AI governance, trust, and app growth - Adeel Shaikh Muhammad (Adeel Solutions)

Welcome to Apptivate, the mobile marketing podcast brought to you by the app retargeting experts at Remerge. Listen to what's working in mobile marketing today from the people who are doing it now. Hey, everybody. Welcome to Apptivate.

Today, I'm joined by Adil Sheikh Mohammed, founder of Adil Solutions, where he works as a CISO consultant and AI governance advisor, helping companies reduce cyber risk without slowing down growth. He splits his time between Dubai and San Francisco and works with teams navigating the very real security and trust challenges that come with scaling AI and marketing. Adil, welcome to the show. Thank you, Taylor.

Thank you so very much for having me. Yeah, I'm excited to talk to you today. Can you just kind of give us a quick snapshot of your background? How did you get into the security space?

I started as a help desk systems, networks, and then landed to cybersecurity around 10 years back. Overall, I have 16 years of experience in tech, whereas 10 plus years in this cybersecurity role. And from very early on in my cybersecurity journey, I was doing the consulting and helping the account managers close to deals in terms of solution architect. And later on, it converted into virtual CISO roles.

And obviously, after AI boom, AI hype, we were always talking about AI guardrails, which convert into AI governance. So, you know, doing this AI governance advisory for last four years. So in simple terms, I help companies move fast with AI and digital growth without breaking trust or creating hidden risk. A lot of my work sits in the intersection of app growth, data usage and AI driven decisioning, you know.

And that's exactly where marketing teams are operating now. So when you start talking to these companies, where are they usually at their AI journey? Are they just getting started? Are just individuals kind of playing around?

Or is it that they're already fully bought in at this point? Usually what I'm seeing is most of my clients have just started. They started, they don't know the use cases. They don't know how to treat this.

Or sometimes their legal department is heading this AI governance or securing governance space. whereas the legal guy don't even know what AI governance is. It's just a mutual responsibility where we are fine-tuning in terms of our station, our advisories, and the coaching services which we provide to our clients. How would you define AI governance?

I define that AI governance is like a guard for AI. Or in other words, it's a referee in a playing ground. to take in a right perspective that there is like one referee is good for one playground or maximum two you know one sitting outside of the playground just a third empire but if there are like more governance more referees as compared to players that is also a disaster and if there is no referee that's also a disaster so we need to find a balance and i will repeat in in in plain terms AI governance is guardrails for AI.

I was reading on Twitter this weekend that a CEO of a company was bi-encoding something and it basically deleted the entire database. So I feel like that's maybe one of the worst things that could happen at this point with AI. But what's the most common mistake we find marketers making that they don't realize is a problem with AI at this point? Yeah, so teams are adopting AI everywhere, but they don't map where it should be used.

Because again, the use cases are not defined. There is sometimes top to bottom pressure that you have to use AI, AI, AI just for the namesake of it. And there are AI wrappers around the companies. So in app marketing also, AI is already embedded, especially I'm sure you have seen in the targeting, in the bidding segment, in the segmentation itself, the creative generation, you know, but nobody owns the full picture.

That's the demiline of what I'm seeing. And the biggest mistake isn't using AI. It's using it without the visibility, which is the main concern. I think you guys have this platform of DSP, the demand side platform.

So, you know, that is also, you know, the system where, you know, automatically add space and optimize targeting. That's also AI heavily used here, right? Where do you think these app marketers, because you mentioned segmentation, personalization, those type of use cases, but are there any use cases that people should be using more that they might not be thinking about? So again, that depends on what is a personal use case around what is the objective.

the biggest problem right now as i mentioned about this ai wrapper is that they don't have the use case or they are struggling with different pilots different pocs different trials different demos again it's like that we need to put ai driven or ai first behind our names so without the use cases they are just going towards it so we need to see that this is not a hype if you want to use one product and it's not cheap the api credits people are struggling to pay for for those so so it's the first issue is not security it's i must say it's creepiness so how does this app knows this about me happens you know a lot that is due to over personalization or you know cross-app tracking and aggressive retargeting And in your experience, when does growth through AI start eroding user trust?

