# Preparing Enterprise Data for Safe AI Deployment - with Todd Vancil of Securiti AI - **Show:** The AI in Business Podcast - **Published:** 15 Jul 2026 - **Source:** https://podcast.emerj.com/preparing-enterprise-data-for-safe-ai-deployment-with-todd-vancil-of-securiti-ai - **Transcript:** https://podcasts.opennash.com/shows/ai-in-business/preparing-enterprise-data-for-safe-ai-deployment-with-todd-vancil-of-securiti-ai-dec41a/ - **Provider:** OpenNash Podcasts (machine-generated) ## In brief Todd Vancil argues that safe enterprise AI starts with securing the data itself, not just the network perimeter. Companies' most valuable data is also their most sensitive, and AI needs access to it. Scanning, classifying and labeling that data before any AI touches it lets systems respect rules, even when they move too fast for people to supervise. The tension is that AI is now compulsory, yet it exposes data that has sprawled across clouds and software services, and it works at machine speed. Vancil says leaders must do older security work faster and smarter, bring security, compliance, data and technology leaders together, delete useless data, and plan for fast breach response. ## Key insights 1. **AI needs an enterprise's most sensitive data** Vancil uses an airline example: to improve products and routes, it must give AI access to customer travel details, passports and birth dates. The data that makes AI valuable is the data regulations most tightly govern. 2. **Perimeter security no longer protects sprawled data** Data once sat in company-controlled data centers behind layered defenses. Cloud infrastructure, software services and data lakes moved it outside those walls, so Vancil says protection must attach to the data itself. 3. **Classify and label data before AI uses it** Vancil describes scanning every file, finding sensitive content and labeling it. Training and retrieval policies can then respect those labels, such as redacting parts, instead of trusting an AI agent to know every security rule. 4. **Deleting redundant data cuts risk and cost** Vancil says 'ROT' data (redundant, obsolete or trivial) adds legal discoverability risk and storage cost, and should stay out of AI. He links storage demand to AI-driven chip shifts and rising storage prices. 5. **Security must be a joint executive effort** Vancil says innovative leaders bring the CISO, compliance, chief data officer and legal teams together with CIO and CTO. He warns that isolated projects repeat the 'shadow IT' problem of the software-as-a-service era. ## Questions this episode answers ### Why does AI make data security harder for companies? Vancil says AI is only useful if it can reach a company's most sensitive data, and it works at machine speed. A breach can therefore spread far faster than in traditional systems. ### What does 'securing the data itself' mean? Vancil means scanning and classifying data, working out who can access it, and labeling it. AI systems are then set up to follow those labels rather than relying only on network or access barriers. ### What is ROT data and why should a business care? ROT means redundant, obsolete or trivial data, such as old files whose owner has left. Vancil says deleting it lowers storage costs, reduces legal exposure from keeping data too long, and keeps junk out of AI. ### Why isn't the traditional 'moat' approach enough anymore? The moat approach protected data held in company-controlled data centers. Vancil says cloud services and software-as-a-service applications moved data outside those walls, so there is no single perimeter left. ### What should executives do first about AI security? Vancil advises treating it as a team effort across the C-suite, identifying which data is sensitive, and protecting it proactively. He also points to cyber insurance, security operations centers, response teams and public relations. ## Facts - **Todd Vancil** [0:17:24]: "It turns out that enterprises hold about an order of magnitude more than the overall public domain of the internet." - **Todd Vancil** [0:16:42]: "There's a term inside the industry that's that is becoming more widely used, called rot data, redundant, obsolete, or trivial data." - **Todd Vancil** [0:18:26]: "There can be a legal exposure that I that I held on to data past the time of legality. All of that data is discoverable" - **Todd Vancil** [0:08:12]: "I come from a cybersecurity background, that's been my posture for, like, the last twenty five years of my career." - **Todd Vancil** [0:08:12]: "Most large enterprises possessed most of their data and applications in physical spaces, either their own data centers or outsourced data centers that they kinda owned." - **Todd Vancil** [0:09:40]: "Whether it be infrastructure as a service from the cloud service providers, the Amazons, the Googles, the Microsofts, whether it's being my data that is now inside of software as a service providers." - **Todd Vancil** [0:19:03]: "Look at their stock. Why is that stock so high? I think it's very simple when you uncover it is our entire industry, from semiconductors through chips and so forth, have reoriented around AI." - **Todd Vancil** [0:22:57]: "The latest things we're seeing around AI is the EI, uh, the EU AI Act, which seeks to start regulating how AI is used, right?" - **Todd Vancil** [0:02:59]: "I live in the, uh, Dallas Fort Worth Metroplex, which makes me pretty much hostage to American Airlines." - **Todd