How Enterprise Leaders Should Think About AI, Quantum, and Crown Jewel Protection

The market rewards speed over security, and most executive teams are making resource decisions accordingly, but that trade-off becomes existential when adversaries are stockpiling encrypted data and quantum computing is approaching viability.

Kathryn Wang is the Principal Public Sector Lead at SandboxAQ, CEO of CTRL+Alt+Defeat,io, and a board advisor whose career spans cybersecurity partnerships, defense technology, and national security. In this conversation, she and MK Palmore work through why AI's biggest enterprise impact so far has been workforce reduction rather than workforce amplification, how counterfeit and trojanized hardware exposes the limits of compliance frameworks like the software bill of materials, and why post-quantum cryptography should be treated as an urgent priority rather than a future concern.

Kathryn shares her framework for cutting through the noise: identify your existential threat, lock down your crown jewels, and stop distributing limited security resources across a perimeter you cannot fully defend.

Things You Will Learn:

1. Why identifying and securing your organization's crown jewels is the highest-leverage move when you're outgunned and under-resourced.
2. How the gap between compliance requirements and actual security effectiveness is widening, and why compliance theater remains a structural problem even at the federal level.
3. What post-quantum cryptography means for enterprise data protection and why the "harvest now, decrypt later" threat model demands action today.
   
   

Tools & Frameworks Covered:

1. Crown Jewel Prioritization: Identify what will shut the company down, determine what adversaries actually want, and concentrate protection there rather than spreading resources across the full perimeter.
2. Measured Optimism on AI Adoption: A decision lens for evaluating AI use: what is the job to be done, how does the tool help, and what are the ways you can injure yourself with it — versus treating AI as a hammer and looking for glass to break.
3. Post-Quantum Cryptography Readiness: The strategic imperative to ensure crown jewel data cannot be ransomed or decrypted when quantum computing reaches viability, given that adversaries are already harvesting encrypted data for future decryption.
   
   

#EnterpriseRisk #PostQuantumCryptography #AIAdoption #CriticalInfrastructure #RiskApogee

🎙️ Thanks for tuning in to The Risk Apogee Podcast!
If you enjoyed this episode, don’t forget to follow/subscribe so you never miss an inspiring conversation.

✨ Connect with Apogee Global RMS for more leadership insights:
LinkedIn: https://www.linkedin.com/in/mkpalmore/
Instagram: https://www.instagram.com/apogee_rms/
X/Twitter: https://x.com/apogee_rms

💼 This episode is brought to you by Apogee Global RMS – experts in risk management solutions. Check out their website to learn more about how they can support your business.

Let’s keep growing and leading boldly. Until next time!

Transcript

SPEAKER_02 0:00

Welcome back to the Risk Apogee Podcast. If you're looking for someone who sits at the absolute bleeding edge where cybersecurity meets physical defense, artificial intelligence, and quantum tech, you are in for a treat today. We are so incredibly thrilled to be joined by Catherine Wang. She describes herself as a mad scientist in cybersecurity partnerships and sales, and looking at her track record, that title feels spot on. Catherine's career spans some of the most innovative corners of the industry. She is currently the principal public sector lead at Sandbox AQ, the CEO of Control, Alt, Defeat, a Board Advisor for Building Cybersecurity, and a driving force as co-chair for uniting women in cyber at the Cyber Guild. But she's not just about building massive strategic partnerships. As she puts it, she's essentially the cue to our national security's James Bond, scouting the horizon to arm the good guys with battle-hardened, bespoke technological arsenals. She is on a mission to champion technology that maximizes human authenticity while keeping our moral compass intact. Plus, anyone whose motto is, come with me if you want to encrypt, is exactly the kind of guest we want on this show. Please join me in welcoming the ultimate cyber innovator, Catherine Wang.

SPEAKER_00 1:15

Welcome to the Risk Apogee, where we cut through the noise to get to the truth about risk. Cyber, physical, human. Every organization faces threats. What separates the ones that survive from the ones that don't is the decisions their leaders make under pressure. Each episode, we go inside the arena with the operators and strategists, shaping how organizations defend, adapt, and lead. This is the Risk Apogee.

SPEAKER_03 1:40

Cal, welcome to the Risk Apogee.

SPEAKER_01 1:42

Thank you. It's an honor to be here.

SPEAKER_03 1:43

I appreciate you making time for the conversation. There's a lot going on right now. The risk landscape, as it were, globally from a geopolitical standpoint, from a technology standpoint. You know, you and I both have spent time in the cybersecurity lanes, which we're going to get a chance to talk about. What uh in the risk aperture are you concerned about?

