Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, Virtual Chief Information Security Officer at Cyber Risk Opportunities. And Jake Bernstein, partner at the law firm of K&L Gates. Visit them at cr-map.com and klgates.com.

Jake Bernstein: So Kip, what are we going to talk about today in episode 210 of the Cyber Risk Management Podcast?

Kip Boyle: It's an episode about boards of directors and how they're actually thinking about generative AI. And what we want to do today is avoid what the headlines are saying. We don't want to repeat what vendors are pitching. We want to know what does the conversation really sound like when board members sit down and wrestle with this? And I can't think of anybody better to help us do that than Vanessa Pegueros. And why? Well, because she sits on boards, live person. She's on that board, BECU, one of the biggest credit unions in the country, Prisidio. She's also a venture partner at Flying Fish Partners. She's actually investing in AI and ML startups. And to top it all off, she's a former CISO at DocuSign and US Bank. So I could not think of a better person to invite onto the show because she's got so many different perspectives that she can bring in.
Now, before I welcome Vanessa back to the show, I want everybody to know that Vanessa was our guest in episode 152. And in that episode, she talked about cyber risk management at the board level. And I think that if you liked the episode today, you should go back and listen to that one as well. Okay. Vanessa, welcome back.

Vanessa Pegueros: Thanks, Kip. It's great to be back with you and Jake for yet another episode. Yeah, you pretty much summarized what I've been up to. I think I get this unique perspective from a board level on what these conversations are like, whether it's cybersecurity, in this case AI, we're going to talk about that. I think what's great is I was an operator for many, many years and I can like... I was on the other side of the board and now I'm in the board and now I can understand both perspectives and the challenges of sometimes communication or other aspects of these complex topics.

Kip Boyle: And no doubt you probably see the CISOs coming up at you and you're just like, "Was I like that?" And you think back and you go, "Probably. Oh, well."

Vanessa Pegueros: Yeah. It's a variety of CISOs. Sometimes the more technical the CISOs, that's the more challenging it is to talk to the board. So there's always that part, but then there's benefits of this very technical CISO as we know.

Kip Boyle: Definitely. Okay. Well, let's get right to it. So Vanessa, when generative AI comes up in a board meeting, and by the way, I think generative AI risk is definitely adjacent to cyber risk. At least that's what I'm seeing unfold. But when it comes up in a board meeting, what does that conversation actually sound like?

Vanessa Pegueros: Well, I mean, you think a board should have everything figured out. Well, these are the people that hire and fire the CEO. These are the individuals who are watching the financial performance of the company. But there is so much change occurring around us in terms of technology and other aspects, geopolitical, all kinds of change. I think boards are just wrestling with their own evolution around how to govern with AI. And I think the challenge can be that sometimes people look to the board to have the answers and they don't. They are learning as well. And depending on the board's own individual member competency around technology, that could be a very challenging thing for the board to get to consensus around what to do or a direction to take.
I feel the boards are just having... As executive teams, CEOs, CIOs, CTOs, as they're similarly sitting around and trying to figure out what to do with AI, how to allocate money and the spend around it, I think boards are also challenged with that, but feel an incredible fiduciary responsibility relative to the company. I think you have differences with boards in terms of highly regulated boards, like a credit union versus... I'm on the board of LivePerson, which by the way, we just sold to SoundHound, so been quite busy with that transaction.

Kip Boyle: Congratulations.

Vanessa Pegueros: Thank you. And LivePerson being just a technology company in AI, the assumption at the board level that AI is just part of everything is just accepted and expected. And I think with highly regulated environments like a credit union, we have to put a lot more thought into it. We have to be very careful around what we adopt and the risks that we're taking. So there are some definite difference. And a private company... because I'm not a small private company, they are just grappling with, "Hey, can we make it through the year with the cash we have?" All very different kind of experiences at the board level.

Kip Boyle: It sounds like you're going from one bubble of perspective to another bubble of perspective. I got to imagine this can be hard to keep it all straight.

Vanessa Pegueros: I think it's challenging, but it's also really interesting. And then it allows me to see some patterns across the different types of companies, but also some differences in how you have to handle that. You can't just treat it all the same.

Jake Bernstein: No, I think that's right. And Vanessa, where would you say... I mean, given the board members are wrestling with all of this like everyone else, where do you think they're getting their information about generative AI and is it generally good information, bad information? I mean, the obvious answer is they're getting it from the AI itself.