Vancil** [0:03:27]: "Airlines know when I'm going to travel, where have I traveled? Sometimes they have partnerships with other organizations, they know where I might be staying or where do I like to stay." - **Todd Vancil** [0:09:06]: "They understood better than anybody else how to build multi layered. We call it defense in depth in the cybersecurity industry" - **Todd Vancil** [0:13:57]: "This is where I've done a request, and based upon that request, the LLM or an agent, an agent says, Hey, I want to augment what I am generating for you as a response with some kind of data retrieval." - **Todd Vancil** [0:27:02]: "You still have to go back twenty five years and do antivirus, you still have to go back fifteen years and do the moats and the boundaries" - **Todd Vancil** [0:21:08]: "the most innovative thinkers that we see are taking a common approach that innovative CIOs and technology leaders have" - **Todd Vancil** [0:23:31]: "Who get together with technologists over here in in, we call it shadow IT. They go buy SaaS to do something that I didn't need to know about and expose the organization to risk." - **Todd Vancil** [0:18:00]: "There's a number of our large customers that have very large initiatives to go identify." - **Todd Vancil** [0:22:28]: "Waymos are even innovating around Uber, right, with, uh, driverless cars and so forth, right?" - **Narrator** [0:00:12]: "Securiti AI's Data Command Center enables AI-powered data security, privacy and governance, providing unified visibility and control across hybrid and multi-cloud data environments." - **Todd Vancil** [0:13:30]: "The labels might say, Hey, you're not allowed to read this part of the book, or this part of the book is redacted, or so forth." ## Transcript **[0:00:12] Narrator:** Welcome everyone to the Emerj AI in Business podcast. Today's guest is Todd Vancil, Vice President of Veeam's Securiti AI, AI Sales Engineering Team. Securiti AI's Data Command Center enables AI-powered data security, privacy and governance, providing unified visibility and control across hybrid and multi-cloud data environments. Todd joins Daniel Faggella, Emerj CEO and Head of Research, to explain why AI forces enterprises to expose sensitive data to new systems and why securing the data itself, not just the perimeter, is now the operational priority. **[0:00:46] Narrator:** He outlines how leaders can control what AI systems ingest and retrieve, reduce redundant data that increases risk, and respond quickly when exposure occurs at machine speed. Today's episode is sponsored by Securiti AI. In this episode, we covered data security. To go deeper on the topic of AI and learn how financial institutions are digitizing paper-based records to unlock usable data for AI and using alternative data like public web and social signals to enhance risk assessment. Download our free PDF report AI in Financial Services Executive Cheat Sheet at Emerj dot com slash FCS one. **[0:01:23] Narrator:** That's EMERJ dot com slash FCS and the number one. Now the conversation with Todd. **[0:01:51] Daniel Faggella:** So Todd, welcome to the show. **[0:01:52] Todd Vancil:** Hey Dan, thanks. It's, uh, a real great pleasure to be here. **[0:01:55] Daniel Faggella:** Absolutely, we're we're touching on a topic that's top of many people's minds here, uh, in in the AI world. As sort of security becomes a bigger and bigger gap and problem within the enterprise. You're talking to a bunch of different enterprises, you guys are now obviously with a much larger organization. I want to kind of let you set the table on what seems most important. So when we look at where AI security sort of seems to be a hurdle within, let's say, larger enterprise corporations, what are the patterns that come up time and time again for you? **[0:02:23] Todd Vancil:** Yeah, it's, uh, you know, our viewpoint of the world, Dan, is really centered around a data security perspective. And if you back off, maybe in a in a thirty or 40,000 foot view of the AI landscape, ultimately, the very lifeblood of AI is data, right? Um, the way that this this revolution is happening with large language models and agentic AI, it starts with these language models being trained on on massive amounts of data. And as we're looking to optimize our businesses, large enterprises in particular, the data that is most valuable to them turns out to be their most sensitive data, right? **[0:02:59] Todd Vancil:** So, um, one of the examples I like to use. I live in the, uh, Dallas Fort Worth Metroplex, which makes me pretty much hostage to American Airlines. I love American Airlines. I've been flying with them for, uh, thirty plus years. But for me to do business with American Airlines, American needs to be in possession of quite a bit of my sensitive data. And some of that's very obvious, such as my address, my birth date, my passport number, but some, some less obvious, right? **[0:03:27] Todd Vancil:** Airlines know when I'm going to travel, where have I traveled? Sometimes they have partnerships with other organizations, they know where I might be staying or where do I like to stay. And so that all becomes very sensitive data. And of course, we know there's tremendous amount of regulations that govern the custodianship and the use and the care of that. However, if American really wants to, or other airlines want to innovate through AI to understand us as travelers better, to create new and better products