for everyone else, it’s just like, “Well, I might need this data a year from now, two years from now.

I might want to reference this data.” 

[David Spark] Have you ever heard Sounil Yu’s whole theory about data being cattle and pets? 

[Dan Walsh] Yeah. 

[David Spark] Have you heard this whole thing? Yeah. 

[Dan Walsh] Yeah. 

[David Spark] Same thing. Some of it has to be slaughtered and some of it needs to be taken care of. 

[Dan Walsh] That’s right. Yeah, exactly. And so, as a result, you get data sprawl in the places where you would least expect it. I cringed a little bit when I saw SharePoint mentioned because a lot of organizations rely on SharePoint, a lot of organizations do not govern SharePoint.

Same thing on the Google side, if you’re in Google Sheets or Google Drive, right? Data everywhere could be downloaded locally to a machine, could be in a shared drive or something like that, and it’s just data that’s sitting out there that’s ripe for bad actors to go in and abuse it if they get access to it.

[David Spark] I’ll throw this to you, Ash. Have you heard this theory about cattle and pets, of how you treat your data? I mean, what both Raj and Ross are talking about is we’ve had governance solutions, and they’ve always felt incomplete, but AI is cranking it up, isn’t it?

[Ash Hunt] Yeah. I think technology governance has been a placebo for years, at least throughout most of my career. And I’ve ran security prior to joining Cyera in very small setups, right through to 100-plus teams across international financial service organizations, and it’s been the same approach.

Now, historically, before AI, we could get away with it to a degree. I think there was a mismatch in expectation management that the pieces of paper that we were writing policies on was some form of security governance and control that we could really understand these processes and the data underpinning them so that when people did leave, we were able to secure the data that they had access to and any other assets.

But that wasn’t true. And actually, they really manifested themselves as a kind of legal control. This is equally true of due diligence questionnaires, right? They’re a legal mechanism, not a security mechanism. 

And the kind of key turning point that AI has ushered in, and it really is a paradigm shift, is that the two things that it is essentially running off of is data and identities and access at very large scale and at a rapid pace. And so, this high tempo complexity is what’s forcing security organizations to have to rethink essentially their control architecture, right?

The way that they’ve designed their controls to operate, what they’re targeting, and all of that ultimately hinges on the precision and the accuracy of the data that the controls are engaging with and all of the complex permission structures that the identities using that data have.

What are the elements that make a great solution? 

7:49.392 

[David Spark] Chris Fontaine of Arctic Wolf said, “What’s working in data governance today is the intent. Companies keep pouring money into catalogs, lineage tools, and access controls because they know trust and transparency matter. Those frameworks still have value for compliance, audits, and keeping a baseline of order.

What’s not working is the execution. In an AI-driven world where data is massive, fast, and unstructured, those rigid frameworks just can’t keep up.” Ah, which you were just talking about, Ash. “That’s where AI can step in. It can discover new data, classify it, flag sensitive content, and monitor usage in real time.

Governance becomes adaptive instead of static, but throwing away traditional models would be a mistake. Policies, accountability, and regulations are not going anywhere. AI won’t replace governance; it can finally make governance work.” Ah. 

And Kapil Raina of Bedrock Data said, “The future is a metadata-driven, always-on governance layer that uses AI for continuous visibility, classification, and control automatically with dynamic policy enforcement.” Both of these quotes really speak to the philosophy of Cyera, I believe, Ash.

Are they on target here?

[Ash Hunt] Right. For sure. Yeah. I mean, I think Chris and Kapil both make excellent points. And the heart of the matter really is that it’s got nothing to do with getting rid of governance. It is that transformation of governance, okay? And I think another really important point that Chris mentioned is this adaptive type of control, shifting away from this kind of static control architecture that we’ve had historically.

Everything is going to be dictated by living data intelligence moving forward, and we’re seeing this already occur with the introduction of different models and different AI applications within the business. And obviously, a lot of the work that we do at Cyera is there to address those challenges.

And you can really see that all of the solution hinges on the precision that you can get from data intelligence by being able to scan, discover, and I think it’s not just about classification. 

When I look back at the beginning of my career, classification was, again, paid lip service to, it was a binary label, often self-applied. And now what we’re seeing really is this kind of contextualized set of heuristics that we’re building around each piece of data.