Vanessa Pegueros: Well, Jake, I think it is truly a combination and it depends on the board member and how... You have some individuals who are just very driven to learn on their own, independent learners and curious, and that's true at the board level as well. I feel like some of our board members that I work with are very much out there reading everything they can about AI. They're consuming it. They are talking to the executive team members and having one-on-one meetings with them to understand things better. I think some board members are a little bit more... They'll sit back and they'll consume the information that the CTO or the CIO the organization provides them. So they're not as... I wouldn't say there's as aggressive as in terms of getting the knowledge. Everybody is different. I think there's so much information out there right now. It's just crazy to... There isn't, I wouldn't say, one thing. I think the executive team, the C-level team, they get a lot of information from vendors and get a lot of education relative to vendors presentations.

Jake Bernstein: How many do you think are using it themselves? Because certainly... I discovered and I find that it is the only way to really learn what AI is capable of is by using it. And no matter how many sales pitches one sits through, no matter how many articles one reads, if you haven't used it yourself, I feel like it's very hard to get a handle on what the transformation looks like. And I'm curious, to the extent that boards are responsible for setting direction and then having the executive team and the C-suite execute on that, do you think it's important for directors to use AI themselves and how many do you think are doing so? I don't have to ask you, I'm fully confident you are fully immersed in it, although-

Vanessa Pegueros: inaudible-

Jake Bernstein: Are you, is the question?

Vanessa Pegueros: Well, actually there is a caveat to that in the sense of because I'm a cybersecurity person as well, I am very cautious of AI. Just yesterday I was in a board meeting and one of the board members was talking about OpenClaw and how they're using it for everything. And I'm like, "Okay-"

Jake Bernstein: So you don't have an OpenClaw running on your personal Mac somewhere with full access-

Vanessa Pegueros: No.

Jake Bernstein: ... to everything? I don't blame you.

Vanessa Pegueros: Yep.

Jake Bernstein: Neither... My story on OpenClaw is that I installed it, started it up on my personal MacBook and then shut it down after an hour after just being like, "You know what? I don't think this is a good idea." And then promptly, the major AI companies started filtering out safer versions of that, like Claude Dispatch.

Vanessa Pegueros: The excitement around AI is... We all know this, we've seen in cybersecurity over and over again, the new technology that it has all the promise of delivering everything that will make your life completely different and it goes through its period of really bumpy roads, big cyber incident occurs, everybody pulls back, everybody... It's just in that same state and I'm cautious with it. I mean, I use it, I... But I don't have my own personal agent because I don't want to give it access to everything that I need to in my life. But to answer your question, Jake, yeah, I think every board member should be doing research, leveraging AI, should use different models, see how they respond. For example, I was using ChatGPT for a while, paid version, and it started to over... All the answers it started to give me were basically in the context of me being a board member.
And I'm like... Even some more personal... And I'm like, "I don't want everything in the context of me being a board member." And then I switched to Claude. I'm using Claude. It hasn't done that yet to me.

Jake Bernstein: Oh, but it will, unless you've turned off memory.

Vanessa Pegueros: Oh, I did turn off memory, so maybe that's why it's not-

Jake Bernstein: That is why. Yeah. And it's interesting, isn't it? So, okay...

Vanessa Pegueros: So to your question, I do think every board member should be using it, should see the potential of it and should be talking to some people who maybe are using it in a more, I would say, risky way and just kind of understand how use cases that are picking up for people and ultimate customers. I mean, you have to dive into it little bit, I don't... Depending on your risk tolerance, how much is the question?

Jake Bernstein: Yeah. Well, let's move into the kind of meat of the episode, which is I think the three ways... Well, actually, Kip, why don't you do this part since... Otherwise, I'm just literally stealing your lines, which I'm happy to do.

Kip Boyle: Oh, well, that's okay because I can steal your lines also. I mean, fair is fair, right? And I know exactly what you're supposed to say.

Jake Bernstein: Yeah. And I think after 210 episodes, we don't even need a script to steal each other's lines, it just kind of happens naturally.

Kip Boyle: Not to steal each other's lines, no.

Jake Bernstein: Yeah.

Kip Boyle: To stay on track, yes. I don't think that's ever going to go away.

Jake Bernstein: No.

