Topic
31 facts from 2 episodes, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
2026
Craig Unger says the EU AI Act focuses on documenting AI use and monitoring AI so that it does not suggest harmful outcomes for real people.
“In the EU, you have the AI Act, which is concerning itself with how you document your usage of AI, how you monitor to make sure the AI isn't suggesting things that we wouldn't want to happen to real people.”
2026
Craig Unger says the first phase of the EU Cyber Resilience Act, which requires reporting of exploited vulnerabilities, became enforceable in September 2026.
“That particular mandate has actually come into being and is enforceable on September of this year.”
2026
Craig Unger says Cyber Resilience Act penalties could reach 15 million or 2.5% of global revenue.
“And the penalties are pretty significant. It could be 15 million or as much as 2.5% of your global revenue, your global turnover.”
2026
Craig Unger says he coined the term 'regulatory rubbernecking' about two weeks before the recording.
“This is a term that I came up with like two weeks ago for for another discussion I was doing.”
2027
Craig Unger says a further Cyber Resilience Act phase, covering secure by design, a software bill of materials and vulnerability handling, is due about a year after the recording.
“And then in about a year from now, there's a newer mandate around full application security, secure by design, a secure bill of materials, how you handle vulnerabilities”
Undated
Craig Unger says the EU's NIS2 cybersecurity directive applies to organizations with fifty or more employees or more than 10 million in turnover, covering about 100,000 organizations.
“NIST two has to be enforced for organizations of fifty or more employees, or organizations that have more than 10 million in turnover, which is 100,000 different organizations.”
Undated
Craig Unger says FedRAMP 20x is a modernization of the FedRAMP program meant to cut the cost of preparing for and undergoing the audit.
“There's a whole new framework called FedRAMP twenty X, and that's a modernization of this, mostly so that you can cut down a bit the costs of actually doing the preparation and the audit”
Undated
Craig Unger says that Hyperproof's busy customers often report being too busy with audits to automate their compliance work.
“a lot of what we hear back is we're so busy doing audits, we don't have the time to automate, right?”
Undated
Craig Unger says that organizations want to stay compliant continuously, but are typically audited only once a year, which drives odd behavior.
“So we want to do that continuously, but we're audited once a year.”
Undated
Craig Unger says a company's board very likely has an audit member assigned to oversee the organization.
“the board itself, which will very, very likely have an audit member that's actually assigned to the organization.”
Undated
Craig Unger defines controls as the processes a company runs to mitigate threats, which reduce the risk that materializes.
“the controls that you're using, which are really just the fancy name for the processes that you're running in your company, those are meant to actually attack the threats.”
Undated
Craig Unger says some organizations justify compliance costs by the dollar amount of risk the activity reduces.
“some organizations tend to look at the compliance activity and the costs associated with running that compliance activity as justified by the risk that it reduces.”
Undated
Craig Unger says regulators want to see that a human is involved at the right moment when AI is used in compliance workflows.
“this is an important part of what the regulatory agencies want to see. And I mentioned it earlier, they want to see that the human is in the loop, right at the right time.”
Undated
Craig Unger says the first stage of Hyperproof's five-stage maturity model is ad hoc compliance, with little written down and no central governance.
“The first is when you look at your organization and you say that compliance is ad hoc.”
Undated
Craig Unger describes the standardized stage of the maturity model as one set of controls mapped to multiple frameworks and requirements.
“I set up one set of controls. I map it to multiple requirements because that's my one set of controls.”
Undated
Craig Unger says the 'integrated' fourth stage of the maturity model connects policies, controls and risks and breaks down silos.
“Policy talks to controls, controls are mapped to risks, you know, all of these things in the way that we talked about.”
Undated
Craig Unger says the final 'optimized' stage uses AI and long-running agents to surface issues before outside parties raise them.
“AI is on the lookout. You have long running agents. They're actually showing you different things that really need to be addressed in the organization.”
Undated
Craig Unger says he has both built compliance software and services and personally performed compliance work inside organizations.
“I've not only, you know, been involved in creating compliance software and services, but I've also done it for organizations.”
Undated
Craig Unger is the CEO and founder of Hyperproof, a platform for managing risk, compliance and security work across large organizations.
“Today's guest is Craig Unger, CEO and founder at Hyperproof. Hyperproof provides a platform for managing risk, compliance, and security work across large organizations.”
Undated
Non-human access to systems often relies on API keys or tokens, which are the same methods an AI uses to access those systems.
“there's also scenarios where you're not present, where you're actually presenting some type of API key or a token or something else in order to get access to a system.”
Undated
Craig Unger says identity and access management has been a major growing area of software for some time.
“the identity and access management area has been a major growing area in the software space for a while.”
Undated
Craig Unger defines shadow AI as the use of AI tools and models inside an organization that gives users visibility into assets the company did not intend them to reach.
“shadow AI is the use of the AI tools and models inside an organization in order to give the users some type of like visibility to certain assets”
Undated
Craig Unger says a user can combine five or six individually acceptable AI requests to reach data or systems nobody had planned to expose.
“It may be the fact that it's doing a con the user's doing a composition of five or six different requests that you kind of hadn't contemplated.”
Undated
Craig Unger says today's AI is better at analyzing large amounts of data than at making decisions.
“I feel like it's today's AI is a lot better at doing that than it is at actually making decisions.”
Undated
Horizon scanning is the use of AI to look across the web and detect changes in regulations.
“So one example would be horizon scanning, what's called horizon scanning, and that's the ability to kind of look across the web and know what's changed in terms of regulations.”
Undated
The audit industry developed sampling methods because data was historically difficult to obtain in its entirety.
“the audit industry has grown up, knowing that the data is difficult to get in in kind of its entirety. And so there's this whole methodology of sampling the data”
Undated
Craig Unger says AI increasingly makes it possible to test an entire population of data instead of a sample.
“But increasingly with the AI, you don't really need to sample the data. You could actually test the whole population.”
Undated
Historical compliance testing mostly consisted of simple machine-checkable tests, such as comparing values or confirming that someone without permission lacked access.
“A lot of the testing that's gone on historically has been the testing that's very easy for machines to do. So that's comparing a value to another value, checking to make sure an individual who shouldn't have access didn't have access.”
Undated
Craig Unger compares risk controls to medicine, saying AI might diagnose or perform a procedure while human experts define the problems and parameters.
“You could have the AI diagnose or even do a procedure, but when it comes to actually defining what really the problems are and the parameters are”
Undated
Craig Unger says control monitoring can no longer be done once a quarter or only before audits and must run continuously.
“we are so far beyond doing that once a quarter or in preparation for an audit.”
Undated
Craig Unger says more than half of breaches at organizations occur through their vendors.
“Because more than half the breaches that happen to organizations today happen through their vendors.”
Episodes