OpenNashPodcasts

The AI in Business Podcast

Preparing Enterprise Data for Safe AI Deployment - with Todd Vancil of Securiti AI

15 Jul 2026 · 32m · Daniel Faggella, Todd Vancil · 19 quoted facts

▶ Play episodeOriginal source ↗

In brief

Todd Vancil argues that safe enterprise AI starts with securing the data itself, not just the network perimeter. Companies' most valuable data is also their most sensitive, and AI needs access to it. Scanning, classifying and labeling that data before any AI touches it lets systems respect rules, even when they move too fast for people to supervise.

The tension is that AI is now compulsory, yet it exposes data that has sprawled across clouds and software services, and it works at machine speed. Vancil says leaders must do older security work faster and smarter, bring security, compliance, data and technology leaders together, delete useless data, and plan for fast breach response.

Key insights

  1. AI needs an enterprise's most sensitive data

    Vancil uses an airline example: to improve products and routes, it must give AI access to customer travel details, passports and birth dates. The data that makes AI valuable is the data regulations most tightly govern.

  2. Perimeter security no longer protects sprawled data

    Data once sat in company-controlled data centers behind layered defenses. Cloud infrastructure, software services and data lakes moved it outside those walls, so Vancil says protection must attach to the data itself.

  3. Classify and label data before AI uses it

    Vancil describes scanning every file, finding sensitive content and labeling it. Training and retrieval policies can then respect those labels, such as redacting parts, instead of trusting an AI agent to know every security rule.

  4. Deleting redundant data cuts risk and cost

    Vancil says 'ROT' data (redundant, obsolete or trivial) adds legal discoverability risk and storage cost, and should stay out of AI. He links storage demand to AI-driven chip shifts and rising storage prices.

  5. Security must be a joint executive effort

    Vancil says innovative leaders bring the CISO, compliance, chief data officer and legal teams together with CIO and CTO. He warns that isolated projects repeat the 'shadow IT' problem of the software-as-a-service era.

Questions

Why does AI make data security harder for companies?

Vancil says AI is only useful if it can reach a company's most sensitive data, and it works at machine speed. A breach can therefore spread far faster than in traditional systems.

What does 'securing the data itself' mean?

Vancil means scanning and classifying data, working out who can access it, and labeling it. AI systems are then set up to follow those labels rather than relying only on network or access barriers.

What is ROT data and why should a business care?

ROT means redundant, obsolete or trivial data, such as old files whose owner has left. Vancil says deleting it lowers storage costs, reduces legal exposure from keeping data too long, and keeps junk out of AI.

Why isn't the traditional 'moat' approach enough anymore?

The moat approach protected data held in company-controlled data centers. Vancil says cloud services and software-as-a-service applications moved data outside those walls, so there is no single perimeter left.

What should executives do first about AI security?

Vancil advises treating it as a team effort across the C-suite, identifying which data is sensitive, and protecting it proactively. He also points to cyber insurance, security operations centers, response teams and public relations.

Facts

Stated by the speakers. Each quote matches the transcript, which shows what was said, not that it is true.

Todd Vancil says enterprises hold about ten times more data than the public internet that public large language models train on.

“It turns out that enterprises hold about an order of magnitude more than the overall public domain of the internet.”

0:17:24 · Todd Vancil · Enterprise data

Todd Vancil says the industry term ROT data stands for redundant, obsolete or trivial data.

“There's a term inside the industry that's that is becoming more widely used, called rot data, redundant, obsolete, or trivial data.”

0:16:42 · Todd Vancil · ROT data

Todd Vancil says keeping data past its legal retention period creates legal exposure because it is discoverable in legal proceedings.

“There can be a legal exposure that I that I held on to data past the time of legality. All of that data is discoverable”

0:18:26 · Todd Vancil · Legal risk

Todd Vancil says he has worked in cybersecurity for about twenty-five years.

“I come from a cybersecurity background, that's been my posture for, like, the last twenty five years of my career.”

0:08:12 · Todd Vancil · Vancil background

Todd Vancil says that more than a decade ago most large enterprises kept data and applications in their own or outsourced data centers, protected by perimeter security.

“Most large enterprises possessed most of their data and applications in physical spaces, either their own data centers or outsourced data centers that they kinda owned.”

0:08:12 · Todd Vancil · Perimeter security · 2010s

Todd Vancil says cloud computing moved enterprise data to infrastructure providers such as Amazon, Google and Microsoft and to software-as-a-service providers.

“Whether it be infrastructure as a service from the cloud service providers, the Amazons, the Googles, the Microsofts, whether it's being my data that is now inside of software as a service providers.”

0:09:40 · Todd Vancil · Cloud migration

Todd Vancil says Western Digital's high stock price reflects semiconductor and chip makers reorienting around AI, reducing storage supply while demand rises.

