<![CDATA[Guardians of the Data]]>https://www.guardiansofthedata.showhttps://substackcdn.com/image/fetch/$s_!6c6Z!,w_256,c_limit,f_auto,q_auto:good,fl_progressive:steep/https%3A%2F%2Fsubstack-post-media.s3.amazonaws.com%2Fpublic%2Fimages%2F82bb6092-bf81-4719-a5b9-8777fc9bb5ca_192x192.pngGuardians of the Datahttps://www.guardiansofthedata.showSubstackFri, 07 Aug 2026 22:38:47 GMT<![CDATA[Denial of Wallet - Robert Whetstine - Guardians of the Data - Episode # 54]]>https://www.guardiansofthedata.show/p/denial-of-wallet-robert-whetstinehttps://www.guardiansofthedata.show/p/denial-of-wallet-robert-whetstineThu, 06 Aug 2026 14:00:57 GMTAccording to this week’s guest, it starts making its own decisions, and not always the ones you’d want.

Robert Whetstine, known across the industry as the Bow Tie Security Guy, joins Ward Balcerzak to unpack the wave of risk headed toward every organization running AI in production. From a looming explosion in CVEs to a brand new attack called denial of wallet, Robert makes the case that AI isn’t replacing the fundamentals of security, it’s making them non-negotiable.

The conversation moves from technical war stories to Robert’s own path from homelessness to Fortune 500 executive, tying together a career built on embracing discomfort and doing the basics better than anyone else.

Takeaways:

  • Shift from a vulnerability management mindset to an exposure risk model. Know your crown jewels, monitor them closely, and be able to answer in minutes whether a new CVE actually touches your environment.

  • Don’t let AI agents get bored. Chatbots without real guardrails will drift outside their instructions the longer a conversation runs, so build in controls rather than trusting the model to police itself.

  • Budget for token costs the way you’d budget for cloud sprawl. A reckless query or a denial of wallet attack can rack up tens of thousands in charges, so plan for a multiplier, not a flat rate.

  • Treat an unrestricted AI model like a brilliant but unsupervised junior engineer. Lock down RBAC, log everything through a third party, and never take an AI’s own explanation of its behavior at face value.

  • Protect your team from hustle culture before it protects your company from anything else. Burnout erodes judgment fast, and the basics, like tabletop exercises and clear data retention policies, only get done by people who aren’t running on empty.

“If you're not actively preparing for your token cost to have a five X multiplier in the next five years, you're going to be drastically surprised.” - Robert Whetstine

Connect with Robert:

Ways to Tune In:

]]><![CDATA[The Host Gets Hosted - Ward Balcerzak - Guardians of the Data - Episode # 53]]>https://www.guardiansofthedata.show/p/the-host-gets-hosted-ward-balcerzakhttps://www.guardiansofthedata.show/p/the-host-gets-hosted-ward-balcerzakThu, 30 Jul 2026 14:01:26 GMTFor Guardians of the Data's one year anniversary, Kraig Faulkner, Field CTO at InfoLock, flips the script and puts host Ward Balcerzak in the hot seat. Ward finally answers the question he has asked every guest all year: what is the biggest challenge organizations face in data security? His answer is blunt. From people, process, and technology to agentic AI oversight and a bold prediction about the future of SOC analyst roles, Ward pulls back the curtain on twenty years building data security programs at organizations like Allstate and Fidelity National Financial.

Takeaways:

  • Prioritize, strategize, and focus. Most organizations skip straight to buying a tool without appointing a leader or dedicating real resources, and that shortcut is why data security programs stall before they start.

  • People and processes come before technology. Ward ranks people first, processes a close second, and technology last, since governance and documentation often matter more than the tool doing the work.

  • Data security is bigger than DLP. Encryption, tokenization, activity monitoring, and data cataloging all belong under the same strategic umbrella instead of sitting scattered across disconnected teams.

  • AI did not create new risk, it exposed the risk that was already there. Years of neglecting data at rest and access hygiene are now surfacing the moment a copilot lets employees search everything at once.

  • Treat agentic AI like any other technology rollout. Give it a full architectural and security review, build in a UAT stage, and do not let it skip the same tollgates every other system has to pass through.

“AI didn't introduce new risks. It exposed the risk that we swept under the rug or neglected for years.” - Ward Balcerzak

Connect with Ward and Kraig:

Ways to Tune In:

]]><![CDATA[Compiled for Your Protection - Guardians of the Data - Episode # 52]]>https://www.guardiansofthedata.show/p/compiled-for-your-protection-guardianshttps://www.guardiansofthedata.show/p/compiled-for-your-protection-guardiansThu, 23 Jul 2026 14:02:56 GMTIn this special compilation episode, Ward Balcerzak brings together some of the sharpest voices from across Guardians of the Data, including Tobias Simpson, Hans Vargas, Trevor Dolan, Matthew Gonzales, Joshua Copeland, Luis Valenzuela, Ketan Gotmare, Kevin Feck, and Dr. Sergio, for a rapid fire tour through the ideas that defined the show this season. From the real risk of misclassifying data to the business case every CISO needs to make in the boardroom, this episode strings together the moments that stuck with listeners most, plus a sobering look at how far social engineering has come with deepfakes, and lookalike domains.

Takeaways:

  • Misclassifying data is a bigger risk than leaving it unclassified. Several guests point to department level tabletop exercises as the fastest way to find each team’s actual crown jewels before rolling out a blanket policy.