As you said like the creepiness even when metrics might still look great Like how do you balance the user trust with creepiness I guess It all about retargeting Retargeting means that showing for example ads to user who already interacted with your app, but did not convert, right? So that is the thing. But it should be like growth breaks when the user feels washed, not when ads perform badly. So this is the thing which we need to take care in this space where, you know, the issue is not security, but declippiness.

Have you seen cases where click-through rates or conversions from gains, I should say, from AI-driven targeting actually hurt retention or LTV down the line? 100%. I've seen very commonly because in the CTR and the LTV, the lifetime value thing, AI is optimized for CTR clicks, but not for the LTV, right? So you get high clicks, you get low quality users, poor retention, right?

So you can win the clicks, but in the end of the day, you are losing the customer in that sense, right? And so these marketers are definitely trying to move fast with AI. I feel like there's a lot of times where IT departments and security don't really know that they're using these tools. how widespread do you think that is and why is that risky if it is at all yeah so you know that's why there is a term of shadow ai i'm sure you know that shadow ai is like the tools which are not approved so they have not approved those tools in the organization due to whatever factor it can be geopolitics it can be other security concern or it's not in the approved list and and they are taking advantage of it and it's not only in the app marketing side of it but overall like i think there was a study they were saying that around 60 to 70 percent of the contracts are being copy pasted to these llms you know because obviously there are nitty-gitties and we don't understand so you know we say that okay chat gpt just flag whatever i need to reply to this guy that you know who shared this one and the legal departments are just sitting idle because if they send to legal department legal department will take two business days so yeah you're always balancing i guess speed and security but what ai safeguards give you the best speed without heavy overhead taylor again you you mentioned 100 right that it's a balance right a lot of time i have seen that just an example sake if you have a client who is asking for the contract or a presentation and you know that's a client of like two million three million dollars you will say break the system man just give me that file so business is obviously you know first priority but we need to keep a balance i'm sure you know you are from app world you know the difference between a security first app versus ui first app in case of sometimes even you you open a paper app and it's asking for 50 otps right and the user is frustrated whereas the other entertainment app from the first click you are into the those release domination structure right so that all depend that we need to keep a balance the major problem from the user side if i see from that angle it's above that sometimes user don't complain they just leave right so watch for you know drop-in session time the uninstall rate increases, the notification opt-outs, right?

These are some early warning systems, I must say. So intuition does not show up in dashboard, it shows up in behaviors. And so when marketers are setting up campaign workflows with the help of AI, do you think there's some parts of those campaign workflows that should never be fully automated? And why would that be?

There should be definitely human in the loop. I'm a big advocate of in the AI governance space that human should be in loop. And anything that impacts directly the user trust, that needs to be taken care for, especially in terms of ad messaging or sensitive targeting, right? AI does not understand context, but humans do.

We understand that, right? So automation scales actions, but not the accountability part. I mentioned that story of the coding agent deleting the code. What do you think is the biggest cyber threat right now from your perspective with AI?

There is no clear answer to that. Why I'm saying is because as per the Elon Musk, we are entering into a singularity, right? Nobody knows what will happen. So there is a massive value in terms of it.

But similarly, there is a threat. Would you target someone based on their health behavior? Or there are some teams that learn risk, right? So people don't misuse AI intentionally.

They misuse unknowingly. I give you an example of this Anthropics Mythos. I'm sure you heard about it. They are saying that...

Yeah, I think that's the one I was talking about. Exactly. So that's like one of the biggest... people are saying one of the biggest cyber security tool out there and that's like as per entropic itself they say that's dangerously that's dangerous to make it you know out to the public why because in a good way yes your own application you can test it that what are the vulnerabilities and it can give you the report right it can even highlight zero days for your audience zero day is zero day where you know nobody knows what will happen or that attack is not out in the market that's why we called it zero day like we are not on one day we are on zero day but just imagine if it goes to the bad guy hand right we are the ethical hackers but what about the hackers itself they can bypass and you know the circumstances cyber security is a part of defenses now every war is using this the cyber warhead we have the cyber crimes just try to understand the cyber means digital so we are guard railing we are protecting anything which is digital right so god forbid we we might enter into a cyber pandemic like that.