“Look at their stock. Why is that stock so high? I think it's very simple when you uncover it is our entire industry, from semiconductors through chips and so forth, have reoriented around AI.”

0:19:03 · Todd Vancil · Storage market · 2026

Todd Vancil cites the EU AI Act as a regulation seeking to govern how AI is used.

“The latest things we're seeing around AI is the EI, uh, the EU AI Act, which seeks to start regulating how AI is used, right?”

0:22:57 · Todd Vancil · AI regulation

Todd Vancil says he lives in the Dallas-Fort Worth area and has flown American Airlines for more than thirty years.

“I live in the, uh, Dallas Fort Worth Metroplex, which makes me pretty much hostage to American Airlines.”

0:02:59 · Todd Vancil · Vancil background

Todd Vancil says airlines hold less obvious sensitive data such as travel dates, past trips and where customers stay, in addition to passport numbers and birth dates.

“Airlines know when I'm going to travel, where have I traveled? Sometimes they have partnerships with other organizations, they know where I might be staying or where do I like to stay.”

0:03:27 · Todd Vancil · Airline data

Todd Vancil says financial institutions are the most sophisticated at defense in depth, the layered security approach used in cybersecurity.

“They understood better than anybody else how to build multi layered. We call it defense in depth in the cybersecurity industry”

0:09:06 · Todd Vancil · Defense in depth

Todd Vancil describes retrieval augmented generation (RAG) as an AI agent fetching data from sources such as Salesforce or airline passenger records to enrich its response.

“This is where I've done a request, and based upon that request, the LLM or an agent, an agent says, Hey, I want to augment what I am generating for you as a response with some kind of data retrieval.”

0:13:57 · Todd Vancil · RAG

Todd Vancil says security layers accumulate: antivirus from about twenty-five years ago, perimeters from fifteen years ago, privileged access management from ten, and identity and access management from five.

“You still have to go back twenty five years and do antivirus, you still have to go back fifteen years and do the moats and the boundaries”

0:27:02 · Todd Vancil · Security history

Todd Vancil says innovative CIOs bring security, compliance, data and technology leaders together to manage AI as a joint program.

“the most innovative thinkers that we see are taking a common approach that innovative CIOs and technology leaders have”

0:21:08 · Todd Vancil · AI governance

Todd Vancil says shadow IT occurred when business units bought software-as-a-service products without IT's knowledge, exposing the organization to risk.

“Who get together with technologists over here in in, we call it shadow IT. They go buy SaaS to do something that I didn't need to know about and expose the organization to risk.”

0:23:31 · Todd Vancil · Shadow IT

Todd Vancil says several large Securiti AI customers run major initiatives to find and delete stale data, partly to save storage costs.

“There's a number of our large customers that have very large initiatives to go identify.”

0:18:00 · Todd Vancil · Data cleanup

Todd Vancil cites Waymo's driverless cars as an example of disruption of ride-hailing services like Uber and Lyft.

“Waymos are even innovating around Uber, right, with, uh, driverless cars and so forth, right?”

0:22:28 · Todd Vancil · Disruption

Securiti AI's Data Command Center provides data security, privacy and governance with unified visibility and control across hybrid and multi-cloud environments.

“Securiti AI's Data Command Center enables AI-powered data security, privacy and governance, providing unified visibility and control across hybrid and multi-cloud data environments.”

0:00:12 · Narrator · Data Command Center

Todd Vancil says data labels can restrict which parts of a file an LLM may read or can redact portions during training and ingestion.

“The labels might say, Hey, you're not allowed to read this part of the book, or this part of the book is redacted, or so forth.”

0:13:30 · Todd Vancil · Data labeling

Chapters

  1. 0:03:57Why AI projects circle back to sensitive data

    Vancil explains that AI value depends on an enterprise's most sensitive data, using an airline example. This frames why data security becomes the central issue.

    “almost every AI project circles around. Okay, why would we do this for a business objective?”
  2. 0:05:33Machine speed raises the stakes

    Vancil and Faggella discuss how AI speeds up both opportunity and exposure, and the new access paths this creates.

    “the machine speed of AI is logarithmically, almost immeasurably faster”
  3. 0:11:30From moats to securing the data itself

    Vancil traces security from perimeter defenses to cloud sprawl, and explains classifying and labeling data before AI uses it.

    “The key now is to actually go secure the data itself”
  4. 0:14:20Controlling ingestion, retrieval and breach response

    Labels govern what models train on and retrieve, and a full data inventory lets companies respond quickly when something leaks.

    “we can't necessarily depend upon the agents or the LLMs.”
  5. 0:16:42Cleaning up redundant, obsolete and trivial data

    Vancil argues that deleting ROT data reduces legal exposure, storage cost and AI risk, and ties storage demand to AI.