  • Treat data classification like a partnership, not an audit. Approach owners with empathy and make it clear you’re there to help them find what matters, not to punish them for how they’ve stored it.

  • A real governance program rests on five pillars: leadership buy-in, an honest maturity assessment, clear policy frameworks, ongoing training, and the right team structure. Fix the most urgent pain points first, then document the rest as a roadmap so the gaps are defensible later.

  • Boards don’t respond to cyber risk, they respond to business risk. Translate technical exposure into dollars, downtime, and operational impact, or the conversation stalls before it starts.

  • Security leaders are caught in a velocity versus control paradox, expected to move as fast as the business while still verifying everything. At the same time, social engineering has caught up with AI, from cloned voices to deepfaked video, making code words and manual verification more essential than ever.

"Unless you can talk business risk, not cyber risk, and you can talk real dollars and cents to the business, you're gonna fail every single time." – Joshua Copeland

Connect with the Guest’s LinkedIns:

Ways to Tune In:

]]><![CDATA[Stop Chasing Shiny Objects - Dana Kilcrease - Guardians of the Data - Episode #51]]>https://www.guardiansofthedata.show/p/stop-chasing-shiny-objects-dana-kilcreasehttps://www.guardiansofthedata.show/p/stop-chasing-shiny-objects-dana-kilcreaseThu, 16 Jul 2026 14:02:02 GMTIn this episode, Ward Balcerzak sits down with Dana Kilcrease, a nearly two decade cybersecurity veteran and current CISO in higher education, to talk about what actually matters when the pace of technology outstrips the pace of resources. Dana makes the case that velocity, not any single threat, is the real challenge facing security leaders today, and that the answer isn't chasing every shiny new tool. It's nailing the fundamentals, building DSPM and DLP into the foundation, and treating AI governance as a partnership rather than a lockdown. Along the way, he shares how a 95 year old institution turned AI anxiety into stronger cross-functional relationships, and offers some blunt career advice for anyone trying to break into cyber.

Takeaways:

  • Resources aren’t scaling at the same rate as technology or attackers, so leaders have to get comfortable doing more with what they already have.

  • Don’t chase every shiny new tool. Go back to first principles, harden your endpoints, lock down your processes, and build a real incident response plan so the blast radius stays small when something does happen.

  • Start data security with visibility. A DSPM foundation paired with DLP tells you where sensitive data lives, where it’s overshared, and where policies need to close the gap.

  • Treat AI governance as a partnership, not a policing effort. Sitting down with academic and administrative leaders to hear their concerns first turned a contentious relationship into a collaborative one.

  • Certifications don’t replace experience. Get clear on the niche you actually want, whether that’s pentesting or research or something else, and build toward that instead of stacking badges for their own sake.

"Experience trumps everything. If you have the option of taking a certification or getting into the trenches and really learning what this means, get into the trenches by all means and go nuts."- Dana Kilcrease

Connect with Dana:

Ways to Tune In:

]]><![CDATA[Data Never Sleeps - Andy Soodek - Guardians of the Data - Episode # 50]]>https://www.guardiansofthedata.show/p/data-never-sleeps-andy-soodek-guardianshttps://www.guardiansofthedata.show/p/data-never-sleeps-andy-soodek-guardiansThu, 09 Jul 2026 14:03:44 GMTOn this episode of Guardians of the Data, host Ward Balcerzak sits down with Andy Soodek, a privacy strategist and data governance expert with over three decades in the industry, to make a case that reframes the whole conversation: data protection was never a project with an end date. Andy breaks down why consent, data sprawl, and now AI are pulling organizations into a governance cycle that never actually closes, and why the companies still treating it like a checklist are the ones falling furthest behind.

Takeaways:

  • Treat data governance as a continuous loop, not a project you complete and shelve. New data, new tools, and new regulations mean the work never truly ends, so build a governance model that evolves alongside your business instead of expecting a finish line.

  • Get intentional about consent and transparency before you collect data, not after. Once that data gets shared with third parties or reused for new purposes, unclear consent turns into unclear liability down the road.

  • Simplify your data classification scheme rather than over-engineering it. Too many tiers create inconsistent access controls and confuse the people who actually need to use the data, so aim for a system that is easy to train on internally and easy to explain to an auditor.

  • Audit your data retention practices honestly. Most organizations are holding far more data than their own policies allow, and old data sitting around past its useful life adds legal exposure with little upside.

  • Build AI governance into your existing risk framework instead of treating it as a separate initiative. As regulations like California’s ADMT rules expand, organizations need real explainability and human review built into automated decisions.

"It's a never-ending governance cycle. You've got to keep up with what you've got going on now, because the next challenge is already on its way." - Andy Soodek

Connect with Andy:

Ways to Tune In:

]]><![CDATA[Emerging Threats in Data Protection - Anand Thangaraju - Guardians of the Data - Episode # 49]]>https://www.guardiansofthedata.show/p/emerging-threats-in-data-protectionhttps://www.guardiansofthedata.show/p/emerging-threats-in-data-protectionThu, 02 Jul 2026 14:00:14 GMTIn this episode, Ward talks to Anand where he explains why proprietary data has become every organization's most valuable asset and why traditional security approaches are struggling to keep pace. From data lineage and insider risk to agentic remediation and AI driven security operations, he lays out a future where context matters more than tools and where security teams need to understand not just where data lives, but why it moves and who is moving it.

