What Mature Security Programs Need Before Deploying AI - with Mark Alvarado of Academy Sports + Outdoors

Welcome everyone to the Emerj AI in Business podcast. Today's guest is Mark Alvarado, CISO at Academy Sports and Outdoors. Academy Sports and Outdoors is a leading American retailer of full line sporting goods and outdoor recreation gear. Mark joins Emerj's Yolandi de Weerdt on today's episode to outline how AI is reshaping security operations, not by introducing new threats, but by amplifying gaps in identity management, data governance and human behavior. He explains why mature programs are positioned to benefit from AI driven detection and why leaders should prioritize identity, data classification and perimeter security before deploying any AI enabled tooling.

Just a quick note for our audience that the views expressed by Mark Alvarado on today's program do not reflect that of Academy Sports and Outdoors or its leadership. According to Nielsen, 91% of podcast listening happens alone, indicating deep, undistracted attention, ideal for complex B2B messaging. To learn how leading brands and AI startups connect with enterprise AI buyer audiences at scale, download our media kit at Emerj dot com slash AD one. That's M E I J dot com slash A D and the number one.

Now, the conversation with Mark

Mark, welcome to the Emerj studio today.

Thank you, good morning, happy to be here.

It's great having you here. I had the the pleasure of having a quick conversation with you about a week ago, and I'm so excited for the conversation to continue today. Um, I'm gonna get us straight to it. There's this feeling among senior leaders that the threat landscape has fundamentally shifted. But it's generally hard to know how much of that is real change and how much of it is just vendor noise. We we see them riding the AI wave very intently, if we can say like that.

When you look across your program, what's changed in the last two or three years? Where does the friction really show up?

That's a good question. I do have a lot of thoughts and opinion on that. I do feel that AI is a bit of a hype word right now. You you hear it all the time. AI, AI, AI. This for those who are not heavy into it, it can get confusing, it can make scared. And in my world, though, I have to really understand that to make sure that I give the business the right message and to make sure that that I'm really looking at it from a realistic standpoint.

I felt like I've been seeing this happen for a while, so I don't think that if someone has a program that they didn't already have buttoned up in in the various categories. AI has only made your program exponentially worse. So if you've already stayed ahead of that, if you already had a pretty good mature program, you're in pretty good shape. So I feel like a lot of it has to do with companies that were already playing catch up or already had a lackluster, not a very mature cyber program, are the ones that are really panicking.

And I think that they should be worried. But for those who have a good, robust, mature one, I think they're still trucking along, but still keeping mindful of the threat landscape and evolving their program as the business evolves.

I'm thinking in terms of security, is is the challenge more about what you're defending against, or is it more about how fast things are moving and that we cannot really keep up with it?

I think it's both, right? Because what's normal in my house may not be normal in yours, right? What's normal in one company may not be normal in others. What's malicious in one company may not be malicious in another. So at the end of the day, a cyber program cost, right? You're ultimately you're reducing risk, and so there's a cost factor that goes along with that. So in order to make sure that you're making a good use of dollars, it's important to know what are the real risk to your business.

And in order to understand that, that means you need to understand how is your company laid out, where is your critical data, where really is the edge, and then start to work backwards from that.

Yeah, I I. It makes sense if we're thinking about it that way. Is there a friction that has now showed its face, um, that you didn't see coming about two years ago, anything that you're dealing with now that really could have not have been predicted?

I'm being honest with this, is it's the people factor. I remember way back when the internet first came out, I was so excited in my twenties, thinking, Oh my god, the internet's here. I'm gonna be smart. All this information is at my fingertips. I can't believe I'm. I'm nerdy, right? So I get excited about a good set of encyclopedias. I remember when I was younger, if you really wanted good information, you had to go find an encyclopedia set.

If you didn't have one, you go to the library, but lots of times those things were ten years or more outdated, so really, you weren't getting the latest and greatest. But when the internet came out, I thought, this is amazing. We are going to get smarter as a group of people. We've got knowledge at our fingertips. What I didn't see, or what I didn't think about, is how, in some ways, I feel like people become, for lack of better word, dumber.

Because they go to the internet and they watch and believe everything that they see, and so without really doing that research. And so now it's amazing how many people can't even remember a phone number because it's they're just it's on their phone, and if they don't have their phone, they can't get to it. How many people can't even use use basic math anymore? So what for me is it's the way that humans still consume their data, their digital data, their information, and don't really think about what are the risks that go along with that.