    “redundant, obsolete, or trivial data. It it's it's staggering and astonishing.”
  6. 0:23:59Building a multidisciplinary AI program

    Leaders should join business, technology, security, compliance and data officers to avoid isolated projects and shadow IT.

    “Leaders should be thinking about this as a multidisciplinary effort from a program management perspective.”
  7. 0:29:19Practical advice for business leaders

    Vancil closes with a three-step approach: C-suite alignment, understanding sensitive data, and proactive protection and response planning.

    “be sure. At the C-suite, they are thinking about this problem as an organism”

Transcript

0:00:12
Narrator

Welcome everyone to the Emerj AI in Business podcast. Today's guest is Todd Vancil, Vice President of Veeam's Securiti AI, AI Sales Engineering Team. Securiti AI's Data Command Center enables AI-powered data security, privacy and governance, providing unified visibility and control across hybrid and multi-cloud data environments. Todd joins Daniel Faggella, Emerj CEO and Head of Research, to explain why AI forces enterprises to expose sensitive data to new systems and why securing the data itself, not just the perimeter, is now the operational priority.

0:00:46

He outlines how leaders can control what AI systems ingest and retrieve, reduce redundant data that increases risk, and respond quickly when exposure occurs at machine speed. Today's episode is sponsored by Securiti AI. In this episode, we covered data security. To go deeper on the topic of AI and learn how financial institutions are digitizing paper-based records to unlock usable data for AI and using alternative data like public web and social signals to enhance risk assessment. Download our free PDF report AI in Financial Services Executive Cheat Sheet at Emerj dot com slash FCS one.

0:01:23

That's EMERJ dot com slash FCS and the number one. Now the conversation with Todd.

0:01:51
Daniel Faggella

So Todd, welcome to the show.

0:01:52
Todd Vancil

Hey Dan, thanks. It's, uh, a real great pleasure to be here.

0:01:55
Daniel Faggella

Absolutely, we're we're touching on a topic that's top of many people's minds here, uh, in in the AI world. As sort of security becomes a bigger and bigger gap and problem within the enterprise. You're talking to a bunch of different enterprises, you guys are now obviously with a much larger organization. I want to kind of let you set the table on what seems most important. So when we look at where AI security sort of seems to be a hurdle within, let's say, larger enterprise corporations, what are the patterns that come up time and time again for you?

0:02:23
Todd Vancil

Yeah, it's, uh, you know, our viewpoint of the world, Dan, is really centered around a data security perspective. And if you back off, maybe in a in a thirty or 40,000 foot view of the AI landscape, ultimately, the very lifeblood of AI is data, right? Um, the way that this this revolution is happening with large language models and agentic AI, it starts with these language models being trained on on massive amounts of data. And as we're looking to optimize our businesses, large enterprises in particular, the data that is most valuable to them turns out to be their most sensitive data, right?

0:02:59

So, um, one of the examples I like to use. I live in the, uh, Dallas Fort Worth Metroplex, which makes me pretty much hostage to American Airlines. I love American Airlines. I've been flying with them for, uh, thirty plus years. But for me to do business with American Airlines, American needs to be in possession of quite a bit of my sensitive data. And some of that's very obvious, such as my address, my birth date, my passport number, but some, some less obvious, right?

0:03:27

Airlines know when I'm going to travel, where have I traveled? Sometimes they have partnerships with other organizations, they know where I might be staying or where do I like to stay. And so that all becomes very sensitive data. And of course, we know there's tremendous amount of regulations that govern the custodianship and the use and the care of that. However, if American really wants to, or other airlines want to innovate through AI to understand us as travelers better, to create new and better products and services, routes and so forth.

0:03:57

Well, they need to train their large language models, or even or make available to their agentic AI agents, they need to make this data available to them. That's what is valuable. And so we see this again and again with organizations is almost every AI project circles around. Okay, why would we do this for a business objective? What are we going to do to innovate? But it comes back to the data, which sort of lands back at our front door.

0:04:21

As an organization that builds, you know, technologies to help with the mission of securing sensitive data.

0:04:27
Daniel Faggella

yeah. So well, it sounds like what you're highlighting here first, I kind of, oh, I opened it up with wherever you want to go with it. Which is sort of like, hey, where is sort of AI security showing up time and time again in the enterprise? What I'm hearing from you is there's a new capability where there's tension to create it. Because we got to be competitive and we got to make our customers happy and our employees happy and stay with the times.

0:04:45

And at the same time, that means new people and new systems are going to be accessing data and then using and airing that data in brand new ways. By golly, how the heck do we deal with that? So it sounds like for you, it's it's like the security thing that comes up is capability desired, bunch of new man and machine concerns open up with new capability. Repeat, repeat, repeat. Is this the pattern that you're kind of putting a thumb on?