Kip Boyle: Okay. So listen, when we were doing show prep, Vanessa, you were describing three ways that boards look at generative AI. You were seeing three and... Anyways, I just thought our listeners would really appreciate hearing you walk us through that, please.

Vanessa Pegueros: Yeah. So there's so much activity around, "Oh, what are we doing with AI?" Even boards pushing management to do stuff with AI. And I started to think, "Well, there's actually two big categories around AI," and then one of them has a couple of different aspects to it. So the first kind of category I would say is saving money. Boards want to save money. They want to get more efficient and there's a way to do that. One is outright, I'd say cost reduction, which is like, "Hey, instead of having this person's full-time doing this job, I'm just going to create an agent and it's going to do that job and now I can lay that individual off," which is straight cost reduction. Now, the other aspect of this kind of saving money is the delayed or unnecessary hiring of additional individuals. For example, I was going to hire five more people in the group, but because of AI, I can augment my current workforce and I no longer need to hire five, maybe I only need to hire one.
So that's, to me, a cost avoidance. But again, the bottom line, it hits the financials in a positive way by reducing your overall expense. So that's one of the big areas. And I think a lot of organizations, the easy ones, it's easier to take this approach with AI at a board level, but the real, I feel, benefit that boards are looking for is, "How can AI either help us optimize our current products that are services or create new products and services that weren't possible before AI?" Those are the true revenue generation components of AI. And I think that's what boards are more excited about, but they realize it's going to take more time. So they want both the cost reductions, but they want the revenue generation.

Kip Boyle: It's interesting. The only thing we really hear about in the news and social media is the cost reduction and not too much in comparison from new products and service optimization. At least that's what I see.

Jake Bernstein: Yeah. And I think it's because the... You can never go wrong in the media making people angry or upset and focusing on negative cost reduction is a good way to do that. I think what's interesting too is that there's a lot of headlines that when you dig into, the facts don't necessarily hold up under scrutiny. Many mass layoffs are easier to blame on AI because allegedly everyone's doing it, but in fact, it's more complicated than that. Now I think there are layoffs that have occurred because of the cost of AI, but that's a relatively small number of companies that are experiencing that compared to the companies that... We went through kind of a historical overhiring phase during COVID and I think you're seeing a lot of correction from that. Nonetheless, the idea that cost reduction and human augmentation are two sides of the same coin is super powerful.
I mean, how often do you save money and get better output? That normally doesn't happen. And that's one of the main things that I've been trying to explain to folks in law firms, which is AI makes you faster and better. Most of the-

Kip Boyle: inaudible.

Jake Bernstein: ... time, it's always... Yeah, you can be both. Usually in the past, it's always been faster or better. Those used to be mutually exclusive. They are not. And I think that is a critical component for boards to begin to understand. I think thinking about it as a cost reduction only is just kind of the like... I mean, that's an immature way to use AI and think about AI.

Vanessa Pegueros: Yeah. And I think... I agree with you, Jake. I think there's a couple of aspects of human augmentation though. One is great. The people who have their jobs, they get to keep their jobs and they have up-leveled their own skills by adopting AI and they'll probably become more marketable to other organizations. So that's good and positive. I think the challenge is what... And we don't need to... This is a little probably podcast on its own, but what happens to the entry level roles and this is plaguing... I think about the legal field as well and others that are being hit, like, "Why do I need to have these interns? Why do I need to have... So what happens?" So that's a large-

Jake Bernstein: And that's a question of augmentation versus automation, right?

Vanessa Pegueros: Yes.

Jake Bernstein: There are things you want to automate away. And I think the question of anything you can automate away, I think you have to ask the question, "How valuable..." Well, it may be very valuable, but does it need a human? And I think again, we're in that transition period. Transitions are always hard.

Vanessa Pegueros: Yes. Yeah. I also would say that... In fact, I do think... I was talking to a startup because part of my role as a venture partner at Flying Fish Partners is I do talk to a lot of startups in this space and one of the questions I've started to ask them is, "What percent of your code is AI generated?" And if we had asked this question two years... It wouldn't even have been a question two years. So they often... When I talked to them, they said 30% right now, and they're a very small team, like very small. And I was like, "Okay, well, why isn't it higher?" And they said, "Because we want to make sure that this is done right and we can't completely allocate 100% at this point." The foundation of the code needs to be high quality and they said, "In a year, it'll be 100%."
So it's an interesting... With 30%, I mean, they would've probably had to hire a couple more people probably, maybe, I don't know. It's hard to say exactly, but their cost care going into the future is going to be significantly less with a more mature product. So they needed the humans to build the high quality product right now, but they're not going to need them as much for the future grouping.

