AI & Cybersecurity Panel | CypherCon 8.0

## Overview

This CypherCon 8.0 executive panel convenes five technology leaders—John Pus (AI Ops, FIS), Tina Chang (CEO, CISLogic), Phil Fenukin (CTO, Care Centrics), Rahul Tidi (30+ years in tech ops and AI), and moderator Grant—to discuss AI and cybersecurity governance, data protection, and implementation strategies. Organized by the Chief Architect Network (a 501c3 nonprofit), the panel addresses how organizations can leverage AI to enhance security posture while managing emerging risks and regulatory uncertainties.

## Key Topics

**Board-Level Adoption & Governance** A central theme is that AI has finally reached boardroom discussion—a shift that elevates CIOs and security leaders. However, boards often conflate AI with generative AI (ChatGPT), causing fear and misconceptions. The panel emphasizes distinguishing deterministic machine learning (consistent, explainable outputs) from non-deterministic generative AI (variable, opaque results). Tina Chang advocates a "zero trust" approach: establish governance frameworks and policies before any AI adoption, requiring approval workflows, data transparency, and clear ownership of results.

**Data Protection & Vendor Risk Management** Organizations must prevent proprietary data from being absorbed into third-party AI training datasets. Real examples cited: Amazon code found in ChatGPT's training data, Miro's controversial opt-in agreement allowing knowledge graph training on customer usage. The panel outlines two strategies: (1) build internal language models on domain-specific data (not requiring massive parameters), or (2) negotiate private vendor instances ensuring data remains proprietary. Rahul Tidi emphasizes that smaller, task-focused language models trained on business documents (customer support, engineering design, compliance policies) are more cost-effective and secure than massive general-purpose models.

**Regulatory Landscape & Compliance** The regulatory environment is rapidly evolving. Existing frameworks (GDPR, HIPAA) apply to AI-processed data; new regulations in Colorado, New York, and Europe require auditable models, especially for discriminatory decisions (insurance pricing, hiring). NIST AI RMF and CISA's AI roadmap are public resources, but most commercial organizations remain immature in governance, with projects often beginning as uncontrolled "skunk works." Compliance responsibility extends to vendor selection—if a vendor's AI causes harm, the organization bears liability.

**AI for Cybersecurity Enhancement** Anomaly detection using machine learning is immediately applicable. Phil Fenukin describes detecting an offshore employee tunneling through a VPN from Thailand—a behavioral anomaly that triggered alerts. Machine learning excels at pattern recognition across user behavior, infrastructure, and network traffic. However, models must continuously retrain to recognize evolving "new normal" patterns as environments change. Graph neural networks are highlighted as particularly valuable in cybersecurity since attack vectors and infrastructure are constantly shifting, unlike static targets.

**Training & Skill Development** A critical gap exists: formal AI training lags 6–12 months behind innovation. The panel recommends learning by doing—experimenting with tools, engaging white-hat experts, and solving real organizational problems. Phil's example of Yahoo's "Local Paranoids" program illustrates embedding security expertise: engineers in each department learn to identify vulnerabilities in their own code. Organizations must allocate ongoing budget for teams to stay current rather than relying on outdated curricula.

## Technical Details

Implementation approaches include private language models using open-source frameworks (e.g., Hugging Face Hub), trained on internal data only. Microsoft and Google offer private Copilot instances where enterprise data remains proprietary. Many SaaS vendors (Microsoft, Google) now include AI-powered threat detection (phishing, anomaly detection) by default, providing immediate security improvements. Machine learning tasks—event correlation, root cause isolation, user behavior analysis, automated patching response—can be deployed in-house without massive infrastructure. Rahul Tidi notes that organizations do not require trillion-parameter models for enterprise problems; smaller models trained on specific business domains are more efficient and secure.

## Takeaways

1. **Governance First**: Establish policies and approval workflows before adopting any AI; use zero-trust principles requiring data transparency and business justification. 2. **Vendor Due Diligence**: Evaluate how vendors handle proprietary data; review contracts for clauses preventing external knowledge graph training. 3. **Distinguish AI Types**: Deterministic machine learning models (linear regression, anomaly detection) are safer than generative AI for sensitive operations. 4. **Start Small**: Implement low-complexity, high-impact applications (anomaly detection, pattern recognition) before attempting large language models. 5. **Culture as Security**: Build positive organizational culture and team dynamics as essential backstops against insider threats and data exfiltration. 6. **Continuous Learning**: Invest in hands-on experimentation and expert engagement rather than waiting for formal training programs. 7. **Business Case Communication**: Help executives understand how AI reduces cybersecurity costs, scales threat response, and improves organizational agility. 8. **Data Exfiltration Controls**: Implement USB restrictions, network monitoring, and data-loss prevention, recognizing no approach is foolproof. 9. **Maturity Recognition**: Most companies are early-stage in AI adoption; collaborate with peers and resources (WCTC, Milwaukee TechHub) to accelerate learning. 10. **Regulatory Preparedness**: Monitor evolving AI legislation (Colorado, New York, EU); align governance to emerging standards (NIST RMF, CISA roadmaps) to mitigate future compliance risk.