Cybersecurity Month Meets AI Risk

Rob 0:01

You know, Don, what month is it?

Dawn 0:04

Cybersecurity Month.

Rob 0:06

Boom, boom, boom. Well, every month is cybersecurity month, but it's officially cybersecurity month. Or it could be donut month. It's probably Oktoberfest month, too. But this well, that's always right. But this week we want to talk about AI safety and starts with your employees because it is Cybersecurity Month here in the States. And you know, we talk about ransomware and we talk about phishing and we talk about when people want to break in, right, Don?

Dawn 0:37

Mm-hmm. Yep. But AI is changing that conversation, or this conversation rather, because now when the biggest risks may not be someone trying to steal information, it may be one of your employees handing it over without realizing it by integrating an AI tool.

Rob 0:53

Yep. It's not because they're m malicious, hopefully not, right? Or they're careless because they're just trying to do their job and they're trying to get through it faster. Right.

Dawn 1:01

So that makes everything different. Uh AI is useful, but it's very powerful and it's already part of the workplace. So the conversation can't just be don't use it.

Rob 1:12

Yep. You will be using it. It's just like the internet. It's, you know, they came back in the 90s. It's just like moving to cloud computing. You're going to use it and you're going to be there. Uh, and that's what you're going to do. So this week, that's what we're going to dive into. Welcome to the Van Ryan Compliance Podcast with Rob and Don. We help growing teams, reduce risks, build trust, and stay audit ready without the overwhelm. And I'm Rob.

Dawn 1:35

And I'm Don.

Rob 1:36

And today we're talking about AI safety, security, and the human side of both.

Dawn 1:40

And it can be Halloween-y too.

Rob 1:42

All right, Don, why don't you kick us off in your Halloweeny spirit? It is October.

Dawn 1:47

All right.

Rob 1:48

So yes. So in this era of AI, or I guess I got called SI over the weekend, um superintelligence, um, why don't you go ahead and walk us through what we're gonna dive into this week?

The Accidental Data Leak Scenario

Dawn 2:01

Well, let's start with something pretty normal. So let's just say an employee has a report to write, and an email to clean up, a complaint to respond to, summarization of notes, meeting notes. They're busy, they're behind.

Rob 2:18

Yep. So they copy it into AI tool, a chat, a GBT, a Grokbot, a Meta, whoever, right? They paste it, hit enter, done, boom, look at the time saved. Epic.

Dawn 2:29

Mm-hmm.

Rob 2:30

Except it's like the mom look maybe, yeah, wait, wait for it.

Dawn 2:36

Maybe that email had patient information in it.

Rob 2:39

No.

Dawn 2:40

Or employee information. Yeah. Or financial information.

Rob 2:44

Yeah.

Dawn 2:45

Or internal business information.

Rob 2:48

Yeah. And if your settings aren't set to omit that company information from the large language models, it's going to get ingested immediately. And that's the key point. The employee probably doesn't even think I'm creating a cybersecurity risk. They think I'm getting my work done.

Dawn 3:04

Right. Which means this isn't just a technology problem. Don't be scared of AI. It's a behavioral problem. I know that sounds like a parent, doesn't it?

Rob 3:15

Yes, the whole you had the whole mom route. You did the mom look and everything. It's all we've always talked about culture, right? Now it's important to talk about behavior is you making sure your team knows how to use it and when to use it. Because for years, our cybersecurity training has focused on keeping the bad guys out. So now, unfortunately, the bad guys unintentionally are probably in, right? Don't click the link, don't open the attachment, don't give away your password with the number one at the end.

Dawn 3:46

One, two, three. Exclamation. No. All all of this is still important.

Rob 3:52

Yes.

Dawn 3:52

All of this is still important.

Rob 3:54

But uh AI adds a new question. What are we voluntarily putting into these tools, Don?

Dawn 3:59

Yes. Nobody has to fish you. Nobody has to steal your credentials. Nobody has to break through a firewall. You can simply copy the information into the wrong place yourself.