Takeaways:

  • Your crown jewels are your proprietary data. In an AI driven world where public information is being commoditized by the minute, the only thing that gives your organization a true competitive edge is what it knows that no one else does. If you do not have a strong grip on that proprietary data, you do not have a fighting chance.

  • Stop waiting for the perfect moment to turn on visibility. One of the most common traps CISOs fall into is holding off on DSPM adoption until every compensating control is already in place. Start building now, because the longer you wait for perfection, the more your data sprawl grows into something that is genuinely unmanageable.

  • Treat data security as a program, not a product. No single tool is going to solve your data security problem. The organizations making real progress are the ones pairing the right technology with the right people, clear policies, and a genuine understanding of what bad actors would actually want from their environment.

  • Build your insider risk and data security programs together. These two disciplines share the same foundation: knowing where your sensitive data lives, who is touching it, and whether that behavior is normal. Tackle them in silos and you are leaving the most important use cases on the table.

  • Before you automate remediation, earn the right to do it. A crawl, walk, run approach is not timidity, it is strategy. Start with alert only mode, study your false positive rate, and give your model time to learn the nuances of your business before you hand it the keys to take action.

"The model should be almost like a trained security architect or security engineer. It should be able to reason for every single action it's taking." - Anand Thangaraju

Connect with Anand:

Ways to Tune In:

]]><![CDATA[Where Is Your Grandmother's Data? - David Smith - Guardians of the Data - Episode #48]]>https://www.guardiansofthedata.show/p/where-is-your-grandmothers-data-davidhttps://www.guardiansofthedata.show/p/where-is-your-grandmothers-data-davidThu, 25 Jun 2026 14:02:46 GMTIn this episode, David Smith, a cybersecurity leader with 30 years of experience across financial services, biopharma, consulting, and the vendor space, reframes the entire data governance conversation around one deceptively simple idea: custodianship.

David argues that AI did not create the data governance crisis. Organizations handed it 30 years of ungoverned data and said go. What AI did was pull the covers off a problem that has been quietly compounding through every layer of abstraction since the mainframe days

Takeaways:

  • Every new layer of data technology, from data warehouses to cloud to AI, breaks the original rules attached to data. The further data gets from its source, the harder it is to enforce how it should be used or protected.

  • Good data governance isn’t about corporate policies and DLP rules. It’s about custodianship, treating every data set the way you’d treat something precious that belongs to someone you love, and being intentional about who can access it, how it’s stored, and what happens if something goes wrong.

  • AI doesn’t create data governance problems, it inherits them. When organizations feed decades of ungoverned data into AI systems, they’re handing enormous power to a tool that has no way to respect rules that were never properly defined in the first place.

  • Data classification fails most organizations not because the concept is wrong, but because schemas focus too much on what the data is and not enough on what people are allowed to do with it. Traffic Light Protocol is a better model because it defines behavior, not just sensitivity level.

  • Starting a cybersecurity career at the help desk builds skills no technical training can replicate. Learning to solve problems under pressure with frustrated users and outdated systems directly prepares you for the real-world constraints of enterprise security work.

"AI inherited rather than creating the data governance problem. Organizations handed it 30 years of ungoverned data and said go." - David Smith

Connect with David:

Ways to Tune In:

]]><![CDATA[Governance Never Ends - Zach Lewis - Guardians of the Data - Episode # 47]]>https://www.guardiansofthedata.show/p/governance-never-ends-zach-lewishttps://www.guardiansofthedata.show/p/governance-never-ends-zach-lewisThu, 18 Jun 2026 14:01:12 GMTThat was the reality Zach Lewis faced, and it became the catalyst for one of the most thorough data governance journeys you will hear on this show. In this episode, Ward sits down with Zach Lewis, CIO and CISO in the healthcare and higher education space, author of “Locked Up,” and a 15 year veteran of the industry. Zach breaks down how a ransomware incident forced a complete reckoning with data classification, what a real multi year DSPM journey actually looks like from the inside, and why normalizing open conversation about cyber attacks might be the most important thing the security community can do right now.

Takeaways:

  • Don’t let a good crisis go to waste. A ransomware event, while devastating, can unlock budget, leadership attention, and organizational urgency that would have taken years to build otherwise. The smartest move after an incident is to channel that momentum into the data governance work you already knew needed to happen.

  • Data classification is not a policy problem, it is an execution problem. Having a policy on paper means nothing if the data isn’t actually tagged, governed, and tied to access controls. The real work starts when you move from defining classifications to enforcing them at scale, and that is where tooling and AI become non negotiable.

  • Data governance is a forever journey, not a project. Even after years of work, Zach’s team is still tackling retention, deduplication, and classification accuracy. The goal is not perfection on day one but consistent progress, eating the elephant one bite at a time.

  • Legal is your secret weapon. General counsel carries a kind of organizational gravity that IT rarely does. When you can align data hygiene and retention efforts with legal risk, people listen and things actually get deleted.

  • AI is shifting the math on what is even possible. Tasks that would have required a team of analysts reviewing files around the clock can now be handled automatically and accurately. Leaders who lean into AI for data security today are building the foundation that makes everything else, from Copilot adoption to regulatory compliance, far less terrifying tomorrow.