Jake Bernstein: Well, and I think people and boards in particular will need to recalibrate how many people are required to build a company. I mean, we've heard about the hypothetical billion dollar unicorn with one employee, maybe not quite yet, but I do believe that's possible. I think in the interim, boards need to consider not so much, "Oh, I need so many fewer people," but instead focus on how much more can a given team do. And that's really... I think there's this tension between optimizing what you have, which I think optimization is going to lead to reduction and automation as opposed to something new, which could expand opportunity and revenue streams and all of that stuff. And that really is the tension there is the save money versus make money AI investment.

Kip Boyle: I think there's also another dimension to this, which we have to think about, which is, "Am I optimizing a process that was created prior to generative AI?"

Jake Bernstein: Oh yeah, that's a really important one.

Kip Boyle: Versus, "Am I optimizing the process assuming that generative AI will play a major role in how that work gets done?" Because one thing that I'm definitely seeing is the value of human involvement isn't really in the production area. I think generative AI is really driving production costs, especially for knowledge work like down to practically zero. Where I think human beings really make a lot of sense and will continue to make sense is judgment, is specification, is deciding, "What should we build and then what should it look like?" Because if you can't do a good job of that, then generative AI is just going to produce slop. I think that's why we see a lot of slop is because there's not enough human involvement saying what should be made and what should it look like.

Jake Bernstein: Yeah, that's a huge part of it.

Vanessa Pegueros: Yeah. There's a lot there you both were talking about. I think we don't really know right now what is all the endpoint on this. I think that's some of the challenge for boards is the unknowns and the unpredictability of exactly where this is going to land. We have counter aspects to it too, like things I think about as a board member is if we adopt all this AI, what is the cost of the AI? A lot of people thought Claude was going to save a ton of money, and in fact, I mean, it's given you a lot of flexibility, scalability, all that, but it's still very expensive and actually... So what does that look like? Should an organization... I think as a board member, should an organization inaudible back their implementation of AI and do it in a more thoughtful, progressive way? Because if everybody's using it, what are the costs of the business of that? The licensing, the token costs, that's a real cost that I don't think we have any good handle on yet.

Kip Boyle: No, I think token cost is being subsidized by massive investor money right now.

Jake Bernstein: Oh, currently-

Kip Boyle: It absolutely is. No one's paying the full load for tokens. And so it'll be interesting to see what happens when that changes. But moving the conversation along here a little bit, because I want to be mindful of the time. Vanessa, what about fear? Is there an element of fear here at the board level, for example, "Hey, we can't sit still in this AI thing. What if our competitors figure it out before we do? Then we're going to get all messed up and we're going to lose our ability to compete." Is that going on?

Vanessa Pegueros: Yeah, I think... I don't know, fear. Yeah, I guess you could call it fear.

Kip Boyle: Well, I don't want to disparage people and say that they're slaves to fear, but...

Vanessa Pegueros: There's fear you might miss something really big that's consequential to the entire company. Yeah, that is the reality. I feel like we all know the Blockbuster story, but I feel like there's so many Blockbusters out there right now. They have no idea or they're just beginning to realize that they're going to be out of business in a year or two. The boards are probably really struggling with, "What the heck do we do?" And so-

Jake Bernstein: That's one of the reasons why I think it's so important for board members to be, frankly, to use it themselves. I had an experience at one of our recent events where a partner sat through probably 45 minutes of an hour long workshop that was about just using AI. And I thought we were all on the same basic page about what we were talking about and what the capabilities were, but around that 45 minute mark, he said, "No, wait a second. Are you saying that I can take a complicated financial loan instrument, put it into AI and the AI will read it, give me feedback and help redline it?"
And for moment, I was stunned because I'm like, "I thought that's... I mean, yes. That is what I'm saying," but I'm like, "I thought we all had agreed on that, that we knew that was that." And as he kind of went on, he was like, "It never occurred to me that that would even be possible." And so I'm like, "This is a real problem," because I can sit there and I can say, "Just use it," and I can tell you to experiment and go try things. But if you're... Particularly as a board member, if you don't even have a baseline expectation or understanding of what the AI can do, you cannot imagine, you literally cannot imagine what's going to happen to your business. And I think that is the block-

Kip Boyle: How can you manage the risk of things you don't understand?

