Welcome to Future of Data Security, the podcast where industry leaders come together to share their insights, lessons, and strategies on the forefront of data security. Each episode features in-depth interviews with top CISOs and security experts who discuss real-world solutions, innovations, and the latest technologies that are shaping the future of cybersecurity across various industries. Join us to gain actionable advice and stay ahead in the ever-evolving world of data security.
EP 31 — Arbor Memorial's Teij Janki on why adding AI before fixing process amplifies weaknesses
Teij Janki (https://www.linkedin.com/in/tjanki/), CISO & Director of IT Governance Risk & Compliance at Arbor Memorial (https://www.arbormemorial.ca/en.html?utm_source=LinkedIn&utm_medium=SocialMedia&utm_campaign=LinkedIn), has spent 30 years moving through the full stack of security, and his view is that the sequencing most teams follow is backwards. His principle is that technology does not solve processes, it amplifies them. That means deploying a tool before fixing the underlying process weakness just scales the problem. The implication for AI adoption is direct and worth hearing spelled out.
On the budget side, Teij makes a case that privacy legislation is a more reliable governance lever than cybersecurity risk alone because privacy laws carry consequences that executive teams will actually act on. He also walks through the gating sequence his team built for AI tool adoption wherein sensitive data gets slowed down and scrutinized, lower-sensitivity use cases move through faster, and staff have a service catalog to work from rather than a blanket ban.
Topics discussed:
Applying a people-process-technology sequence to security programs before introducing AI or automation tooling
Using privacy legislation as an executive governance lever when cybersecurity risk alone fails to drive budget decisions
Building a gating sequence for AI tool adoption that separates sensitive from low-sensitivity data use cases
Replacing blanket AI bans with a structured service catalog that lets staff self-select and move tools through approval
Identifying process weaknesses before deploying technology to avoid amplifying existing security vulnerabilities at scale
Progressing security from a technical cost center to a strategic business enabler using the CMMI maturity model
Applying martial arts principles of discipline, clear expectations, and target-setting to cybersecurity team leadership
Evaluating where generative AI delivers in security operations versus where magical thinking still outpaces real-world performance
24 Feb 2026
EP 30 — Postman's Sam Chehab on Three Unteachable Traits He Hires For
At Postman (https://www.postman.com/)'s scale of 40 million developers generating billions of API requests, Sam Chehab (https://www.linkedin.com/in/schehab/), Head of Security & IT, centers on three enforcement domains: authenticated and encrypted data paths, zero-trust inter-service communication, and runtime instrumentation. His vendor evaluation is just as precise, cutting past feature lists to one demand: show me the architecture diagram and walk through exactly how your solution addresses my threat models.
Sam identifies why generative AI creates fundamentally new risk: the combination of private data access, untrusted content processing, and external communication capability. This trifecta explains why browser-based AI is nearly impossible to contain; it touches local machines, queries the open web, and executes actions on your behalf. Sam also covers how he screens for three traits he can't train: initiative to self-direct research, attitude to absorb constant setbacks, and aptitude to process how rapidly this field moves.
Topics discussed:
Implementing data path integrity, zero-trust inter-service authentication, and runtime instrumentation with immutable logs
Evaluating cybersecurity vendors by demanding architecture diagrams and specific threat model solutions rather than feature lists
Managing freemium platform security with anomaly detection, rate limiting, and abuse prevention across 40 million developers
Identifying AI security's dangerous trifecta: private data access, untrusted content processing, and external communication capabilities
Building MCP generators that enable least-privilege API servers by allowing developers to select only required methods before deployment
Using AI agents to generate security tests during development, shifting validation from security teams to automated testing
Applying security hygiene fundamentals before adopting specialized vendor solutions
Hiring security teams based on three unteachable traits: initiative, attitude, and aptitude
10 Feb 2026
EP 29 — Age of Learning's Carl Stern on Why Certifications Are Side Effects, Not Final Goals
Carl Stern (https://www.linkedin.com/in/carlstern/), VP of Information Security at Age of Learning (https://www.ageoflearning.com/), explains why forcing controls into place without executive alignment guarantees you'll fight uphill battles every single day, as people begin to see security as a blocker rather than a business enabler. Instead, he starts with identifying crown jewels and acceptable risk levels before selecting any frameworks or tools, ensuring the program fits company culture instead of working against it.
He also asserts that certifications like HITRUST and SOC 2 validate you're already operating securely; the real program is the daily processes people follow because they understand why, not compliance theatre. Carl also argues the cybersecurity industry exists at its current scale because of a systemic failure: companies ship insecure software without liability, pushing security costs downstream. Most breaches exploit preventable defects that should never reach production, not sophisticated zero-days.
Topics discussed:
Building security programs from scratch versus inheriting existing programs and why executive alignment prevents daily uphill battles
Treating certifications as validation of operational security rather than the primary program goal
Pairing administrative controls with technical monitoring to establish baselines before enforcement for unstructured data security policies
Applying three-part investment calculus for lean teams: measurable risk reduction, manual work automation, and crown jewel protection
Calculating true cost of 24/7 internal SOC coverage including shift staffing, turnover, training, and tooling versus managed services
Why attack patterns remain consistent across healthcare, education, gaming, and retail despite different compliance requirements
Explaining how AI lowers the barrier for exploit development and expands zero-day risk beyond traditional high-value enterprise targets
Arguing that the cybersecurity industry exists at current scale because companies ship insecure software without liability, pushing costs downstream
Who has been a guest on Future of Data Security
Names identified in recent episode analyses. Showing up to five guests.
Robert Kang
Michael Hensley
Chris Pahl
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
YouTube views
113,700
Score snapshot 15 Sept 2025
Apple Podcasts (US)
5.0 / 5
1 ratings
Spotify
5.0 / 5
2 ratings
Podcast Authority Score: 36 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
27
Social presence
0
YouTube
82
Engagement
32
Contact Future of Data Security
Guest appearances
Does not typically book guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Future of Data Security?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