and services, routes and so forth. **[0:03:57] Todd Vancil:** Well, they need to train their large language models, or even or make available to their agentic AI agents, they need to make this data available to them. That's what is valuable. And so we see this again and again with organizations is almost every AI project circles around. Okay, why would we do this for a business objective? What are we going to do to innovate? But it comes back to the data, which sort of lands back at our front door. **[0:04:21] Todd Vancil:** As an organization that builds, you know, technologies to help with the mission of securing sensitive data. **[0:04:27] Daniel Faggella:** yeah. So well, it sounds like what you're highlighting here first, I kind of, oh, I opened it up with wherever you want to go with it. Which is sort of like, hey, where is sort of AI security showing up time and time again in the enterprise? What I'm hearing from you is there's a new capability where there's tension to create it. Because we got to be competitive and we got to make our customers happy and our employees happy and stay with the times. **[0:04:45] Daniel Faggella:** And at the same time, that means new people and new systems are going to be accessing data and then using and airing that data in brand new ways. By golly, how the heck do we deal with that? So it sounds like for you, it's it's like the security thing that comes up is capability desired, bunch of new man and machine concerns open up with new capability. Repeat, repeat, repeat. Is this the pattern that you're kind of putting a thumb on? **[0:05:08] Todd Vancil:** Yeah, and I think the the extra added dimension of anxiety comes in from the sheer velocity of change and exposure. Frankly, if something goes wrong at AI speed, think about how we do in our own life. I'm I'm organizing a little vacation for my wife and I currently using AI to do that, and the speed with which I can do things, or I can pass off to agents to do things for me so much faster, right? **[0:05:33] Todd Vancil:** And so where we worry about, where, where large enterprises in particular, they're certainly always concerned about data breaches, data exposures, and the and the derivative costs of that. In terms of consumer confidence, in terms of regulatory exposure, fines, or even, frankly, oftentimes people's careers that are in positions of responsibility inside these organizations. You know, you mentioned man and machines. Well, now the machine speed of AI is logarithmically, almost immeasurably faster than that of what just man and machine in a in a traditional task of data security. **[0:06:09] Todd Vancil:** And so, you know, now a breach happens, it can happen at a pace and rate that is sort of terrifying, right? And so you ask, what I consistently see is organizations keep coming back to this. It's undeniable the opportunity that businesses have to leverage this power that we just it. It continues to innovate and change every day. But what is also undeniable is the exposure that we leave ourselves to. I'm not speaking to the sort of overall fear society has of AI taking over, but it's that it's that simple thing. **[0:06:41] Todd Vancil:** If I want to leverage AI to innovate in my business, to streamline, to optimize, or to innovate, I have to. I have to give AI access to my most sensitive data, and that's what it keeps coming back to for us. **[0:06:53] Daniel Faggella:** A couple things come up as pie slices of the meta concern you've addressed, and I want to see if I'm missing any slices. But let me just give you a few that are coming up. One of them is capability desired. Okay, people, and to your point, increasingly, machines now must access new data. And so there are questions of are the new inroads to access potentially places where leaking or unwarranted access could occur. And so there's sort of like, are the new? **[0:07:20] Daniel Faggella:** Are the new doors we build to this data silo of sorts? Are they gonna have other people walk in those doors? We don't want walking in. That's one thing. Second thing, when that data walks out the door to be used for said application, is it only the right data, not the stuff we don't want to expose? So can can is the door the right shape, so only things that are the right shape can come out of that door? **[0:07:40] Daniel Faggella:** And then maybe third is if it's machines that are accessing and using and wielding that data. Are things getting hallucinated, are things getting manipulated, are things getting so? The there's? There's a few sub issues within the meta challenge of, oh, by golly, we have new security concerns. Am I missing any important quadrant here? I'm just bringing up some things that came to mind. **[0:08:02] Todd Vancil:** No, I think it's all, it's, it's all related, and um, I'm, I'm just an old Texas boy. I'll do my best job to to answer that in a three-part way that you asked it. **[0:08:12] Daniel Faggella:** Go for it. **[0:08:12] Todd Vancil:** I come from a cybersecurity background, that's been my posture for, like, the last twenty five years of my career. And so I'm gonna take you down a little bit of a a sideways journey to to arrive where we're going to, right. But as but in the world of cybersecurity, we began with moats, right? We had our castles, if you will, which was, you know, maybe more than a decade ago. Most large enterprises possessed most of their data and applications in