How Compliance Became Cool: Richa Kaul on Security, Privacy, and AI

Because all of these privacy controls, they really have— or these privacy

frameworks, right? They have almost 2 sides. The first side

is the security side, which is how do we actually keep this

consumer's data secure and thereby keeping it private?

The other side of it is more of the pure privacy stuff, which is

things like how do we let them opt out? How do we let them retrieve

their data when they want to? Those are sort of the— how do you make

the experience for the consumer almost like more seamless, more in control? But

we really focus on the security side. How do you really lock down your environment

to make sure that there's never, you know, something to be worried about,

right? Of course, there's always risks in every enterprise, but there's never, you know, you

do as much proactive preventative work as possible. And

that happens by keeping an eye on all of the different security controls that you

have across your complicated enterprise, all in one single pane of

glass. And that's a really hard job to do, but that is what we have

set out to accomplish. Your biggest security risk may be

closer than you think. Rich Akall reveals how AI,

privacy, and smarter compliance are changing the way companies protect

data.

Hello and welcome back to Data Driven, the podcast where we explore the emerging industry

of data science, AI, and of course, it's all not

possible without data engineering. And unfortunately, my favorite data engineer

in the world, Andy Leonard, can't make it today, but I am here today with

Richa Kaul, who is the founder of and

CEO of Komplianz, an AI-driven platform

transforming governance, risk, and compliance for enterprises.

Previously, she held leadership roles at ContractPal AI, where she scaled

global compliance solutions. I'm noticing a theme here. Under her leadership,

Komplianz has raised $30 million in total funding, driving

rapid growth and the development of multiple new AI agents.

Richa's expertise— Richa expertise, because she's going to be richer than

Bill Gates, as we said in the virtual green room. Your

expertise has been featured in Authority Magazine, GRC

Pod, and several leading industry

podcasts. So welcome to the show, Richa. And I was

going to say, we joked around in the virtual green room how

compliance is cool again. And then I realized, wait a minute, It's never really been

cool before. So, but it certainly seems to

me to be a growth industry given all the compliance

mechanisms. So particularly in AI governance, right? And AI

governance is something that I'm passionate about. I didn't,

I never thought I'd be passionate about governance, but so what

brought you to compliance? Oh yeah, great question and

happy to share. I have always thought that compliance was cool and I will tell

you exactly why. I don't know how much you, are

kind of worried about your own data privacy, but I consider

myself a data privacy nut. And I've been that

way for many, many years. So I would

rather not give any of my data to companies or even

governments. You know that whole TSA thing now where they just scan your face?

I hate that. I hate that. I hate that. In today's world,

if you don't do that kind of stuff, you have to live as a hermit.

So again, I'm out there giving my data away. And I feel

like when the breaches started happening, do you remember the big

Equifax breach almost 15 years ago now? That was the

first big breach that caught everyone's attention and made us realize that, wait a

second, this data that we're just handing over is at risk. Right. And it

made me realize that we may not be able to

protect our data by not giving it, but we should really hold the

enterprises who have it accountable And we should help them stay secure.

And that was really the why behind compliance with a Y.

I like that because you're right. Like you— and again, we can debate

philosophically about, hey, that seems like a system of control where you have to live

as a hermit if you don't want to give away your data. But that's a

whole other conversation. But you're right. Like, I think the Equifax thing, I think, really

woke people up because, you know, I don't know

where your thinking was before that versus post that, but

I would imagine that if you were passionate about privacy, anyone who was passionate about

privacy and awareness about what's going on there probably seemed a

little cuckoo before that breach. And then afterwards,

not as cuckoo, right? Okay. And as these breaches go on, the Target

breach is the one that really kind of made me go sit up and

realize, wait a minute now, they know what about me? You know, and I'm not

a regular Target shopper, but, you know, I go there often

enough that they clearly would have data on me. And

then obviously also the, the whole thing where they reverse engineered, uh, who was

pregnant and who wasn't based on buying patterns.

I know. Um, and again, like, early on I

probably looked a little tinfoil hatty, right? But,

you know, if it— if time is— I guess given enough time, even the mo—

most conspiracy theorists are proven not as wrong,

if not right, not as wrong as we thought originally.

I think my friends still think that I'm a bit cuckoo, to be honest, when

it comes to my data privacy. But it's because you have these days,

you know, agents going out outside their sandbox and

infiltrating Hugging Face. And you have— it's just

there's a lot of threats out there. And I think that it is really

important that we can, you know, we need to be able to trust the enterprises

who have the world's data. And so from our perspective, we

went at that mission from day one, and we're really proud to be

working with those companies every single day. How do you track—

now that governments and politicians are realizing that privacy matters, right?

