Person
2 episodes · 42 quoted claims
Palo Alto Networks' 2026 identity security landscape study, as cited by Craig Unger, found 109 machine identities per human identity in an average enterprise.
“It showed that there's 109 machine identities per human identity in an average enterprise.”
Non-human access to systems often relies on API keys or tokens, which are the same methods an AI uses to access those systems.
“there's also scenarios where you're not present, where you're actually presenting some type of API key or a token or something else in order to get access to a system.”
Craig Unger says identity and access management has been a major growing area of software for some time.
“the identity and access management area has been a major growing area in the software space for a while.”
Craig Unger defines shadow AI as the use of AI tools and models inside an organization that gives users visibility into assets the company did not intend them to reach.
“shadow AI is the use of the AI tools and models inside an organization in order to give the users some type of like visibility to certain assets”
Craig Unger says a user can combine five or six individually acceptable AI requests to reach data or systems nobody had planned to expose.
“It may be the fact that it's doing a con the user's doing a composition of five or six different requests that you kind of hadn't contemplated.”
Craig Unger says organizations in Europe face a higher bar for describing how data is used, including the right to have data deleted.
“I'd say even especially if you're in Europe, because there's even more of a higher bar to what has to be described in terms of how data is used”
Vendors commonly share SOC or ISO compliance reports so customers can judge whether the vendor meets the customer's own criteria.
“It's quite common for a vendor to, like, share their SOC report or whatever their ISO report so that you can take a look and say, well, it met their criteria, but does it meet our criteria?”
Customers can add contractual obligations such as a data processing agreement, which is a mechanism familiar from the GDPR.
“Maybe it's kind of a data processing agreement, as folks might be familiar with in the GDPR, or you know, whatever it is, the different frameworks have some different capabilities for that.”
Hyperproof offers a product for third-party risk, the area covering how vendors handle data.
“So that whole area, which broadly falls under third party risk, we at Hyperproof have a product for that.”
Craig Unger says today's AI is better at analyzing large amounts of data than at making decisions.
“I feel like it's today's AI is a lot better at doing that than it is at actually making decisions.”
Horizon scanning is the use of AI to look across the web and detect changes in regulations.
“So one example would be horizon scanning, what's called horizon scanning, and that's the ability to kind of look across the web and know what's changed in terms of regulations.”
Craig Unger says tracking regulatory change used to rely on subscription services such as LexisNexis or Thomson Reuters.
“in the old days, where there had been almost like subscriptions to systems, maybe it'd be like a LexisNexis or, you know, or Thomson Reuters or whomever.”
The audit industry developed sampling methods because data was historically difficult to obtain in its entirety.
“the audit industry has grown up, knowing that the data is difficult to get in in kind of its entirety. And so there's this whole methodology of sampling the data”
Craig Unger says AI increasingly makes it possible to test an entire population of data instead of a sample.
“But increasingly with the AI, you don't really need to sample the data. You could actually test the whole population.”
Historical compliance testing mostly consisted of simple machine-checkable tests, such as comparing values or confirming that someone without permission lacked access.
“A lot of the testing that's gone on historically has been the testing that's very easy for machines to do. So that's comparing a value to another value, checking to make sure an individual who shouldn't have access didn't have access.”
Craig Unger compares risk controls to medicine, saying AI might diagnose or perform a procedure while human experts define the problems and parameters.
“You could have the AI diagnose or even do a procedure, but when it comes to actually defining what really the problems are and the parameters are”
Craig Unger says the most-used dollar-based risk systems rely on simulation modeling such as Monte Carlo simulation, which is not AI itself.
“They used more of like a simulation modeling, like a Monte Carlo type simulation, which certainly is not really an AI in and of itself.”
Hyperproof has found that using AI up front to connect data, controls and policies and suggest attack scenarios improves dollar-based risk modeling.
“when you combine an AI up front to be able to make the connections between the data elements and the controls, the policies, perhaps suggest some different attack vectors”
Craig Unger says a company pursuing SOC 2 compliance might have a couple hundred controls, some of which would be affected by AI.
“They might have a couple hundred controls. Just to give you a sense of scale for what it might take to become SOC compliant.”
Craig Unger says control monitoring can no longer be done once a quarter or only before audits and must run continuously.
“we are so far beyond doing that once a quarter or in preparation for an audit.”