Jake Bernstein: You can't. And I think-

Vanessa Pegueros: That's where the anxiety comes from on boards because they understand at a high level that that is the situation. They're grappling with, "How do we deal with it?" So that fear, anxiety... I would call it anxiety, actually, if I had to-

Kip Boyle: Maybe a rational fear, anxiety, sure. Yeah. Okay, cool. You're the board member, I'm not. You can characterize it the way you want to. That's cool. All right, I appreciate the perspective there on just concerns about remaining competitive, given that this is a transformative technology that's coming out. Now, let's transition here to another facet of this. So because you've been on both sides as a board member and as a CISO, if you're the board member receiving the CISO briefing, what do you expect? What do you want? A senior technology leader... Let's say it's a company that doesn't have a CISO or something like that, but whoever is providing the thought leadership internally on AI and AI risk management, I mean, what is it that you need from them? Because I think our listeners would love to be better tuned there.

Vanessa Pegueros: Yeah. I mean, what I would like to see from senior technical leaders, whether CTO, CISO, other CIO, is a level of focus and discipline on what they're presenting. So thoughtful projects, initiatives with really well articulated outcomes that they would like to achieve, not trying to boil the ocean and do everything all at once because I know that is very challenging to do and also someone based in the reality of the current... What foundation they're building off. Technical debt could be a huge impediment to adoption of AI. And I want to hear from a leader who understands the technical debt. Most companies have technical debt. And how they are going to navigate the implementation of AI while addressing that technical debt. And so to me, it's a lot of focus, a lot of strategic thought into where they envision their organization, the company to be relative to this in the future and why they believe that this is the right one.
I am not a big believer of... You know in cyber, Kip, we always have the kind of a, "Well, what are other companies doing that are similar to us?" I mean, I just don't feel that as a board member, that's very useful to me at all. I want to know more specifically for our organization and the challenges we have, which are very different... Some very similar challenges, but also very different challenges, like, "What is the right plan and approach for our company?"

Kip Boyle: Taking into account your distinctiveness.

Vanessa Pegueros: Yes.

Kip Boyle: Yeah, that makes a lot of sense.

Vanessa Pegueros: Distinctiveness can be a thing that costs you more to do things, but it also can be an advantage depending on what that-

Kip Boyle: Yeah. Yeah. I'm willing to spend more on something... I'm a small business owner, so I have to think about, "How is Cyber Risk opportunities different? Why would somebody choose us instead of one of our competitors?" And so I often think about things like, "Maybe I should spend an extra dollar per widget because that actually translates into more revenue." And so optimizing on cost reduction could actually result in decreased revenue because we're just not as attractive, we're not as distinctive. And so yeah, so you've got to be thoughtful about distinctiveness. I got to say, before I own my own business, I don't know that I understood that. I think back to when I was an in house CISO and how hard it was for me to understand the mind of the business leaders and how they were trying to make good decisions for their brand, for their customers. It just wasn't an experience that I'd ever really had. And so that was just an ongoing challenge.

Vanessa Pegueros: The other big thing that I think about if we have a technology leader coming to present is, we as a board have made this investment on all this tooling. I call inaudible tooling, whether it's security tooling, it could be infrastructure tooling, et cetera, like, "How are you leveraging that tooling? What needs to happen? How are you helping preserve the investment while moving forward into this new world?" Now it might be maybe not something a board wants to hear, but it might be saying that we can't use this tool, going-

Kip Boyle: Mm-hmm.

Vanessa Pegueros: And I think it's okay to say that. And I also think you need to really put thought into, "Why is it not okay? What did you miss? What did you miss when you picked that tooling? Are you going to blame the vendor for this or is it-"

Jake Bernstein: Always blame the vendor.

Vanessa Pegueros: Yeah, exactly. That's the easy way. And that, to me, when you just blame the vendor, as a board member, but that's... Obviously, this has to do with my background, they always lose a little bit of credibility because the vendor takes active management. A vendor is... You just don't put it in place, like everything's supposed to be inaudible. So I think that's also... Like, "How are you going to preserve or how are you going to continue to utilize our already invested capital in this business?" Or now are we just saying, "That's all throwaway," and if you say, "It's all throwaway," I'm going to be like, "Why?"