SPEAKER_01 2:02

Where do I start? Um well there is, I will um well, I don't think you can go 10 minutes in any conversation in the Bay Area or even anywhere else in the world for that matter without talking about AI. AI is a tool. And in many cases, uh, the people who are proceeding with some kind of a measured optimism, I find are being very balanced about how to effectively use a tool. They're thinking about what is the tool, the the job I'm trying to accomplish, how will the tool help me get there? What are possible ways that I can injure myself with this tool? And there are other people that are just taking the tool and immediately starting to like, well, I wonder what this hammer's gonna do if I, you know, rake it across this glass window. I do think that every country is taking a very different approach to AI, every company is taking a very different approach to it. And it's fascinating watching how the approaches turn into policies, which turn into regulations, were turn into practice, and then what the long-term impacts are going to be with that uh approach towards AI in their ability to innovate or their ability to efficiently operate.

SPEAKER_03 3:11

What are the chief concerns that you hear from one company to the next? What are the themes that you see evolving?

SPEAKER_01 3:16

Yeah, so over-reliance and overconfidence in AI and its true ability. It's really just over not truly understanding the limitations of AI and then going full board and then making um decisions based off of that, and then you need to, of course, correct. Time is of the essence and time is money. Also, I am very worried that in general, um, you know, we're we are not addressing the key components that make up successful AI, including the data fidelity. Is there any concept of data procurement, data licensing? I mean, we saw OpenAI was just sued by Encyclopedia Britannical for like eight-digit million dollar numbers. And I think that's because they got off easy. Like, who owns this information? Do they own it in perpetuity? And can we create the equivalent of the S bomb, the C bomb, an AI bomb, uh a training data bomb? Like we're starting to think about how do we protect our AI and ensure that it it is effective enough for our our operations.

SPEAKER_03 4:18

The the a great example is how how effective was the was and is the software build materials? Um I mean, you mentioned it. So I want to make sure that we're we're adequately both giving uh acknowledgement of maybe the impact it's had on cybersecurity in particular, but um I I'm not sure it was the resolution that everyone thought it would be.

SPEAKER_01 4:39

And that's a challenge with like CMMC and uh some of these accreditations and compliance requirements in general. The moment that you give somebody a test, if we are not approaching that test with the understanding of the philosophy behind it and we're simply looking for to do compliance theater, then things things change. What do I need to get 90% on this? Exactly. Exactly. So if we're if we're to answer your question bluntly, I think the baseline requirements were helpful. And I see this mostly from the national security perspective because I work in the public sector. The the federal government does have requirements for um software bill of materials. Now, does that translate into the secondary tier, the third tertiary tier? Not really.

SPEAKER_03 5:20

There's there's only does it translate into effective security?

SPEAKER_01 5:24

Yeah, exactly.

SPEAKER_03 5:25

That's the question.

SPEAKER_01 5:26

But at least we have it there.

SPEAKER_03 5:27

Yeah.

SPEAKER_01 5:27

And we don't have it in many other places. Now, again, with compliance theater, there are ways to circumvent this. Now, in a previous life, I was fascinated by weaponized or trojanized hardware devices that were coming in from China. So the way that cyber adversaries think, I wish I was a better criminal, I would make more money, is the federal government wants to buy a thousand Sony Bravias. And the average cost, if you were gonna go and procure it, is going to be somewhere around $1,200 a pop. Somehow a vendor came in and offered the thousand TVs at $600 a pop. Riddle me this. How does the math work on that? Like whose cousin do you know at the manufacturing plant that could strike a deal that good? So then it begs a question it's so cheap, it's suspect. Right. And what's wrong with it? Well, lo and behold, there's a lot of counterfeit devices now that are in circulation, not only in across the government agencies, like defensive industrial basis, but also in our conference offices, right? In our homes, in our all these places where you can remote enable voice or video recording if you needed to, or disable the device from functioning if that component was tampered with. You could you could actually have a kill switch in it. Is it recording? Does it do vocal recognition? Can it do facial recognition? Can it pick up like uh other ambient noise and a mess hall where conversations could like classified conversations shouldn't be happening, but they may. Is it in a three-star general's office on the wall behind him? It's it's really hard to tell. So while sophomore bill of materials, like it is a fundamental, um, valuable intent, whether or not it's effective, even when it's required by the United States government, there's ways around it.

SPEAKER_03 7:12

I look at it like the the NIST CS CSF, right? I I feel as though from a regulatory standpoint, practitioners actually have everything that they need to engage in good practices and to do the right thing. The question is, remains, there's a gap between the information available and the actual practice. Why is that gap as large as it is? And if I were to proffer to you that the gap's actually widening, what would you what would your response be to that?