"A data governance journey never ends. It's a forever journey. Much like zero trust, the heavy lifting gets done and then it's about setting the right processes in place." - Zach Lewis

Connect with Jason:

Ways to Tune In:

]]><![CDATA[Securing the Future - Jason Torres - Guardians of the Data - Episode # 46]]>https://www.guardiansofthedata.show/p/securing-the-future-jason-torreshttps://www.guardiansofthedata.show/p/securing-the-future-jason-torresThu, 11 Jun 2026 14:02:18 GMTIn this episode, Jason Torres draws on over 20 years of experience in healthcare cybersecurity to make the case that data security still comes down to two fundamentals that most organizations haven’t cracked, knowing where your data lives, and knowing who is attached to it.

Jason breaks down why regulated industries like healthcare face a uniquely relentless challenge where data creation never stops, clinical staff have little patience for security friction, and the stakes of getting it wrong are measured in patient trust and breach costs. He also shares why AI governance committees are the non negotiable first step before any organization touches AI tools.

Takeaways:

  • Start with the basics, know where your data lives. Before any tooling, framework, or governance program can take hold, organizations need to first identify, locate, and classify their data. It sounds simple, but most companies still can’t confidently answer that question, and everything else depends on it.

  • Access and ownership are two different problems. Knowing who should have access to data is not the same as knowing who does. Closing that gap requires ongoing partnership between security teams and business stakeholders, not just a one time audit.

  • AI governance must come before AI adoption. Throwing AI tools at the business without establishing governance frameworks, leadership buyin, and usage policies is, in Jason’s words, “the Wild Wild West.” Forming an AI governance committee to define expectations and outcomes is the essential first step.

  • The business case for security tools has fundamentally changed. Where organizations once needed dedicated headcount to implement and run new solutions, AI-driven automation is shifting that model, enabling teams to repurpose existing talent rather than request new hires, and to justify investments with clearer, metrics backed ROI.

  • Diverse backgrounds build stronger security teams. Some of the most effective security professionals didn’t come up through traditional IT paths. Bringing in people with backgrounds in finance, communications, or even ministry, as Jason did, creates the range of perspectives and communication styles that make security teams more resilient and well rounded.

“Every journey begins with the first step. There's no blueprint for becoming a security leader. It all depends on the time you put in, the knowledge you develop, the action you put forth — and ultimately the relationships you build along the way." - Jason Torres

Connect with Jason:

Ways to Tune In:

]]><![CDATA[Where Are Your Crown Jewels? - Tony Schimizzi - Guardians of the Data - Episode #45]]>https://www.guardiansofthedata.show/p/where-are-your-crown-jewels-tonyhttps://www.guardiansofthedata.show/p/where-are-your-crown-jewels-tonyThu, 04 Jun 2026 14:02:06 GMTIn this episode, Tony Schimizzi draws on years of consulting experience to make a point that cuts to the core of modern data security: this is no longer just a cybersecurity problem. It has become a large-scale business operations and governance challenge.

Tony breaks down why data sprawl across SaaS products, cloud apps, and collaboration tools has made it nearly impossible for most companies to know where their data is, let alone where the crown jewels are and how well they are protected.

Takeaways:

  • Do the Fundamentals First: Asset management, visibility, access control, data classification. These have not changed, and they will not. Most breaches happen because the basics were not in place.

  • Security Is a Double Negative: IT can point to uptime as value. Security cannot point to revenue. Understanding that dynamic and learning to communicate in KPIs and measurable outcomes is how security teams earn their seat at the table.

  • Say Yes, And: The most effective security professionals are not the ones saying no. They find the compensating control that lets the business move forward safely. Never no, but. Always yes, and.

  • Build a Risk Council: Instead of having security engineers fight business decisions above their pay grade, bring the right leaders together: CISO, IT, HR, marketing, legal. Let them hash it out. Decisions made there carry weight decisions made at the engineer level never will.

  • If It Matters, It Should Be Measurable: KPIs taken to the board quarterly, along with examples of incidents that did not escalate because controls were in place, are how security teams demonstrate value without a direct revenue line.

  • Understand How the Business Makes Money: Before you can evaluate risk, you need to know what the business actually runs on. If your initiative would slow down the revenue engine, you need to know that going in.

Take Risks When You Are Young: Professionally and personally, the window to experiment, grind, and separate yourself is in your 20s. It is easier to course correct early than to try to change direction later.

"Companies no longer fully understand or control identity, access, and the data movement across their environments." Tony Schimizzi

Connect with Tony:

Ways to Tune In:

]]><![CDATA[Classify First, Secure Everything Else - Cory Zaner - Guardians of the Data ]]>https://www.guardiansofthedata.show/p/classify-first-secure-everythinghttps://www.guardiansofthedata.show/p/classify-first-secure-everythingThu, 28 May 2026 14:02:55 GMTToday’s guest, Cory Zaner, Senior Enterprise Architect for critical infrastructure and trusted advisor to executive leaders, joins Ward to discuss why organizations continue to struggle with data security fundamentals, and what it actually takes to fix them.

With over 20 years of experience across energy, manufacturing, and defense industries, Cory draws on his military background, time at Raytheon, and hands-on work in OT/ICS environments to break down the data security challenges most organizations are still getting wrong.

Takeaways:

  • Start with Data Classification, Not Tools: Before reaching for the latest shiny object, organizations need to define their data tiers. Cory recommends aligning to an established framework like NIST, then mapping your tiers to a simple color-coded system,red, yellow, green, so users can actually act on it.

  • Keep It Simple: Over-complicated classification schemes with 10–20 tags and sub-tags are a recipe for failure. If your users need a secret decoder ring to understand how to classify data, the program has already failed.