They just kind of want it. So really, it's the end user. That it we talk about technology, we talk about AI, but who's really stealing your information? An AI, a computer doesn't really have use for your money, right? It doesn't necessarily have the emotions or anything. It's a human on one side using technology to dupe you, your information, and and it's on the other side, the person who's using, is trying to defend against. So it's a people situation, and and it's the people's behavior and use of the device and data which drives the risk, right?

If if more people really understood the risk that they are, like social media. I had a conversation with someone a couple years back how they were saying it's so unfair what they're doing to your data and everything else like that. And oh, it's a shame. And I said, Hey, newsflash, did anyone from any of those social media outlets ask you for your information? Did anyone force you to put your food on there, your workout schedule, your vacation trips, all these things?

No one did. You willingly put it there, and you never thought, and as it was free, so you, you never really thought about what are they doing with that data? And and it's the same thing that happens in more companies or consumer, or if you're in a consumer based business, you're you're using technology. We're never gonna go back to the old days of stone and sticks, writing stuff in the stone, etching stuff into stone. So the technology is here to stay, and it's only gonna get in our lives even more.

But it's the responsibility, it's the personal responsibility of the individual using the device and the data that they're putting there and learning how it works. So that you can best secure your data. And that's what I think is. That's the thing that doesn't seem to surprise me as much as cybercrime ends up in the news, as much as you can read about some of this crazy stuff. And you know, honestly, some of the cyber criminals, they're not that they're not that sharp, they're really not.

I mean, they're smart enough to, but they're not, they're not doing anything that fantastic. It's the old tried and true things, right? Because humans, we fall for these things. We're, we're, we're, we're kind, or we want to be kind, or we want to get something for nothing and all these things. And so it's the human factor, I think, that just surprised me, but it doesn't surprise me. It surprises me that it hasn't gotten any better, but doesn't surprise me that that's what still keeps happening.

Yeah, that's interesting. And the more we talk about it, the more I think, if if we had to make a list of examples, we'd probably just add to the list as we go. I I like this part of the conversation, it's it's quite interesting to hear your personal take on it, and I agree with a lot of what you just said. Uh, we're getting into the part of conversa- of the conversation where we now get to talk about how AI is helping us with these friction points.

Now, I think with the humans, we might still still need a bit of thinking here, but in terms of tooling and platforms, the vendor pitch has completely changed. I think two or three years ago, uh, you were buying endpoint protection or identity tools or very specific things. And now every one of those vendors, those same vendors, are just leading the conversation with the term AI. And like you said earlier, you think AI is a hype word.

And I think for many of these vendors, for them to just, uh, label something as AI is is a very common thing at the moment. So for a leader trying to make good decisions about real programs, that creates, uh, a a new problem, if we can say it like that. It's not just about is this tool good anymore, it's about is this really AI? And is it something that works, or is it just putting an AI label on something and charging me twice as much?

How do we separate what is real AI and what is just a label?

That I think gets tricky because AI comes in all different fashions, right? There's large language, there's large language models, there's open, there's closed. Really, uh, this is what I think is is the the cliche word is artificial intelligence. In the reality, when you dig into it, there's a lot more going on to with it, and it depends on what you're trying to do with it to get your back. And that's what I think is where every company should have an AI governance program, and within that AI governance program, you should go ahead and define and educate the end users on the guardrails, on when you should use it, when you should not.

The questions you should ask yourselves on what you're trying to achieve with that use of AI, and what are you going to do with the data? It's going to be open, is it going to be closed, is it going to be a one-way or a two-way connection? All these different things that go along with it. Because going back to, I was saying about the human connection, is it's people that are deciding to use this. And you can put all the types of controls in the world that you want, but don't doubt the spirit of the human ingenuity.

When they decide they want to do something, they find a way to get around it. And so ultimately, if you don't get them to buy into your mission, they're constantly working against you, right? You can, what I would say, you can have the most robust locks on your house, but if someone in your house just flat out leaves it open, or bypasses, or jimmy's the lock, so it can automatically shut. It doesn't matter how expensive that lock is, someone's going to get in, and that's what I think with the with AI.

So with with the vendors, uh, to get to back to your original question about the vendors. Yes, I think lots of them are using the cliche word, and I think that the onus on this is on the company using the AI to do the education, to figure out does this really work for them? And I'm not saying that the vendors are bad, but they're out to sell a product, right? So they're gonna kinda tell you what they need, how they can fix it.

