Let’s Talk Data: Business Technology Podcast

The episode surfaces several legitimate security concepts - shadow data, data poisoning, DSPM, impossible travel detection, access creep - but large portions are spent on biographical setup, defining basic terms for beginners (e.g., what qualitative research is, what MFA is), and host restatements that add no new content. The insight-per-minute ratio is materially diluted.

“data visibility is one of the biggest challenges that the people I talk to run into, they don't know where the data is. And if you don't know where the data is in your organization, they can't classify it. If I can't classify it, I can't protect it”

“they want to secure against AI, but they're also saying I want to use AI to help my posture be better”

The episode reprises widely circulated security doctrine - zero trust, least privilege, MFA, encrypt at rest and in transit - without a contrarian or first-principles angle. The one genuinely fresh framing is the terms-of-service red flag around silent policy changes, which is practical and underemphasised elsewhere.

“My favorite red flag in terms of service is we reserve the right to change these terms of services, and you have to keep checking back. We will not notify you”

“identity and access is. They call it the new perimeter”

Lisa Horwich is a credentialed B2B tech qualitative researcher who conducts primary interviews with CISOs and security architects, giving her genuine synthesis value; however, she is a researcher-about-the-field rather than a practitioner who has built or run security programs at scale, and the insights she shares are largely paraphrased from unnamed sources rather than first-hand operational experience.

“I talked to a VP who said, gen AI pose a lot of risk to security in the sense that attackers are going to use them in lots of new and creative ways and are already using them”

“I talked to a head of cybersecurity who talked about, hey, my top security risks are exposure of private data”

The episode names a handful of concrete references - SolarWinds, Anthropic's model finding vulnerabilities, Lakera AI's Gandalf tool, SOC 2, ISO 27001 - and provides a rough range of 6 - 10 tools that enterprises deploy. However, there are no hard breach statistics, no client case studies with outcomes, and all research quotes are attributed only to anonymous job titles.

“There's a fun website from a company called Lakera L A K E R AI. They have tools called Gandalf that demonstrates how to jailbreak passwords. They totally gamified it”

“large organizations can be using upwards of 10 different tools to secure data”

The host keeps the conversation on track and occasionally adds useful framing (the COVID/perimeter analogy), but predominantly summarises the guest's points back at length and poses leading questions rather than probing claims or introducing productive tension. There is no pushback or follow-up that forces the guest beyond prepared talking points.

“Is that a fair statement?”

“So thinking about good posture, bad posture, there's gotta be some best practices that you can share”