That’s really ingraining the business context around that piece of data. When you can start doing that at scale, that’s what’s really going to begin to transform controls into something that can adapt to almost like the ambient signals from the technology environment.

So that if there is a permission change, if there is a change in the state of the data, that our defensive mechanisms can kick into play and adapt accordingly. 

[David Spark] Dan, AI does seem like a logical solution for what AI is creating. I mean, this is kind of a theme [Laughter] that keeps coming back again and again. You know, you deal with AI with AI. But the idea of humans governing this still is impossible.

We will need some technical controls to constantly reclassify, yes? 

[Dan Walsh] Yeah, I think where AI is going to help is going to be the summarization and then the identification of where there’s problems. When I think a lot about AI, I always think a lot about it parallels the rise of cloud computing, right? So, 20 years ago, the infrastructure was the asset because of cloud.

Twenty years later, the data is the asset because of AI. And so, it’s impossible for me to read several Wikipedia articles and then summarize it in a reasonable amount of time. And so, I would never do that. But that is something that AI could do as an example.

And so, I think what’s going to be most important is that the humans are the ones tuning the policies, tuning the context, tuning the scope, and making sure that they are understanding all of those things in light of the threat environment that they’re operating in.

Sponsor – Cyera 

11:45.902 

[David Spark] Before I go on any further, I do want to tell you about our spectacular sponsor, and that would be Cyera. AI is here and it’s moving fast, but with every new system, tool, and integration, your data and your security posture are under more pressure than ever.

That’s where the DataSecAI Conference comes in. It’s going to be happening soon, November 12th and 13th, 2025, in Dallas. DataSecAI ’25 is the industry’s leading conference at the intersection of cybersecurity, data governance, and AI innovation, and hosted by AI and data security leader, Cyera, our sponsor as well.

By the way, I went to their event, which was their first one last year, and it was phenomenal. 

This isn’t just another tech event. It’s a conference built by the industry, for the industry, designed to help CISOs, data leaders, and business technologists rethink what’s possible, share real-world strategies, and collaborate on the future of AI security.

You’ll hear from top voices driving transformation across sectors, from enterprise CISOs to AI threat intelligence experts, and walk away with the insights you need to scale secure innovation. If your job touches security, AI, or data, you need to be at DataSecAI.

Now, there’s no cost to attend. You just got to bring your perspective and join the conversation. Simply go to Cyera’s website. It’s cyera.com. And then you’ll see at the very top of the screen, there’s a DataSecAI link to register for the event. So, go to cyera.com and click the link at the very top of the page.

Where does this effort fall flat? 

13:20.654 

[David Spark] Dustin Sachs of CyberRisk Collaborative said, “I don’t think AI has changed the data governance approaches. Why wouldn’t we apply traditional DLP approaches to AI data? The data going into AI or coming out isn’t fundamentally different from pre-AI data.

I think re-engineering or change approaches every few years or in response to new technology creates more uncertainty.” And Hadas Cassorla of SideChannel said, “A huge problem with data governance in the AI Age is the I, integrity, of the CIA triad.

Because people are heavily relying on LLMs and not necessarily understanding that the output can be incorrect or hallucinated, they’re relying on output as though it is true. That denigrates the integrity of data.” Hadas makes a really good point, and I think as integrity improves with AI, it will be less valid, I would say, but it’s definitely valid today, yes?

[Dan Walsh] Yeah, I think so. I mean, look, what I would say is I think that no matter how much AI improves, if it doesn’t have the context of the organization, it will always fall short. So, I think to the degree that that context can be enriched, that is going to be huge.

I think the interesting thing about these two quotes is Dustin’s referring to, if I’m reading through the lines here a little bit, traditional data in-house that’s not generated by AI, and Hadas is talking about, “Well, what about if we take that data and we use that data to create new data using LLMs?

Now we’ve got another data governance type of issue.” 

I do think with Dustin, I think he’s right. I think having basic DLP, and maybe not so basic anymore because I think traditional DLP fell short 10 years ago, 20 years ago, in that it could only really understand one source of data, or it would sit in the browser, it would sit on the endpoint.

Now we’ve got DLP solutions that are far beyond that, that can actually look through the environment and understand sort of how the data’s flowing through the environment, which I think is much more contextually aware, which is valuable. And so, I think that these technologies are going to be vital to addressing the AI problem, but again, this new data that’s being generated, that’s an entirely other issue with AI.

