Latest / Full Tech Ahead / Own Your AI Risk!

Transcript

Own Your AI Risk! · Full Tech Ahead

• 0:29
  SPEAKER_01: Hello and welcome to Full Tech ahead.
• 0:32
  SPEAKER_01: I am back with another great interview here at Qualas America's Welcome in 2026.
• 0:38
  SPEAKER_01: And I have Ivan Milinkovic with me.
• 0:41
  SPEAKER_01: He is the VP of Cyber Risk Technology at Qualis.
• 0:46
  SPEAKER_01: How are you doing today?
• 0:47
  SPEAKER_00: Fantastic.
• 0:48
  SPEAKER_00: Thank you very much for having me.
• 0:50
  SPEAKER_01: Happy to have you on the show.
• 0:51
  SPEAKER_01: Can you first share a little bit about Qualis and what you do for the company?
• 0:57
  SPEAKER_00: Indeed.
• 0:58
  SPEAKER_00: So in terms of Qualis, I guess, we try to help companies de-risk their businesses.
• 1:05
  SPEAKER_00: Qualis obviously started many years ago, 26, if I'm not mistaken, as a vulnerability management company.
• 1:10
  SPEAKER_00: We reinvented ourselves and now we're definitely a risk management company.
• 1:15
  SPEAKER_00: And we're trying to find ways of actually helping people do that in a cost-optimal way.
• 1:23
  SPEAKER_00: I joined Qualis two years ago.
• 1:26
  SPEAKER_00: It's amazing.
• 1:26
  SPEAKER_00: I still don't know where those two years went.
• 1:29
  SPEAKER_00: Before that, I was a group CSO, a very large company, and uh I was lucky and privileged to uh sit one evening next to uh our CEO.
• 1:38
  SPEAKER_00: I don't have a clue who he was, and he managed to convince me during a dinner that it would be the right thing for me to join Qualis.
• 1:45
  SPEAKER_00: And here we are, two years after that.
• 1:48
  SPEAKER_01: Wonderful.
• 1:49
  SPEAKER_01: Well, you're you had a session earlier today.
• 1:51
  SPEAKER_01: It was about who owns the AI cyber risk.
• 1:55
  SPEAKER_00: Indeed.
• 1:56
  SPEAKER_01: So there's a lot to unpack there, but can you basically answer that question for our audience today?
• 2:01
  SPEAKER_00: Indeed, it was a tough one.
• 2:03
  SPEAKER_00: I think because of the fact that AI is still to a large extent something new to people, there are still some, I guess, unknowns, there are still some doubts.
• 2:14
  SPEAKER_00: My take on the whole thing is that it shouldn't be like that.
• 2:18
  SPEAKER_00: I don't see new great risks.
• 2:21
  SPEAKER_00: It's all the stuff that in some shape or form we already know, have experienced, and in theory, should have names behind those roles.
• 2:30
  SPEAKER_00: But yes, there was a bit of um how to put it, I used the word um during the panel session, sloppy shoulders, when I was trying to put people on a spot and effectively ask them, you know, a simple question, are you the one owning that risk?
• 2:46
  SPEAKER_00: And for your audience, it was quite interesting because we had a CEO, a board member, a CFO, and a CIO, sorry, and a CISO in the room.
• 2:55
  SPEAKER_00: So again, between all those C-level executives, the questions are still there.
• 3:01
  SPEAKER_00: I understand if in many cases people can't precisely answer that one.
• 3:08
  SPEAKER_00: However, we can try.
• 3:09
  SPEAKER_00: And my take on that is you have to try, you have to start somewhere.
• 3:14
  SPEAKER_00: Don't strive for perfection.
• 3:16
  SPEAKER_00: Perfection is the biggest enemy of good.
• 3:18
  SPEAKER_01: Why is it such a problem?
• 3:21
  SPEAKER_01: And how can leaders get better at this?
• 3:24
  SPEAKER_00: Sure.
• 3:24
  SPEAKER_00: I guess it's novelty.
• 3:26
  SPEAKER_00: I guess it's the fact that things are changing almost overnight.
• 3:30
  SPEAKER_00: The last six months have fundamentally changed everything around us.
• 3:35
  SPEAKER_00: And even before that, obviously, AI is not something new.
