Show Notes
Most organizations believe they know where their sensitive data lives. That confidence often disappears as soon as they scan the environment. Files have been copied into personal folders, cloud storage, SaaS platforms, and systems that were never included in the original security plan. AI can now reach much of that data faster than teams can classify or govern it.
In this episode of The Blind Spot, Jason Lee sits down with Heather Case-Hall, cybersecurity leader and author of Data in Plain Sight, to discuss what happens when AI meets years of unclassified data and unmanaged access. They cover why legacy DLP tools miss context, what DSPM reveals about the true scale of the problem, how Copilot and other AI tools can surface data that was never meant to be broadly available, and why non-human identities make access governance more complicated. They also discuss why companies should plan before buying another tool, where SaaS platforms create visibility gaps, and how the C-suite can translate data security between technical teams and the board.
About the host Jason Lee is Managing Director at Z Cyber. For more than 20 years, he has worked the part most people skip past: what happens after the risk is visible, across infrastructure, AI, and GRC.
About the guest Heather Case-Hall, MSc, is a cybersecurity leader, the author of Data in Plain Sight, and a 22-year veteran of the US Army. Her work focuses on helping organizations understand, classify, and protect their data as AI changes who and what can access it.
About Z Cyber Z Cyber is the security team that builds, runs, and improves your program through an Executive Security Advisor and Glance, its AI-native GRC platform.
Links Buy Data in Plain Sight on Amazon: https://www.amazon.com/s?k=9798996263837 Z Cyber: https://www.ztekcyber.com The Blind Spot: https://www.ztekcyber.com/resources/the-blind-spot Apply to be a guest: https://www.ztekcyber.com/resources/the-blind-spot/apply Get started with Z Cyber: https://www.ztekcyber.com/get-started
More from The Blind Spot
When the CTO, the CIO, and the CISO disagree about AI in the same room, the person who wins is rarely the person who is right. It is the one who can tie the decision to a business outcome, and who has earned enough trust that a no actually means no.
A point-in-time security assessment can be out of date the moment the report arrives. When new vulnerabilities can move from detection to exploitation in hours, the harder problem is no longer finding more. It is knowing which ones matter and fixing them fast enough.
A busy cybersecurity program is not necessarily a well-run one. The difference is whether the work protects the business, supports growth, and gives leaders confidence that the company can respond and recover when something goes wrong.
Security leaders often talk about risk. CFOs hear cost, trade-offs, timing, probability, and whether the decision can be defended to the CEO or the board.
Boards and CISOs are often on two different planes. In the first episode of The Blind Spot, Jason Lee sits down with Antonio Bovoso, cybersecurity executive and author of The Boardroom CISO, on why security and the board talk past each other and how to close the gap. They get into reframing risk as enablement, tying cyber to how the business actually makes money, cutting vanity metrics and the museum-quality deck, and where cyber liability really lands.