Podcast Transcript

You're listening to the RSA Conference podcast where the world talks security.

Hello, listeners. Welcome to this edition of our RSAC podcast series. Thank you for tuning in. I'm Tatyana Sanchez.

And I'm Kacy Zurkus.

And we are your RSAC podcast hosts. Kacy, what are we going to discuss today?

Well, Tatyana, according to Forbes, 72% of businesses have adopted AI for at least one business function. And, of course, that was, you know, last week when we were writing the script, so that number likely increased since then. It's just insane how prolific AI is. And we'll continue to see these numbers rise in the weeks, days, months, and years to come.

But while AI provides many benefits and has been expanding across critical sectors, it can also disrupt an organization's privacy and compliance efforts. So that's why we're excited to welcome Noor Bains as he will examine how AI can create new risks in consent and data use.

He'll share real world cases and practical guidance so our listeners can learn how to build privacy first AI systems that maintain trust and regulatory alignment. Are you ready to dive in?

Yes. I am. But before we get started, we do wanna remind our listeners that here at RSAC, we host podcast twice a month, and we encourage you to subscribe, rate, and review us on your preferred podcast app so that you can be notified when new tracks are posted. And now we would like to ask our guest to formally introduce himself before he dives in. Noor?

Yeah. Thank you, Kacy. Thank you, Tatyana. My name is Noor Bains. I'm a principal field solutions architect for CDW.

I've been in the cybersecurity industry for more than fifteen years. I have been privileged enough to have been in different roles in cyber security from SOC, NOC advisor, professional services implementation engineer, risk and compliance advisor for a Canadian government Crown Corporation, and most recently as a solutions architect. I get to see different customer environments from different verticals, from different sizes and scales, and try to help them to improve their security posture from an enterprise risk management approach, as well as from considering their business use cases as well.

And, yeah, thank you for having me.

Thank you for being here, Noor. And as we know, organizations are adopting AI every minute, every day for new uses. So, Noor, why are the privacy and compliance now the ultimate gating factors for AI adoption rather than technical innovation?

Yeah. So the numbers tell a story. And one thing we can be sure of in this digital age is that everything is quantified, including technology disruption and adoption.

According to a survey done by Harvard Gazette, the AI adoption within the same lifecycle, if you compare it to the adoption of the Internet in 1999 and the adoption of enterprise computing in 1980s, has been higher. And this is not surprising. But it tells us a story. It tells where businesses are investing.

It tells us how should we quickly adapt to the potential next wave that is approaching. We're seeing AI being embedded, not just the typical retail personal use cases, which were pretty heavily leveraged in the past few years. But we're seeing investments in sensitive areas and the use cases being leveraged in sensitive areas, such as healthcare, diagnostics and financial risk modeling as well. Let me show you a personal story.

So recently my wife went to dentist and when she came back home, she was unusually excited.

She told me she needed a root canal. So that is not something for me that sparks excitement. That sounds like pretty painful. And then she ended up mentioning that her doctor actually leveraged AI driven imaging to detect the issue.

And the doctor mentioned that traditional methods would have caught it later. And this could have been more painful. So potentially, and I say potentially at this point, we have not actually gone through the treatment or potentially this will be a less painful treatment. Now this is the quite power of AI.

A bit of backstory to this. I talk about AI all day. So that's something my spouse, my wife, the one she went to the doctor, she was laughing because there she mentioned, there you go. I have another AI story. I wouldn't be surprised if my four year old daughter at this point talks about AI in the next couple of years. But anyways, coming back to it. So there's a flip side, and it's one that organizations can't afford to ignore.

A single privacy or compliance failure can cascade into headlines, lawsuits, customer churn. We are seeing, for the first time, seventy two percent of S and P 500 companies now disclose AI related risks in their filings. So what this signals is that there is reputational fallout from poor governance, and this is no longer just theoretical. It's visible, it's material, and regulators and investors are paying attention to this.

Technology is not the bottleneck anymore. Governance is. Excessive data collection, such as biometrics, health records, financial data, combined with misconfigured models and insecure pipelines create vulnerabilities, which ultimately erode trust. When stakeholders can understand or rely AI outputs, confidence in leadership erodes with it.

And even when no laws are broken, being perceived as careless with AI can permanently damage a brand. So the real question isn't, at this point, can we build it? It's more, can we build it responsibly enough that people will trust and adopt it? So that's really defining the challenge of AI in this era.

I love the personal anecdote, I have another one for you. I went to the doctor recently with my daughter, and the nurse practitioner asked, do you mind if I use the AI notetaker?

And I said, well, is it tied to any of her PII?

And she said, I don't know.

And she said, I guess maybe we shouldn't use it then. And I was like, yeah. I think that's fine. We've made it this far without using it. I think we'll be okay. But, you know, those types of questions are probably not regular questions that doctors get, obviously, because they couldn't answer the question.

And I'm thinking of other instances where maybe someone has an AI notetaker on their phone or even like smart glasses and they're attending a meeting that maybe is meant to be closed door and they're recording for for their notes, but they're actually recording content that shouldn't be recorded or shared. Right? And these are just the little, you know, my life risks that I can think of that truly I'm not even sure if they're actually risks, but I am so interested in hearing from you.