SPEAKER_01 7:39

Uh emphatically agree.

unknown 7:40

Yeah.

SPEAKER_01 7:41

Yeah.

unknown 7:41

Yeah.

SPEAKER_01 7:42

But this is where I think cyber psychology is something that I've started to go down in a hole and it's very fascinating. I liken the whole world of security and risk being very similar to, you know, an enterprise being akin to an operational organism. So if you go to a restaurant for breakfast and you see a donut for a dollar fifty or egg white omelet for five dollars, what do we choose? So the gap widens partially because we can go for something that feels good, that feels comfortable, and it's cheaper and it's immediate, right? We get to we get to feel the immediate endorphin kick of that sugar high, or we can go for the clean protein that was probably harder to source, harder to uh eating healthy is expensive. It it is, but it's to your point, the gap is widening because the child the the choice for short-term pain, long-term gain, it's not something that I would say as a species we're wired to do right now.

SPEAKER_03 8:40

Yeah. Yeah. No, I I think things are getting harder, but I I do feel as though uh organizations are beginning to understand the risk associated with their digital assets, their digital transformation efforts. It just whether or not there's a willingness for them to then do the homework necessary to lean into things like artificial intelligence and all of its capabilities and do it safely and effectively, I think is still a question as to whether or not that's a there's an answer to that.

SPEAKER_01 9:08

So uh this is somewhat of a rhetorical question, but like what is the biggest impact that AI has had on enterprises today?

SPEAKER_03 9:15

Yeah, I think that's a hard question to answer because I don't know that enterprise has gotten their hands wrapped around the ROI associated with AI just yet. Although I think that's coming. Um, because I think that there's a demand to very much understand, okay, we've taken the leap, we've made the investment in this technology. Uh at some point, someone's gonna come around and ask, okay, what are we getting for the amount of money that we're spending on this?

SPEAKER_01 9:38

So here's my observation. And I agree with you completely. I'm gonna get it a little bit more um, get a little spicy. The biggest implication that I've seen that AI has had on enterprises is a reduction in workforce.

SPEAKER_03 9:50

Yeah. I mean, I don't think anyone could argue with that. Now I think many enterprises, especially the technology space, are still reeling from layoffs and reduction in force, basically, based upon this idea that this entry-level work can likely be handled by an agent.

SPEAKER_01 10:06

Yep. So if and I won't speak on behalf of every other country out there, but what my understanding is, is that uh for the other countries that don't have a leg up on um the last 50 years worth of technological advancement like the United States does, they took AI and they turned every single person that that could into a hyper effective, efficient, contributing person to the workforce.

SPEAKER_02 10:34

Yeah.

SPEAKER_01 10:34

And we took AI and we actually did the opposite. We uh disabled our workforce by replacing them with AI. It was probably one of the most myopic things that we could possibly do with AI.

SPEAKER_03 10:48

You're you're touching on something that's super interesting here. So if we think of universal availability of these technologies and tools, is there a chance that we can sort of level set or or bring up the quality globally of business operations, workforce requirements, that kind of thing? I mean, it it sounds like from what you're saying, there's a chance for them to rise. And we could have gone higher, but we were taking a different path.

SPEAKER_01 11:14

Yeah. Well, a good example of this, and this is a drop in the bucket. Like what's happening right now with AI is going to make the industrial revolution look like a blip on the radar. But back in the day, old timey, there would be people that actually deliver oil to everybody's houses so they could light their lanterns and then put oil in all of the the street lamps, yeah, right, that are that light the the path on streets. Everybody was worried with the invention of the light bulb, Tom Settison, that their jobs are going to go away. And yet we're here, right?

SPEAKER_03 11:43

And and then yet we've seen a well that their jobs did go away and people adapted, or I should say industry adapted and found another way to incorporate those folks into the into the workforce. In fact, because of that, because of electricity, other industries grew and benefited from it. And I think that ultimately something similar will happen. Uh, although I think it's debatable. I I still believe we're in the early stages of the AI revolution or evolution, however you want to describe it.

SPEAKER_01 12:13

Yeah, I agree. There's no question that AI is going to do some incredible things. And it's it's all compounding. We thought, I thought, cyber threat landscape was untenable before. And then AI came in and just like melted my entire brain. I I don't I don't even know where to begin now. Um, not that I'm I'm I'm a skeptic on AI. I'm actually a very strong advocate for it, but a measured optimist. Yeah, but but it is created a whole other landscape of threat now because if we've got our AI defending against their AI from a cybernutrition standpoint, how do we make sure that our AI is stays ours? Yeah. Or focus on us that can't be corrupted, you know, or weaponized.