Kip Boyle: Yeah, you better explain that to me. Listen, we haven't mentioned it yet, but you, Vanessa, have an article that should be publishing just a few days before this episode is released. Did you want to say a word or two about that?

Vanessa Pegueros: Well, yeah, I've got an ongoing series of articles around different perspectives as me as a board member and in my approach to different topics that... Like AI is one of them, cyber. But I've got this upcoming article that's going to be talking about some of the issues facing boards and all this change in AI. And so yeah, that's going to be coming out soon.

Kip Boyle: Where should people look for it at?

Vanessa Pegueros: I'll be posting it on my LinkedIn.

Kip Boyle: Okay, great. So for those of you who are listening to this audio only, then you can go to my LinkedIn profile and you can actually access this video recording. And if you look in the notes in the comments, I've actually put Vanessa's profile link in there as well as her website and I'll add it to the show notes as well. So no excuse for not reading Vanessa's insightful article when it comes out. Okay?

Jake Bernstein: Definitely. Excellent.

Kip Boyle: Great. Well, so Jake, what about-

Jake Bernstein: Governance?

Kip Boyle: ... how should this... Yeah.

Jake Bernstein: Should we govern it? So governance is a word that... It gets bandied about all the time. There's always governance, compliance, regulatory, all these kinds of issues. And look, as we kind of almost led with... We were talking about OpenClaw, generative AI has major risks. It can be incredibly powerful. It is incredibly powerful. And with great power, comes great responsibility, thanks to Uncle Ben.

Kip Boyle: Marvel reference, everybody.

Jake Bernstein: Marvel reference. Yeah. I would imagine that 90% plus of our listeners got that reference. So what does good governance look like at the board level and what does it even mean to govern AI?

Vanessa Pegueros: Yeah. So I think it's in process. I mean, I think organizations are struggling with what that structure looks like. I think we always start with policies and standards and stuff like that. And I think that's important, especially for audits, but we all know that policies exist, things are written down, but that doesn't always mean the employees do exactly what they should do. I think the first challenge with policies is people even reading them. I mean, coming from cybersecurity, most people don't even read the policy or the standards. So there has to be... That's a legacy thing we put in place, I'm not sure how effective it is at governing. I think what I'm starting to see because AI is so spread out through the enterprise is the need for some clear roles and responsibilities like accountability. So some of the companies I'm involved with, they have one individual who is the AI accountable person.
Some have a council that they put in place for governance, which is more of a cross-functional business participants from different areas of the organization who get together and they collectively make decisions around AI. They address issues around AI. And then obviously, the ultimate decision authority around the risk around AI does... There could be a management team who, I call it, pre-processes the risk, decide, "Hey, this is important enough. We need to bring it to the risk committee of the board," or maybe it's a full board issue that needs to be addressed. But I think that's kind of how I see it working right now. Whether or not this is the right structure for governance with AI, I don't know yet. We're still in the early days of it and I think we are struggling with some aspects in general of the organization and the employees are moving at one pace and the boards are moving at a slightly slower pace. So what is the gap that is developing right now? And that is something I think about.

Jake Bernstein: Yeah. I mean, it's a huge question. I know we're starting to run out of time here. So what is the one governance question every board should be asking about gen AI right now?

Vanessa Pegueros: One governance question.

Jake Bernstein: And no compound questions. I will object.

Vanessa Pegueros: Yeah, I know. Good question. I would say where are all the places we are using AI today?

Jake Bernstein: That's a good question. And-

Kip Boyle: And maybe how much we're spending on it?

Jake Bernstein: Nope, compound question.

Kip Boyle: Oh no, no, that's my question. How much are we spending on it?

Jake Bernstein: Yeah, that's a good question. I mean, I do think asking about shadow AI can be part of Vanessa's question. I think that is one question still. Where are we using AI, whether we know it and have approved it or not is the real critical question. And I'm just going to call that one question because I think that shadow IT was the bane of existence for every CISO for many, many years, particularly as cloud stood up.

Kip Boyle: Still is.

Jake Bernstein: I mean, it still is, Kip. We still talk to clients.