• 3:38
  SPEAKER_00: But we need to start thinking what's behind the scenes.
• 3:42
  SPEAKER_00: We need to start thinking about those things that were there, you know, always, like your data, your users, who's doing what, how, and why.
• 3:51
  SPEAKER_00: Those are some fundamental questions that we still need to answer.
• 3:56
  SPEAKER_00: Those are fundamental questions that were there 10 years ago, 15 years ago, 20 years ago.
• 4:02
  SPEAKER_00: Our biggest challenge is, I guess, that we are still trying to find the next big enemy, something that's, you know, um, well, not very tangible to put it like that.
• 4:15
  SPEAKER_00: And sometimes I think we're trying to hide behind that rather than answer the simple things that are in front of our noses.
• 4:23
  SPEAKER_01: But AI definitely has changed the territory quite a bit.
• 4:27
  SPEAKER_01: I mean, and it's rapidly evolving so quickly.
• 4:31
  SPEAKER_01: So, how can business leaders stay on top of the increase, rapidly increasing risks from AI?
• 4:41
  SPEAKER_00: Another fantastic question.
• 4:43
  SPEAKER_00: Look, uh, the challenge there is that first and foremost, the speed of everything has changed so greatly.
• 4:49
  SPEAKER_00: In the past, I think we were able to hide behind the fact that it was relatively expensive to find new exploits and whatnot.
• 4:57
  SPEAKER_00: Unfortunately, we lost that control.
• 4:59
  SPEAKER_00: Also, uh, we have something new that's happening that is genuinely one of those rare new new things, I would say.
• 5:07
  SPEAKER_00: And that is on the back of a couple of incidents, we we recently saw.
• 5:11
  SPEAKER_00: You know, it's very interesting when you can say there was no human attacker, there was no human intention, there was no one waking up in the morning saying, you know what, I'm gonna go after that company and I'm gonna hack them.
• 5:24
  SPEAKER_00: We saw cases where AI sort of made that decision on its own.
• 5:29
  SPEAKER_00: That is definitely something different.
• 5:32
  SPEAKER_00: Um, however, at the end of the day, when we think about how those things happen, when we think about why those things happen, the fundamentals, the the base for everything is still the same.
• 5:44
  SPEAKER_00: We have problems we haven't fixed for a very long time.
• 5:47
  SPEAKER_00: We have maybe a huge amount of technical debt, we have some legacy problems, and in many cases, we are still trying to combat all of this using legacy processes that are unfortunately not fit for purpose anymore.
• 6:01
  SPEAKER_00: So the biggest change, what people should do like tomorrow, is to start figuring out how to get rid of all those legacy processes.
• 6:11
  SPEAKER_00: That's where the bottleneck is.
• 6:13
  SPEAKER_01: Yes, absolutely.
• 6:14
  SPEAKER_01: I want to go back to so when AI makes all these decisions by itself, but really that's from the input of everyone else and how it's been trained.
• 6:23
  SPEAKER_01: So I think how can business leaders address their use with AI so this doesn't happen.
• 6:30
  SPEAKER_00: Indeed, look, I guess the simple answer to that one is when it happened the first time.
• 6:36
  SPEAKER_00: I looked at it and I was almost happy.
• 6:40
  SPEAKER_00: I know that's wrong to put it like that, but let me explain myself.
• 6:44
  SPEAKER_00: When you deal with junior cyber stuff, one of the first things we tell them, one of the first things we want to teach them is to think outside the box.
• 6:55
  SPEAKER_00: That's exactly what happened.
• 6:58
  SPEAKER_00: It started doing something well outside the box.
• 7:01
  SPEAKER_00: But again, going back to basics, even in that case, yes, it depends whether you are talking about something that's happened within your environment, so what we like to refer to as a rogue agent, or something that's external to you.
• 7:16
  SPEAKER_00: If it's external, again, it cannot do something new, it cannot do something that you're protected from.
• 7:23
  SPEAKER_00: Therefore, again, it's back to basics.
• 7:26
  SPEAKER_00: Sort out the problems you already have, change your processes, make sure that you don't suffer because you're too slow to respond to certain things, and because effectively you have things unresolved in your environment that are maybe years old.
• 7:43
  SPEAKER_00: If that's the case, the probably somewhere else.