physical spaces, either their own data centers or outsourced data centers that they kinda owned. **[0:08:42] Todd Vancil:** And you could have physical controls, hey, only certain people can get there, and then you certainly had access controls to that. So so we thought of first what was called perimeter security, right? We built really good moats around our enterprises, and we had our data centralized. And so I wanna say it was easy, it was hard to do because you still have to give access to that data for various channels. But we understood how to secure that, right? **[0:09:06] Todd Vancil:** And the largest, you know, I'd say the the most sophisticated organizations in the world at doing this are our financial institutions, right? At at the end of the day, when we look at major banks or, uh, financial institutions or platforms, they're really at this point giant technology companies that are moving ones and zeros that represent our money. And so they understood better than anybody else how to build multi layered. We call it defense in depth in the cybersecurity industry to protect our data was ultimately the goal of of, you know, the adversary, whether it be, you know, criminal or, uh, nation state or other. **[0:09:40] Todd Vancil:** Um, they want access to that data, right? That's the valuable thing. What's happened first, and you know, there's no line in the sand we can say, but I'll just say. The overall revolution of cloud computing has said, Hey, many of my workloads, including a lot of my data now, is moving into not only different physical, but different virtually physical, uh, environments. Whether it be infrastructure as a service from the cloud service providers, the Amazons, the Googles, the Microsofts, whether it's being my data that is now inside of software as a service providers. **[0:10:12] Todd Vancil:** The way that we deliver applications and solutions to the enterprises is now cloud first, which means my data now has migrated outside my four walls, outside my moat, and into these cloud locations, cloud databases, cloud data storage, cloud data lakes, data warehouses, software as a service applications. And now when we introduce artificial intelligence into this mix, my data, which has sprawled, that's the word we use, it's sprawled all over the place. Many different people, many different systems, many different methods to access that data, and now it's imperative. **[0:10:47] Todd Vancil:** It's not optional, Dan, as we know, it's not optional to play the AI game. We're we are. It's compulsory, not. Yeah, maybe right? **[0:10:54] Daniel Faggella:** it was five years ago, certainly not today. **[0:10:56] Todd Vancil:** So so now we don't have moats, and now we have our data in so many different places, but we have this compulsory necessary to unlock it. The the mission becomes, at least from my perspective, right, is I'll call it pre runtime of AI pre before anybody actually sends a prompt to an LLM, or an LLM, rather, send something to an agentic agent to do something. We've got to secure the data first, and it turns out where we're at now is instead of just securing the moats or the access methods, or the networks, or the privileged access management. **[0:11:30] Todd Vancil:** The key now is to actually go secure the data itself, and that begins with understanding its scale through classification. Where is my da data sensitive, right? I I use the metaphor, if you will, think of, think of an enterprise and its data as a giant library. Now that breaks down if you think of it as a physical library, but think of the library, use the metaphor, but but think of the library as physically distributed in the cloud versus on prem and so forth. **[0:11:56] Todd Vancil:** But I walk in the doors of that library, physical access, uh, or even virtual access. And then this department has my cloud saas data, this department has all my infrastructure as a service, this department has my data lakes and data warehouses. This data I've shared with others. Now I have to walk into that library and literally scan and classify and understand all that data, who has access to it, what is its sensitive, where has, how has it gotten there, where's it moved? **[0:12:23] Todd Vancil:** And the the idea is you can think all the way down to now even unstructured data versus databases or structured things like files, uh, you know, maybe structured data like Excel tables or so forth. Now, the the power is to unlock all of our unstructured data, word files, PowerPoint text files, PDFs. Think of those as books, right? And now it's incumbent upon enterprises to literally have technology that reads those books, literally reads the books, and then understands what sensitive data is in there, how did it get there, who has access to it? **[0:12:56] Todd Vancil:** And and then we do what we call one simple thing is label the book. That's a way of securing the data at the data. Then you said the second part was, Hey, well, what does this? Uh, you know, when we do training or ingestion, is how we use, that's how we're teaching LLMs, we got to control our training ingestion through the understanding of the data itself. Because I've scanned and classified it and now labeled it. So as I build ingestion policies or training policies, when LLMs are reading those files, those books, they have to be set up to respect the labels that are on there. **[0:13:30] Todd Vancil:** The labels might