0:05:08
Todd Vancil

Yeah, and I think the the extra added dimension of anxiety comes in from the sheer velocity of change and exposure. Frankly, if something goes wrong at AI speed, think about how we do in our own life. I'm I'm organizing a little vacation for my wife and I currently using AI to do that, and the speed with which I can do things, or I can pass off to agents to do things for me so much faster, right?

0:05:33

And so where we worry about, where, where large enterprises in particular, they're certainly always concerned about data breaches, data exposures, and the and the derivative costs of that. In terms of consumer confidence, in terms of regulatory exposure, fines, or even, frankly, oftentimes people's careers that are in positions of responsibility inside these organizations. You know, you mentioned man and machines. Well, now the machine speed of AI is logarithmically, almost immeasurably faster than that of what just man and machine in a in a traditional task of data security.

0:06:09

And so, you know, now a breach happens, it can happen at a pace and rate that is sort of terrifying, right? And so you ask, what I consistently see is organizations keep coming back to this. It's undeniable the opportunity that businesses have to leverage this power that we just it. It continues to innovate and change every day. But what is also undeniable is the exposure that we leave ourselves to. I'm not speaking to the sort of overall fear society has of AI taking over, but it's that it's that simple thing.

0:06:41

If I want to leverage AI to innovate in my business, to streamline, to optimize, or to innovate, I have to. I have to give AI access to my most sensitive data, and that's what it keeps coming back to for us.

0:06:53
Daniel Faggella

A couple things come up as pie slices of the meta concern you've addressed, and I want to see if I'm missing any slices. But let me just give you a few that are coming up. One of them is capability desired. Okay, people, and to your point, increasingly, machines now must access new data. And so there are questions of are the new inroads to access potentially places where leaking or unwarranted access could occur. And so there's sort of like, are the new?

0:07:20

Are the new doors we build to this data silo of sorts? Are they gonna have other people walk in those doors? We don't want walking in. That's one thing. Second thing, when that data walks out the door to be used for said application, is it only the right data, not the stuff we don't want to expose? So can can is the door the right shape, so only things that are the right shape can come out of that door?

0:07:40

And then maybe third is if it's machines that are accessing and using and wielding that data. Are things getting hallucinated, are things getting manipulated, are things getting so? The there's? There's a few sub issues within the meta challenge of, oh, by golly, we have new security concerns. Am I missing any important quadrant here? I'm just bringing up some things that came to mind.

0:08:02
Todd Vancil

No, I think it's all, it's, it's all related, and um, I'm, I'm just an old Texas boy. I'll do my best job to to answer that in a three-part way that you asked it.

0:08:12
Daniel Faggella

Go for it.

0:08:12
Todd Vancil

I come from a cybersecurity background, that's been my posture for, like, the last twenty five years of my career. And so I'm gonna take you down a little bit of a a sideways journey to to arrive where we're going to, right. But as but in the world of cybersecurity, we began with moats, right? We had our castles, if you will, which was, you know, maybe more than a decade ago. Most large enterprises possessed most of their data and applications in physical spaces, either their own data centers or outsourced data centers that they kinda owned.

0:08:42

And you could have physical controls, hey, only certain people can get there, and then you certainly had access controls to that. So so we thought of first what was called perimeter security, right? We built really good moats around our enterprises, and we had our data centralized. And so I wanna say it was easy, it was hard to do because you still have to give access to that data for various channels. But we understood how to secure that, right?

0:09:06

And the largest, you know, I'd say the the most sophisticated organizations in the world at doing this are our financial institutions, right? At at the end of the day, when we look at major banks or, uh, financial institutions or platforms, they're really at this point giant technology companies that are moving ones and zeros that represent our money. And so they understood better than anybody else how to build multi layered. We call it defense in depth in the cybersecurity industry to protect our data was ultimately the goal of of, you know, the adversary, whether it be, you know, criminal or, uh, nation state or other.

0:09:40

Um, they want access to that data, right? That's the valuable thing. What's happened first, and you know, there's no line in the sand we can say, but I'll just say. The overall revolution of cloud computing has said, Hey, many of my workloads, including a lot of my data now, is moving into not only different physical, but different virtually physical, uh, environments. Whether it be infrastructure as a service from the cloud service providers, the Amazons, the Googles, the Microsofts, whether it's being my data that is now inside of software as a service providers.

0:10:12

The way that we deliver applications and solutions to the enterprises is now cloud first, which means my data now has migrated outside my four walls, outside my moat, and into these cloud locations, cloud databases, cloud data storage, cloud data lakes, data warehouses, software as a service applications. And now when we introduce artificial intelligence into this mix, my data, which has sprawled, that's the word we use, it's sprawled all over the place. Many different people, many different systems, many different methods to access that data, and now it's imperative.