We're seeing obviously the GDPR is the one that gets all the attention. But

in a previous role, I worked with

some folks in Latin America, and apparently Latin American countries have

not as strict as the GDPR, but it's definitely in that direction. The US is

more of a healthcare data is treated one way, this type of data is treated

another way. What do

you— what else is you're seeing in the world? And like, how, if you're an

international enterprise, this is starting to become a very

tricky field to navigate. Yeah, agreed.

So one thing just to clarify is that we really focus on the

security side of things. So we focus on the security

side of privacy, I suppose you could say, because all

of these privacy controls they really have, or these privacy frameworks, right?

They have almost 2 sides. The first side is the security side, which

is how do we actually keep this consumer's data

secure and thereby keeping it private? The other

side of it is the more of the pure privacy stuff, which is things

like how do we let them opt out? How do we let them retrieve their

data when they want to? Those are type sort of the how do you make

the experience for the consumer almost like more seamless, more in control? But

we really focus on the security side. How do you really lock down your environment?

to make sure that there's never, you know, something to be worried about,

right? Of course, there's always risks in every enterprise, but there's never, you know, you

do as much proactive preventative work as possible. And

that happens by keeping an eye on all of the different security controls that you

have across your complicated enterprise, all in one single pane of

glass. And that's a really hard job to do, but that is what we have

set out to accomplish. Oh, okay. And I think, That brings up an

interesting point because when you say compliance, I immediately, I live in the DC area,

right? So immediately I go towards the legal aspect of it. And I had a

previous guest, we talked about the need for a

chief or a digital trust officer at the C-level of a company. And my

kind of initial, and I do agree that it gets needed, but my first kind

of thought being a realist is, well, that's both technical

and the legal department have to get along. And I can't imagine,

I mean, it is implicitly cross-functional. I would say if you have a

chief trust officer, but those

people tend not to see eye to eye. I say this as someone who

did work in the— I spent some time in the legal department at Microsoft, which

was a very odd experience of being one of the few

technologists in a company that was a technology

company, but like being one of the few technologists

in a very large legal organization. That was a Quite kind of like, I

don't know if you ever watched like the old Mr. Wizard shows where he'd like,

or whatever the science YouTubers were, you put your hand in like

one hand in hot water, one hand in cold water, and then like you put

your, you mix them and like your brain's all confused. That was kind of like

what it was like working there. But so

what, how do you, do you,

are there industry standard privacy controls? Is

there something above and beyond that? Like, is there some kind of ISO

certification for it? Like, what, what does that look like? Yeah, there's many,

many, many controls, many certifications. Uh, we support

all of the out-of-the-box frameworks that you would expect, all the

security frameworks, some of the privacy frameworks, or all the privacy frameworks. I

think that, again, there's a lot of tools out there that focus on the

operationalization of privacy controls. So things like cookie

management, you know, data subject access requests.

We really focus on the security side. So we're really focused on saying,

you know, an average enterprise has about 1,100 controls

that they manage, security controls. And controls, of course, are just

commitments to things like we will put antivirus on all of our employees'

endpoints, we will have encryption on in transit, we will

XYZ, XYZ, right? Every one of those is a control. And if you

have 1,100 commitments that you are making from a security perspective,

based on what is required of you by regulation, based on what you decide that

you need to commit to as an organization. How do you keep track? 1,100 is

a lot. Right. And especially when the source of truth behind every one of those

1,100 controls is completely disparate. Because

if you're a complex enterprise, then for one control, you might have to look at

13 systems. You might only have to look at 2 systems, but in, you

know, 30 accounts across those 2. So the point is, it starts to get very

messy. And instead, what we do We integrate with the

sources of truth that send the signals for each of those controls

so that an enterprise can look and say, okay, I have 1,100 security

commitments or controls that I make every day.

Previously, I had to sample test those and hope that my sample testing

either proved compliance or pointed me to some risks that I was

having. Now I can actually say with

confidence that these 1,100 controls are operating

effectively as desired. And if there's an issue with one of them, I

can reach in, look at what's behind the curtain, fix it, come

back out and just make sure everything else is going okay. And that's that

preventative, proactive model that we strive for. Okay,

so how do you fix it? Is it— you fix inside that platform or is

that like a something else? Are you raising these awarenesses or

are you part of the solution too? Yeah, we're part of the solution in so

much that we actually give step-by-step guidance on how to address the

problems. Usually it's not so easy as, you know, turn it on again or something.