We hear about these new risks, privacy risks that AI is introducing, particularly the fact that the legal controls have not yet even been designed to help mitigate these risks. So what are some of the risks that we should be concerned about?

Most of the customers we talk about, that's the number one question we are helping customers as well. So there are a few big ones. First, complexity of data sources. AI pulls from different sources that fall under different privacy regimes.

So what requires explicit consent in one jurisdiction doesn't in another, and legacy controls were not built for that mosaic. Second, the consent is static and AI learning is dynamic. A user agrees to terms at one point, but the model keeps learning and infers sensitive information downstream. For example, someone marks a preference for gluten free food and the model infers that they have a celiac disease. So that's health data derived without explicit consent.

And the third being re identification risk. Even anonymized data can be relinked with other data sets. For example, a fitness app combined with location history and purchase history can reveal health status, lifestyle, financial habits. And finally, the opaque nature of AI means that data collected for one purpose gets reused or potentially reused for others, often without even knowing about it. Legacy frameworks like static consent forms and one time privacy notices simply aren't designed for this kind of continuous inferential data processing. So that's some of the big ones that we see and we potentially try to help our customers with.

And if AI isn't integrated with strong guardrails, it can lead to operational disruption within an organization, you know, especially with health care. It can lead, you know, patient risk or if they're on a machine and the system goes down, it can be critical. So, Nour, can you provide some real world examples of AI failures within organizations? And then what do they teach us about the consequence of moving too fast without proper consent and governance?

So AI failures can create tangible harm, and governance must evolve alongside. So I'll give you three examples. First, a major healthcare partnership, and this was a well intentioned AI project, attempted to build a diagnostic tool, but it assessed around a million patient records without proper consent. Regulators later ruled that the data use violated privacy requirements. The key takeaway was simple.

Even well intentioned AI projects can breach the law consent, data minimization, and pipeline controls are not rigorously designed.

I'll give you a second example where a facial recognition company scrapped billions of publicly available images to build its biometric database. Now the practice triggered lawsuits, regulatory actions across multiple countries. This case underscores how over collection of sensitive information, even without explicit permission, can spark global legal, ethical, and reputational consequences as well. And third, and this is something that we're seeing a lot more and a lot of companies are actually tackling this, a larger enterprise developed AI hiring model that ultimately had to be abandoned after it found to disadvantage female applicants. Now, the system learned from historical hiring patterns that were already biased, and without proper bias mitigation techniques, it's simply automated discrimination. This really shows how AI can amplify inequalities when the training data reflects past human bias.

Across all these three use cases or examples, the pattern was pretty much similar. Speed without governance create real harm. Whether it's privacy violation, unethical data sourcings, or algorithm bias, the absence of strong oversight, turn AI initiatives into compliance failures and reputational risks.

So what are some practical steps that our listeners can take today to build AI systems or tools that are privacy first and maybe compliance by design?

So when we talk about responsible AI, the conversation often jumps to regulation or technical controls. But the reality is organizations don't just need to wait for new laws or new tools to start doing this right.

There are practical and concrete steps that can be taken today to build AI systems that are privacy first and compliance by design. The starting point in this journey is privacy by design. That means embedding privacy into entire system lifecycle from day zero. Before a single model is trained, teams should be running threat models, mapping data flows, conducting privacy impact assessments, the defaults matter.

Opting out from tracking, anonymized logging, principle of only collecting what's absolutely necessary for the specific use case. And from there on, focus shifts on governance, which has to be centralized, automated, and continuous.

Manual compliance checks don't scale in the AI driven environment.

Organizations need automated audit trails, continuous monitoring, compliance controls integrated directly into MLOps, DevOps pipelines.

Governance should follow the model from development to deployment, not really chase after the fact.

And transparency, another pillar. Tools like model cards, data lineage tracking gives teams the ability to answer fundamental questions.

What data trained this model? Why was the data chosen? Has the model changed over time? And this is what makes AI auditable. And for regulators, this is what makes AI defensible. And then there's explainability. If a model influences hiring decision, which we leveraged in the previous example, a loan approval, a medical recommendation, leaders of that organization must be able to articulate why the model behaved the way it did.

Explainability frameworks help organizations demonstrate fairness, detect bias, and maintain trust within customers.

And finally, organizations should anchor their programs to establish frameworks: GDPR, CCPA, HIPAA, NIST, ISO. Perform regular gap analyses.

Both the technology and regulatory landscape are evolving quickly. Staying compliant is not really a one time project. It becomes a continuous posture.

And to summarize, responsible AI is not about slowing innovation. It's making innovation sustainable.

Privacy first, compliance by design system don't just reduce risk. They really accelerate trust, adoption, and long term value.

I agree. And I'm so grateful that you joined us today because it's an important conversation. I think that a lot of times when tools are released and they afford great efficiency and, expediency and convenience and all of the benefits that we're seeing as reasons why folks are leveraging AI, it's hard to kind of pause and think about the maybe not so great implications that can come along with implementing these tools into their daily use and organizations and systems. So really appreciate you joining us today as a reminder to think about privacy and compliance and the impact on the users.

So thank you so much for being here today. Listeners, thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership, and be sure to check 1rsac.com for new content posted year round. Until next time.