[David Spark] Tagging what Dan just said, do you think new data being generated by AI is a different data governance problem than just the data we had before that, Ash? 

[Ash Hunt] I mean, I think it’s all pretty much part of the same collective problem you’re going to have to deal with, but I think Dan’s absolutely right that it’s a core consideration that we didn’t have to deal with, certainly maybe 5 years ago, 10 years ago, right?

Where it’s not just that we’ve got the same static sets of data that are going into models, these models are doing inference and correlation on a completely different scale than we had before, and then producing new outputs, even if they’re only a slight variation.

And so, Hadas is completely correct in that integrity. And I think really as an industry, right, we’ve had a pretty much anchoring bias to the sea of that triad for a very long time. 

I used to be the exec sponsor for the EU DORA Act, for example, something focusing heavily on resiliency, and we’ve kind of shafted the A to the side. And I think the same is with I at the moment. I think integrity is going to become a key differentiator, and I think that’s particularly going to happen when you look at the competitive advantage edge organizations are going to seek to use AI for.

Okay? They’re going to want to leverage it to help nudge out industry competitors. The integrity of their data is going to become absolutely pivotal in that because of the potential damage to IP, to brand, etc. 

I do think one of the things that is slightly making this challenging is that quote from Roy Amara, right, which is that we’re kind of overestimating the impact of the technology in the short term, but underestimating it in the long term. When you look at the way AI’s being deployed in enterprise, at least particularly on the end user side at the moment, a lot of it is in very basic LLMs.

The trouble is, because we’ve never really dealt with the data governance issues and the access governance issues in the first place, those end users have free reign to create and spin up any new amount of data and also to put data into all sorts of models, and you know how complex our SaaS supply chains are, and that’s become even worse with AI.

So, I think when you put that all together, it’s not necessarily that we would deal with it as a separate new problem, but it’s definitely an evolution of the problem we were dealing with historically. 

What needs to be considered? 

17:41.676 

[David Spark] Duane Gran of Pellera Technologies said, “Most data governance efforts seem to oscillate between decentralized efforts, where the work is spread out to departments but unevenly applied, or centralized where people who don’t understand the data make ill-informed decisions about it.

Both extremes aren’t working well for us. So, I sense there is an opportunity for change here. I’m a bit skeptical to say that we can sprinkle AI on the solution and get better results. Interestingly, one of the best indicators if some data is important or necessary is whether it has been used within some duration.

You don’t need AI to tell you that some SharePoint site is an abandoned ghost town.” 

And Mike Elkins, who’s the CISO for Humanis Technology, said, “AI has to be part of the solution, which is still also part of the problem.” This is a recurring theme, by the way. He goes on to say, “Most organizations don’t even know/understand their data egress, ingress, and permissions.

The main theme of the risk is how the scale, scope, size, and velocity of the risks require adaptability and speed, and that it’s not ever going to get easier than it is right now. As the AI systems grow on their own at a pace we as humans can barely comprehend, how can we manage data that moves in the world of AI and quantum computing?” Ash, I want to go to Duane’s comment of like data has historically not had a sort of a linear path of management, has it?

So, this is, I think, maybe just exacerbating the problem. 

[Ash Hunt] Yeah, I think Duane makes a really interesting point in that historically, data has been owned by all sorts of functional requirements across the business. Certainly when I used to be a global CISO, I would be regularly engaging with general counsel as much as my CFO and chief revenue officer, as then I would with my chief risk officer and my CTO.

You’re right, each of them almost has a buy-in, a stake into the data governance collective issue that we’re trying to deal with. And I think actually, one of the most interesting aspects of that is the CFO and the CRO’s point, which is that they want to strip revenue intelligence out of our data to make it usable, to help grow opportunity and growth across the organization landscape.

And that’s a really interesting flip side to a lot of what we’re dealing with in data security. I think a lot of security professionals think that risk is almost just on the downward sort of side of that equation, but actually the opposite is when we’re reducing loss exposure, we’re increasing growth opportunity for the business.

And I think that’s something that organizations, particularly at the CXO level, are really putting pressure on technology teams now to try and open those doors up, right? And you’re seeing that with trying to unlock AI across the organization. 

I think Duane also makes a super-interesting point around decisions. We historically across security have been doing decision by gut instead of decision by design, and I think one of the really clever things that AI’s really going to enable us to do is to start building very effective data storytelling and analytics into our security landscape.