0:10:47

It's not optional, Dan, as we know, it's not optional to play the AI game. We're we are. It's compulsory, not. Yeah, maybe right?

0:10:54
Daniel Faggella

it was five years ago, certainly not today.

0:10:56
Todd Vancil

So so now we don't have moats, and now we have our data in so many different places, but we have this compulsory necessary to unlock it. The the mission becomes, at least from my perspective, right, is I'll call it pre runtime of AI pre before anybody actually sends a prompt to an LLM, or an LLM, rather, send something to an agentic agent to do something. We've got to secure the data first, and it turns out where we're at now is instead of just securing the moats or the access methods, or the networks, or the privileged access management.

0:11:30

The key now is to actually go secure the data itself, and that begins with understanding its scale through classification. Where is my da data sensitive, right? I I use the metaphor, if you will, think of, think of an enterprise and its data as a giant library. Now that breaks down if you think of it as a physical library, but think of the library, use the metaphor, but but think of the library as physically distributed in the cloud versus on prem and so forth.

0:11:56

But I walk in the doors of that library, physical access, uh, or even virtual access. And then this department has my cloud saas data, this department has all my infrastructure as a service, this department has my data lakes and data warehouses. This data I've shared with others. Now I have to walk into that library and literally scan and classify and understand all that data, who has access to it, what is its sensitive, where has, how has it gotten there, where's it moved?

0:12:23

And the the idea is you can think all the way down to now even unstructured data versus databases or structured things like files, uh, you know, maybe structured data like Excel tables or so forth. Now, the the power is to unlock all of our unstructured data, word files, PowerPoint text files, PDFs. Think of those as books, right? And now it's incumbent upon enterprises to literally have technology that reads those books, literally reads the books, and then understands what sensitive data is in there, how did it get there, who has access to it?

0:12:56

And and then we do what we call one simple thing is label the book. That's a way of securing the data at the data. Then you said the second part was, Hey, well, what does this? Uh, you know, when we do training or ingestion, is how we use, that's how we're teaching LLMs, we got to control our training ingestion through the understanding of the data itself. Because I've scanned and classified it and now labeled it. So as I build ingestion policies or training policies, when LLMs are reading those files, those books, they have to be set up to respect the labels that are on there.

0:13:30

The labels might say, Hey, you're not allowed to read this part of the book, or this part of the book is redacted, or so forth. That way, sensitive data that I don't want in a certain format in a certain LLM or application actually gets secured prior to runtime. And then you spoke about, well, I'll talk, I'll get to that next. But even when it comes to agentic or what, or, you know, the simple part of this is what we call was retrieval augmented generation or rag, right?

0:13:57

This is where I've done a request, and based upon that request, the LLM or an agent, an agent says, Hey, I want to augment what I am generating for you as a response with some kind of data retrieval. Go look at my Salesforce, go look at these account records, come back with all the sales calls that we've done or so forth, or go look at passenger name records inside an airline and put together where this particular passenger.

0:14:20

Others have traveled or where they're gonna travel, that type of thing, same thing. We've got to secure the data itself because we can't necessarily depend upon the agents or the LLMs. Knowing all of my security policies and being able to wander through those corridors of defense in depth because the speed and the velocity is too great, right? So that's all the I'll say, the pre runtime and the runtime security. Now now bad things are gonna happen, right?

0:14:45

As you said, bad things are gonna happen. We're gonna have a hallucination potentially. Um, we might even have data leaks, right? And so we want to know as fast as possible what got leaked, what got breached. And because I have an understanding back to the library metaphor, I've actually inventoried and classified every bit of my data in my library. If something gets leaked or exposed, now I understand, okay, who had access to it, how did they get there, what else would they have access to it?

0:15:13

A lot of our customers, particularly large enterprises and financial institutions in particular, want to leverage this deep understanding of data and the ability to secure it for post breach operation. How do I boundaryize that? how do I control it? how do I build a response to that? So, you know, it's just it's, it's a. It's a very similar to problem what we've had as security professionals for years. AI just introduces a new amount of velocity of that, right?

0:15:40

And all we've talked about so far is AI that we've introduced in the organization, right? The the the little bit more terrifying part is when agents or LLMs can get introduced by adversaries in sort of slow attack methods that y- that, you know, we worry about going forward.

0:15:56
Daniel Faggella

yeah. Well, I mean, I. There's certainly analogies to how security was, but there's certainly, as you had mentioned, uh, uh, many new cans of worms and new permutations of sort of risks that we need to be addressing. You've given us sort of what I was hoping we were gonna be able to paint here of, like, what is the proactive posture we want to land in? And you've sort of gone through categorically what that looks like in a few different places, including sort of as soon as data lands somewhere, being able to label it, being able to know where it sort of belongs to, uh, it doesn't get accidentally scooped by anybody.