Rob 4:10

Yeah. And that's a completely different security issue, is when your team is using these tools to better their job and better

Shadow AI Tools Spreading Fast

Rob 4:17

your company. But unfortunately, they create an AI safety risk, right? Um, and that is why we're going to talk about and dive deeper this week in the cybersecurity conversation.

Dawn 4:26

Yes. And this is where shadow AI or SI becomes an issue. Tomorrow it'll change again. Probably will.

Rob 4:38

Oh, shadow AI. So people remember there is still a dark net. There has always been a dark net. And the dark net bots and the bad guys and gals are using AI for bad. It's the same story. There is evil and there is good. So for years, we have dealt with shadow IT. We've still dealt with shadow AI. We still sometimes do uh dark web scans where we're seeing if your credit card information is out there, or we're seeing if your your credentials have been have been um compromised right. But employees today, they may not know about that or may not think about that, or it's going so fast that they're just going ahead and sending information out and um going through file share apps or even ransomware software.

Dawn 5:23

Yep. And now it's AI. Here we are. AI is all around us. Chatbots, yay, grockbots are fun, agents, they are fun, writing tools, meeting assistants, yeah, browser extensions, AI note takers, free tools. Someone discovered online. Yep. Yes, all of this.

Rob 5:44

The two biggest issues I see is the browser extensions, the plug into Chrome, or or um Edge. I had to think about that because I don't know if somebody uses Edge anymore. Um, or Safari, but also the AI note takers using Gemini or Granola or 365 or Copilot or anything. Where's that data going? You know, is it going into a Slack channel? Is it going into Teams? Is it going into a doc, a Google Doc or a Word doc, right? And those are the things that that leadership needs to be able to see and understand. We had to make sure what AI tools we have, what is approved. Tell your people what's approved. If not, people are resourceful. We'll go get our own tools. And every day there's a new AI bot.

Dawn 6:30

Yep. And that only tells what leadership knows about. Leadership doesn't know if Betty's over here or Bob's over here doing some clod coding, creating something and ingesting all this company information.

Rob 6:48

So since we're all remote around the globe. You know, you don't walk, you're not, you're not Miss Mrs. Lumberg walking down the halls from office space on with your coffee cup.

Dawn 6:58

There's no Mrs. Lumberg. That was Mr. Lumberg.

Rob 7:01

I know, but if you did it, it'd be Mrs.

Dawn 7:03

Oh, I gotcha. Okay.

Rob 7:05

But then, yeah, because we were talked about you being the team mom today. Oh gosh. But we don't, we don't want to

Don’t Ban AI Build Guardrails

Rob 7:15

ban it. I mean, there's a lot of there's so much misinformation about technology, AI, SI, whatever I you want to call it. It will, it makes life better. I'm a big supporter of it. I think Dawn is as well. We've seen it with our own business, how we've improved everything from financials to just simple processes to simple just um updating everything from marketing to documents, to policies, to cleaning things up, to improving the business. But we put guardrails around it and don't just open things up. You need to understand what you're doing and be able to work with the AI so that you're comfortable with it because it will continue. No matter what safety experts that don't work at any of the companies anymore say or do, it's it's more of a political football, if you will, coming into an election season, right? But do what's right for your business and understand those guardrails.

Dawn 8:09

Yep. Yep. And, you know, yeah, and that's definitely what we're, you know, don't ban it. You know, ask, ask who's using it, how they're using it, um, and and keep track of what you're using. Also, don't just stop using it. If your team is using Claude, then let's, okay, let's get a let's get an enterprise, you know, model, let's get a team model so we can purchase it. So then you've got some BAAs around there, you've got some, you know, you've got some uh contracts around that, you've got some more security. Um, so so don't just stop it. Just okay, let's let's vote on it. Let's see what everyone's using. What are we using the most of? We have we use four different models here. Uh well, we use multiple models, but we subscribe to, you know, to to four different ones and and other ones have it in it, and you know, ingrained in it. But um, you need to know what what you need to use it for and how you're using it and do you need it.