SPEAKER_03 12:59

A very similar thing happened with nuclear technology, uh, which evolved into what they call mutually assured destruction, right? Which is this idea that kept everyone at bay because yes, you may have the same technology or tools, but basically we're gonna wipe each other out, and that's what stops folks from actually pushing the button. So maybe let's I can't see a similar thing happening in cyber only because the adversary doesn't care about their own destruction, because in most cases their destruction is a virtual one, and it's not something that means that they're no longer gonna be in existence. They have shown a resilience and a pretty good ability to pivot when necessary. So I think if anything, as we begin to sort of reach parity with the adversary, I just think they're gonna find new ways to leverage what what they already have available to them, which is this winning percentage that is in their favor and an ability to essentially take any at bat that they would like, right?

SPEAKER_01 13:52

So, and this is where I I really do want to see a lot more convictions from cybercrime operations.

SPEAKER_03 13:58

Yeah, I don't I don't think we've ever seen enough to make it a deterrent.

SPEAKER_01 14:02

Yeah. It and a part of it is also they are protected from extradition laws. Like they're located in places that we cannot access. And they're, I mean, with with the geopolitical landscape right now, like if we are the the concept of our ability to work together to take down adversaries that may be nation state sponsored or may not be, just is has become a lot harder.

SPEAKER_03 14:24

Right. Any concerns about uh robotics? That's an I that's a pretty interesting topic. I think it's sort of happening uh as an adjacency to this whole AI revolution. And I don't think people know what to believe just yet because they're not present everywhere. I mean, we see some forms of the robotics. You know, you have self-driving cars, uh, you have uh what is it, DoorDash and some other things like delivery or foods. If you've been on any college campus here recently, they have the food delivery uh vehicles just sort of zooming around campus on their own. They're they're like little moving coolets. I I think it's I think it's amazing. Any thoughts about that? Any concerns?

SPEAKER_01 14:58

My thought is it is necessary.

SPEAKER_03 15:00

Yeah.

SPEAKER_01 15:01

It is, it's actually a critical component to the long-term existence of humanity. And I'll tell you why. There is a really great book. It's written a few years back now by a man named Peter Zion's End of the World is just the beginning. It's a fascinating book, and he goes through very high level of fidelity and research for all of these fascinating topics, but it's it it focuses around one centralized challenge, and that is the global population decline. So, since like basically the the the 20s through the 50s, especially through World War I, World War II, we continue to see global populations rise, right? But then we got to almost a critical mass, and now we're starting to see a decline. There's not enough people now to support, there's not enough in this current generation to support the generation prior. And then we're gonna see this with agriculture, which is gonna affect our food supply. We're gonna see this across some of the other uh more operational like uh industries that we depend on for Maslow's hierarchy of needs, right? These days, we need robotics to help do some of the scaled work that we no longer have human bodies to do. There are some countries that are gonna fare better than others, the United States being one of them because they're a geographic area of success, right? We and France, I think, is the only one, the two countries that if everything went to hell in a handbasket tomorrow, we could hunker down and feed every single person within the country based off of food we produce in the United States alone. Other countries cannot say that. They have a high export for the goods that they have in country, or they import a significant amount of the food into their country.

SPEAKER_03 16:33

Yeah, I think all you have to do is walk into a Costco and see the uh the bounty overabundance uh of nourishment that we have available to us. What are folks in the C-suite talking about as it relates to risk?

SPEAKER_01 16:45

I'm fascinating. This landscape, investors, the market, they reward speed over security. So the risk at the executive level, I think, is not getting to market fast enough. This is where trade-offs happen. Our we're training for the Olympics. Like we're gonna push ourselves to the brink of exhaustion to the point of our breaking point to be able to get that muscle, to get that speed, to shave off that one one point in one second. And we see this with the top AI developers right now, right? Like the OpenAI Claude and Gemini. Any one of those three will have an announcement and have a material impact on the other two's stock with for the next two weeks. Or Jensen will come online and say that he doesn't believe that quantum is on the roadmap for another five years and impact the entire quantum industry's market cap for the next month. Deep Seek will come out and produce something of the more efficient usage of um the NVIDIA GPUs uh by like 30%. And that will affect NVIDIA stock for the next six months. This is what executives, I believe, worry about. It is not cyber risk, it is shareholder value.

SPEAKER_03 17:56

Is is that real or phantom, though? I I I noticed there's a ton of talk in market circles around whether or not all of this AI talk represents some kind of a bubble of some kind. Is that real or are they misreading the adoption of this technology?