0:16:24

It sort of step one is, um, we figure out, you know, the categories, the labels, and then, you know, the access, et cetera kind of flows immediately from there. Um, which which, in an era where we're we're all creating so much ambient data, we couldn't possibly label it by hand. Uh, we would need, uh, that, that, that sort of capability moving forward. Yeah, go ahead,

0:16:42
Todd Vancil

it's funny you mention that, you know, uh, uh, you mentioned the rate and velocity. We're creating data, we're also creating stale, stagnant, useless data that we actually should be deleting and getting rid of. There's a term inside the industry that's that is becoming more widely used, called rot data, redundant, obsolete, or trivial data. It it's it's staggering and astonishing. When you h- here here's two statistics, right? One an actual statistic, and then a second one to think about is we think about the amount of data that our public LLMs, ChatGPT, Claude or others train on out in the broader public domain.

0:17:24

It turns out that enterprises hold about an order of magnitude more than the overall public domain of the internet. Isn't that a little is that it's sort of incomprehensible, but it's true, right? And then within those data estates, you know, enterprises are like, uh, the rest of us, right? And and I'll, I'll simplify it to me. I'm a grandpa now, I raised two kids in the era of digital data. I have untold amount of digital refuse of photographs and movies and all the stuff about my kids history that honestly, I should clean up and get rid of.

0:18:00

But the task becomes one that is doesn't add value into my day. Same is true for enterprises, right? You have mountains and mountains of this rot, redundant, obsolete and trivial data that a lot of them are coming to us. In fact, there's a number of our large customers that have very large initiatives to go identify. Think of it, get back to the back to the library. What parts of this library have dusty old books that nobody's used?

0:18:26

That, uh, the custodian that was responsible for these books has left the company, right? Where can we go find this? And literally, I'll be funny, but burn it down, where can we get rid of it? Because it it's not only there's an exposure there. There can be a legal exposure that I that I held on to data past the time of legality. All of that data is discoverable if there happens to be some sort of legal, uh, initiative against your organization.

0:18:52

And and how many of our customers are actually funding? This activity is just a hard dollar savings on storage. And sorry to take one more step on this, yeah, go but you can

0:19:02
Daniel Faggella

for it.

0:19:03
Todd Vancil

derivatives of what's going on in the storage industry right now. I mean, Western Digital is an example. Look at their stock. Why is that stock so high? I think it's very simple when you uncover it is our entire industry, from semiconductors through chips and so forth, have reoriented around AI. So the sort of more normative uses of chips around things like just storage, well, we have less production, so there, and yet there's a greater and greater demand for storage.

0:19:31

So that's why you see such an increase of, uh, demand, yet a reduced supply for storage. So there's a huge advantage to organizations if they can go identify this rot. First of all, to keep it out of AI, right? Because I don't want my AI looking at my useless data, uh, secondly, I don't want to be legally exposed. Thirdly, let me go save a bunch of money on storage that I just keep paying for year after year after year, whether it's in the cloud or on prem or whatever.

0:19:57
Daniel Faggella

yeah, I mean, well, look, I think, you know, there's all I'll the recent

0:20:00
Todd Vancil

leave it to there.

0:20:01
Daniel Faggella

literature from the eighties talking about, you know, most of the stuff you put in a manila folder, you're never gonna use again. You got to be more discriminatory with that. But now it's like, you look at the exploding costs of creating unlimited digital data every five seconds. And now we're, you know, if we're talking, you know, billions of dollars here, you know, we we oughta, we oughta really be keeping an eye on this thing. Um, I, I wanna.

0:20:19

We're gonna start getting into what leaders should be doing to sort of address some of these emergent risks here. But I, I wanna start, I guess, very high level about how people should be thinking about these challenges. You mentioned the data overload, rot data thing, which could cause legal issues or just cost. You mentioned e- being able to kind of be proactive about pre labeling data and making sure who can access what and sort of how that works.

0:20:40

You mentioned the looming idea of sort of AI systems that are requesting access and tapping in and, uh, trying to get a hold of what we've got, uh, in in new ways. Myriad new kind of hurdles and challenges, totally different state of nature, faster state of nature than we've lived in in the world of security. W We just we're gonna get into some actionable steps. But I just wanna talk conceptually, like, is there a core paradigm you think through, or core tenets and principles you think through when you're communicating with leaders who are adapting to all of this at once?

0:21:08
Todd Vancil

There sure is, I mean, and from my selfish viewpoint, remember, I'm the I'm the vice president of sales engineering. So ultimately, you know, I'm in a revenue generating role. My job is to sell as much of our software as possible. That said, I'll speak from the customer perspective inward. The most innovative thinkers that we see are taking a common approach that innovative CIOs and technology leaders have, uh, over the years, they understand the functional disciplines that need to be joined together in a program management of these new technologies and applications, right?