So there's something going on. And so we do do that. Actually, the

sneak peek. I will— I'll leave that for next year. Yeah, and I

would imagine that you're probably already being asked, how do you make sure your agents

are compliant with— because we're hearing all over the news about

agents breaking their container and things like that. And I have

a— I just installed actually this week, I've had OpenCLAW running for a couple months

and I installed Hermes and I'm impressed with its tenacity.

Actually, both of them, but more Hermes than that. And I know really has more

to do with the underlying model than, than the harness. But like, how do you—

the tenacity, I think, is both admirable and a little dangerous because I've

seen it. I've asked it to—

we were looking at moving and I asked it to research a property and it

was red. One site blocked it, but then it found another

way to like send a proxy to that site. And I'm kind of like— sipping

my coffee, watching it work, like, seems a little—

I wouldn't say shady, but it's definitely

questionable. I should probably give it guardrails, like, as I see it kind of go

off. And to me, as a developer, AI builder,

AI engineer, I just made a simple request. I didn't

think I would have to tell it not to break the law or do anything

kind of questionably ethically, like screen scrape or anything like

that. But I would imagine that's given your background and passion for

compliance is probably top of mind. Like, how do you make sure your

bots behave? Yeah, it's a big topic.

Gosh, our CTO could talk about this for hours, but I think the,

the top line is that we

feel like we get to be on the good side of AI these

days. It almost feels like a lot of AI products

and a lot of AI use cases are quite scary,

have a lot of potential for bad. Our AI agents'

missions are to stay compliant. And so it becomes a

little bit of the nature of the task is also

quite sound. And I think that actually helps quite a

lot, right? There's, there is just that fact. We've put in

guardrails at the development layer so that the agents basically have really,

really small jobs, each of them. And there's kind of checks and

balances on each of the agents. And each of them have such a small

purview that you actually kind of seek protection in that as well.

There's another And there's a number of other things that we've done from a more

technical perspective. But to be honest with you, we've, we've been lucky to

find that obviously with all the controls that we've put in place on our own

agents, we've seen really good results both from a security, privacy,

as well as just efficacy perspective. Security in depth

seems to be the answer to a lot of things, right? Yes, layered security,

whether it's the locked door, the alarm system, you know,

the spiky bushes outside the windows, right? Security is

not a one and done. It's a multi-phase approach.

And I would imagine compliance probably

not the same, but pretty close to that, right? I mean, what,

what does— who's your ideal customer? Like, is it the CTO? Is

it the legal department? Is it some combination? Is it the—

I know some companies now have chief privacy officers. Sorry, I cut you off.

But like, who is this? It's the CISO, actually. So the

Chief Information Security Officer is usually our target, kind of

target buyer. Obviously, usually reporting to them, they have some sort

of Director of GRC or Governance, Risk, and Compliance. And so that's

actually a perfect buyer for us, or a VP of Information Security. And

so typically, again, these folks are sitting in partnership with

the legal team or the privacy team. They are doing the protection

of customers' data, and the privacy folks and legal folks are doing,

I know, something slightly different, like making sure that they're meeting the privacy

regulation in terms of data subject access or other things like

that. And these CISOs and their teams are really focused on how do we

protect, how do we stay proactive. And that's really what we do. We give

them the avenue to monitor their controls live, to

basically get a continuous monitoring across their entire

environment and tell them when something's astray, and then they can

go in and proactively address it. And that is That means a lot for them.

Interesting. Yeah. Is this something that smaller, mid-sized

companies also need to like think about too? Like, or are you targeting the global

2,000? Or, I mean, everybody, privacy becomes

everybody's business. Yeah, it really does these days. And especially

now, I mean, really, like it is, we're seeing everyone's focus

be more and more on AI governance, on AI security, on information

security in general. What we have found is it's quite industry-specific. So

I think that we serve a lot of the companies that, of

course, you know, if they get breached, there are serious consequences. So healthcare is

probably our biggest industry, and we have a lot of healthcare clients that are

also mid-market because they obviously have to protect patient

data, and that is such sensitive data, and they're really just like

quite prone to be, to be hacked or breached because, you know, people are

attacking them. And so from our perspective, that's been historically one of

kind of the best, best industries for us to really

work with because they care. And we really like to work with the people who

care. Well, that, that's a good point because I think you probably can

tell right away of who has a metaphorical gun to

their head versus actually care about privacy, right? Exactly.