SPEAKER_01 18:11

I don't uh it's it's a tough one. I I would say if I were gonna pick one of the two lanes, I'd say they're not misreading it. There are some very inefficient or I would say myopic views on how to use AI at that level of adoption, I think will die down.

SPEAKER_03 18:26

The people who can create a we're gonna stop seeing baby videos of babies dancing, and I don't even know. That's my favorite at the moment. The baby videos, do you? I spent a lot of time watching those. Those are funny. They make me laugh out loud.

SPEAKER_01 18:42

And and so this is a good point, though. There's commercial use for AI, and then there's like enterprise use for AI. Sometimes they overlap and sometimes they don't. We're using AI to create new content daily. This is like expanding the content creation landscape, the cost of hosting. There's a non-trivial cost of giving everybody access to AI, especially when they don't have to pay for it. Cost got to come out from somewhere. But I don't think that's changing. So, from that perspective, it's not misplaced. The people who use AI in very creative ways, I'll give I'll give you an example. So, about a year ago, I joined my current company, Sandbox AQ. And what they're what they're doing is they're taking existing quantum technologies like an MRI machine that's been around for 50 years. One of the reasons why it's so big and clunky is because it has to be shielded. In a hospital, there's a lot of electromagnetic interference. And if you get that interference in there, the doctors cannot read the MRI properly. They cannot diagnose if you have heart disease or some kind of heart attack. People are dying on stretchers. One person dies every five minutes, some ridiculous statistic like that, because they cannot get into MRI machines fast enough. So the AI application that's very creative is well, what if we knew every electronic signature from every medical device, including the elevators within a hospital, and we could use it to filter out all of that noise. Now we have the ability to build an MRI machine about the size of a boom mic, wheel it from hospital bed to hospital bed, and start taking highly accurate photos for physicians to make better adjustments to get these people life-saving care. Now, it gets even more interesting when you compile AI on top of all the results that you're getting. If you can increase the number of scans that you do and properly label them, what my heart does versus what your heart does is going to look like two very different scans. Not only because our gender, not only because our age, not only because of our like physique, like your body mass versus my body mass, like we will now be able to more granularly segment ourselves into these subcategories so that they can get so physicians or even AI can take a look at okay, if Kat is a woman of this age, this muscle mass, this ethnicity, her heart should be pumping like this.

SPEAKER_03 21:01

Yeah, it'll increase the the quality of the information and data available to make judgments and make decisions. That's I think there are a couple of industries that are are going to be hugely disrupted. And I think we we're not even really seeing the impact of shit. And and medical devices and and medicine in general, I think, will be among the top industries impacted.

SPEAKER_01 21:21

Pharmaceutical too, right? Like um, there's a it's a nine billion dollar industry with a 90% failure rate. When you go and pay for your medication, you're not paying for how much it costs.

SPEAKER_03 21:32

Yeah. That's that that that didn't work, huh? Exactly. All the experimentation, research.

SPEAKER_01 21:36

So I I do think that the creative, the truly meaningful applications of AI will it is not misplaced. It's do are we going to cut 60% of our software development workforce in favor of AI?

SPEAKER_03 21:50

Well, I think Microsoft did just that, didn't they?

SPEAKER_01 21:52

Yeah. And there are some very large global internet platforms that are starting to hire him back.

SPEAKER_03 21:57

Interesting.

SPEAKER_01 21:58

Yeah.

SPEAKER_03 21:58

So I mean the the Shift as we were talking about with uh electricity. Uh the industry will find other ways to absorb uh these folks and their talents. There may be some pivoting required by these folks. Maybe there's an adaptation of their skill that's required.

SPEAKER_01 22:11

Yeah.

SPEAKER_03 22:12

Um, or learning a new skill uh that may be required. But I I I'm in full agreement. I I think AI is a is a tool. I think it's a great tool as a versioning business owner. I can tell you I'm able to do things with AI that previously I would have had to hire a team of people to do. Yeah. Um, which means it's there's a cost-saving value to it that's readily apparent. Yeah, absolutely. We talked about AI. We talked a little bit about robotics. What are you guys doing in the space uh for the current company that you're working on that's uh that's important to you?