say, Hey, you're not allowed to read this part of the book, or this part of the book is redacted, or so forth. That way, sensitive data that I don't want in a certain format in a certain LLM or application actually gets secured prior to runtime. And then you spoke about, well, I'll talk, I'll get to that next. But even when it comes to agentic or what, or, you know, the simple part of this is what we call was retrieval augmented generation or rag, right? **[0:13:57] Todd Vancil:** This is where I've done a request, and based upon that request, the LLM or an agent, an agent says, Hey, I want to augment what I am generating for you as a response with some kind of data retrieval. Go look at my Salesforce, go look at these account records, come back with all the sales calls that we've done or so forth, or go look at passenger name records inside an airline and put together where this particular passenger. **[0:14:20] Todd Vancil:** Others have traveled or where they're gonna travel, that type of thing, same thing. We've got to secure the data itself because we can't necessarily depend upon the agents or the LLMs. Knowing all of my security policies and being able to wander through those corridors of defense in depth because the speed and the velocity is too great, right? So that's all the I'll say, the pre runtime and the runtime security. Now now bad things are gonna happen, right? **[0:14:45] Todd Vancil:** As you said, bad things are gonna happen. We're gonna have a hallucination potentially. Um, we might even have data leaks, right? And so we want to know as fast as possible what got leaked, what got breached. And because I have an understanding back to the library metaphor, I've actually inventoried and classified every bit of my data in my library. If something gets leaked or exposed, now I understand, okay, who had access to it, how did they get there, what else would they have access to it? **[0:15:13] Todd Vancil:** A lot of our customers, particularly large enterprises and financial institutions in particular, want to leverage this deep understanding of data and the ability to secure it for post breach operation. How do I boundaryize that? how do I control it? how do I build a response to that? So, you know, it's just it's, it's a. It's a very similar to problem what we've had as security professionals for years. AI just introduces a new amount of velocity of that, right? **[0:15:40] Todd Vancil:** And all we've talked about so far is AI that we've introduced in the organization, right? The the the little bit more terrifying part is when agents or LLMs can get introduced by adversaries in sort of slow attack methods that y- that, you know, we worry about going forward. **[0:15:56] Daniel Faggella:** yeah. Well, I mean, I. There's certainly analogies to how security was, but there's certainly, as you had mentioned, uh, uh, many new cans of worms and new permutations of sort of risks that we need to be addressing. You've given us sort of what I was hoping we were gonna be able to paint here of, like, what is the proactive posture we want to land in? And you've sort of gone through categorically what that looks like in a few different places, including sort of as soon as data lands somewhere, being able to label it, being able to know where it sort of belongs to, uh, it doesn't get accidentally scooped by anybody. **[0:16:24] Daniel Faggella:** It sort of step one is, um, we figure out, you know, the categories, the labels, and then, you know, the access, et cetera kind of flows immediately from there. Um, which which, in an era where we're we're all creating so much ambient data, we couldn't possibly label it by hand. Uh, we would need, uh, that, that, that sort of capability moving forward. Yeah, go ahead, **[0:16:42] Todd Vancil:** it's funny you mention that, you know, uh, uh, you mentioned the rate and velocity. We're creating data, we're also creating stale, stagnant, useless data that we actually should be deleting and getting rid of. There's a term inside the industry that's that is becoming more widely used, called rot data, redundant, obsolete, or trivial data. It it's it's staggering and astonishing. When you h- here here's two statistics, right? One an actual statistic, and then a second one to think about is we think about the amount of data that our public LLMs, ChatGPT, Claude or others train on out in the broader public domain. **[0:17:24] Todd Vancil:** It turns out that enterprises hold about an order of magnitude more than the overall public domain of the internet. Isn't that a little is that it's sort of incomprehensible, but it's true, right? And then within those data estates, you know, enterprises are like, uh, the rest of us, right? And and I'll, I'll simplify it to me. I'm a grandpa now, I raised two kids in the era of digital data. I have untold amount of digital refuse of photographs and movies and all the stuff about my kids history that honestly, I should clean up and get rid of. **[0:18:00] Todd Vancil:** But the task becomes one that is doesn't add value into my day. Same is true for enterprises, right? You have mountains and mountains of this rot, redundant, obsolete and trivial data that a lot of them are coming to us. In fact, there's a number of our large customers that have very large initiatives to go identify. Think of it, get back to the back to the library. What parts of this library have dusty old books that nobody's