Predicting technology is notoriously difficult, so this episode isn't really about prediction. It's about direction.

In this episode of AI Security Multipliers, Steve looks beyond the next model release and explores how AI could reshape technology, work, cybersecurity and governance over the next decade.

In the near term, AI may simply become normal — embedded into the applications and technology we already use, while AI agents increasingly move from answering questions to actually performing work.

Five years from now, those agents could form a genuine digital workforce, changing jobs, management and the way organizations operate. That raises some difficult questions: What happens to entry-level work? How do people develop expertise when AI performs many of the tasks traditionally used to learn it? And what happens when managers aren't just managing people, but potentially dozens or hundreds of AI agents?

By 2036, AI may no longer feel like a separate technology at all. It could simply become infrastructure — with software increasingly understanding our intent and applications disappearing behind the outcomes we're trying to achieve.

And then there's the bigger question: what happens when useful intelligence itself becomes cheap and widely available?

We also explore what this future could mean for cybersecurity, identity, autonomous systems, Zero Trust, AI governance, AGI and the relationship between human and machine intelligence.

The goal isn't to correctly predict 2036.

It's to build organizations capable of adapting when we get there.

Topics include: future of AI, artificial intelligence, AI agents, agentic AI, enterprise AI, AI jobs, future of work, AI workforce, AI cybersecurity, AI governance, AGI, digital workers, autonomous AI, identity security, Zero Trust and the future of technology.

Send us Fan Mail

AI security posture management. AI gateways. AI firewalls. Agent security. Runtime protection. Model security. AI governance platforms.

Some of these technologies will be essential. But before adding another platform, another dashboard and another acronym to the security stack, there's a question worth asking:

How much of your AI security problem can you solve with the tools you already own?

In this episode of AI Security Multipliers, Steve looks beyond the AI security hype to examine how many enterprise AI risks are actually familiar cybersecurity problems wearing a very clever new interface.

Excessive AI access is still an identity problem. Sensitive data being shared with AI is still a data protection problem. An overprivileged AI agent is still a privileged access problem. An insecure AI workload is still a cloud security problem. And AI generated malicious code executing on a laptop is still something endpoint security should care about.

We explore how existing capabilities including IAM, MFA, privileged access management, DLP, endpoint security, cloud security, SIEM, Zero Trust and security monitoring can form much of the foundation for securing enterprise AI.

There are genuinely new AI security risks that require new capabilities. But the answer shouldn't be to build an entirely separate cybersecurity stack for AI.

Start with the risk. Map the controls you already have. Identify the real gaps. Then buy technology to fill those gaps.

Because there's a difference between security architecture and shopping.

Topics include: AI security, enterprise AI, generative AI security, agentic AI, AI agents, cybersecurity, AI governance, identity security, IAM, DLP, Zero Trust, SIEM, cloud security, endpoint security, AI security tools, security architecture and cybersecurity tool sprawl.

Send us Fan Mail

They're accessing information, using applications, calling APIs, operating browsers, making decisions and increasingly taking action on our behalf.

So here's a deceptively simple cybersecurity question:

Who is the agent?

In this episode of AI Security Multipliers, Steve explores what happens when AI agents begin behaving less like traditional software and more like a digital workforce.

We look at why agentic AI creates a new identity and access management challenge, how AI agents differ from traditional service accounts and automation, and what happens when agents begin delegating work to other agents.

We also explore the coming challenge of Shadow Agents, agent lifecycle management, least privilege, Zero Trust, kill switches, accountability and the uncomfortable possibility that enterprises may eventually have far more AI identities than human ones.

Because securing AI agents isn't simply about controlling what information they can access.

It's about understanding who they are, what they're allowed to do, who owns them — and how you stop them when something goes wrong.

Your newest employee might not be human.

But they still need an access review.

Topics include: AI agents, agentic AI, enterprise AI, AI cybersecurity, AI governance, identity security, IAM, non-human identities, machine identities, Shadow AI, Shadow Agents, Zero Trust, least privilege, autonomous AI, AI risk management and the future of work.

Send us Fan Mail

In this episode of AI Security Multipliers, Steve looks at one of the uncomfortable realities of tools like Microsoft 365 Copilot: AI may not be creating your data security problem. It may simply be exposing the one you already had.

We explore RAG, enterprise search, excessive permissions, SharePoint sprawl, information governance and why “clean all your data before deploying AI” probably isn't a realistic strategy.

And there's another possibility: AI might actually be one of the best things to happen to information governance in years.

Because AI didn't create decades of bad permissions and forgotten files.

It just made them searchable.

Send us Fan Mail

In this special edition of AI Security Multipliers, Steve takes a closer look at Microsoft Scout — Microsoft's new always-on AI agent for work — and what it could mean for the future of enterprise AI, Microsoft 365, cybersecurity and AI governance.

Unlike a traditional AI assistant or chatbot, Scout is designed to do more than answer questions. It can work across Microsoft 365, files, browsers and enterprise systems, perform multi-step tasks and increasingly take action on behalf of the user.

