EP 31 — Arbor Memorial's Teij Janki on why adding AI before fixing process amplifies weaknesses
Future of Data SecurityShow Notes
Teij Janki, CISO & Director of IT Governance Risk & Compliance at Arbor Memorial, has spent 30 years moving through the full stack of security, and his view is that the sequencing most teams follow is backwards. His principle is that technology does not solve processes, it amplifies them. That means deploying a tool before fixing the underlying process weakness just scales the problem. The implication for AI adoption is direct and worth hearing spelled out. On the budget side, Teij makes a case that privacy legislation is a more reliable governance lever than cybersecurity risk alone because privacy laws carry consequences that executive teams will actually act on. He also walks through the gating sequence his team built for AI tool adoption wherein sensitive data gets slowed down and scrutinized, lower-sensitivity use cases move through faster, and staff have a service catalog to work from rather than a blanket ban. Topics discussed: Applying a people-process-technology sequence to security programs before introducing AI or automation tooling
Using privacy legislation as an executive governance lever when cybersecurity risk alone fails to drive budget decisions
Building a gating sequence for AI tool adoption that separates sensitive from low-sensitivity data use cases
Replacing blanket AI bans with a structured service catalog that lets staff self-select and move tools through approval
Identifying process weaknesses before deploying technology to avoid amplifying existing security vulnerabilities at scale
Progressing security from a technical cost center to a strategic business enabler using the CMMI maturity model
Applying martial arts principles of discipline, clear expectations, and target-setting to cybersecurity team leadership
Evaluating where generative AI delivers in security operations versus where magical thinking still outpaces real-world performance
More from Future of Data Security
When agentic AI systems make multiple tool calls, store data, and act autonomously, static compliance frameworks fall apart. Kevin Bauer, CISO at Chainalysis Government Solutions, argues security teams need continuous monitoring of which controls were in effect at runtime and whether those controls actually worked. Kevin led the first blockchain analytics product to FedRAMP Moderate authorization, where data sensitivity emerged through attribution to real-world entities. He draws direct parallels between those boundary-setting challenges and today's governance gaps in agentic AI, where data classification must drive compliance obligations in real time.
The gap between an exploit's first use and its public disclosure has gone negative. Agentically deployed attacks now reach their target before the vulnerability behind them is ever publicly reported, a shift most security programs are still catching up to. Tom Doughty, Chief Information Security Officer at Generate:Biomedicines, walks Jean through what that shift demands from a security team, from agentic countermeasures to a different approach to non-human identity, plus what changed when he moved a 25-year financial services security career into an AI-native biotech (generatebiomedicines.com) built on machine-generated molecules.
Gopuff runs 200-plus AI agents and 100-plus MCP servers across three public clouds, and Ravi Nori is the one securing all of it. The Head of Cyber Security at Gopuff brought a defense-industry classification ethos to a cloud-native retail platform where customer data sits at the top of the priority chain. Ravi walks Jean through Gopuff's three AI deployments, the shadow AI sprawl he uncovered during an environment scan, and why agent security now spans three surfaces: desktop, browser, and cloud. He also breaks down how boards push for AI adoption while security lags behind.
What if the file itself decided who gets access, carried its own encryption, and refused unauthorized requests? Georgeo X. Pulikkathara, Global CIO and CISO at iMerit Technology, sees that future arriving fast. With 34 years in IT security and active service as a Colonel in the US Army Reserve, Georgeo breaks down 40-minute AI-enabled breaches, the flood of non-human accounts, and why human oversight remains the one control that will never go away.
Gartner predicts 40% of enterprise applications will incorporate agentic AI by year's end, but Jon Rohrich is asking a more basic question: why? Leading Avanade's Canadian cybersecurity practice with nearly 30 consultants, Jon keeps watching proof of concepts succeed, only to collapse when unmodeled risks surface in production.