• 7:45
  SPEAKER_00: If that's the case, you know what any threat actor can and will exploit that.
• 7:51
  SPEAKER_00: I like to say that bad guys are running businesses, they really take care of ROI.
• 7:56
  SPEAKER_00: If they can open a bottom drawer and reach for something that's been there, I don't know, the last 10 years and you still haven't fixed it.
• 8:04
  SPEAKER_00: That's what they're gonna go for.
• 8:06
  SPEAKER_00: They're not going to throw money at a problem they don't have to.
• 8:09
  SPEAKER_00: Again, if it's something that's inside, it's gen, you know, if it is genuinely AI as a problem.
• 8:16
  SPEAKER_00: What I say uh advise people to do is look at what you've got, make sure that all the agents that are running across your environment obey the same rules that your users have to obey.
• 8:29
  SPEAKER_00: Make sure that the identities behind those agents are controlled, make sure that you expire them and rotate them, make sure that you understand what is a good behavior.
• 8:40
  SPEAKER_00: So, effectively, what I'm saying here is baseline the good stuff.
• 8:46
  SPEAKER_00: There's probably still more time now to do that.
• 8:49
  SPEAKER_00: Make sure that before things really get out of control, you understand what's going on, and you have the, I guess, as a benchmark, as a gauge.
• 8:59
  SPEAKER_00: Because once you achieve that, you will then, I guess, easily spot what's extraordinary and you can go after it.
• 9:07
  SPEAKER_01: Fantastic.
• 9:08
  SPEAKER_01: Well, tomorrow you have another session, and it's called wrist yoga.
• 9:13
  SPEAKER_00: Indeed.
• 9:14
  SPEAKER_01: So share a little bit about that concept.
• 9:17
  SPEAKER_00: Sure, a mind that is not throne.
• 9:19
  SPEAKER_00: Uh, it's a fantastic concept we get from yoga.
• 9:23
  SPEAKER_00: Uh, it's one of those things that when people think about yoga, you know, most of people think about postures and they think about it as an exercise.
• 9:31
  SPEAKER_00: But the way to think about it is it's a system, it's a system that has to be practiced, and every element of that practice is important.
• 9:39
  SPEAKER_00: And ultimately, where that leads you to, when we're talking about the eight limbs of yoga, effectively it calms the mind, it prepares you for what comes next.
• 9:50
  SPEAKER_00: You don't get easily overexcited with good news, you don't effectively get into some state of despair with bad news.
• 9:59
  SPEAKER_00: You're able to handle those things whatever they are.
• 10:02
  SPEAKER_00: And that's exactly what this session is all about.
• 10:05
  SPEAKER_00: It is effectively advocating for good risk management practices, it is advocating for if you prepare for all those things, if you practice the whole range of things that you should use, will not put you in a funny shape.
• 10:22
  SPEAKER_00: Good news, well, paint them as a win and look towards the next thing.
• 10:26
  SPEAKER_01: So thinking proactively and then being readily adaptable.
• 10:30
  SPEAKER_00: Absolutely, and making sure that you think in advance about all of those scenarios, making sure that at the end of the day, what we advocate for in Qualis, which is risk operation center, you apply those principles so that you understand where the dangers might come from, and you actually put the right controls in place to be able to control as much of it in a risk, sorry, in a money-optimal way.
• 10:59
  SPEAKER_01: Do you think in studying where the risk may come from, and this might be far out in the future, but we're hearing now more about quantum as well.
• 11:07
  SPEAKER_01: Indeed.
• 11:08
  SPEAKER_01: Does that add anything into the fold?
• 11:10
  SPEAKER_00: It absolutely does.
• 11:12
  SPEAKER_00: Um, when I talk about those things, I like to mention tree lenses.
• 11:17
  SPEAKER_00: If you think about it, um, you know, we need to sort of have a view on what's really beyond the horizon.
• 11:24
  SPEAKER_00: So maybe you need a telescope for that one.
• 11:27
  SPEAKER_00: What's just around the corner, you need a periscope.
• 11:30
  SPEAKER_00: What's in front of your nose?
• 11:32
  SPEAKER_00: Well, you might need glasses or a magnifying glass, depending on how bad or good things are.
• 11:37
  SPEAKER_00: That's exactly how you need to think about some of those things.