So hope so, hope so. We don't go there. And again, that's why the AI governance is very much important. Otherwise, again, it's a singularity and we don't know what will happen.

Adil, you're scaring me a little bit here. We will see. Yeah, but you're right. It's such a, we're, I'd say, maybe like three-ish years into it and it's moving so fast that I definitely think there need to be a little bit of guardrails.

Do you think that there's any AI compliance processes that companies are doing now that are just kind of a waste of time and add little value? Or do you think that any kind of compliance is good? Very much over documentation is going on. Sometimes the answer is yes or no, but you have to read 50 lines of email with many dashes.

You know, that's an AI written email, but still, but That's the email side, but overall, the over-documentation is a big point. And secondly, trying to control everything equally, that will break things. And not prioritizing high-risk areas. So treat AI risk like a marketing spend.

Focus where impact is the highest. I should ask, what region, because you're split between Dubai and San Francisco, what region do most of your customers come from? and are there any differences in working with companies from different geos? Yeah, obviously, you know, UAE, both cities are, you know, moving extremely fast in terms of AI adoption and being the king of San Francisco, all the legends are sitting there.

We are in Silicon Valley, whereas Dubai, they have invested a lot. they came up with this report that around 50 percent they are seeing themselves especially in the government sector that the agent agent agentic ai will take place within two years which is extremely big number with with terms of government so both both regions are extremely fast extremely dynamics but obviously there are some geographical differences especially in terms of culture, in terms of languages. In Dubai, we have Arabic also there, whereas in San Francisco, English is good, sometimes Spanish or other languages, but majorly English.

There are cultural differences, but I must say that both cities are extremely, extremely fast. Who in your mind should be controlling within a company the AI governance? Do you think it should be like the cmos the cso's or a mix between both it's a mutual responsibility that is because in the end of day it's all about that who is the data owner right so for which element who is the data owner and there should be no blame game in this category and you know i mentioned in the start that about that legal guy you know who don't know anything about ai and he's the caio now right so so so we have to like it's a mutual responsibility in between the technical teams the ctos in between the marketing teams in between the boards right board is very much responsible they say that no no no we have already delegated but no it's their responsibility then the cizos chief information security officers the information security or cyber security as a whole area plus the legal department what we have seen is that officially they say that you know security team or a legal team but actually sometimes it's a marketing team or a product team right so the team making decisions with data owns the risk and you know data is the new oil right so it's a mutual risk it's not you know one guy is not responsible and when you when you go in and audit these companies do you see more risk of let's say a person that you said just uploaded a 50-page contract for legal help is there more risk there or is there more risk when the agents are actually coding and more of that like vibe coding is the risk more like we're leaking personal company information or we're letting them give access to systems that maybe ai shouldn't be shouldn't be in at that point in both perspectives the responsible is you and me only like the human element so one side you are the one who is uploading the document right so you are responsible and in other side you are the one who is giving the access to your computer that please do this please do that that's the problem that in cyber security also and in now in ai governance also we need to educate our stuff right we need to increase the funding the budgets for awareness right if our staff is not aware because you know i'm sure you remember two to three years back when this ai hype created microsoft introduced co-pilot and they say that windows will take screenshots of your what you are doing so that it knows your context and then it can decide and it can give you references and help you with the co-pilot thingy everybody shouted at that time no no no no it's not acceptable you know how come microsoft can do this that they are taking screenshots of my dashboard and all and today in 2026 we are giving the rights to clawed and open claw by ourselves right we are saying do whatever you want with this browser don't interrupt me don't wake me up it's a scary place to be all depend on that what awareness you are giving to your users to your companies AI is efficient to protect you also Like for example if you are using OpenClaw ask OpenClaw only that how I can secure you, how I can guardrail you.