0:21:39

And so when you start to think through the value chain, maybe that's I'm, I'm really trying too hard to sound smart here, Dan. But when you think Yeah, go for it, about

0:21:47
Daniel Faggella

I'm I'm following you, I'm following the value you. What's up?

0:21:49
Todd Vancil

chain of AI, right? We we've got first, the business innovators connecting with the technologists that say, Okay. Here are the ways we can unlock the power of AI in support of our corporate objectives. Whether that be to save money and be optim, you know, optimize the business, whether that be to innovate and literally flank entire industries or organizations and disrupt them in the way, you know. And the most disruptive things I think we've seen over the past fifteen or twenty years.

0:22:17

I mean, you and I travel quite a bit. I almost never hop in a taxi, Uber, uh, or Lyft. I don't think it's it is the way to go. And It's all Waymos and

0:22:27
Daniel Faggella

here in Austin. It's wonderful.

0:22:28
Todd Vancil

yeah, Waymos are even innovating around Uber, right, with, uh, driverless cars and so forth, right? So the innovators and the technologists get together and understand, okay, here's how we're gonna unlock that. But but the but the the CIOs with foresight understand, okay, who else do I need to bring along? I need to bring along certainly my security organization, my CISO and their staff, particular data security, which is what I get greatly concerned with, need to bring along my compliance organization.

0:22:57

Because, uh, we, we are in a world where, y- y- you know, governments and regulatory institutions are doing everything they can keep up. For example, the the latest things we're seeing around AI is the EI, uh, the EU AI Act, which seeks to start regulating how AI is used, right? So the the most innovative teams we're seeing, you're saying where to start first is is to step back. And rather than let these projects go in isolated ways, where, like, you know, I mean, frankly, when we saw the SaaS revolution, we would see businesses who got tired of waiting for IT.

0:23:31

Who get together with technologists over here in in, we call it shadow IT. They go buy SaaS to do something that I didn't need to know about and expose the organization to risk. It's really the same concept with AI. We've got to come at this as a multi disciplinary organization, certainly it technology innovation, certainly business innovation, but we've got to protect ourselves from a compliance, from a data security, from heck, just, um, good old integrity and ethical perspectives, right?

0:23:59

So the that, you know, when you, when we say start first, I think start there, right? Leaders should be thinking about this as a multidisciplinary effort from a program management perspective. Well, ultimately, you know, my view on this is a data security view, and data is our most precious commodity. I mean, we go back to what we were talking about, financial institutions, right? Our ones and zeros that represent our cash and our four zero one ks and our our brokerage accounts and our savings accounts and checking accounts.

0:24:25

Like, that's the most important things that banks are protecting for us and where that flows and so forth, right? So that data needs to be very deeply thought through. That's why the such a really important role is the chief data officer and the chief data and analytics officer. Those folks have have a really important job in combination with chief legal teams. Oftentimes we see them responsible for compliance. And and then the CIO and the CTO who are responsible for this innovation, right?

0:24:53

We see them more and more needing to be part of a unit, as opposed to, uh, siloed functions within the organization.

0:25:02
Daniel Faggella

yeah, why? I? I I think that's a positive development, you know, as as, uh, a guy who doesn't have a dog in the fight with any individual firm, but but who, uh, observes enterprises, you know, who's who've fallen on their face in many, many predictable, silly ways. You know, like you had said, building up a big cluster of momentum in some shadow pocket where clearly this is unsustainable from a governance compliance standpoint. To, you know, not thinking more, not thinking thoroughly enough through ROI, or not consulting the people that are gonna be the end users before we invest a ton of money in application.

0:25:33

What you're talking about, I mean, tell me if I'm wrong, by the way, I'm gonna nutshell some things here for the audience. Is essentially the companies that are smart are thinking through at a capability level. What is the future version of their business? L You know, where, where AI is part of the business strategy, it's not the whole strategy, it layers onto the business strategy. So where AI adds value to augments, expands, makes relevant the business strategy going forward two, three years, nobody can look forward ten years anymore, going forward two, three years and saying, cool.

0:25:59

Here's how we differentiate, here's how we make operations more efficient, here's how we make employees and customers happier, here's how we win market share. And then we roll back and say, cool, those are the capabilities we know we can, you know, really put a thrust into. What are all the things we need to have in place, including the data security side of things from the get go? This seems like an inevitable element of maturity now that AI is not gonna be in what we could call popcorn pilot projects in little dark corners.

0:26:27

If it's gonna be everywhere, by golly, uh, we gotta treat it like infrastructure. So that that development feels net positive, and it sounds like that's that's what you're seeing the smart companies do already.