You really can. And healthcare is interesting because

implicitly you have to share the data, right? Like, you know, my insurance company has

to know what my X-ray does. the X-ray

or imaging center has to send the report back to the doctor, right? So it's

a very data-centric business. Yeah. But

obviously we've heard horror stories about local

hospitals, smaller hospitals being ransomwared. And I know strictly

speaking compliance is not protection against

ransomware directly, but I would imagine there's probably some

kind of side effect that would, if they are compliant, they

probably would be less susceptible

to ransomware. Yeah, exactly. And I mean, again, of course,

you— we don't like to breed breach shame, as we say, but I

think the reality is that a lot of the breaches that have

happened in the last 15 years are preventable.

And they're from, you know, they're a mixture of certain

configurations not being on. And then there's just security training.

And I think that part of it is that a lot of security professionals are

so busy doing what's urgent that they don't have

time for what's important. And oftentimes really good security

training for the wider organization falls into the important but not

urgent. Right. And so what happens is that they don't have capacity for it. And

one of the things that I like to tell people is like, look, your biggest

liability is actually the rest of your organization. Like those, those social

engineering emails are getting really good. And you need to be able to train them.

And they're like, we don't have time for that. That's not even on the radar

of things we need to accomplish. It's like, okay, well, our AI agents do a

lot of your manual work for you so that you have time to focus on

what's important. And that honestly makes a really big difference.

Well, it's kind of like fire safety training, right? Like, why do firefighters go to

schools and stuff like that and talk to kids about smoke alarms and stuff? It's

because they are literally fighting fires, right? And

that's obviously a good example. But like, I think it's— I think we— I think

the IT security field can learn a lot from public

safety in terms of the PSAs and like the community work that

they do and teaching this type of safety because they clearly deal

with urgent literal life and death issues, but they also take time out

to realize like slowing down the pipeline

by educating kind of the masses goes a long way

to hopefully make it easier. I don't mean

I don't know how I don't know if they track metrics that you know. firefighter

Joe and Sally, they did a thing in this

elementary school and, you know, house fires went down by 10%. I don't know if

they track it to that degree, although that would be an interesting privacy, I guess,

case right there. Right. But, um, but yeah, like how does that—

and, and, and the Target breach, for example, was

credentials that should have expired for, I think from an HVAC

company, like something like really mundane. Yeah. And

it's the mundane stuff. Yeah, it's always the mundane stuff. But I mean,

again, user access reviews can be automatically checked in our platform. So it's things like

that which we can really easily automate. And so those breaches actually

get prevented and it's just kind of, yeah, it's kind of crazy,

honestly. And just going back to the fire alarm example, it would be like if

your fire alarm, you know, randomly went off and you had to

have enough knowledge to know when it was real and when it was fake. That's

the example, making it a like for like with social engineering. Sometimes we get these

emails, we don't know if it's real or fake. So we have to suddenly become—

all of us have to become cybersecurity experts to know, you know, is

this real? Do I need to be worried about this? And that's why you're seeing,

you know, I worry about my parents and them falling for a scam sometime

because, yeah, it's just crazy. It's crazy what you have to know these days.

And so, yeah, it's— You have to have like street smarts about you

just because the internet is as far away as your phone.

Yeah, exactly. Interesting.

One of the things that I would say

that sounded crazy when I said it originally

was like the front line of the next conflict is as far away as your

phone. And like we're seeing kind of like cyberspace is

an active kind of, even if there is no, what

the cool kids in DC call kinetic warfare going on, it is still very

much an open field in the cyber realm. So you really have to,

you really have to be very mindful of your phone is a connection

to the world, but it's also the world's connection to you.

Yeah. And sometimes, sometimes the world does not have

your best interests, right? Or there's going to be bad actors in it. Agreed. It's

very scary, actually. It's

interesting how you're seeing a lot of kids opt into the older style

clamshell phones or flip phones. It's kind of like that's

the new retro is going back. I'm thinking of

it myself, to be honest. Maybe keeping like an iPod Touch

with me for other stuff. But honestly, it's like, yeah, I

get it. I don't think we all want to be reached so much anymore either.

Right. It was— it had a certain appeal back in the day, but now that

we've gotten it, it's be careful what you wish for. Totally agree.

So what

What do you— so you mentioned something, you talk about the, your smoke alarm going

off or your fire alarm going off all the time. I worry about that because

I think alarm fatigue is very real or dialogue fatigue, right? How many times you

go to a site and it says, hey, we have cookies.

Like, I'm a cookie— Always reject them. Always reject them. Even if it

has an extra screen you have to click through, just do it. It's worth it.

It's worth it. Protect your data. Okay. I

always choose, um, except necessary only. Is that

not safe enough? No, that's the only one that you can really do in the

US, so that's fine. But, uh, even if it makes you click through a

screen to validate it, go through it. Sure.

Toggle things off and yeah, just don't give them your cookies.