What I mean by that is that we’re not just going to be trying to manually download reports from different products that we’ve got and hope that we’re going to be addressing the right risks. We’re going to start seeing orchestration at scale where our technologies are integrated and that we can start building cohesive enterprise risk stories that are going to target the greatest areas of loss exposure.

And I think that is something that is really elevating the CISO to have these more informed conversations and better justified conversations with the CXO and the business because they’re starting to realize that there is a revenue side to their risk equations in the business and that we do want to empower organizations with AI, but we need to do it securely.

And so, I think having the ability to get across all of your data and your identities, wherever they might be, recognize that they’re going to be evolving at rapid pace and scale, and finding a way to then take the stories out of that to address the biggest risk areas and the greatest opportunity areas, I think’s really where organizations are going to be leaning into moving forward.

[David Spark] Good point. Dan, how well does the business understand the double-edged sword that AI introduces? 

[Dan Walsh] I think it depends on the department. I think sales is super pumped about the revenue potential. I think legal is rightly concerned about what risks there are, and security’s concerned about – I think to Ash’s point – we’ll want to make sure that the company begins to come up with their own stance on that as an organization, so everyone’s on the same page.

I’d also add that we talk a lot about software supply chain. We should start to think about this in terms of data supply chain because I think once organizations understand how it’s all interconnected together and that that interconnectivity represents a risk to the business, they’ll begin to manage it better.

[David Spark] Very good. 

Closing 

22:23.175

[David Spark] Well, that brings us to the very tail end of this program, but there’s one last thing I want to do, and I’m going to start with you, Ash. Ash, at the end of the show, we always ask which quote was your favorite and why, so I’ll ask you that.

Which quote of all these quotes that I read was your favorite and why? 

[Ash Hunt] I think Hadas makes a really important point, right, which I think that is the integrity is one of the key aspects of the triad that is going to dictate the speed and the usage of AI going forward. I think when, again, I talk about that challenge we’ve had with policy governance historically, what we really want to move to is dynamic policy as code moving forward.

The only way you can deliver that true control automation is going to be having to ensure that you’ve got the integrity of your data at all points of its lineage, okay, not just at rest. And so, I think for me, Hadas really has tapped into something that I think’s going to be a crucial and core factor of the discussion and debate we’ll have on AI moving forward in industry.

[David Spark] Excellent point. Dan, your favorite quote and why? 

[Dan Walsh] I like Duane’s quote, “Most data governance efforts seem to oscillate between decentralized efforts where work is spread out to departments but unevenly applied, or centralized where people who don’t understand the data make ill-informed decisions about it.” I think that is the crux of the matter that organizations need to solve.

[David Spark] That’s kind of the theme of our whole discussion here. That brings us to the tail end. I want to thank Cyera, our sponsor for today’s episode, but more importantly, if you’re listening, especially from the Dallas area or wanted to get to the Dallas area, go check out their DataSecAI conference, DataSecAI ’25.

This’ll be their second one. I was at their first one. It was phenomenal. So, I can speak from firsthand that it was a great event. Go to their website, cyera.com. And at the very top of the page, you will see a link for DataSecAI. Go ahead and click on that.

Ash, are you hiring over there at Cyera? 

[Ash Hunt] We absolutely are. We’re growing at a rapid pace. We’re the fastest growing data security company in the world and we’re hiring all over. So, yeah, please feel free to reach out. 

[David Spark] All right. So, go to their job board. There will be a link to Ash’s LinkedIn profile on the site. Anything else you want to say about Cyera or about the event coming up in November? 

[Ash Hunt] I think you said it best, right? It’s an industry event created by industry for industry. It’s going to be amazing thought leadership. We’re getting really impressive speakers from all over the world, and it’s just a really great opportunity to try and talk about these problems in more depth and try and find some really good answers.

[David Spark] Yeah. What was really interesting, and this was last year, so I’m sure the story’s completely different this year given the pace this is all moving, but I can tell you from last year, getting to talk to people who were actually solving this problem was very, very interesting.

It wasn’t just people coming with questions, but there were some people who actually had answers as well. Thank you very much, Ash. Thank you very much, Dan. And thank you, our audience. As always, as I always say, I greatly appreciate your contributions and listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site CISOseries.com where you’ll also see plenty of ways to participate, including recording a question or a comment for the show.

If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to Defense in Depth.