That capability could fundamentally change how we work. It also raises some important questions.

What happens when AI stops simply answering questions and starts performing work inside the enterprise? What identity should an AI agent have? What data should it be able to access? Which actions require human approval? And how do organizations govern, monitor and secure an increasingly autonomous digital workforce?

Steve explores why identity, Zero Trust, information governance, Microsoft Entra, Purview and cybersecurity become even more important in an agentic AI world — and why Microsoft's existing position across identity, security, data, Microsoft 365 and the enterprise could give it a significant advantage.

The AI model may not be Microsoft's biggest advantage.

Microsoft's biggest advantage may be that it already lives where we work.

Topics include: Microsoft Scout, Microsoft Copilot, AI agents, agentic AI, enterprise AI, autonomous AI agents, Microsoft 365, Microsoft Entra, Microsoft Purview, cybersecurity, Zero Trust, AI governance, information governance and the future of work.

AI Security Multipliers explores how artificial intelligence is changing cybersecurity, governance and enterprise technology — and how organizations can use AI to multiply capability without multiplying risk.

Send us Fan Mail

In this short introduction, Steve explains what the podcast is about, why he created it, and the perspective he brings to the rapidly changing worlds of AI, cybersecurity and governance.

No hype. No fearmongering. Just practical conversations about what matters, what’s changing, and how we can use AI to multiply what people and organizations are capable of achieving.

Send us Fan Mail

We hear plenty about how attackers are going to use AI. But what about the defenders?

In this episode of AI Security Multipliers, Steve looks at the other side of the AI security story: how AI can help cybersecurity teams work faster, prioritize better, investigate incidents, improve detection, strengthen identity security, and deal with the enormous amount of information modern security environments generate.

From SOC operations and threat hunting to vulnerability management, incident response, phishing defense, and security awareness, the opportunity isn't about replacing security professionals. It's about giving them more time to think and multiplying what they can accomplish.

We also tackle the harder question: how much should AI actually be allowed to do on its own?

And in this week's Multiplier, there's a simple place to start: ask your security team what repetitive task they wish they didn't have to do.

AI is coming for cybersecurity.

Good. Let's use it.

Send us Fan Mail

In this episode of AI Security Multipliers, Steve explores how organizations can govern AI without becoming the Department of No.

As AI adoption accelerates, many organizations are responding with policies, committees, risk assessments, approval processes and new governance structures. Those controls can be important, but treating every AI use case as though it carries the same level of risk can quickly create bureaucracy rather than meaningful governance.

A developer using an approved AI tool to explain non-sensitive code isn't the same risk as an autonomous agent capable of changing production systems or approving financial transactions.

So why would we govern them the same way?

We look at how risk-tiered governance can create a faster path for low-risk AI use while applying greater scrutiny where the consequences actually matter. We also explore why organizations should build on existing security, privacy, data, procurement and technology governance rather than creating an entirely separate AI bureaucracy.

Because good governance shouldn't make safe AI harder to use.

It should make the safe path the easiest path.

In this episode:
• Why AI governance can unintentionally create Shadow AI
• Why organizations should govern the risk, not the buzzword
• How risk tiers can prevent every AI use case becoming a major approval exercise
• Why governance should start with the business use case
• How to create a fast path to yes
• Why approved AI platforms and safe experimentation environments matter
• How existing security, privacy, data and technology governance can support AI
• Why AI policies need to be understandable enough that employees actually read them
• How cybersecurity can become an accelerator rather than a gatekeeper
• Why AI governance needs to evolve as capabilities change
• How to measure whether your governance model is actually working
• The role of executives and boards in AI oversight
• Practical steps for improving your AI governance process now

The Multiplier:
Take your organization's AI governance process and actually try to use it.

Choose a simple, low-risk AI use case and follow the process from beginning to end.

How many forms?
How many approvals?
How many meetings?
How many days?

And most importantly:

At any point would a reasonable employee decide it was easier just to go around you?

If the answer is yes, don't immediately blame the employee.

Fix the path.

Because one of the best ways to reduce Shadow AI isn't another monitoring tool. It's making approved AI easier to use than unapproved AI.

Good governance doesn't just control risk. It creates a faster path to yes.

Govern the risk, not the buzzword.

Send us Fan Mail

In this episode of AI Security Multipliers, Steve explores what happens when AI evolves from an assistant that recommends what to do into an agent that can actually do it.

An AI agent may read email, access enterprise data, update records, call APIs, initiate workflows, modify permissions or interact with other systems. At that point, the security question is no longer simply, "What can the AI see?"

It's "What is the AI allowed to do?"

We look at why agent identity and authorization are becoming critical security boundaries, how delegated authority changes risk, and why familiar concepts such as least privilege, separation of duties, human approval and auditability become even more important when the actor isn't human.

Because every time you give an agent another tool, you're not just adding a feature. You're adding authority.