Yeah. I know I saw something very disturbing is a,

um, there's a YouTube video. I haven't verified it, but, um, smart TVs

Yes. Are also notorious. They

actually will report back what it

sees on the screen. And they're probably

listening as well, to be honest. I think this is the reality of our phones

these days. There's a lot of, a lot of sneaky apps in

there. We carry our phone with us all the time. There's a lot of sneaky

apps in there that are listening. And they say that it's for, you know, accurate

advertising or whatever, but they're literally listening. It's crazy. That's why when you

talk about something, all of a sudden you get an ad about it. Yeah, I've

noticed that too. And it's fascinating

that those stories are so anecdotally well known

or come across so often, like there has to be a grain of truth to

it. No, it is true. Yeah. Yeah.

I mean, it's just— and it was one of the major TV manufacturers did get

caught listening in on people's conversations because I think the remote control had a

voice-activated feature or something like that, and I saw that

and I was like, uh, I don't know if I want that. You know, I

think our fridges are gonna start too. That's the whole smart fridge thing. Crazy.

I, um, I— my fridge was like, hey, connect

me to the internet, I'll do this. No thank you,

I'm good. I don't need that.

Well, there's a meme going around, it's like, you know, IT people tend

not to have automated homes, right? Exactly, because we know the

risks. We know the risk. Yeah, yeah. I mean, the only thing that I would

want in terms of automation is to know

if a door is left open. Yeah, great. You know, just because I got

dogs and— And be able to monitor the temperature from far away,

so in case your pipes freeze. That's another good one. Right, right. Or water

sensor. Or water sensor. Yeah, exactly. Like basic safety stuff.

For the temperature thing, I actually have a little robot over there with it I

can tilt and it shows me that this is within view of it.

Kind of analog, but again, because even then, like,

you know, I, I have these thoughts and I'm like, oh, maybe I'm paranoid, right?

You see these IoT sensors, right? And you've probably heard this

joke, the S in IoT stands for security. And

you know, all these smart devices and you hear about these breaches, even if

the manufacturer had the most noble intentions, right?

You are putting data, whether it's your heart rate data, if it's a smartwatch,

in the hands of somebody who their priorities

was getting to market, not necessarily— Yeah.

Security. Agreed. There's a lot of health tech

companies where when they've gone out of business now, you notice that they

can sell the data. Of the companies, and that is really

scary— of the consumers, sorry. That's really scary. So there's just basically

health tech companies out there who even, you know, even if they put a bunch

of— let's say they have the best of intentions and they put a bunch of

privacy and security things. Right. Well, when things go under and they don't do

so well, they can literally sell that data. It's a— it's an asset,

and they can sell that data as part of their, you know, closing down of

the company. That is crazy to think about. And that's— even— yeah, I'm

sorry, go ahead. Didn't mean to cut you off. Even if, even if during the

process of closing down, they may have the best of intentions, but their

creditors will be like, I don't care about these people's privacy, right? Even,

even if someone's the most noble person in the world. And, um,

I'm glad you mentioned that because— and if we're getting off too far off topic,

let me know, because if you listen to the show, Andy and I are known

to do that. But Spirit Airlines in the US? Yeah, that's right.

They sold the Customer data. Yeah. Or part of it at least. Yeah.

Well, not just the customer data, but also the private emails. I think

either Meta or Google was trying to buy it. So they, all the private emails

in there. Now I think somebody, one of the, I think the flight

attendant unions or somebody, one of the unions is assuming like, no,

these are private conversations. But it's interesting. Like it's just kind of

like, who would think when a company goes

under, like you expect like the desks and the chairs and stuff like that to

be kind of auctioned off. But you know, the emails, the data, I mean, that's

Just not something I think the average person would've thought

about. Agreed.

So what can people do

to, to do a better job of securing their privacy, right?

Individuals? Individuals, right? Like if you're an individual, if you're somebody

listening to this, and a lot of our listeners are data engineers or data

scientists and, or AI engineers.

they're probably more aware than your average bear. And that

rhymes. Maybe we'll put it on a t-shirt. But, um,

what can people do, right? I mean, obviously you reject the cookies that you can.

Yep. You— but there's got to be

more, right? I've seen ads for DeleteMe,

I think, is it? And there's a couple of firms that kind of offer that.

But I mean, are services

like that Valuable, right? You know.