But the vendor doesn't know your company, he doesn't know how you operate, and so that's where I think it, it, it. The responsibility is on the company itself to dig into the. Or the people that work for that company to really understand their need and to ask the right questions. Because the vendor, not, not, not because he's bad, he wants to sell a product and he doesn't know your environment, right? So he can tell you that it does this or it does that, but but, and this is what I've learned lots of times, too, is also it's really important to define the word.

Even though you and I may be talking about AI, you may have a different understanding of what AI is versus me. And that can be okay in a generic conversation. But if you're gonna really start getting into splitting hairs and getting to technical stuff and spending money, and maybe it turns into a legal conversation, it's important for both of us to say, for the sake of this conversation, when I say AI, I mean this. Is that what you understand it to be?

Great, and then we have a understanding of, or a consensus that this is what we're talking about. And that's where I think it gets really, really complicated, right? In my world, I find that I don't. Not everyone gets excited about cybersecurity and technology as I do. I, I know that can see the eyes glaze over a little bit when I get into too much details. It's somebody like, I'm losing them. So my constant struggle is to find a way to be relatable and to get my message to them in a way that they can understand without turning them into cybersecurity experts.

Because that's where I think the message falls on deaf ears, why a lot of mistakes are made, uh, why sometimes money is wasted, or why ultimately a breach occurs is because I've seen a lot of talented people in the cybersecurity world. What we're not always the great at is the people skills, and we're not always the greatest at being relatable.

Yeah, and I guess that's that's why it's important to also ask the correct questions before we onboard with any new vendors, because it basically creates the internal evaluation to be a bit less complicated and the input more accurate and valuable. So is there? When we say that we need to ask the correct questions, or at least just a set of questions that will be relevant to our specific organization, is there a a question that you now ask in every vendor conversation that you didn't three years ago?

What we do, what I always do is, you know, I've been in IT for twenty two years and twenty three now, going on twenty three. And I actually started off as a business analyst, not in cybersecurity, as a business analyst, got a job, transition. I was in high speed manufacturing for eleven years, got laid off, had a brother in law who had a IT consulting company, brought me in on as a business analyst, gave me the brother in law special, started me off that way.

And the skills I learned in the first three years of doing that job, I still use today. Because as a business analyst, you learn to analyze the problem at a fundamental level. So a business department had a need for something, and I had to go. And first of all, figure out what was their need, what would they, what it is today, what it would like, what would they like to be in a perfect world, understand if there were technical requirements.

And then go do some research. And so I'd have to sit and listen to my business partners, and I had to understand their need and make sure that I clearly articulated it. And then you, you learn to use a basic set of skills to which you would display that information, get their buy-in, everything else, swim lanes, visio's, all these different things. And then, once the solution was agreed upon, then I became the project manager to now get that that idea into a real world application, so we can close it out.

I didn't understand at the time how important those skills are, something that I use to this day and to teach to other folks when I'm mentoring them. Because for any, and when you follow those basic principles, you can apply them in almost any other different field and you can learn that. So in the cyber world, those are the things I look at. If I have to go acquire a new tool or going to solve a business problem, I first get to the core of what is the problem, right?

And write out a problem statement, literally do this. I have a a document that I turn that's going into a project charter. I start off with, what is my problem statement? What are my possible solutions? Why is this potentially needed? What would like to be in a perfect world? What are some possible solutions? And what is the true cost of ownership for all of that? And I start this off with myself. It now some may say, Oh my god, that's a lot of work.

Well, you're just not. But if I get that done, I will have either done one or two things. I will have sold myself on my own solution, or sold myself off of the solution, right? Because at the end of the day, all of this equates to money. I'm gonna have to, I'm gonna go ask somebody to spend some money on this. And if I can't clearly articulate what I'm gonna do with the money, why do I need the money and how it's gonna solve a problem?

No one's gonna want to give me the money. Now, let's say I get lucky enough without doing all that to someone to give the money, but then it turns out later on that I can't solve the problem. I've wasted someone's money, right? And and if you're war working for a publicly traded company, you've wasted shareholder dollar, right? So that's a huge deal. So that fundamental thing is what I ask myself and this this, whether it's AI or whatever.

I use this in any type of problem and to make sure that I'm thinking of it in the right way. And that if it turns into a project, now I've got the foundation to clearly be able to go out and work this project and execute it and get it to to a successful completion.

Yeah, so so it's also not just about what questions to ask, but it's also about how to evaluate it. And it sounds very much like what we're saying is, oh, well, you, I'm gonna just get credit for it in the back end. But uh, what you're saying is that don't create solutions for problems that do not exist. I think that a lot of people, especially with the AI hype that we're seeing and the fear of missing out on AI and the pressure of, um, having to implement all things AI.