Rob 9:07

Um people are gonna use it. It it's a toy, right? It's a toy to some people. It's powerful to business owners and founders or leaders and organizations. Um, and and we're getting really good, it's getting very good uh at understanding your business. So making sure that we have those guardrails and give people, give people what they need, right? People want the bot, give them the bot. Oh, but this is how you're gonna use the bot. Also, when someone leaves your organization, you want to, you know, you make like to your point, Don, make sure we have an enterprise plan. Because if if Sandy leaves, we want to make sure we have all the information that Sandy uh plugged into maybe the marketing plans, right? So then it's in the uh in the GBT or the Claude or the GrokBot or whatever bot you want. Uh and then we're able to continue the business. So it the knowledge doesn't just live and and and leave with someone. Those are the key pieces.

Track Usage With Forms And Owners

Dawn 10:01

I think the big thing with leadership, we've been asked by a lot of business owners is how do we track this? I think the big thing is is that if someone asks you for it, you need to have a a document. You need to say, fill out a form. It could be a simple Google form, you know, or a Microsoft form. How are you using this, Bob? What are you creating with it? What kind of data are you going to flow through it? These are all these questions that you should be asking and not just giving people access because you don't, you know, they don't even know. And so we need to track it. So someone needs to be the holder of this. They need to track who's using what. Are we paying for it? Um, and and what information's going in there. And then does everyone need it? Or is it just Bob's department, you know? So we need to be really, really uh careful and we need to really track, track this. Yep.

Rob 10:56

And make it simple. Don't be complicated. There's nothing complicated. So, like here, you know, for for example, we say we know marketing, um, the copy resides well in GBT, but sometimes the graphics are better in Claude. But end of the day, Juni on the team has to review it. Have the human in the middle review it before it goes out to the world to make sure it looks right because it does make mistakes, just like humans make mistakes, right? Yep. That's why we have a QA process on audits. That's why you need to have a QA process within your organization to make sure things look good before they go out. Checks and balances. Um, it's just taking away all that heavy lift of stuff we've got to do. And those are the key pieces. And I think the most important thing is don't put any sensitive information, any of the tools. For example, I, even though you can sign BAs with GBT and portions of Claude and not Grockbot or the others, because they're not designed for that, don't put health information in there. To Don's point, don't put any financial information or proprietary information. Right? If you need to write a handbook or update a policy, make sure you have that data. You make sure it's your own enterprise edition or business edition of those models. Uh and don't leak the data because everything's trackable. If there is an incident or breach, it will be tracked and it'll be it, you know, you'll be held liable. So Yep.

Dawn 12:17

Uh having a clear, clear understanding, clear guardrails of the usage of it. Yep.

Rob 12:24

Have you seen it be wrong before dawn?

Dawn 12:27

Yes, I got upset this weekend at it.

Rob 12:30

You were yelling at your grock bots. Tell me about your grok bots.

Dawn 12:34

Yes. Yes. It got uh they get sideways. Um you can have a clear prompting. Um, and it can get it can completely redo. You know, the best thing is is if you've got, if you can,

Human Review QA And Verification

Dawn 12:48

you know, if you're whatever you're doing, making sure you've got a backup, because you can always go back to the previous version if you're if you're doing versioning or something of something, um, whether it be a proposal or a, you know, some sort of a, you know, policy or I don't know, what whatever you're doing. So yes, because they can be wrong, they can not only give you wrong information when you search up some information, but they can also um produce things wrong.

Rob 13:16

Yep. Yeah. That's why you have to verify that. It makes it a little dangerous, but also it gives you the ability to think a little bit differently and and be able to fill in those gaps that are incorrect. Or help it actually helps me think better. Like I have to think about how do I want this document or how do I want this financial review to look? What's the end in mind? Um, you know, what's the end point in mind or the goal? I can talk on a Monday. And what are we going to do with that? And you have to still have that in place before you move forward. It's great at brainstorming, it's really good at at drafting and summarizing, but execution, I think it's a dual path. You know, we're starting to let things kind of do on its own, like auto-reconciliation of accounts, that's pretty easy matching up. We still have to finalize the financial reports, but it really takes a lot of that lift away. Yeah.