  • The Data Owner Classifies the Data: Not IT. Not the tool. The person who knows what the data is worth is the one who should be tagging it. Technology can assist, but it can’t make that judgment call for you.

  • Align to a Framework, Then Scope It: Whether it’s NIST, ISO, or another standard, anchoring your program to an established framework takes the argument off the security team’s plate. You’re not asking people to trust your ideas; you’re pointing to an industry consensus.

  • Start with Unstructured Data First: Cory recommends beginning with your M365 or G Suite environment, where user-generated content lives, before tackling structured data like SQL databases. That’s where the real user behavior risk is.

  • Build the Right Committee: Data classification can’t live in a security silo. Legal, privacy, and HR are essential early partners. Build a governance committee with real ownership, not just initial enthusiasm that fades after the first few meetings.

"Garbage in, garbage out. AI can make things prettier, but we cannot change the mindset of people with technology.” - Cory Zaner

Connect with Cory:

Ways to Tune In:

]]><![CDATA[Navigating the Data Maze - Brian Cherry - Guardians of the Data - Episode # 43]]>https://www.guardiansofthedata.show/p/navigating-the-data-maze-brian-cherryhttps://www.guardiansofthedata.show/p/navigating-the-data-maze-brian-cherryThu, 21 May 2026 14:01:43 GMTThese three questions sit at the heart of every data security challenge and according to Brian Cherry, most organizations still can’t answer them.

In this episode, Brian, a Global Director of Information Security with over 20 years in cybersecurity, joins Ward to dig into the sprawling reality of data security: why data never stays where you think it does, how shadow IT and bad governance quietly create massive exposure, and why AI is raising the stakes on all of it.

Brian also shares how curiosity, mentorship, and asking the right questions shaped his entire career and why those same instincts are the most powerful tools any security professional can have.

Takeaways:

  • Know your data before you protect it. You can’t secure what you can’t find. Start by asking four foundational questions: What data needs protection? Where does it live? Have you truly looked everywhere? And who has access and how did they get it? These questions sound simple, but most organizations haven’t fully answered any of them.

  • Act like an investigative journalist when talking to the business. Going into stakeholder conversations without pretending to have all the answers actually gets you further. When people feel like they’re teaching you, they open up and that’s when you learn where the real data risks are hiding.

  • Governance isn’t sexy, but it’s where the real power is. Red team exercises find problems, but governance is what actually prevents them. Policies, controls, and proper data classification programs are what keep businesses from accidentally creating their own worst security incidents.

  • AI is amplifying your existing data problems, not creating new ones. If sensitive data is scattered in shared directories, staging environments, or forgotten backups, any AI tool with access to it becomes a liability. Getting AI-ready means solving the fundamentals first classification, access control, and visibility.

  • Find a mentor, and be one. A mentor who pushes you to understand the business side of security, not just the technical side, can completely change your trajectory. And when you’ve made it, look back. The best investment you can make in the profession is helping someone else ask the next question.

"If you don't ask questions, you're never going to know the answer. That's where my career started, and it's still the most powerful tool I have." - Brian Cherry

Connect with Brian:

Ways to Tune In:

]]><![CDATA[Fighting AI Risk with AI - Kevin Feck - Guardians of the Data - Ep #42]]>https://www.guardiansofthedata.show/p/fighting-ai-risk-with-ai-kevin-feckhttps://www.guardiansofthedata.show/p/fighting-ai-risk-with-ai-kevin-feckThu, 14 May 2026 14:04:00 GMTToday’s guest, Kevin Feck, Director of Data Protection and Security Architect, joins Ward to unpack how AI is reshaping the data security landscape.

With over two decades in cybersecurity, Kevin shares why the industry’s long-standing challenges of data classification, access control, and visibility have suddenly become urgent in the age of AI. From the risks of copilots and LLMs to the reality of “AI readiness,” this conversation dives into what organizations are getting wrong and how to fix it.

Kevin also breaks down why trying to “boil the ocean” with data security initiatives often fails, how to scope efforts effectively, and why security teams must evolve from perceived roadblocks to true business enablers.

Takeaways:

  • Classify Your Data Before Connecting AI to It: AI tools like Copilot can instantly surface sensitive data that used to take weeks to find manually. Granular, contextual data classification is the foundation.

  • Correlate Sensitive Data With Permissions: Knowing where your sensitive data lives isn’t enough. Lock it down to authorized users so AI agents can only access what they should.

  • Fight AI with AI: Regex based DLP tools are no longer sufficient. Invest in AI powered data security that can understand context, not just patterns.

  • Build an AI Governance Program: Get lawyers, procurement, security, and technical staff aligned on what “AI” actually means in each vendor contract. Not all “AI” is equal.

  • Treat User Education as a Core Security Control: No tool is 100% effective without trained users. Ongoing security awareness training is essential to make data classification stick culturally.

  • Prioritize “Better Together” over a single pane of glass fantasy: No one tool covers every environment perfectly. Integrated tooling with shared intelligence is more effective than waiting for a perfect unified solution.

  • Hire For Passion, Not Just Credentials: In a field evolving daily, someone deeply motivated to do the right thing will outperform a technically skilled person who is just checking boxes.