used? **[0:18:26] Todd Vancil:** That, uh, the custodian that was responsible for these books has left the company, right? Where can we go find this? And literally, I'll be funny, but burn it down, where can we get rid of it? Because it it's not only there's an exposure there. There can be a legal exposure that I that I held on to data past the time of legality. All of that data is discoverable if there happens to be some sort of legal, uh, initiative against your organization. **[0:18:52] Todd Vancil:** And and how many of our customers are actually funding? This activity is just a hard dollar savings on storage. And sorry to take one more step on this, yeah, go but you can **[0:19:02] Daniel Faggella:** for it. **[0:19:03] Todd Vancil:** derivatives of what's going on in the storage industry right now. I mean, Western Digital is an example. Look at their stock. Why is that stock so high? I think it's very simple when you uncover it is our entire industry, from semiconductors through chips and so forth, have reoriented around AI. So the sort of more normative uses of chips around things like just storage, well, we have less production, so there, and yet there's a greater and greater demand for storage. **[0:19:31] Todd Vancil:** So that's why you see such an increase of, uh, demand, yet a reduced supply for storage. So there's a huge advantage to organizations if they can go identify this rot. First of all, to keep it out of AI, right? Because I don't want my AI looking at my useless data, uh, secondly, I don't want to be legally exposed. Thirdly, let me go save a bunch of money on storage that I just keep paying for year after year after year, whether it's in the cloud or on prem or whatever. **[0:19:57] Daniel Faggella:** yeah, I mean, well, look, I think, you know, there's all I'll the recent **[0:20:00] Todd Vancil:** leave it to there. **[0:20:01] Daniel Faggella:** literature from the eighties talking about, you know, most of the stuff you put in a manila folder, you're never gonna use again. You got to be more discriminatory with that. But now it's like, you look at the exploding costs of creating unlimited digital data every five seconds. And now we're, you know, if we're talking, you know, billions of dollars here, you know, we we oughta, we oughta really be keeping an eye on this thing. Um, I, I wanna. **[0:20:19] Daniel Faggella:** We're gonna start getting into what leaders should be doing to sort of address some of these emergent risks here. But I, I wanna start, I guess, very high level about how people should be thinking about these challenges. You mentioned the data overload, rot data thing, which could cause legal issues or just cost. You mentioned e- being able to kind of be proactive about pre labeling data and making sure who can access what and sort of how that works. **[0:20:40] Daniel Faggella:** You mentioned the looming idea of sort of AI systems that are requesting access and tapping in and, uh, trying to get a hold of what we've got, uh, in in new ways. Myriad new kind of hurdles and challenges, totally different state of nature, faster state of nature than we've lived in in the world of security. W We just we're gonna get into some actionable steps. But I just wanna talk conceptually, like, is there a core paradigm you think through, or core tenets and principles you think through when you're communicating with leaders who are adapting to all of this at once? **[0:21:08] Todd Vancil:** There sure is, I mean, and from my selfish viewpoint, remember, I'm the I'm the vice president of sales engineering. So ultimately, you know, I'm in a revenue generating role. My job is to sell as much of our software as possible. That said, I'll speak from the customer perspective inward. The most innovative thinkers that we see are taking a common approach that innovative CIOs and technology leaders have, uh, over the years, they understand the functional disciplines that need to be joined together in a program management of these new technologies and applications, right? **[0:21:39] Todd Vancil:** And so when you start to think through the value chain, maybe that's I'm, I'm really trying too hard to sound smart here, Dan. But when you think Yeah, go for it, about **[0:21:47] Daniel Faggella:** I'm I'm following you, I'm following the value you. What's up? **[0:21:49] Todd Vancil:** chain of AI, right? We we've got first, the business innovators connecting with the technologists that say, Okay. Here are the ways we can unlock the power of AI in support of our corporate objectives. Whether that be to save money and be optim, you know, optimize the business, whether that be to innovate and literally flank entire industries or organizations and disrupt them in the way, you know. And the most disruptive things I think we've seen over the past fifteen or twenty years. **[0:22:17] Todd Vancil:** I mean, you and I travel quite a bit. I almost never hop in a taxi, Uber, uh, or Lyft. I don't think it's it is the way to go. And It's all Waymos and **[0:22:27] Daniel Faggella:** here in Austin. It's wonderful. **[0:22:28] Todd Vancil:** yeah, Waymos are even innovating around Uber, right, with, uh, driverless cars and so forth, right? So the innovators and the technologists get together and understand, okay, here's how we're gonna unlock that. But but the but the the CIOs with foresight understand, okay, who else do I need to bring along? I need to bring along certainly