Jon Oltsik

"Not only do we have to have secure cloud development, but we have to have secure AI development. And that may involve some new skill sets, some new tools, but it's a requirement."

"So the first thing that I would do is I'd get all of the stakeholders in place and if you don't have strong governance, build strong governance. Now a lot of that starts with what are we trying to do here? So no one's going to play... Well, developers will play with AI, but if I'm a CEO, I'm going to say, well, what's the business value here?"

"The more those two groups are working in parallel or cooperatively instead of in conflict, the better for security, the better for the organization. We'll get better applications, more secure applications, and we'll mitigate risk."

"And we have to start with training our developers, training consumers, because this is a new world. And so from a security point, yeah, training about things like prompt injection and sharing confidential data, certainly. But the developers, this is a playground for them. So we have to put some, maybe not guardrails, but some guidance for them."

"So it starts with the policy and the framework, and then it's applying those policies and frameworks and then it's monitoring those policies and frameworks. Now, there are often a lot of tools to do that, but the key is being able to again catch those policy violations."

"What I'm saying and what I'm seeing proactive CISOs do, cast a wide net because the history, historically strong vendors may not have the best solution for you. And there's a lot of innovation. A lot of it's going to fall on its face. You and I have seen this a million times in the industry, but someone's going to come through and have a revolutionary or at least a very good evolutionary platform for AI and security. So be open-minded."