The problem is that your data is constantly being actually taken from

you and being put back in. So even when you are doing some of those

things, you, you're living your life on one side and then you're

continuously giving your data back in to the, to the

ether. There's— it's really challenging. I do think that over time you can

chip away at it. I really do think that simple things that you can do

is, you know, just being conscious about it. So things like rejecting

cookies, things like making sure that you're not signing up for extraneous

things. There's also a setting on your phone. Let me pull out my phone so

I can get the clicks right. So you can go to your phone and if

you go to your settings, I have an iPhone. If you go to your

settings and then you go to, if you search

privacy. Yep. So you get a privacy and security option.

See if it's here. Yep. And you scroll down and you find microphone.

And it should have a list of all of your apps that have access to

your microphone. And you can go in and like turn off a lot of

microphone access because there's a lot of apps in there. I don't think Uber needs

access to your microphone. I don't think LinkedIn needs access to my microphone. So

there's things like that. And that actually prevents some of the listening that's happening

under the guise of like, oh, better targeting of ads and stuff like that. And

the same thing with the camera. And over months, sometimes

more than months, you start to notice that the algorithm actually doesn't

have you not locked down as much. which actually is kind of a proof

point of you protecting your privacy and your personal data a little bit more.

Of course, there's a lot more you can do from the perspective of just like,

as simple as it sounds, like having better passwords, not, you know, using different— I

mean, all of those are basic things, but this is a little extra tip that

I usually tell my friends and family. Oh, that's good to know. I was looking

through the Android settings earlier this week for a different reason, and I

noticed like, hey, there are a lot of apps in here that want access to

the camera. I don't remember authorizing that. Yeah, usually it

gets authorized at the beginning. So yeah, exactly. And you can always turn it on

again if you need it, but I just— right, all of mine are off.

No, that's a good point. And, and, um, I find it fascinating that the only

way you can kind of like proof it, prove it, is you wait

a few months and see, do they have you now on lockdown? It's like

naive. You're like, wait, we don't have any visibility into this? And then I'm like,

oh yeah, we don't have any visibility into this. Like, it's crazy. Even with the

GDPR and things like that, you don't really have that. And I'm glad you

mentioned Apple because Apple really doubled down on privacy as a

feature. You know, I have an Android phone and God only knows what

goes on under the hood on that one, right? It's pretty good.

I don't know. I should probably do some more research on it, but. It depends

on the vendor because the beauty of open source is,

you know, anyone can modify it. The horror of open source is

Anyone can modify it, right? Apple does do a better job of

locking things down, but even then it's not, I mean, you hear stories about

there's companies that will, you know, break in iPhones. I know Apple took

a pretty big stand when, uh, I think the FBI or

one of the US federal government basically said, you need to create a patch

for this, for the iPhone so we can break into this guy's phone. And they

refused. And they were taken to court. And then one day they

just, the government dropped the case quietly. And you're like, hmm,

oh, there's a startup out of this country that has a tool that breaks

iPhones, right? So it's, um, it's interesting because as convenient as

these devices are, they have a lot of information on us.

And even if everything is done right, if you have an

advanced persistent threat that's

well-funded like a nation-state, not really much you can do,

right? Aside from moving to a cabin in the woods, right? Mm-hmm. Exactly.

Full circle back to the beginning of the conversation. Right. Unless you wanna be a

hermit. It's just a, it's a fascinating and terrifying world,

I think. But back to like the business angle of it, what,

you know, we saw Apple really pivot to privacy at Union

Station in DC. There was a huge ad I remember seeing that was,

had the Apple, you know, Safari private by default. Right now the browsers

are starting to do this. Yeah. With, in terms of alerting you about these super

cookies and things like that. So it seems like privacy, if

not now, in the near future could be a business strategy,

right? We're seeing Apple kind of use that to good effect. What do you

think that people will finally seek out

compliance solutions because like, hey, we're

compliant, right? That becomes something they can put on their brochures?

Yeah, I think so. And I think you're already seeing that. So obviously there's this

big push around SOC 2 compliance, which, you know, really matters.

We usually serve B2B companies because B2B companies, you know, to have

to serve a B2B customer, you have to have some proof of compliance. So there

is already that mentality. And I think the question is, will that bleed into

B2C? Honestly, I think most B2C companies now also seek those types

of compliance certifications because to them, it's peace of mind, as

it is for founders, for others. Like, it really is peace of mind. And

I think it is surprising how much that can— how much peace of mind it

can get you. Getting an external assessment, getting an external pen test,

getting external SOC 2 or ISO, there is something about it if,

especially if it's a good auditor, that really makes you feel like, okay, amazing. Like,

I do at least have some type of check on this. And yeah, and it

matters. And much of those things are also about incident response and business

continuity in the event of a disaster. Right. And so it's not all about

preventative. It's also about preparing you if something is to happen.

