
Show Notes
Thoropass Co-founder and CEO Sam Li joins Ben on Chief AI Officer to break down how AI is shaping the compliance and security landscape from two crucial angles: as a powerful tool for automation and as a source of new challenges requiring innovative solutions.
Sam shares how their First Pass AI feature is helping along the audit process by providing instant feedback, and also explores why back-office operations are the hidden frontier for AI transformation. The conversation explores everything from navigating state-level AI regulations to building effective testing frameworks for LLM-powered systems, offering a comprehensive look at how enterprises can maintain security while driving innovation in the AI era.
Topics discussed:
The evolution of AI capabilities in compliance and security, from basic OCR technology to today's sophisticated LLM applications in audit automation.
How companies are managing novel AI risks including hallucination, bias, and data privacy concerns in regulated environments.
The transformation of back-office operations through AI agents, with predictions of 90% automation in traditional compliance work.
Development of new testing frameworks for LLM-powered systems that go beyond traditional software testing approaches.
Go-to-market strategies in the enterprise space, specifically shifting from direct sales to partner-driven approaches.
The impact of AI integration on enterprise sales cycles and the importance of proactive stakeholder engagement.
Emerging AI compliance standards, including ISO 42001 and HITRUST certification, preparing for increased regulatory scrutiny.
Framework for evaluating POC success: distinguishing between use case fit, foundation model limitations, and implementation issues.
The false dichotomy between compliance and innovation, and how companies can achieve both through strategic AI deployment.
Listen to more episodes:
Apple
Spotify
YouTube
More from The Chief AI Officer Show
98% of IT leaders say they're using AI, yet 43% aren't measuring ROI and 80% admit they're not using it to its potential. Olga Lagunova, Chief Innovation and Technology Officer at GoTo, says the industry won the adoption battle but hasn't reached the outcomes it needs. Olga breaks down GoTo's federated AI steward model, where functional leaders own roadmaps and a central enablement team provides infrastructure. She explains why SMB pragmatism shaped their practical AI principles and how 39% of employees already report AI is eroding their skills.
Eric Ries built the Lean Startup methodology, helped advise on Anthropic's long-term benefit trust structure, and is now making an argument most enterprise leaders aren't ready to hear: deploying AI agents inside a company with bad governance isn't just a compliance risk, it's an existential one. His new book, Incorruptible, makes the case that the same slow-moving forces that corrupt companies over decades will be dramatically accelerated by AI, and that the standard governance playbook most executives have been handed is the actual source of the problem. In this conversation, Eric and Ben cover the legal and structural traps that silently strip companies of mission control long before anyone notices, why Anthropic walking away from a $200M Pentagon contract turned into an unexpected competitive advantage, and what AI leaders specifically need to do before they deploy agents at scale. Eric is direct about what he thinks leaders are getting dangerously wrong right now, and he pulls no punches. Topics Discussed: Why standard "best practice" corporate documents are structurally designed to separate mission from control
Intercom launched outcome-based pricing before the market had a framework for it, before inference costs made it profitable, and before customers knew how to budget for it. Fergal Reid, Chief AI Officer, was inside that decision and he shares exactly how they modeled their way through it, what two bets he personally owned, and why they went to $1 per resolution knowing it was a loss. That pricing story is inseparable from their model strategy. Fergal walks through the production data that led them to conclude that Opus 4.5 didn't outperform Sonnet 4.0 on their RAG customer service task, what that told them about the limits of general intelligence at the application layer, and why it pushed them to build Apex, their own model trained via reinforcement learning on an open-weight base specifically for customer service. With 85% of Intercom's own support volume now fully automated, the bets held. Topics discussed: Outcome-based pricing mechanics: the $2 beta, the loss-leader move to $1, and the two assumptions Fergal had to own
What happens when a journalist turned Amazon product manager becomes the Chief AI Officer of one of the world's largest international broadcasters? You get someone who sees the AI threat to media not just as a distribution problem, but as a full production chain crisis that requires a fundamentally different organizational architecture. Marie Kilg, Chief AI Officer at Deutsche Welle, makes the case that legacy media's survival depends on something most AI transformation conversations ignore: data interoperability across systems that were never designed to talk to each other. With 32 languages, siloed editorial teams, and decades of layered organizational structure, Deutsche Welle's path to an AI-powered content flywheel starts at the infrastructure layer, not the model layer. Topics Discussed: Why AI threatens the full media production chain, not just distribution
Most security leaders treat AI as a new threat category requiring new defenses. Rohit Parchuri, SVP and Chief Information Security Officer at Yext, pushes back hard on that. His argument: if your foundational controls are solid, AI does not require you to rebuild anything. What it does is amplify whatever you already have, gaps included, which makes the real question not "what new controls do we need?" but "how well are we actually executing on what we already built?" Rohit walks host Ben Gibert through how Yext is operationalizing this at scale: threat-modeling AI as just another system with inputs, processing, and outputs; building AI security testing directly into the existing CI/CD pipeline rather than standing it up as a separate track; investing heavily in data classification and taxonomy to solve DLP before deploying any AI tool internally; and establishing an AI Excellence Committee with cross-functional representation to run a single governance funnel across every AI request in the company. He also makes the case that the CISO who earns a seat at the AI strategy table is the one who deeply understands the business value chain, not just the threat landscape. Topics discussed: Threat-modeling AI as a system instead of a threat category