SPEAKER_01 22:41

So the w we kind of touched on quantum before. This is the it had its moment when um I would say two years ago and then open AI came on the scene and all of a sudden just redirected everybody's attention to AI. Yeah, we we do have a little bit of the shiny toy syndrome, but quantum is still very much a focus area. I would call AI, if we were going to give it a a you know psychological adjacency, like uh metaphor, I would call AI a very much of a toddler. We're we're we're growing it. It's going to be incredible one day. It's already doing some amazing things, but like trying to manage it and make sure that uh it's learning all the right things that it should learn and it isn't injuring itself and or others. Don't hit your brother with a cat like a like a toy is a full-time job. But then when you have quantum and the ability to just produce things at massive scale and speed, it's like giving this toddler a sharpie pen or one in each hand and telling to just like go nuts. And you're like, oh my gosh. The the amount of the the concerns that I have is every country has amassed a lot of IP or sensitive data off of everybody else for the last 70 years. When we have quantum computing hitting the scene, not only will it be able to help us accelerate AI and what AI does, but it will affect our ability to protect our IP or our sensitive information, our high value assets. I mean, I I do worry from a cyber lens, quantum will change the game yet again. Right. And it will increase the threat landscape yet again. And I'm very worried that we're not ready for it.

SPEAKER_03 24:17

Yeah, I mean, maybe the nature of risk management is such that, you know, uh every three to five years, first of all, you need to be looking at a window of the future, not necessarily protecting against events of the past. Three to five year windows that we have in risk management, sort of planning for the future. Part of risk analysis, I think, is that you know, uh building for future growth and scaling. Yeah. And I think part of the challenge that companies experience is that they're so adamant about addressing the issues and concerns of the day that they're not even really thinking about building for the future. Uh, is there a way to counter that? Are there best practices? Is there a way of thinking about risk that will enable you to plan for the future?

SPEAKER_01 24:55

Sure. So I uh I'm gonna say something unpopular. There's not enough people right now within cybersecurity to address all the problems. I don't even think there's enough tooling um from the the vendor landscape that actually truly addresses some of the simp like the the sources versus the symptoms. So if we're outgunned and out-resourced, outmanned, and our leadership team is worried about speed over security, what do we do? My opinion is in order to uh address the zero-sum game, you need to think about what your existential threat is. Like what will shut your company down? Is it uptime if you're a water processing plant or an energy uh plant that supplies uh critical infrastructure to the city? Is it high-value assets? Is it the data that you you have on your customers? Uh is it um your IP, the AI that you have that you're developing? Figure out what that is and make sure that if you get got, none of the adversaries can either A, take it for ransom or be decrypted. That's what I would do. Like go go straight to the source. Like, what is the adversary after? What do I have a value that somebody else would want? Core business, yeah. Core business. Lock it up really well. And this is part of the reason why I feel like as we think about a post-quantum cryptography, we got to make sure that our data, our crown jewels are protected. So all of these other perimeters are things that you have to deal with on a regular basis. It'll be very difficult for you to find a way to dig yourself out of that. Maybe you can tool it to the point where if you trust the security operations like platform to raise the truly like mission critical things to your attention. So you you denoise um properly, that you may be able to do more forward-thinking things. So it's further safeguard your perimeter. But you can't, you cannot um buy yourself that time unless you know that your crown jewels are secure. That that's what I would do.

SPEAKER_03 26:43

Yeah. I mean, that that dilemma that you just identified, though, is the same dilemma we've been dealing with for the past two decades. And I think organizations oftentimes don't go through the steps to identify what those crown jewels are. In fact, I it it's funny you use that term because I haven't haven't heard anyone refer to the quote unquote crown jewels in a long time. Are they still the center point of enablement for security? Is that what you're there to do? So I especially Is it even definable? I think is probably a better question.

SPEAKER_01 27:12

Oh, I hope so. I mean, that's the ex a core reason why the executive team exists. Like, what are you here fundamentally to to to solve? What is your value proposition to the world? What makes you think that what like that's that's the first question that investor is going to ask you? So I would hope that they can answer that question. But as we look at the what the equivalent of the AI arms race right now, if I'm a another nation and I am limited in my capacity uh for innovation, why would I go invest in my own resources to innovate new things when I could just go steal it from them somebody else? It's a it's an interesting topic, but there are legitimate examples of how this has happened throughout the United States history. Yeah. Right. Think about where Huawei is and how they got there. There's a really great book. I've been talking about it a lot. I need to get some new repertoire. It's uh called uh Battlefield Cyber and it walks through the whole process in which the PRC was able to do a ton of unknown intrusions to a uh a Canadian company called Nortel Networks back in the day. Nortel Network had satellite offices and very large ones in Texas, and there just happened to be a scandal in the financial sector for embezzlement. I think that's what it was. And while the entire world was looking at that particular use case, yeah, they were stealing trade secrets from the side, like under right from underneath them. And then when net Nortel Networkers folded the original like platform for Huawei, what we know as Huawei today, went and bought all of the infrastructure. We're talking the actual buildings, the employees that worked at Nortel Networks and immediately spun up Huawei. So, how do these companies, you know, around the world get the leg up? How are they able to leapfrog? It's because they didn't start from ground zero. So we should absolutely be knowing what our crown jewels are and why it isn't critical that we protect them. And it should not sit squarely on the shoulders of the cyber team that is defending it. It is an existential threat that will affect the entire company and its existence.