“It’s always been about the data. Tell me what that data is and I’ll tell you how much I have to care about it.” - Kevin Feck

Connect with Kevin:

Ways to Tune In:

]]><![CDATA[AI Governance: Navigating the Speed of Change - Sweeney Williams - Guardians of the Data - Ep #41]]>https://www.guardiansofthedata.show/p/ai-governance-navigating-the-speedhttps://www.guardiansofthedata.show/p/ai-governance-navigating-the-speedThu, 07 May 2026 14:02:17 GMTIn this episode of Guardians of the Data, Ward sits down with Sweeney Williams, Head of Responsible AI, to unpack the biggest challenge facing data security today … speed.

With over 20 years of experience spanning cybersecurity, privacy, and AI governance, Sweeney shares how the rapid acceleration of AI is reshaping everything from geopolitical competition to regulatory approaches and security threats. What once felt like a manageable evolution now demands constant adaptation, forcing organizations to rethink how they govern, secure, and deploy AI in real time.

The conversation explores why traditional approaches to regulation and risk management are struggling to keep up, how bad actors are leveraging AI to scale attacks, and why organizations can’t afford to wait for clarity before taking action. Sweeney also outlines practical steps for building a strong AI governance foundation, emphasizing the importance of fundamentals like data governance, transparency, and cross functional collaboration.

Takeaways:

  • Speed is the Defining Challenge of AI. AI isn’t just evolving quickly. It’s forcing rapid change across regulation, geopolitics, and security. Organizations are struggling to keep pace with constant shifts in capabilities and expectations.

  • Regulation is Lagging and May Stay That Way. Global attitudes toward AI regulation have shifted dramatically, with many regions prioritizing innovation and competitiveness over strict governance.

  • AI is Amplifying Security Risks. Bad actors are using AI to launch more sophisticated and scalable attacks, lowering the barrier to entry and increasing the pressure on security teams.

  • Fundamentals Still Matter! Strong data governance, transparency, access controls, and bias mitigation remain essential, even as the technology evolves.

  • You Can’t Wait for Clarity! Organizations that delay action until regulations stabilize risk falling behind. The best time to build AI governance is now.

  • Third party AI Risk is a Growing Blind Spot. Vendors are rapidly embedding AI into their products, often without clear visibility, making third party risk management more complex than ever.

“The best time to plant your AI governance tree… is right now.” - Sweeney Williams

Connect with Sweeney:

Ways to Tune In:

]]><![CDATA[AI Is a Tsunami: Why Teams Are Playing Catch-Up - Ben Rothke - Guardians of the Data - Episode #40]]>https://www.guardiansofthedata.show/p/ai-is-a-tsunami-why-teams-are-playinghttps://www.guardiansofthedata.show/p/ai-is-a-tsunami-why-teams-are-playingThu, 30 Apr 2026 14:02:39 GMTIn this episode of Guardians of the Data, Ben Rothke joins the show to break down the biggest data security challenges facing organizations today and why many of them are harder to solve than ever before.

With over 30 years in cybersecurity, Ben shares a grounded perspective on how the landscape has evolved from simpler perimeter-based models to today’s world of data sprawl, AI-driven threats, and overwhelming complexity. He explains why AI isn’t just another trend, but a “tsunami” that’s fundamentally changing how both attackers and defenders operate.

The conversation dives into why so many organizations are playing catch-up, how shadow IT and poor foundations create long-term risk, and why the most dangerous security problems can’t be solved with a single tool or quick fix. Ben also offers practical guidance on how teams can approach AI more responsibly, starting with clear use cases, strong guardrails, and embedding security from the very beginning.

Takeaways:

  • Get Security Involved From the Start: Before deploying any new technology, especially AI, loop in information security from day one. Don’t retrofit security after the fact; it’s far more costly and risky.

  • Define Your Use Case Before Buying Tools: Ask “What is my problem, and how will this tool solve it?” Don’t buy enterprise AI or security tools because they’re on the Gartner Hype Cycle. Start with a clearly defined use case.

  • Create AI Policies and Guardrails Now: If your organization hasn’t done it yet, immediately establish policies and processes governing how AI tools can be used: what data can be entered, by whom, and under what conditions.

  • Document Before You Deploy: Create detailed design documents for any AI or IT system before rollout, covering use cases, security controls, privacy controls, and support plans. Undocumented “shadow IT” becomes tomorrow’s critical vulnerability.

  • Address Data Sprawl Proactively: Inventory where your data lives across servers, cloud, mobile, and third-party vendors. You can’t protect what you don’t know you have.

  • Take Third-Party Supply Chain Risk Seriously: Even a single weak vendor can expose massive amounts of data. Vet your software supply chain rigorously.

“In the last year and change, the challenge of AI has just been a tsunami.” - Ben Rothke

Connect with Ben:

Ways to Tune In:

]]><![CDATA[The Unstructured Data Problem Not Yet Solved - Brent Bigelow - Guardians of the Data - Episode #39]]>https://www.guardiansofthedata.show/p/the-unstructured-data-problem-nothttps://www.guardiansofthedata.show/p/the-unstructured-data-problem-notThu, 23 Apr 2026 14:03:26 GMTIn this episode, Ward sits down with Brent Bigelow: security consultant, President of the Charlotte ISSA, and a cybersecurity veteran with nearly four decades of experience. They unpack one of the most persistent and overlooked challenges in data security: unstructured data.

Brent shares why unstructured data remains the “wild west” of security, how it quietly grows through everyday business operations, and why most organizations still struggle to get their arms around it, especially in the context of mergers and acquisitions.