And so there's peace of mind that also comes from that, from actually having good

processes in place if the you know, the worst is to happen and you'd

get breached. And that's also just good to know.

So all of that, I think, is, you know, it's just part of the— part

of how I think the industry is maturing, part of how we're all learning.

And I'm really glad that it's headed that way. No, I mean, that makes a

lot of sense in terms of— I would imagine

companies that have cyber

risk insurance, probably the insurance companies are going to wise up

and start demanding better paper trails of

like what's going on, right? Because if you don't know, you don't know, right? And

if you don't know, you don't know to fix it, right? So

just even, I think I would encourage everyone to at least do one of these

audits because then, you know, then you know

what the risk profile is, right? Maybe, maybe you have a high-risk profile.

Maybe it's better than you think. Probably not, but maybe it's better than you think.

Exactly. And then you at least have a list of things to

work on, right? Yep. I think in the virtual green room, we, we both mentioned

moving, but it's like getting a home inspection, right? You wanna make sure that, hey,

the foundation's okay. Or, you know, you're worried about this leak in

this room and it's like, ah, it turns out to be nothing, right? It's, um,

it's, um, it's, it, it's interesting. And I, I

find it fascinating that, um,

we are in that phase of why are we—

why is compliance making, if not a comeback, like, like it's

finally becoming in vogue. And it's because compliance touches a lot of things

that touch a lot of our lives. Yeah. Whether it's straight up security,

privacy, right? And everyone, I think, has a slightly different definition of what

privacy is, right? One of the funniest things in, uh,

one of the GTA games, I think it was 5.

They, they don't mention Facebook by name, but the site is called

Privacy Invader, which is, um, they certainly, um,

social commentary is a big part of the game as much as carjackings and

things like that. Uh, I don't know if you've ever played it, but like, if

you, even if you just like listen to the radio stations on there, the social

commentary is pretty biting. And, um, But,

um, I, I just think it's fascinating

that we all have to think about this, right?

And you mentioned your parents, you know, my mom would fall for things. And

even though, like, you know, eventually I gave her a lockdown

Linux laptop because

she would get a lot of scam calls. Yeah. And it's

really, you know, it's really a malware thing that happens. Well, and,

and they're getting better at it. Like they're cloning voices. Really sad. Doing— I

know. It's just really upsetting. And you think like, you know, the

human capacity for creativity, you have to step back and admire it

if it was only focused on something non-destructive.

Yeah, I know. It's really upsetting. I mean, and it, it really is. And it's

kind of like I would get these calls too. And

I'm like, I kind of know. I, one of the common themes when I worked

for Microsoft was people would, mess with the scammers

because they say, hey, I'm calling from Microsoft. Really? What building are you in?

Really? What org are you in? Like, where are you in the GAL? I was

like, I'm sorry, sir, I don't know what the GAL is. Well, if you don't

know what the GAL is, you don't work here. And for those who don't know,

GAL is Global Address List. It's basically the, um, the thing that Outlook was

hooked up to. So if somebody said they work for Microsoft, you would

ask them that or what their alias was. But no, I think, I think we

all have to be street smart. Even if you—

because I think humans are really

good to adapting to their environment generally,

right? Someone who grew up in

Staten Island is going to be a bit more street smart than someone who grew

up on a remote desert island, right, where everybody knows each other,

right? That's an adaptation. But

there are no remote desert islands anymore. Yeah. Your

phone, your watch, I mean, everything, your fridge. My God, your fridge

is spying on you or could be spying on you. Like, what sort of weird

cyberpunk dystopia have we found ourselves in? Right? I often

wonder that. Like, you know, we don't even have the flying

cars like they did in Blade Runner, you know?

But, you know, here we are in this kind of this something that I think

even Orwell would be like, Dude, if, if you would write about it, he goes,

nah, that's not believable. People willingly bring in like these devices that

listen to everything they say. They wait and they carry it around with them. Come

on. No one would believe that. Right. Yet truth turned

out way stranger than fiction. Right. And I'm not, I say

this, I feel like I'm a hypocrite because I have a couple of, I don't

wanna say her name cuz she'll wake up. Yeah. I have

Amazon Echos, right? I have a couple Amazon Echos and I

eventually will get rid of them,

but I certainly don't have a Ring camera. Right.

And now that we're on the topic of cameras, and I know we're coming close

to our time here, what— I don't know if you've been tracking this, but

there's been a big pushback in the US against flock cameras. Yeah.