Dawn 14:09

And you have to make sure that you're prompting it, you're asking it, but you need to verify it. You need to own the decision. If you're using the tool, you're owning the outcome. So if you present a project plan and your manager, owner, teammate says, Whoa, what's all this stuff? You know, you own that. You should have looked at it, you know? Um, you should have looked at what what data it was um putting out. So definitely the tools are great. They're great for brainstorming, they're great for summarizing, but make sure that it's it's correct.

unknown 14:43

Yeah.

Dawn 14:44

Yep.

Rob 14:44

Yep. And that, and how you do that is really the culture, right? Like, for example, we'll talk about it every week in our staff meeting on Mondays. Like, how is everybody using AI, comfortable with it, making sure everybody uses the business accounts, do not use personal accounts, you know, that is against the policy at Ned Van Ryan, and you need to set that up as well. Yes, I know people are people and they will bounce out, but the best

Business Accounts Policies And Offboarding

Rob 15:07

thing you can do is having, you know, signed employee agreements that states from a legal perspective, a um you have to use the approved tools of the business. That's the key piece.

Dawn 15:17

And if you think for your job, we we say this to our team, if you think you need a tool, then come to us. So we have some clients that their employees are just on their phone, just using Chat GBT and stuff and their personal, you know, just their free account. Well, go to your boss and say, or your manager, I I need to use this because XYZ. Um don't just use it on the fly because you're already probably putting sense of information in there and you're putting the company at risk. So definitely, definitely say, I I would like to have this tool. This would help me because of this. Um, you know, and so so definitely that and that's how we that's how we work with our team too.

Rob 15:56

Yeah. So give me a solution. Like, here's the solution. I could use this model to create that market or that review. And and be smart about it, right? We need to make sure we have good, smart, educated directions as we're going through everything and make sure we're very intentional in our use, not just, not just, yeah, give it a try. And it's fun.

unknown 16:18

Right.

Rob 16:18

But as we as we wrap up, Dawn, as we close, what are the three things our listeners need to take away from this week's cybersecurity?

Dawn 16:26

Yeah, the first thing is it's sort of a third-party risk register, if you will. Um, what AI tools are we actually using? What data is actually flowing through there? Very important. Yeah. Yep. And what is acceptable and what's not acceptable use. Those are three huge things. A lot of in-betweens of that too. I mean, I I've got risk registers that have multiple columns in them. Um, so, but those are really a good three to start with.

Rob 16:57

And also date, like the rate register, I I still like visual maps. Oh my gosh. I mean, those old days of Visios. That's still, I don't know if that's a thing anymore. But just like workflows, like data flows. Where's the data come into the organization? Where does it flow out of the organization? Where does it connect to? Everything is, you know, web-based, but are you using a VPN somewhere? What does that look like? And stuff like that. Understanding those guardrails. And it doesn't need to be a 50-page policy, it doesn't need to be anything like that. It could be one or two pages of a clear just direction of where the data flows. So making sure you have your risk register, data flow uh points, making sure you educate your team and they understand how to use AI correctly and most importantly accurately with uh your customer data and your company data. Yep.

Dawn 17:43

Exactly.

Rob 17:44

Any last words of wisdom, Don?

Dawn 17:46

Nope. AI is a great yeah. I'm done. A AI is a great tool. Can it be used for bad? Yes, everything can be used for bad. Let's just think I mean in the world. But AI is a great tool. But use it smartly. Smartly? I don't know if that's the right way. Smartly good. Use it.

Three Takeaways Risk Register And Data Flows

Dawn 18:06

Have the guardrails, understand how you're using it, how you're not going to use it, and use it to help you create more and to streamline your business, streamline your tasks. Improve. Yeah, improve, improve things. It they're great tools. Just be careful how you use them.

Rob 18:22

Yeah. I think that's the great, I think that's a great way to wrap up this week's podcast.

Dawn 18:26

Absolutely.

Rob 18:27

Good job, Don. That was fun.

Dawn 18:28

Good job, Rob. Yeah. All right.

Rob 18:30

Until next week, I'm Rob.

Dawn 18:31

I'm Don.

Rob 18:32

Bye-bye. Bye-bye.