The conversation explores how “shadow business” contributes to data sprawl, why traditional approaches like classification and DLP fall short, and how the rise of AI is accelerating both the risk and complexity of managing unknown data. Brent also reflects on his career journey from the pre-internet era to today’s AI-driven landscape, offering hard-earned lessons on sustainability, leadership, and staying curious in a rapidly evolving field.

Takeaways:

  • Audit Your Unstructured Data: You can’t protect what you don’t know you have. Dedicate a formal project to discovering, cataloging, and classifying unstructured data across your organization, especially after mergers and acquisitions.

  • Establish and Enforce a Data Governance Policy: Policy is the “stake in the sand.” Define where data should live, in what formats, and who owns it. Without written policy, you have nothing to point to when a breach or compliance issue surfaces.

  • Watch Out For “Shadow Business,” Not Just Shadow IT: Business units are storing data in unauthorized places just as often as rogue IT does. Extend your data governance conversations beyond IT to include business unit leaders.

  • Control Privilege and Access as People Leave: When employees move on, they often take data access, or even the data itself, with them. Enforce least-privilege and revoke access promptly at offboarding.

  • Treat AI Ingestion of Unstructured Data as a Risk: If your organization is deploying Copilot, generative AI, or any LLM that touches internal data, understand what unstructured data it’s consuming. Garbage in, garbage out, and the “garbage” could be sensitive or regulated data.

  • Don’t Let Duplicate Data Pollute Your AI Models: Version control and de-duplication matter more now than ever. Unmanaged duplicates degrade AI output quality and can introduce conflicting or outdated information into critical workflows.

  • Know Your Data Classification Framework and Actually Use It: Internal use, confidential, public. Make sure employees understand how to label data and where each classification belongs.

“Unstructured data is no different than the ocean: it just keeps rising.” - Brent Bigelow

Connect with Brent:

Ways to Tune In:

]]><![CDATA[Using AI to Solve the Data Visibility Problem - Andrew Wilder - Guardians of the Data - Episode #38]]>https://www.guardiansofthedata.show/p/using-ai-to-solve-the-data-visibilityhttps://www.guardiansofthedata.show/p/using-ai-to-solve-the-data-visibilityThu, 16 Apr 2026 14:00:55 GMTIn this episode, Andrew Wilder shares why traditional data loss prevention (DLP) programs have struggled to deliver real value, and what needs to change in an AI-driven world. Drawing from decades of experience leading security programs at global organizations, he breaks down the core challenge most teams still face: relying on humans to classify and manage massive volumes of data simply doesn’t scale.

The conversation explores how AI is reshaping data security, from automatically identifying sensitive data to reducing false positives and improving visibility across the organization. Andrew also explains why security should act as an enabler, not a blocker, and how CISOs can prioritize the right investments while balancing risk and business needs.

If you’re rethinking your approach to data security, AI, or DLP, this episode offers a practical look at what’s working, what isn’t, and where the future is headed.

Takeaways:

  • Stop Relying on Humans to Classify Your Data: Manual data classification fails at scale. Invest in AI-powered DSPM tools that automatically crawl, catalog, and classify sensitive data across your environment.

  • Use Just-In-Time Popups to Change User Behavior: Real-time prompts asking users to justify unusual data movement are more effective than blocking controls. They create accountability, generate valuable intel, and shift culture without requiring a large team to chase false positives.

  • Think of Security as an Enabler, Not a Blocker: Present risks with options and let the business decide their risk appetite. Your job is to inform, not to dictate. Frame security like brakes on a Formula 1 car: they let you go faster safely.

  • Look at AI From Three Angles: How is the business using it (and how do you secure that)? How are attackers using it? How can your security team use AI agents to do more with finite resources?

  • Build a Team of “Bot Masters”: Use AI agents to automate repetitive tasks (SOC L1 triage, GRC forms, legacy account cleanup, third-party risk). Free your human talent for higher-value, strategic work.

  • Reassess Your Security Posture At Least Every 90 Days: The risk landscape changes fast (new AI models, zero-days, etc.). Your 3-year roadmap should be a living document, not a static plan.

“Your job as a CISO is to be kind of a ruthless prioritizer.” - Andrew Wilder

Connect with Andrew:

Ways to Tune In:

]]><![CDATA[Solving Velocity vs. Control in the AI Era - Ketan Gotmare - Guardians of the Data - Episode #37]]>https://www.guardiansofthedata.show/p/solving-velocity-vs-control-in-thehttps://www.guardiansofthedata.show/p/solving-velocity-vs-control-in-theThu, 09 Apr 2026 14:02:45 GMTToday, Ketan Gotmare shares how nearly two decades in cybersecurity have shaped his perspective on modern data protection and why today’s biggest challenge isn’t a lack of tools, but a fundamental imbalance between speed and control.

He introduces the concept of the “velocity versus control paradox,” where businesses are under constant pressure to move faster, adopt AI, and drive digital innovation while security teams are still expected to verify, govern, and reduce risk without slowing anything down. Ketan walks through the evolution of data security, from the “castle and moat” era to today’s borderless, cloud-first world, explaining why traditional approaches no longer work and what organizations must do instead. He emphasizes that security teams can no longer act as gatekeepers, and must shift toward enabling the business while still protecting sensitive data. The conversation dives into practical ways to get started, including how to define what sensitive data actually is, where it lives across structured and unstructured environments, and why most organizations struggle before they even begin implementing frameworks like zero trust.