Craig Unger says more than half of breaches at organizations occur through their vendors.
“Because more than half the breaches that happen to organizations today happen through their vendors.”
Craig Unger says the EU AI Act focuses on documenting AI use and monitoring AI so that it does not suggest harmful outcomes for real people.
“In the EU, you have the AI Act, which is concerning itself with how you document your usage of AI, how you monitor to make sure the AI isn't suggesting things that we wouldn't want to happen to real people.”
Craig Unger says the first phase of the EU Cyber Resilience Act, which requires reporting of exploited vulnerabilities, became enforceable in September 2026.
“That particular mandate has actually come into being and is enforceable on September of this year.”
Craig Unger says a further Cyber Resilience Act phase, covering secure by design, a software bill of materials and vulnerability handling, is due about a year after the recording.
“And then in about a year from now, there's a newer mandate around full application security, secure by design, a secure bill of materials, how you handle vulnerabilities”
Craig Unger says Cyber Resilience Act penalties could reach 15 million or 2.5% of global revenue.
“And the penalties are pretty significant. It could be 15 million or as much as 2.5% of your global revenue, your global turnover.”
Craig Unger says the EU's NIS2 cybersecurity directive applies to organizations with fifty or more employees or more than 10 million in turnover, covering about 100,000 organizations.
“NIST two has to be enforced for organizations of fifty or more employees, or organizations that have more than 10 million in turnover, which is 100,000 different organizations.”
Craig Unger describes the Cybersecurity Maturity Model Certification (CMMC) as security requirements for all suppliers to the US Department of Defense.
“the CMMC, which is really a set of requirements around how security is handled for all suppliers to the Department of Defense, right?”
Craig Unger says FedRAMP 20x is a modernization of the FedRAMP program meant to cut the cost of preparing for and undergoing the audit.
“There's a whole new framework called FedRAMP twenty X, and that's a modernization of this, mostly so that you can cut down a bit the costs of actually doing the preparation and the audit”
Craig Unger says he coined the term 'regulatory rubbernecking' about two weeks before the recording.
“This is a term that I came up with like two weeks ago for for another discussion I was doing.”
Craig Unger says that both the EU AI Act and the US CMMC requirements have been slowed down while governments reconsider the right requirements.
“including the EU AI Act and including CMMC in the USA, that have been slowed down so that the government could go back and say”
Craig Unger says that Hyperproof's busy customers often report being too busy with audits to automate their compliance work.
“a lot of what we hear back is we're so busy doing audits, we don't have the time to automate, right?”
Craig Unger says Hyperproof's products include automations that pull in data from a customer's whole environment and test it.
“we have in our products, we have automations that you can use to bring in data from your whole environment, you can test it, all that stuff.”
Craig Unger says that organizations want to stay compliant continuously, but are typically audited only once a year, which drives odd behavior.
“So we want to do that continuously, but we're audited once a year.”
Craig Unger says a company's board very likely has an audit member assigned to oversee the organization.
“the board itself, which will very, very likely have an audit member that's actually assigned to the organization.”
Craig Unger defines controls as the processes a company runs to mitigate threats, which reduce the risk that materializes.
“the controls that you're using, which are really just the fancy name for the processes that you're running in your company, those are meant to actually attack the threats.”
Craig Unger says some organizations justify compliance costs by the dollar amount of risk the activity reduces.
“some organizations tend to look at the compliance activity and the costs associated with running that compliance activity as justified by the risk that it reduces.”
Craig Unger says regulators want to see that a human is involved at the right moment when AI is used in compliance workflows.
“this is an important part of what the regulatory agencies want to see. And I mentioned it earlier, they want to see that the human is in the loop, right at the right time.”
Craig Unger says the first stage of Hyperproof's five-stage maturity model is ad hoc compliance, with little written down and no central governance.
“The first is when you look at your organization and you say that compliance is ad hoc.”
Craig Unger describes the standardized stage of the maturity model as one set of controls mapped to multiple frameworks and requirements.
“I set up one set of controls. I map it to multiple requirements because that's my one set of controls.”
Craig Unger says the 'integrated' fourth stage of the maturity model connects policies, controls and risks and breaks down silos.
“Policy talks to controls, controls are mapped to risks, you know, all of these things in the way that we talked about.”