0:26:36
Todd Vancil

Yeah, and it and it, and it already is. I mean, there's, you know, we act like AI is new machine, machine learning, neural networks, AI have been with us for some time. Just the rate and rapidity of innovation, and now with large language models, and I mean, look how fast, uh, Anthropic and others are moving, is just forcing us as organizations to move as fast. And maybe positive news for those in the vendor space and security is, you know, this is this is what I call Egypt old.

0:27:02

You don't get to stop doing any of the stuff that you have done in the past. You still have to go back twenty five years and do antivirus, you still have to go back fifteen years and do the moats and the boundaries, and you still have to go back ten years and do privileged access management and five years and do a deep identity and access management. And now data security level, we just have to do it way, way faster and way, way smarter.

0:27:25

Because both the technology and the adversary who is leveraging the same technology are innovating at that pace.

0:27:32
Daniel Faggella

Yeah, so I guess closing note here from your vantage point, when it when it gets kind of tactical, let's say we've got some business leaders tuned in. I'm sure we've got plenty who are at a position of all right. We think we're coming to some grips on what the strategic picture is for AI, bigger picture. We're we're getting a sense of what we need to become, what fundamental capabilities we need to change, whether it's customer experience or product recommendations or fraud detection or whatever it is.

0:27:57

You know, in in the banking space, maybe there's again certain certain elements of sort of the online user experience. They've got a a number of core initiatives, none of which are trivial, real major business. Now it's time to roll back and make practical kind of governance at the beginning of that plan. You know, when we get that cross functional team together, we start have these conversations. Are there kind of a tactical one, two, three that you'd sort of advocate leaders think through in terms of bringing that paradigm you just painted really to life in a business that's ready to to transform?

0:28:28
Todd Vancil

yeah, and I and I will confine my advice, uh, to my area of expertise, which is security, and in particular data security is. And I'll put it back to to, you know, our own, our our own data, right? Let's let's suppose in our own sensitive data. We have things that could expose us to losing our jobs or losing our relationships, or even losing our lives, right? We would, we would pay a tremendous amount of attention to how that quote unquote sensitive data could be used and exposed.

0:28:55

That's why we buy things like identity protection, why we, uh, buy things like virus protection. Are we careful about our phones and where we use them? And so just it's start with the end in mind is understand, as we're innovating around these areas of the business again, compulsory, not optional. What of that, from a data perspective, is sensitive and could represent, uh, a threat to me as a company, to my customers, to my partners and others.

0:29:19

And so now I've got to be very intentional about understanding all of that data prior to unlocking it to AI. We're going to do it, we have to do it right, and so, uh, and it's no small project or task. And and so my my one, two, three advice is, um, be sure. At the C-suite, they are thinking about this problem as an organism, as opposed to individuals. Secondly, is make sure we understand what data, what aspects of that data are sensitive, that we're going to do in that.

0:29:48

And then let's be very, very careful about how we protect ourselves proactively and the ways we've talked about in securing that data. How we protect ourselves with our, uh, cybersecurity insurance providers, how we protect ourselves with our security operations centers, our response teams, uh, and even down to to PR, uh, and how we manage the corporate brand.

0:30:10
Daniel Faggella

yeah, well, I, I, uh, I think. Fortunately, the trend of this becoming more embedded with strategy at the top is moving in the right direction for the sake of the health of the organizations that are that are doing this stuff. And I think even considering the PR element is probably something that should be thought through early on as well. So hopefully for some of the audience tuned in, getting some of those action steps in order once your mind is right could be rather productive.

0:30:34

I know that, Todd, that's all we've got for time, and it's been a pleasure being able to have you with us here on the show. Thanks so much for joining us.

0:30:38
Todd Vancil

Dan, it's been a real privilege. Thank you very much.

0:30:55
Narrator

Wrapping up today's episode, I think there are three key takeaways from our conversation with Todd. First, AI adoption forces enterprises to expose sensitive data to new systems and access paths, making data level security, not perimeter controls, the real foundation of safe deployment. Second, leaders need a unified approach to classifying, labeling, and governing sensitive information across cloud and source environments, so AI systems only ingest and retrieve what they're authorized to use. And finally, reducing redundant and obsolete data and preparing for rapid post breach response are now core operational requirements in an environment where mistakes propagate at machine speed.

0:31:32

In this episode, we covered data security. To go deeper on the topic of AI and learn how financial institutions are digitizing paper-based records to unlock usable data for AI and using alternative data like public web and social signals to enhance risk assessment. Download our free PDF report AI in Financial Services Executive Cheat Sheet at Emerj dot com slash FCS one. That's EMERJ dot com slash FCS and the number one. For further executive level analysis and to join our network of leaders delivering workflow impact with AI, visit Emerj dot com.

0:32:05

On behalf of the team at Emerj, we'll see you on the next episode.