It's very common for organizations to create solutions for problems that do not exist, just so that they can have the AI label on something. And you've basically started answering, uh, my final question as well, because I want us to close on something that I know that our listeners will really find useful. Because s these conversations very often end in a well, you know what, AI is coming, so good luck to you, you know, make sure that you've got your seatbelt fastened.

So if you had a peer, someone in your seat, uh, ask you, what do they need to have in place before starting AI, um, or before deploying AI in their organization? What would you tell them? I assume, obviously, building on the foundation that you just said about asking the right questions, but uh, defining the problem and all of that, anything in addition to that before we start deploying?

Yes, I think that every program should have three foundational things in place moving forward in the future, whether it's AI or not. A strong identity access and privilege access management program, because lots of times AI is going to use a specific identity to be able to talk back and forth to the systems. You're gonna want to have a good data classification program, so knowing where your data is right, because not all data is equally weighted, right?

Some data is critical data and then get you in trouble with regulators, and some is not. So if you're using AI, if you're using data with the AI system, and it's really basic, generic data that it ultimately got compromised, not gonna cause a lot of burn. And y you, you'll, you'll know whether to stand down or escalate. So you need to have a data governance program, and then you should also have a good perimeter slash network security program.

Because wherever your edge is, if for some reason those systems get compromised, you're gonna want to see the data in transit. You're gonna want to be able to examine those packets. You're gonna want to be able to see if it turns out that it has a malicious uh payload in it that you can kill the network connection, uh, and or disable the user ID as quickly as possible. Because I think lots of times, fundamentally, at a CISO level, your job is not to stop every little thing that happens.

You can, that's great, but there's a cost associated with it. Your job is to keep the event from being material, right? And so material meaning where it's gonna cost a company. If we're the material threshold is different for every company, and each company should determine what that material threshold is, but keeping it from being material. Because that's how you start on the bigger picture, right? That's how you make sure that you're you're making good use of funds, because your program's gonna cost.

And then so that's prioritizing, and then you can start to work your way back down. If you want to get to the point that you want to have it so buttoned up and being so mature that that it's just buttoned up really tight, you can do that too. It's gonna be a cost associated with that, but that's a journey, right? That's not gonna usually happen overnight, but getting those three things in place identity access, privilege access, data classification, or or data governance frame, data governance framework, and perimeter slash network security.

Those three things are what AI is gonna be using. Now there's a lot of other things, so I don't want to. I don't want to minimize all the other domains that are part of the cyber, but those three. In a world where most a lot of companies are going to cloud and where identities are being, or, uh, AI is moving at a much greater pace and attacks are coming in higher volume and the level of sophistication is going up.

You're gonna want to be able to, and you want to want to fight AI with AI, right? Because so if you're using some AI based tools, you got those three areas buttoned up, you stand a fighting chance.

Yeah, that's it's. I like that. It's super practical and makes so much sense, cause what I'm hearing is that basically whatever you have to protect, depending on your type of organization. If there's a license to be protected, or if there's a fine that can be prevented, that's where th- those are your starting points, and those are the first things that you make sure that you protect. Um, am I getting that right? Is it the right message?

Hm, yeah, what's funny, I think so. So, in my journey to try to figure out how to talk cybersecurity in the cyber world, or in the IT world, when I would struggle to try to explain to someone in layman's terms this cyber stuff. Let's just say in in in this world of rules, the way it is to travel, here are the fundamental rules. Anytime you want to go from your house to another house, to another location, the rule is you have to get in your car and drive, and your car can't drive itself, you have to drive.

And in order for you to start your car requires keys, that's how you get from house to house to house. In this scenario, this is what this is. The road is the network, the car is your device, whether it's your mobile device or your laptop. The user ID is you who drives it, and the keys is your password. Today, no matter how far advanced we've got for the most part since the invention of the networking computers, that is held true.

You have to talk via the network, and that network hasn't changed that much. IP four versus IP, uh, IP six, if you're using IPv six, if you're using out there outside of the US. And you still require passwords, although there's now things talking about about passwordless and various other things, but that's the general rule, the way it works. So if you're able to guard the roads, police the roads, and if you're able to kick the person out of the car and take the keys out of it when needed, then if you, if your tools are able to see that, and you're able to look at the ideas going back and forth.

