EP 25 — Cybersecurity Executive Arvind Raman on Hand-in-Glove CDO-CISO Partnership
Future of Data SecurityShow Notes
Arvind Raman — Board-level Cybersecurity Executive | CISO roles at Blackberry & Mitel, rebuilt cybersecurity from a compliance function into a business differentiator. His approach reveals why organizations focusing solely on tools miss the fundamental issue: without clear data ownership and accountability, no technology stack solves visibility and control problems. He identifies the critical blind spot that too many enterprises overlook in their rush to adopt AI and cloud services without proper governance frameworks, particularly around well-meaning employees who create insider risks through improper data usage rather than malicious intent.
The convergence of cyber risk and resilience is reshaping CISO responsibilities beyond traditional security boundaries. Arvind explains why quantum readiness requires faster encryption agility than most organizations anticipate, and how machine-speed governance will need to operate in real time, embedded directly into tech stacks and business objectives by 2030.
Topics discussed:
How cybersecurity evolved from compliance checkboxes to business enablement and resilience strategies that boards actually care about.
The critical blind spots in enterprise data security, including unclear data ownership, accountability gaps, and insider risks.
How shadow AI creates different risks than shadow IT, requiring governance committees and internal alternatives, not prohibition.
Strategies for balancing security with innovation speed by baking security into development pipelines and business objectives.
Why AI functions as both threat vector and defensive tool, particularly in detection, response, and autonomous SOC capabilities.
The importance of data governance frameworks that define what data can enter AI models, with proper versioning, testing, and monitoring.
How quantum computing readiness requires encryption agility much faster than organizations anticipate.
The emerging convergence of cyber risk and resilience, eliminating silos between IT security and business continuity.
Why optimal CISO reporting structures depend on organizational maturity and industry.
The rise of Chief Data Officers and their partnerships with CISOs for managing data sprawl, ownership, and holistic risk governance.
More from Future of Data Security
When agentic AI systems make multiple tool calls, store data, and act autonomously, static compliance frameworks fall apart. Kevin Bauer, CISO at Chainalysis Government Solutions, argues security teams need continuous monitoring of which controls were in effect at runtime and whether those controls actually worked. Kevin led the first blockchain analytics product to FedRAMP Moderate authorization, where data sensitivity emerged through attribution to real-world entities. He draws direct parallels between those boundary-setting challenges and today's governance gaps in agentic AI, where data classification must drive compliance obligations in real time.
The gap between an exploit's first use and its public disclosure has gone negative. Agentically deployed attacks now reach their target before the vulnerability behind them is ever publicly reported, a shift most security programs are still catching up to. Tom Doughty, Chief Information Security Officer at Generate:Biomedicines, walks Jean through what that shift demands from a security team, from agentic countermeasures to a different approach to non-human identity, plus what changed when he moved a 25-year financial services security career into an AI-native biotech (generatebiomedicines.com) built on machine-generated molecules.
Gopuff runs 200-plus AI agents and 100-plus MCP servers across three public clouds, and Ravi Nori is the one securing all of it. The Head of Cyber Security at Gopuff brought a defense-industry classification ethos to a cloud-native retail platform where customer data sits at the top of the priority chain. Ravi walks Jean through Gopuff's three AI deployments, the shadow AI sprawl he uncovered during an environment scan, and why agent security now spans three surfaces: desktop, browser, and cloud. He also breaks down how boards push for AI adoption while security lags behind.
What if the file itself decided who gets access, carried its own encryption, and refused unauthorized requests? Georgeo X. Pulikkathara, Global CIO and CISO at iMerit Technology, sees that future arriving fast. With 34 years in IT security and active service as a Colonel in the US Army Reserve, Georgeo breaks down 40-minute AI-enabled breaches, the flood of non-human accounts, and why human oversight remains the one control that will never go away.
Gartner predicts 40% of enterprise applications will incorporate agentic AI by year's end, but Jon Rohrich is asking a more basic question: why? Leading Avanade's Canadian cybersecurity practice with nearly 30 consultants, Jon keeps watching proof of concepts succeed, only to collapse when unmodeled risks surface in production.