Takeaways:

  • Embrace the “Velocity vs. Control” Mindset: Security teams must stop being blockers. Find the balance between enabling business innovation and maintaining data protection.

  • Apply Zero Trust as a Concept, Not a Product: Don’t buy into “zero trust” tools blindly. Start small and identify your most sensitive/high-value data, layer controls around those assets, and expand from there. Never trust, always verify.

  • Know What Your Sensitive Data Is Before Worrying About Where It Is: Partner with Privacy, Legal, and Compliance early. Ask: “If this data got out, would it cost us money or damage our brand?” That’s your sensitive data. Define it in a formal standard before scanning anything.

  • Don’t Try to Boil the Ocean, Start with the Obvious: Prioritize structured/business-system data first. Then tackle unstructured user-generated data. Leave shadow data for the crawl/walk/run phase.

  • Don’t Do It Alone: Build strategic partnerships with data teams, privacy, legal, risk, and compliance. Data governance and data security have the same goals. Leverage that alignment.

  • Think Data Lifecycle (DSPM), Not Just Classification + DLP: Track data from creation to retirement. Understand how data flows across your network, to SaaS platforms, and to third parties. Data lineage is the foundation of mature data security posture management.

“You cannot block the business.” - Ketan Gotmare

Connect with Ketan:

Ways to Tune In:

]]><![CDATA[Speaking Business: How Modern Guardians Translate Tech Talk - Guardians of the Data - Episode # 36]]>https://www.guardiansofthedata.show/p/speaking-business-how-modern-guardianshttps://www.guardiansofthedata.show/p/speaking-business-how-modern-guardiansThu, 02 Apr 2026 14:01:39 GMTToday, we unpack a huge topic: how to “speak business” when you’re a technology leader. We take a look back at recent episodes to hear from real cybersecurity experts on how they convey risk and security concerns to people who don’t have the technical expertise.

This episode brings together insights from industry leaders on how to shift from being the “department of no” to becoming a trusted business partner by understanding business priorities, communicating risk in meaningful terms, and building strong cross-functional relationships.

Featuring: Antonio Taylor, Joshua Copeland, Rick Doten, Jennifer Fite, Mark Alvardo, Frank DePaola, and Sanjeev Kumar.

Takeaways:

  • Stop Being the “Department of No”: Instead of defaulting to blocking requests, find the safe and right way to enable what the business needs to do.

  • Learn to Speak Business, Not Tech: Translate technical jargon and cyber risk into business risk, real dollars, and layman’s terms so leadership can understand, support, and fund your programs.

  • Be a Student of the Business: Understand your organization’s structure, operations, long-term strategy, and threat landscape so you can give relevant, informed advice.

  • Build Relationships with Your Peers: Proactively connect with people across departments (HR, sales, operations) whose work your decisions will impact.

  • Listen for Problems You Can Solve: In one-on-ones with business leaders, listen for pain points where security, automation, or AI can add value. Then offer solutions, not restrictions.

  • Frame Security as Risk Guidance, Not Gatekeeping: Present risks, likelihoods, and impacts, but let the business make the final decision to accept, mitigate, or transfer risk.

  • Make Business Partners an Extension of Security: When you bring people secure solutions that help them do their jobs, they start asking vendors the right security questions on your behalf.

“In this time and age, the abuse of data is more existing than the use of data itself.” - Anand Pallapalayam

Connect with these featured guests:

Ways to Tune In:

]]><![CDATA[Re-Air: Implementing Robust Data Protection Measures - Hans Vargas - Guardians of the Data - Ep #35]]>https://www.guardiansofthedata.show/p/re-air-implementing-robust-data-protectionhttps://www.guardiansofthedata.show/p/re-air-implementing-robust-data-protectionThu, 26 Mar 2026 14:02:33 GMTIn this re-aired episode, we revisit a powerful conversation with Hans Vargas, Enterprise Data Protection Lead at Marathon Petroleum Corporation.

Hans shares timeless insights on one of the most persistent challenges in data security: understanding what data actually matters and how to protect it effectively. From the importance of data discovery and classification to the realities of working with business stakeholders, this episode is a practical look at what it takes to build a strong data protection foundation.

As organizations continue to navigate cloud adoption, AI, and increasingly distributed environments, Hans’s perspective is just as relevant today as when this episode first aired.

Takeaways:

  • Know What You Need to Protect: Start with data discovery and identify what data you have, where it is, and what is sensitive. You can’t protect what you don’t know exists.

  • Engage Data Owners Directly: Build relationships with data owners, not just stakeholders. Have open conversations to understand what is truly sensitive and important to the business.

  • Communicate the Value of Data Protection: Clearly explain to business units why data protection matters, using relatable analogies if needed (e.g., moving houses, hoarding).

  • Establish and Strengthen Data Governance: Ensure your organization has clear data governance policies covering the entire data lifecycle from creation to disposition.

  • Collaborate Across Teams: Work closely with data governance, legal, and business units. Data security is a two-way street; share discoveries and insights to improve overall protection.

  • Don’t Rely Solely on Tools: Deploying a tool is not enough. Make sure processes and responsibilities are in place before or alongside technology adoption.

  • Consider the Full CIA Triad: Don’t focus only on confidentiality. Ensure data integrity and availability are also prioritized to keep the business running smoothly.

“I argue that the conversation about the architecture of how to protect data should be one of the first things.” - Hans Vargas

Connect with Hans:

Ways to Tune In:

]]>