Because everything talks to everything, nothing talks to another device without a user ID. Usually requires a password, even whether it's an application. So if you can control those three things and detect when something's gone wrong or gone rogue, or gone malicious, or do whatever, then you stand a fighting chance. Because now also the other thing is, too, when you look at AI to analyze, let's say within your daily life, most of us are creatures of habit.

So when you look at systems, the way they talk to each other, let's say, for some reason, you go to five or six different houses every week or every day. And you wake up, you go at a certain time, you do all these things. You start benchmarking with AI and says, here is the way Yolandi goes about her day. Now, when someone tries to impersonate Yolandi or go rogue, they're gonna go to a different house that they didn't go to.

They're gonna, they're gonna access a different road, they're gonna potentially drive a different device, or they're gonna start accessing data and putting it in different places that they never did before. And so your AI system can analyze it, and that's what it looks like. It's rather than getting in all the specifics and everything, let's just let's just take it. You ever seen a hive map? A hive map is just what I love about data. It's why data is the most valuable thing on the planet, why bad guys want to steal it and everything else.

If you take data and throw it against a wall and let it just kind of go about its normal day through the hive, you'll see where your problems at. You see big data information clusters together, right? Oh, this is interesting. Why there's a cluster here? You zooming it? Oh, most people are using this, we're using that. If we take Yolandi's data for the day or the week and how she operates, you'll see a cluster of data.

And we see those clusters of data are obviously important because that's where she goes. Let's start benchmarking rules on that, let's start saying this is how. So now that's how we know when Yolandi's going about her day and doing a normal and nothing's gone wrong, nothing's malicious. This is what her data pattern looks like. When the data starts, when the pattern starts to deviate, you're like, whoa, wait a minute. Hey Yolandi, we noticed you m went to this day, that day.

W- was that legitimate? And you're like, Oh, yeah, yeah, I had to do whatever. Okay, cool, we'll let that one fly. But when you throw AI to analyze it all and trigger on when the data starts to deviate, that's when you can pretty quickly see something's wrong, something's wrong here. Data pattern is deviating. Take the keys out of the car, take the car off the road and get the user out of that car because something's wrong.

Now, every now and then, businesses change and stuff like that, and so you may cause a business outage. But you can ask forgiveness on those rather than, uh, um, than no one's gonna really get mad if you ultimately were a little on the cautious side. So AI is really good at helping on those areas. It's really good at analyzing data, large volumes of data pretty quickly, and then you start to throw rules and alerts on there to start to get it now to let it plug into different devices.

So it can do an action when the pattern is so different, or the action is so egregious, that you just can't afford to be to to get it wrong. So you could, you do an action first, investigate, turns out that, oh, you know, it was a false positive. Cool, get the car back on the road. They were they. That was legitimate. So that's to me why I love what I love about AI. It allows me to do my job better, more efficiently.

It's a little bit more expensive, but I think the cost is justified. And I think going back to, I was telling you those three areas that if you, if you button up those areas first and prioritize IAM, PAM, uh, data classification or data governance program, and perimeter security, network security, you're you're in a good, you're in a good position.

Mark, that was, that was brilliant. I think you painted a picture for some of our listeners that they probably will never forget, and they'll probably use this, these examples, uh, in the boardroom quite often. Um, it's really, uh, even someone like me that I probably should care more about the security of these things. Um, I also now had a bit of an aha moment, like, Okay, wait, now this makes sense, and now I understand why we have these guardrails and these rules in place.

Thank you so much, it's been super valuable. Um, I cannot wait to get the feedback from this episode, cause I think, like I said, a lot of our listeners just realized, Oh, this is what the picture looks like, and and you're very good at painting that. Thank you so much for sharing that with us.

You're very welcome, thank you for having me.

Wrapping up today's episode, I think there are three key takeaways from our conversation with Mark. First, leaders should view AI as an accelerant to existing security gaps and reinforce identity and privilege access controls before adding new capabilities. Second, disciplined data governance is essential for any effective AI deployment. And finally, AI delivers real operational value when it flags abnormal human or system behavior early enough for teams to contain incidents before they become material. According to Nielsen, 91% of podcast listening happens alone, indicating deep, undistracted attention, ideal for complex B2B messaging.

To learn how leading brands and AI startups connect with enterprise AI buyer audiences at scale, download our media kit at Emerj dot com slash AD one. That's M E I J dot com slash A D and the number one. For further executive level analysis and to join our network of leaders delivering workflow impact with AI, visit Emerj dot com. On behalf of the team at Emerj, we'll see you on the next episode.