my security organization, my CISO and their staff, particular data security, which is what I get greatly concerned with, need to bring along my compliance organization. **[0:22:57] Todd Vancil:** Because, uh, we, we are in a world where, y- y- you know, governments and regulatory institutions are doing everything they can keep up. For example, the the latest things we're seeing around AI is the EI, uh, the EU AI Act, which seeks to start regulating how AI is used, right? So the the most innovative teams we're seeing, you're saying where to start first is is to step back. And rather than let these projects go in isolated ways, where, like, you know, I mean, frankly, when we saw the SaaS revolution, we would see businesses who got tired of waiting for IT. **[0:23:31] Todd Vancil:** Who get together with technologists over here in in, we call it shadow IT. They go buy SaaS to do something that I didn't need to know about and expose the organization to risk. It's really the same concept with AI. We've got to come at this as a multi disciplinary organization, certainly it technology innovation, certainly business innovation, but we've got to protect ourselves from a compliance, from a data security, from heck, just, um, good old integrity and ethical perspectives, right? **[0:23:59] Todd Vancil:** So the that, you know, when you, when we say start first, I think start there, right? Leaders should be thinking about this as a multidisciplinary effort from a program management perspective. Well, ultimately, you know, my view on this is a data security view, and data is our most precious commodity. I mean, we go back to what we were talking about, financial institutions, right? Our ones and zeros that represent our cash and our four zero one ks and our our brokerage accounts and our savings accounts and checking accounts. **[0:24:25] Todd Vancil:** Like, that's the most important things that banks are protecting for us and where that flows and so forth, right? So that data needs to be very deeply thought through. That's why the such a really important role is the chief data officer and the chief data and analytics officer. Those folks have have a really important job in combination with chief legal teams. Oftentimes we see them responsible for compliance. And and then the CIO and the CTO who are responsible for this innovation, right? **[0:24:53] Todd Vancil:** We see them more and more needing to be part of a unit, as opposed to, uh, siloed functions within the organization. **[0:25:02] Daniel Faggella:** yeah, why? I? I I think that's a positive development, you know, as as, uh, a guy who doesn't have a dog in the fight with any individual firm, but but who, uh, observes enterprises, you know, who's who've fallen on their face in many, many predictable, silly ways. You know, like you had said, building up a big cluster of momentum in some shadow pocket where clearly this is unsustainable from a governance compliance standpoint. To, you know, not thinking more, not thinking thoroughly enough through ROI, or not consulting the people that are gonna be the end users before we invest a ton of money in application. **[0:25:33] Daniel Faggella:** What you're talking about, I mean, tell me if I'm wrong, by the way, I'm gonna nutshell some things here for the audience. Is essentially the companies that are smart are thinking through at a capability level. What is the future version of their business? L You know, where, where AI is part of the business strategy, it's not the whole strategy, it layers onto the business strategy. So where AI adds value to augments, expands, makes relevant the business strategy going forward two, three years, nobody can look forward ten years anymore, going forward two, three years and saying, cool. **[0:25:59] Daniel Faggella:** Here's how we differentiate, here's how we make operations more efficient, here's how we make employees and customers happier, here's how we win market share. And then we roll back and say, cool, those are the capabilities we know we can, you know, really put a thrust into. What are all the things we need to have in place, including the data security side of things from the get go? This seems like an inevitable element of maturity now that AI is not gonna be in what we could call popcorn pilot projects in little dark corners. **[0:26:27] Daniel Faggella:** If it's gonna be everywhere, by golly, uh, we gotta treat it like infrastructure. So that that development feels net positive, and it sounds like that's that's what you're seeing the smart companies do already. **[0:26:36] Todd Vancil:** Yeah, and it and it, and it already is. I mean, there's, you know, we act like AI is new machine, machine learning, neural networks, AI have been with us for some time. Just the rate and rapidity of innovation, and now with large language models, and I mean, look how fast, uh, Anthropic and others are moving, is just forcing us as organizations to move as fast. And maybe positive news for those in the vendor space and security is, you know, this is this is what I call Egypt old. **[0:27:02] Todd Vancil:** You don't get to stop doing any of the stuff that you have done in the past. You still have to go back twenty five years and do antivirus, you still have to go back fifteen years and do the moats and the boundaries, and you still have to go back ten years and do privileged access management and five years and do a deep identity and access