I think that's interesting. Do you think this will be the moment we look back

on and people realize, We kind of already live in a surveillance

state. Yeah, it's a tough one. I think

that these types of things are all adding up in a moment where AI is

becoming kind of an avenue that makes everybody understand what

cybersecurity means. I think that honestly, cybersecurity has been

such a, uh, techie word and phrase

and concept for so long. And so people didn't really have something that they

understood, you know, other than the breaches if it affected you maybe. But even

then, there was a lot of just, you know, okay, it is what it is.

Like, well, what you gonna do? My information's already out there. I think that when—

I think that a flock camera is— of course, I mean, it's also like you're—

it's literally filming you. So I think that it would have probably been a big

deal regardless. But I think that it's just adding up and adding up on top

of everything that's going on. And people just are quite anti-AI right now

in a way of saying, you know, they're anti-data centers, they're anti-that type of

thing. Everyone just kind of wants that control back. I feel it too. You know,

we used to live in a simpler world. And AI innovation is amazing for

so many things. And again, I think we've— I feel really lucky

because I get to be on the good side of AI. We get to use

AI innovation to keep companies secure. That is an excellent

reason to use it. And there's a lot of reasons that I don't really know

if it's worth the gallons of water that it's using. And so,

right, that's— I think that's kind of to each their own. But anyway, I know

we're at time, but I just wanted to— No, no, no, no. I mean, it's—

I think it's interesting. I think more people need to have these conversations. And you're

right, people, they hear cybersecurity. My wife works in that field and

she worked in it way before it was cool. And

it's one of those things where no

one wants to get a report from security. That's

kind of the mentality. Like no one wants to talk to anyone in security, whether

it's physical security or whatever, but

they're there to protect you, right? Like save you from yourself. I don't know. I

think it's interesting because I think people have to wake up and

realize, like, there is no remote place on Earth anymore, right?

You can get an internet signal pretty much anywhere on the

planet, right? Um,

and if you are within reach of a cell tower, then you are

within reach of, you know, the machine. And

I think maybe we're going to realize, I think slowly

people, the way people are pushing back against AI, The way people are

pushing back against the surveillance cameras and things like that. I

don't think people realize, the general public didn't realize that AI

basically gives you a kind of intelligence that's not just smart,

but a plate reader, a

human plate reader can only do but so much. You can only

hire but so many human license plate readers, but you

have this one kind of I don't want to say mind or

consciousness because that, that's a loaded word, but there's one system that

can act like it's watching you everywhere, right? It

gets to a very— was this Foucault? One of the— there was a French philosopher

that talked about this, and they designed a prison

where everything could be seen from like one central point. Yeah. And it

freaked people out. And it was like, I think they've banned the

use of, or that design, but But I don't know, I think we kind of

like walked into it and kind of we were sold convenience

and in a deal with the devil almost like our

convenience for privacy. It's interesting. Yeah. So,

ending on not such a positive note, I think what you're doing is important because

I think it makes people aware

at the C-suite level more and more about their privacy,

what their security should be. And it sounds like you make it easy, right? It

sounds like you make it— We do. A dashboardy experience.

That's what it should be. And I think you— and

if you have your agents coming out soon, which you don't want to talk about,

I understand, you know, you can actually— oh, go ahead. We have

21 agents already live that are doing a lot of monitoring. And yeah, so this

is just the next wave of agents on the remediation

side. But yeah, we have a wide range, wide array of

curve on that front. Fortune 500 companies use our AI agents every day

to stay secure, monitor third-party risk, monitor their own

risk. Yeah, it's good stuff. Very cool. Well, awesome. Where can folks find out

more about you and Compliance? Yeah, compliance.com.

Easy enough. Compliance.com. With a Y? With a Y. Compliance with a Y dot

com. Exactly. And that's where you can find us. Awesome.

Awesome. Well, thank you for your time and really enjoyed our conversation.

And if your CTO wants to come and Geek out for a couple hours, let

me know. We'd love to have that because I think I think as

agents become more and more capable, I think

conversations like this are going to be even more important. I mean, they're

important today, but I think once you give these

things that have no

ethical constraints,

have no conscience. so to speak, and have

no fear of being— even the most

worst person you can think of

had some kind of concern about being

caught, captured, and punished for their crimes. I don't think

AI has that, right? And we've seen the

horrible things humans can do, right? And that's with, quote unquote, a

conscience. of some sort, whether it's broken or not is another question,

right? So you could just imagine what a machine could do with

that kind of thing. So again, another positive note to end on, but

not everything ends like a good Disney movie. With that in mind, I'll let the

outro play. Thanks again to Rich Akowal for joining

us and breaking down the evolving world of AI, privacy,

security, and compliance. If you enjoyed the

conversation, be sure to subscribe, share the episode, and join us next

time on Data Driven.