It will help you. There are hundreds of videos available on YouTube which can help you to secure your instances. But we are the ones who are trying to bypass security and giving the full access. And I know that you have this seven-step approach to AI guardrails or governance.

Maybe you can go over those quickly or just tell the listeners which ones or one people often forget or miss. Yeah, firstly, the approach is the step-by-step framework, which is very high impact. The idea is that don't control AI, control how it's used. so first is the map ai usage i discuss in start about the use cases because again it's a pressure from the top to bottom or bottom to top whatever and now we just need to have that ai driven word in start of our company so please map the ai usage and this can be done very easily first of all if you want to integrate ai just write what tasks you do in a day there are 50 tasks 60 tasks you do in day and then ask those tools only that how i can automate this first task how i can automate this second task right so map the ai usage that's that is the first second is the define sensitive data we discussed this point slightly about the data ownership and all that stuff so you should know that which data decide to whom third is the assigned ownership so there should be data owners to everything and then apply the guardrails, monitor the outcomes, train your teams, very important, the awareness part and then improve continuously.

Okay, so the steps are map AI usage, define sensitive data, assign ownerships, add guardrails, monitor outcomes, train your teams and improve continuously. And which of those steps do you think that most people miss? Initial steps. If we say that Just guardrails are important.

We are focusing on that part. They will directly jump to adding the guardrails. And then that app will break. Because we have not done the mapping.

We have not identified what are the sensitive data. And we have not decided the ownership. And we are directly jumping towards the guardrails. We are always in a hurry.

So we just need the outcomes. So monitor outcomes is like what? It's the fifth step. So at least go from the start, from the mapping itself.

Number one step is often the most important. Neil, anything else you want to cover before we jump into our rapid fire questions? No, that's it. You know, my point is that the companies that win in, especially in your sector, in the app marketing, won't be the fastest, but they will be the ones that scale trust alongside the growth.

So that is the, I must say, extract of our discussion that trust is really valuable alongside the growth. I love it. So now is our rapid fire portion of the show. I'm just going to maybe give you 10 or so questions, quick questions, quick answers, and we'll go from there.

Is there any data type that should never go into an AI tool? API keys. People are copy-pasting API keys in the chat, and I'm shocked to see that. What's more dangerous, moving too fast with AI or not moving at all?

Human who is not using AI versus human who is using little AI versus human which is using aggressively the AI. So that would be the first. It's not like you are more intelligent than me. No.

It's just about you are using more AI or not. I like it. Best city for a cybersecurity conference, Dubai or San Francisco? Both cities have amazing conferences.

So I cannot choose one. What's the best meal you've had on a work trip? That's always the steak. I love steaks.

Oh, so good. If you could instantly master any one non-work skill, what would it be? Negotiations. How to negotiate.

Negotiations. Okay. If you weren't in security, what would you be doing? I might be, you know, trading something or some import or export business.

If somebody has a weekend in Dubai, is there anything that they should not miss out on doing there? There are hundreds of things in Dubai to do. If it's a winter season, there are hundreds of activities, especially if there are amazing beaches out there in Dubai. Obviously, the private beaches, which are better than a scale.

The Ora Pool, which is at the top of Nakhil Mall, where you can see the whole of Palm Jumeirah. That's really awesome. And that you can enjoy in summers also, because that's our air-conditioned north. So don't miss on this Ora Pool.

Amazing. I'm going to look it up after this. Well, Adil, thank you so much for joining the Aptivate podcast, how can people find out more about you or look you up? My website is adil.

solution. They can go there. They can find my LinkedIn also from there. So adil.

solution, you can contact me for anything related to cybersecurity or AI. Amazing. Well, Adil, thank you for joining the Aptivate podcast and hope you have a great rest of your night. So kind of you, man.

So kind of you, Taylor. Lovely connecting with you and hope you can connect face-to-face also in person soon. Yes. Hit me up when you're in San Francisco.

I'll be around. Thank you, dude. Thank you. All right.

Thank you. That's a wrap on Apptivate, powered by Remerge, global leaders in helping apps drive growth and retention.