EP 29 — Age of Learning's Carl Stern on Why Certifications Are Side Effects, Not Final Goals
Future of Data SecurityShow Notes
Carl Stern, VP of Information Security at Age of Learning, explains why forcing controls into place without executive alignment guarantees you'll fight uphill battles every single day, as people begin to see security as a blocker rather than a business enabler. Instead, he starts with identifying crown jewels and acceptable risk levels before selecting any frameworks or tools, ensuring the program fits company culture instead of working against it. He also asserts that certifications like HITRUST and SOC 2 validate you're already operating securely; the real program is the daily processes people follow because they understand why, not compliance theatre. Carl also argues the cybersecurity industry exists at its current scale because of a systemic failure: companies ship insecure software without liability, pushing security costs downstream. Most breaches exploit preventable defects that should never reach production, not sophisticated zero-days. Topics discussed: Building security programs from scratch versus inheriting existing programs and why executive alignment prevents daily uphill battles
Treating certifications as validation of operational security rather than the primary program goal
Pairing administrative controls with technical monitoring to establish baselines before enforcement for unstructured data security policies
Applying three-part investment calculus for lean teams: measurable risk reduction, manual work automation, and crown jewel protection
Calculating true cost of 24/7 internal SOC coverage including shift staffing, turnover, training, and tooling versus managed services
Why attack patterns remain consistent across healthcare, education, gaming, and retail despite different compliance requirements
Explaining how AI lowers the barrier for exploit development and expands zero-day risk beyond traditional high-value enterprise targets
Arguing that the cybersecurity industry exists at current scale because companies ship insecure software without liability, pushing costs downstream
More from Future of Data Security
When agentic AI systems make multiple tool calls, store data, and act autonomously, static compliance frameworks fall apart. Kevin Bauer, CISO at Chainalysis Government Solutions, argues security teams need continuous monitoring of which controls were in effect at runtime and whether those controls actually worked. Kevin led the first blockchain analytics product to FedRAMP Moderate authorization, where data sensitivity emerged through attribution to real-world entities. He draws direct parallels between those boundary-setting challenges and today's governance gaps in agentic AI, where data classification must drive compliance obligations in real time.
The gap between an exploit's first use and its public disclosure has gone negative. Agentically deployed attacks now reach their target before the vulnerability behind them is ever publicly reported, a shift most security programs are still catching up to. Tom Doughty, Chief Information Security Officer at Generate:Biomedicines, walks Jean through what that shift demands from a security team, from agentic countermeasures to a different approach to non-human identity, plus what changed when he moved a 25-year financial services security career into an AI-native biotech (generatebiomedicines.com) built on machine-generated molecules.
Gopuff runs 200-plus AI agents and 100-plus MCP servers across three public clouds, and Ravi Nori is the one securing all of it. The Head of Cyber Security at Gopuff brought a defense-industry classification ethos to a cloud-native retail platform where customer data sits at the top of the priority chain. Ravi walks Jean through Gopuff's three AI deployments, the shadow AI sprawl he uncovered during an environment scan, and why agent security now spans three surfaces: desktop, browser, and cloud. He also breaks down how boards push for AI adoption while security lags behind.
What if the file itself decided who gets access, carried its own encryption, and refused unauthorized requests? Georgeo X. Pulikkathara, Global CIO and CISO at iMerit Technology, sees that future arriving fast. With 34 years in IT security and active service as a Colonel in the US Army Reserve, Georgeo breaks down 40-minute AI-enabled breaches, the flood of non-human accounts, and why human oversight remains the one control that will never go away.
Gartner predicts 40% of enterprise applications will incorporate agentic AI by year's end, but Jon Rohrich is asking a more basic question: why? Leading Avanade's Canadian cybersecurity practice with nearly 30 consultants, Jon keeps watching proof of concepts succeed, only to collapse when unmodeled risks surface in production.