SPEAKER_03 29:13

What do you think about talent? As you were talking about that that topic, it um it brings to mind the idea that a lot of great talent just moves from one company to the next in today's uh environment. In fact, there's probably not a week that goes by that you don't hear about some company quote unquote stealing talent from another company, uh especially in the AI wars. Is that the same thing? Or or is it a a different manifestation of the same concept when you bring new competency into the group that maybe you didn't have, but it used to support someone else's efforts, maybe even a competitor?

SPEAKER_01 29:44

Everyone seems to be hot trying to hire for that. And there just isn't enough of that around. I do see it as like a if you can afford them, but it also prices out a lot of these other companies from getting that type of talent. Do you need it? I don't know. But I don't know that you do.

SPEAKER_03 29:59

If you have these super They seem to be convinced that they do because the the compensation packages are are quite unbelievable.

SPEAKER_01 30:06

Yeah, and the expect if they're to be believed. Right. And if the that expectation actually comes to fruition, they're they're worth their weight in gold, literally, then I guess you know that's that's how they they choose to invest. Some of it is optics.

SPEAKER_03 30:21

Right.

unknown 30:22

Yeah.

SPEAKER_01 30:23

Oh, so and so just left blah for this one. And I'm like, oh, okay, cool. Good. Who's this person's name? Like you you treat them like they're some kind of a celebrity. Right. And maybe they are. Yeah. It's been really interesting seeing how AI companies are approaching their own forms of ethical AI development too. So it is much about hiring talent to align with mission principles. And I wonder whether or not, I'm guess we've heard many stories of visionaries who have disagreed with fundamental leadership direction, chose to splinter off and go create their own thing and hold to some um core principles, right? They're they're they're their key values. And uh that is not to be underestimated in the general public.

SPEAKER_03 31:05

You do a lot of speaking on the circuit. I see you on panels and keynotes, and anyone who follows you on LinkedIn knows that um you're a world traveler. What topics are people interested in? What do you get the most feedback on?

SPEAKER_01 31:18

There has been a strong response to operational technology intrusion. Critical infrastructure, we've brought it up a couple of times. I do think it's important because people may not think about the cyber consequences or the risks associated. They immediately know when their power doesn't, their their house don't have power or they can't call their children to go pick them up because telecommunications lines are down. So there's a lot of interest about that. Quantum continues to be a huge topic. And then AI as well. I think a lot of people, the young rising professionals, are trying to understand how they find a place for themselves in the workforce now with AI. We've been, and I don't mean to set an alarm, but sometime between like the 1930s, 1950s, and now, we've lost our ability to play the long game, right? China can have a hundred-year plan, which means that you put the plan in place, you will never see it come to fruition. Your kids may never see it. Only your grandkids will see it. And it is a requirement for you to carry through that vision across three generations in order to hit it. It means you have to put so much forethought into what that's going to mean in a hundred years, knowing how quickly everything changes in order for it to still be relevant and not be thrown out out the window. We do not think that way, at least in what Western culture. So, how does that translate to kids these days? Half of the kids that I see, they're raised on tablets, the the tablet nannies, right? They are having legitimate motor function issues. Their hands hurt after a minute of holding a pen. There's actually no need to learn how to type anymore, MK. Everything that I remember this is that a problem? It is absolutely a problem. And I would say that it there is a tactile, and this is a psychological, like there's tons of studies on this. There is a psychological um and tactile association from doing repetitive motions. Um, you some people memorize better when they have the tactile kind of experience. Some people are auditory learners, some people are visual learners. And the process of I cannot turn right on this street. It's closed down. How do I navigate myself to this end destination without using your GPS and having some sense of like internal navigation? No, those are not things that people use anymore. Now, are they going to be necessary as an arguable thing? But well, I guess one the larger point I'm making is we put students in school and they go through a rigor, rigorous like a set of coursework. They're told what to do their entire lives. And now you've got AI taking over their entry-level jobs and they don't know what to do with like the the skills that they've learned to turn it into the thing that's meaningful of amplifying what AI can already replace jobs to do.