management. And now data security level, we just have to do it way, way faster and way, way smarter. **[0:27:25] Todd Vancil:** Because both the technology and the adversary who is leveraging the same technology are innovating at that pace. **[0:27:32] Daniel Faggella:** Yeah, so I guess closing note here from your vantage point, when it when it gets kind of tactical, let's say we've got some business leaders tuned in. I'm sure we've got plenty who are at a position of all right. We think we're coming to some grips on what the strategic picture is for AI, bigger picture. We're we're getting a sense of what we need to become, what fundamental capabilities we need to change, whether it's customer experience or product recommendations or fraud detection or whatever it is. **[0:27:57] Daniel Faggella:** You know, in in the banking space, maybe there's again certain certain elements of sort of the online user experience. They've got a a number of core initiatives, none of which are trivial, real major business. Now it's time to roll back and make practical kind of governance at the beginning of that plan. You know, when we get that cross functional team together, we start have these conversations. Are there kind of a tactical one, two, three that you'd sort of advocate leaders think through in terms of bringing that paradigm you just painted really to life in a business that's ready to to transform? **[0:28:28] Todd Vancil:** yeah, and I and I will confine my advice, uh, to my area of expertise, which is security, and in particular data security is. And I'll put it back to to, you know, our own, our our own data, right? Let's let's suppose in our own sensitive data. We have things that could expose us to losing our jobs or losing our relationships, or even losing our lives, right? We would, we would pay a tremendous amount of attention to how that quote unquote sensitive data could be used and exposed. **[0:28:55] Todd Vancil:** That's why we buy things like identity protection, why we, uh, buy things like virus protection. Are we careful about our phones and where we use them? And so just it's start with the end in mind is understand, as we're innovating around these areas of the business again, compulsory, not optional. What of that, from a data perspective, is sensitive and could represent, uh, a threat to me as a company, to my customers, to my partners and others. **[0:29:19] Todd Vancil:** And so now I've got to be very intentional about understanding all of that data prior to unlocking it to AI. We're going to do it, we have to do it right, and so, uh, and it's no small project or task. And and so my my one, two, three advice is, um, be sure. At the C-suite, they are thinking about this problem as an organism, as opposed to individuals. Secondly, is make sure we understand what data, what aspects of that data are sensitive, that we're going to do in that. **[0:29:48] Todd Vancil:** And then let's be very, very careful about how we protect ourselves proactively and the ways we've talked about in securing that data. How we protect ourselves with our, uh, cybersecurity insurance providers, how we protect ourselves with our security operations centers, our response teams, uh, and even down to to PR, uh, and how we manage the corporate brand. **[0:30:10] Daniel Faggella:** yeah, well, I, I, uh, I think. Fortunately, the trend of this becoming more embedded with strategy at the top is moving in the right direction for the sake of the health of the organizations that are that are doing this stuff. And I think even considering the PR element is probably something that should be thought through early on as well. So hopefully for some of the audience tuned in, getting some of those action steps in order once your mind is right could be rather productive. **[0:30:34] Daniel Faggella:** I know that, Todd, that's all we've got for time, and it's been a pleasure being able to have you with us here on the show. Thanks so much for joining us. **[0:30:38] Todd Vancil:** Dan, it's been a real privilege. Thank you very much. **[0:30:55] Narrator:** Wrapping up today's episode, I think there are three key takeaways from our conversation with Todd. First, AI adoption forces enterprises to expose sensitive data to new systems and access paths, making data level security, not perimeter controls, the real foundation of safe deployment. Second, leaders need a unified approach to classifying, labeling, and governing sensitive information across cloud and source environments, so AI systems only ingest and retrieve what they're authorized to use. And finally, reducing redundant and obsolete data and preparing for rapid post breach response are now core operational requirements in an environment where mistakes propagate at machine speed. **[0:31:32] Narrator:** In this episode, we covered data security. To go deeper on the topic of AI and learn how financial institutions are digitizing paper-based records to unlock usable data for AI and using alternative data like public web and social signals to enhance risk assessment. Download our free PDF report AI in Financial Services Executive Cheat Sheet at Emerj dot com slash FCS one. That's EMERJ dot com slash FCS and the number one. For further executive level analysis and to join our network of leaders delivering workflow impact with AI, visit Emerj dot com. **[0:32:05] Narrator:** On behalf of the team at Emerj, we'll see you on the next episode.