Vanessa Pegueros: I'll just say I don't like the term shadow because I don't really... Shadow IT was one I... Many years ago, I was like, "I just don't like that term." What represents to me what's happening in the business back in that context was the technology team wasn't keeping pace with the business and therefore, the business decided, "I'm going to just start doing this myself." And then we all of a sudden said it was a bad thing when actually it wasn't necessarily a bad thing. It was the technology team not keeping up with the business. So I'm not saying it didn't cause potential risk, all that, but I think the real root of the problem is that technology teams are out of... They were out of touch with the criticality of what the business needed.

Jake Bernstein: And that's a very... I completely agree that that's a diagnosis for how we get to shadow IT and shadow AI, but I still think that the phrase shadow is helpful because it happens in the shadows and that creates a massive quantity of risk that has to be governed. And now I'm speaking as the compliance lawyer in the room because particularly with AI, it goes so far beyond one or two topics. It includes IP issues and confidentiality issues and privacy and obviously, cybersecurity as well. But I think that is nonetheless the core question. Where are we using AI?

Vanessa Pegueros: Yeah. And it also groups to just generally, and I mentioned in my article, having a culture over controls. A culture is much more powerful in my mind than a set of controls. And I think that's the challenge cyber has faced and is the same challenge AI is facing. How do we get to the lowest levels a culture of responsible use of AI, following... Asking questions about guardrails. And somebody... I was just a couple of days ago was talking about how they're implementing... At their developer level, each developer is their own vulnerability management and remediation. They are accountable for it, not the security team. They are accountable for it.

Kip Boyle: I really like that. That's really good.

Vanessa Pegueros: And the importance of like as we... We have to push this down and we tried to do it with cybersecurity. I think with AI, we have... There are a lot of similarities between the journey with cybersecurity and the journey we're going through right now with AI.

Kip Boyle: And what I tell my customers is you really want to put the enforcement and the controls into the arms of the frontline supervisors because that I think is where cultural boundaries and practices are really rooted more than anywhere else is in the frontline supervisor. Because if I walk up to somebody, an individual contributor and I say, "Hey, you should use a password manager." Well, who the hell am I? They're going to look directly at their supervisor and say, "Do I have to do that thing that Kip said? Because Kip doesn't write my performance review and he doesn't decide my bonus, but if I do what he says, it's going to ruin my productivity. So anyway, that's-

Vanessa Pegueros: I think... I would question in the age of AI, and this again, it could be a completely different podcast, but the entire structure of organizations is no longer going to work. Hierarchy that we have and the way we get work done is-

Kip Boyle: But that assumes an AI native architecture for business.

Vanessa Pegueros: Yes.

Kip Boyle: Doesn't it? Yeah. Okay. So until we get that.

Vanessa Pegueros: But there is, how do we evolve our current organizational structures as we adopt AI to really optimize AI? That is-

Kip Boyle: That's hard. That's really hard.

Vanessa Pegueros: We're probably going to have to get there because in order for it to truly work and embed itself into every process of the business, it's going to have implications and structure.

Kip Boyle: Maybe we need more Nokia bankruptcies to send a signal to the rest of the market that like, "You can't ignore this. This is for real." I don't know. I mean, it's been things like that that I think has caught people's attention in the past when transformative technologies have rolled out and people are going, "I don't know if I should do anything about that or not." And something big happens and they're like, "Oh, I guess I should." I don't know.

Vanessa Pegueros: inaudible, it's... Are you going to wait too long? Is your own... But it's a balance, right? I really don't believe that there's a whole lot of a benefit for most organizations to be on the bleeding edge right now. It's too uncertain.

Kip Boyle: Well, what a great way to wrap up the episode. On that note, I really appreciate the fact that you were here, Vanessa. Thanks so much for coming back on our show. Again, we're going to put your LinkedIn profile, your website into the show notes when your article drops later in May of 2026, I encourage people to check it out. Anyway, that wraps up this episode of the Cyber Risk Management Podcast. Today we talked about how boards of directors are actually thinking about generative AI, things like cost reduction, human augmentation, two sides of the same coin. And what about the growth of new products and services? We touched on competitive anxiety. I won't use the F-word. And related things. And we did that with our guest, Vanessa Pegueros. Thanks, Vanessa. We'll see you next time, everybody.

Jake Bernstein: See you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cybersecurity hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.