In this episode:
• The difference between AI that advises, assists and acts
• Why autonomy is really about delegated authority
• Why every AI agent needs an identity
• Whose permissions an agent should use
• The difference between capability and authority
• Why agents could recreate the service-account problem at enormous scale
• How tools and APIs increase an agent's authority
• What happens when an autonomous agent gets something wrong
• Why prompt injection becomes more serious when AI can take actions
• When "human in the loop" actually provides meaningful oversight
• Why logging and auditability matter for autonomous systems
• How separation of duties applies when the actor isn't human
• Why least privilege and just-in-time access matter for AI agents
• Practical steps for discovering and governing agents already inside the enterprise

The Multiplier:
Choose one AI agent your organization is using, building or seriously considering and ask five questions:

What identity does it use?

What data can it access?

What actions can it take?

Who can authorize those actions?

And how do we stop it?

If you can answer all five clearly, you've got the beginnings of a security model.

If you can't, the agent may already have more autonomy than your governance does.

Govern the risk, not the buzzword.

Send us Fan Mail

In this episode of AI Security Multipliers, Steve explores why enterprise AI is changing the traditional security boundary and making data, identity and access governance more important than ever.

For years, organizations accumulated SharePoint sites, file shares, security groups, inherited permissions and old documents. Much of that information was technically accessible but difficult to discover. AI changes the equation by allowing employees to search, summarize and connect information across enormous amounts of enterprise data in seconds.

The permission may not have changed. The value of the permission has.

We look at why permission isn't necessarily the same as intent, how AI exposes years of accumulated access decisions, why identity effectively becomes part of every AI query, and why data classification and ownership suddenly matter a great deal more.

We also explore RAG, oversharing, public AI services, DLP, and why simply locking everything down isn't the answer.

In this episode:
• Why AI changes data discovery, not just data access
• Why permission isn't necessarily the same as intent
• How AI exposes old SharePoint and access-control problems
• Why identity becomes part of the AI security boundary
• Why data classification matters again
• The importance of clear data ownership
• How AI changes the risk of overshared information
• Why RAG doesn't automatically make enterprise data safe
• The risks of employees putting sensitive information into public AI services
• Where DLP helps, and where it doesn't
• Why locking everything down can undermine the value of AI
• Practical steps CISOs can take now

The Multiplier:
Choose one AI-enabled enterprise application and one ordinary employee account. Ask a few normal business questions about information that employee probably doesn't need for their day-to-day job.

Don't bypass controls. Don't jailbreak the model. Just use the AI normally.

If it finds something surprising, don't immediately blame the AI.

Ask a better question:

Why could this employee access the data in the first place?

Because AI isn't just changing the threat landscape. It's changing the value of permissions you already granted.

Govern the risk, not the buzzword.

Send us Fan Mail

In this episode of AI Security Multipliers, Steve explores why trying to assign all AI risk to a single executive or function may be the wrong approach.

Using practical enterprise examples, we look at the difference between identifying risk and accepting it, why the business needs to remain accountable for business outcomes, what the CIO and CISO should actually own, and whether appointing a Chief AI Officer really solves the accountability problem.

We also look at the role of data owners, AI governance committees and boards, and why governance should scale according to the use case rather than treating everything involving AI as equally risky.

In this episode:
• Why AI risk doesn't belong to one person or department
• The difference between risk identification and risk acceptance
• What the CISO should, and shouldn't, own
• The CIO's role in enterprise AI
• Why data owners remain critical to AI governance
• Whether organizations really need a Chief AI Officer
• Why committees shouldn't become the owners of risk
• How boards should think about AI oversight
• Why AI governance should follow the use case
• A simple model for establishing AI accountability

The Multiplier:
Choose one real AI use case in your organization and ask five questions: Who owns the business outcome? Who owns the data? Who can accept the risk? Who can stop the use case? And who gets the phone call when it goes wrong?

Five different names may be perfectly reasonable. Not knowing the answers is the governance problem.

Govern the risk, not the buzzword.

Send us Fan Mail

In the first episode of AI Security Multipliers, Steve explores what happens when generative AI enters the enterprise faster than traditional IT and security processes can keep up.

From shadow AI and Microsoft 365 Copilot to data permissions, identity, AI agents and governance, this episode looks at the practical challenges facing technology and security leaders as AI adoption accelerates.

We explore why blocking AI isn't a strategy, how AI can expose data and permission problems that have existed for years, why AI agents are changing the identity conversation, and how organizations can put sensible governance around AI without making the secure option impossible to use.

In this episode:
• Why employees, not IT, often introduce AI into the enterprise
• Shadow AI and what it tells us about employee demand
• Why enterprise data may be the real AI security boundary
• How AI exposes existing permission and access problems
• The emerging identity challenge created by AI agents
• Why AI governance should focus on risk rather than technology
• How cybersecurity can enable AI rather than simply saying no
• Practical steps technology leaders can take right now

The Multiplier:
Talk to three regular employees. Ask what AI tools they're using, what they're using them for, and what information they're putting into them. Then listen. What you learn may tell you more about your real AI environment than a twenty-page strategy document.

Send us Fan Mail