• 11:41
  SPEAKER_00: And definitely quantum is one of those that at the moment it's somewhere far on the horizon, but it will be with us well, pretty much tomorrow.
• 11:51
  SPEAKER_00: Uh, I guess the bad news is that we don't have the exact date.
• 11:54
  SPEAKER_00: There are some dates when it comes to legislation, when it comes to the expiry date for certain protocols and algorithms and whatnot.
• 12:04
  SPEAKER_00: But the bad news is really nobody knows exactly when the world's going to reach that stage where effectively everything that we know about simply becomes non-valid.
• 12:17
  SPEAKER_00: Therefore, the biggest thing people can do now is understand what they have out there.
• 12:23
  SPEAKER_00: Again, that's nothing new.
• 12:24
  SPEAKER_00: Understand where those potential problems are, understand and put plans in place with some firm dates and names against them.
• 12:33
  SPEAKER_00: Say, you know, this has to go by then, whatever.
• 12:37
  SPEAKER_00: Understand where your data is, understand what you're using.
• 12:40
  SPEAKER_00: This is just good old cyber hygiene, nothing new about that.
• 12:45
  SPEAKER_00: But again, that is the very first step towards us preparing for the quantum event, if you want.
• 12:53
  SPEAKER_00: And again, uh in COLIS, we do have something exciting coming when it comes to um the whole thing.
• 13:01
  SPEAKER_00: And we will be helping our clients to understand again all of those things that I mentioned, make sure that you know they have a good visibility of what's out there, make sure that they understand why some of those things won't work anymore when that happens, and ultimately hopefully help them structure the whole programs around it so that they don't suffer tomorrow.
• 13:23
  SPEAKER_01: Yeah, and one of the things seems to be a common thread that it's not just all on Qualest, that partnerships are important.
• 13:31
  SPEAKER_01: Um, and can you share why it's so important to collaborate and partner with these other companies?
• 13:35
  SPEAKER_00: Oh, absolutely.
• 13:36
  SPEAKER_00: Look, we don't claim that we cover absolutely the entire cyber ecosystem.
• 13:42
  SPEAKER_00: I don't think there's a single company out there that does.
• 13:46
  SPEAKER_00: What is important, and it's also important from a perspective that client environments normally very complex environments.
• 13:54
  SPEAKER_00: Uh, you have a variety of vendors, variety of products.
• 13:58
  SPEAKER_00: Um, therefore, as I say, it's very important somehow to bring all of this stuff together.
• 14:04
  SPEAKER_00: And as the industry, we need to become better at helping our clients achieve that.
• 14:10
  SPEAKER_00: If all vendors worked in complete isolation, that would be at the end of the day a nightmare for our clients.
• 14:16
  SPEAKER_00: That could be a nightmare for the entire industry, that would be a nightmare for everybody involved.
• 14:23
  SPEAKER_00: Honestly, not good.
• 14:24
  SPEAKER_00: Whereas if we again work together within the industry and if we provide some uh ready solutions to our clients, and if they have that additional level of confidence by knowing that our products integrate well, that our products work together to protect them, I guess that's a win-win.
• 14:47
  SPEAKER_01: Absolutely.
• 14:48
  SPEAKER_01: Well, if there was one key takeaway you could leave our audience today with, what would that mean?
• 14:55
  SPEAKER_00: I guess this is the toughest question of them all.
• 14:57
  SPEAKER_00: Trying to choose just one single nugget, I guess.
• 15:02
  SPEAKER_00: Look, um, I'm gonna try to put it like this try and figure out what you have out there, try and figure out who's responsible for it, try to understand what's there around the corner.
• 15:15
  SPEAKER_00: Yes, those are three things, but nonetheless, I think they are very important.
• 15:20
  SPEAKER_00: Uh, if you want to succeed, if you want to stay afloat, if you want to be a successful business, I definitely try to uh think about all three.
• 15:30
  SPEAKER_01: All right.
• 15:31
  SPEAKER_01: Thank you so much for sticking with me today.
• 15:34
  SPEAKER_00: Thank you.
• 15:35
  SPEAKER_01: And thank you to our audience.
• 15:36
  SPEAKER_01: If you have any questions or comments, leave them below, and I will try to respond back as soon as possible.
• 15:40
  SPEAKER_01: Have a great