SPEAKER_03 34:01

So you brought this up and opened the door. And I've been thinking about this. Are we even teaching from the elementary through secondary education level? Are we even teaching the right things to prepare folks for what's going to happen in the future? I mean, our our system of education, even today, even if the AI boom was not happening, it's arguable that it's antiquated. It's based on a very, very old sort of structure. Uh, there's a seasonal component to it, at least here in the United States, how kids are taught and when they're taught had to do with agricultural scheduling and all that kind of stuff back from the 1800s, which like doesn't make sense for today. But we can't seem to break the cycle. And we don't, I we either don't want to adapt or don't feel the need to adapt. What it is that we're teaching our kids when we're teaching them. As a parent, personally, I would uh love if my kids were in school year round. Um, but I I'm not sure that's shared by uh by every parent. Any thoughts about are we teaching are we even teaching the right things?

SPEAKER_01 34:56

Um it's funny. I was it was recently lunar new year. So we went to a party and I had all these little kids and I had like 15 red envelopes where it's customary to give cash to little kids. It's I think it's if you are don't have a job, you get red envelopes. So every single one, they're all lined up. They're anywhere from one all the way to 10. And there's like 15 of them. I'm like, happy lunar new year, learn AI. Happy Lunar New Year, learn AI, happy lunar near year. Do you know what Andy's gonna say? Learn AI? Yes. Good girl, go ahead. Are we teaching it? Uh, I'm not a child psychologist, but I will say this. I think it's actually more important to teach media literacy between the ages of like, I don't know, three, however, as soon as they're exposed to a device to 12.

SPEAKER_03 35:37

Yeah, definitely through the teen years. That's when it's got the substantive impact.

SPEAKER_01 35:41

Yes, sir. Media literacy. Just focus on the basics for your education, learn how to hold a pen, all this. If you need to learn how to type to draft your report, awesome, but type it. Do not talk to type. Yeah. Do not use ChatGPT, don't use any crutches. Like learn the fundamental basics of communication. Learn how to work in groups and in pairs. Uh, learn how to have shared responsibility. Go outside and don't give yourself macular degeneration because you don't have enough exposure to vitamin D. Like get the basics from zero to 12. And the only thing that we, I would say I would teach children is media literacy because that is extremely important. Now, from 12 onwards, like take a look at some big problems. Like we're talking global issues, and start thinking about how AI can make that better. It doesn't have to fully solve the problem, right? Make it better. And if we think about applying AI to something that's actually meaningful, we get ourselves out of this, like, uh, I can what can I use? AI, I can use it to s to to ingest all of the potential summer camp options for my kid and then stack rank them in order of, you know, timing based off of my schedule. Very helpful, but maybe not something that they can make a career out of.

SPEAKER_03 36:50

I'm oftentimes influenced by things I read, songs I hear. There's been a rare occasion there's a piece of artwork that I see that might inspire me. What are you reading? What's um what's inspiring to you today?

SPEAKER_01 37:02

You're reminding me that I need more sources of inspiration. I try to learn cross-disciplinary things. It takes me out of my world and gives me perspective on why I do what I do. Yeah. Like fitness culture has been a really big part of how I psychologically condition myself for discipline. So where I can, I try to not choose the donut. Or I learn about neurodegeneration. Yeah. Right. And so I find all of those things very inspiring. And if you can, you you realize after you pursue knowledge and self-fulfillment and improvement in all these other areas, every single one of them is impacted by cyber. Every single one of them can be impacted by AI. And when I go down these paths, I give myself again purpose for why securing that layer is going to be so important and then why the proper usage of all of these technologies really will accelerate and make our lives better. So um, that gives me inspiration. Otherwise, the grind is rough.

SPEAKER_03 38:06

Well, we're wishing you luck on the continued grind. I really appreciate you coming into the studio for the risk apogee. This episode, I think, is going to be uh helpful to folks who who key in on it. And thanks for your time. Where can folks where can folks connect with you? Where can they find you?

SPEAKER_01 38:19

I'm on LinkedIn a lot. Um, and uh I'm speaking at conferences quite frequently. I'll be at RSA, I'll be black hat, and um I'm I'm very optimistic for this space. So for anybody who's interested, just try to remember two things. Know what your data is worth because you now have a digital identity. And whether you like it or not, everything you put out there, if it's it's it's on the internet, it stays on the internet, you know? And and try to think about how these technologies can change the world as opposed to just very reactional applications and uses.

SPEAKER_03 38:51

Catherine Wang, thank you. Thank you.

SPEAKER_00 38:53

All right. Thanks for being here on the Risk Apogee. Every episode, we dig into what it actually takes to lead through risk. And that's the same work we do every day at Apogee Global RMS. Cybersecurity, physical security, organizational resilience, talent strategy, one integrated approach built around your people, not just your platforms. Are you ready to move from reactive to resilient? Visit apogeeglobalrms.io and sign up for a risk free consultation with our team of advisors.