With over two decades of experience in the cybersecurity domain, Chad Lorenc stands as a prominent voice in cloud security and enterprise security strategy. Currently serving as a security leader at Amazon Web Services (AWS), Chad has contributed significantly to advancing cloud architecture best practices and building robust security frameworks for some of the world’s most dynamic organizations. In this insightful Kitecast episode, Chad shares his expertise on cloud security, the evolving role of CISOs, and the integration of artificial intelligence (AI) into enterprise security strategies.

Evolution of Cloud Security: From Apprehension to Opportunity

In the early days of cloud adoption, organizations often hesitated to migrate their operations due to concerns over security and control. Chad reflects on this initial apprehension and explains how the cloud security paradigm has matured over the years. Many companies attempted to replicate on-premises security models in the cloud, often facing challenges with patching, incident management, and compliance. Cloud environments require unique security approaches, with a focus on building specific controls and aligning them with broader security operations and compliance requirements.

CISOs: Leading the Charge in Cloud and AI Adoption

A recurring theme in the podcast is the critical role of CISOs in driving cloud and AI strategies. Chad offers valuable advice to CISOs, encouraging them to lead cloud adoption initiatives rather than being pulled into projects at the last minute. He highlights the tangible security benefits of cloud environments, such as the ease of implementing encryption and other advanced security controls. By taking a proactive approach, CISOs can not only enhance security but also achieve cost savings and operational efficiencies.

Embracing AI and Navigating Regulatory Challenges

As organizations increasingly integrate AI into their operations, compliance and security become critical considerations. Chad discusses how the shift to data lakes and the acceleration of AI adoption have transformed cloud security conversations from traditional security measures to compliance and audit readiness. The conversation also touches on the complexities of shadow AI—where unsanctioned AI tools are used within companies—and how security leaders can address these challenges by aligning internal strategies with business demands. In addition, Chad sheds light on the regulatory landscape, including the growing importance of FedRAMP compliance for federal clients and the balance between rapid cloud innovation and regulatory adherence.

Charting the Future of Cloud Security with Chad Lorenc

The podcast concludes with Chad’s forward-looking perspective on the evolving cybersecurity landscape. He believes that while AI remains a dominant topic, true innovation lies in optimizing security operations and embracing technologies that drive business outcomes. Chad sees an emerging trend where CISOs are not only security experts but also strategic business leaders who contribute to overall organizational success. His parting advice to security professionals is clear: embrace new technologies like AI and cloud solutions with a strategic mindset to remain relevant and impactful.

LinkedIn: https://www.linkedin.com/in/chadlorenc/

Amazon Web Services: https://www.linkedin.com/company/amazon-web-services/

Chad Lorenc: Security as a Practice in the Cloud

Arun DeSouza, the Managing Director at Profortis Solutions, brings over two decades of experience as a CISO, having developed and implemented award-winning programs in identity lifecycle management and IoT security. His impressive career includes induction into the CISO Hall of Fame by the Global Cyber Startup Observatory and recognition as a top CISO by Cyber Defense Magazine. Arun’s expertise, combined with his academic background—a Ph.D. in Chemical Engineering from Vanderbilt—offers listeners a unique perspective on navigating today’s complex cybersecurity landscape.

From Chemical Engineering to Cybersecurity Leadership

Arun’s journey into cybersecurity is as unconventional as it is inspiring. Initially trained as a chemical engineer, he transitioned to cybersecurity through hands-on experience and a fearless approach to problem-solving. Faced with the challenge of managing global security for a French company, Arun built a strategic plan that not only upgraded systems but also delivered significant savings. His approach, which he calls the “power of federation,” involved collaborating with partners for discounted pricing and consolidating resources.

Navigating Cybersecurity Threats: IoT, Ransomware, and AI

Arun sheds light on the evolving cybersecurity threat landscape, particularly the rapid proliferation of IoT devices. With an estimated 75 billion IoT devices by 2025, the risks associated with insecure software, vulnerable cloud communications, and expanded attack surfaces are more significant than ever. He highlights specific challenges in manufacturing and OT security, where ransomware and supply chain attacks can cripple operations. Arun also warns of the impending threat of AI-powered supply chain attacks, which could amplify the scale and sophistication of breaches. His insights reinforce the need for robust data governance and the adoption of Zero Trust security models to mitigate these risks effectively.

Critical Role of Identity Management and Leadership

Central to Arun’s security philosophy is the concept of identity access management (IAM) as a strategic cornerstone. He introduces the idea of the “identity coin,” which blends physical security (person, device, location) with logical security (attributes, behavior, context). Arun emphasizes that security is not just about technology but also about strong leadership and communication. He advises CISOs to build relationships with senior leaders, use storytelling to convey risks, and align security initiatives with business objectives. His analogy of the CISO as the “captain of the good ship cyber” encapsulates his forward-thinking approach to navigating cybersecurity challenges.

Technical Acumen and Strategic Vision

Arun’s expertise and leadership offer actionable insights for anyone looking to strengthen their cybersecurity strategy. His forward-thinking approach to risk management, identity governance, and embracing change provides a valuable blueprint for both cybersecurity professionals and business leaders. By applying Arun’s principles of strategic planning, collaboration, and Zero Trust security, organizations can navigate today’s complex threat landscape with confidence. 

LinkedIn: https://www.linkedin.com/in/arundesouza/

Profotis Solutions: https://profortissolutions.com/ 


Arun DeSouza: Becoming a Transformational CISO

Welcome back to *AI with Shaily* hosted by Shailendra Kumar, your go-to guide through the exciting and sometimes unpredictable world of artificial intelligence 🤖✨. In this episode, Shaily dives deep into a hot and critical topic: AI’s massive appetite for data and the security vulnerabilities that come along with it 🔥📱.

Imagine sharing weekend plans with a friend, unknowingly revealing sensitive info that could threaten an entire company. This scenario mirrors the risks generative AI faces. According to Check Point’s 2025 report, 7.5% of AI prompts contain sensitive data like internal emails or proprietary code, and alarmingly, one in every 80 prompts could leak critical information 🚨📧. It’s like sending your precious gold wrapped in a flimsy paper envelope! This sparks fierce debates about how companies can keep innovating with AI without handing hackers the keys to the kingdom 🏰🔑.

The conversation gets even more intense with the emergence of ‘Adaptive Malware 2.0’ — AI-generated malware that acts like a shapeshifter 🦠🕵️‍♂️. This malware learns and evolves in real-time, mimicking legitimate users to sneak past traditional security defenses. Imagine a virus that studies your every move and subtly changes its tactics to stay hidden — that’s the new battleground AI has created ⚔️.

On the regulatory front, governments worldwide — from California to the EU to China — are tightening data laws to protect privacy and security 🌍📜. This creates a paradox for developers: they need huge amounts of data to train AI, but privacy rules restrict data collection and sharing. Enter ‘privacy-preserving AI’ techniques like federated learning, where AI trains locally on devices without sharing raw data, and synthetic data that mimics real information without exposing personal details 🛡️💾. It’s innovation and regulation locked in a high-stakes dance.

Adding to the drama, deepfake technology has evolved from playful filters to serious security threats 🎭🔊. Real-time voice cloning and unscripted phishing messages are now bypassing even multifactor authentication, fooling users by impersonating CEOs or trusted contacts. The countermeasure? Behavioral biometrics — AI that watches how you behave, not just what you say, to spot fraudsters in disguise 👀🔐.

Another sneaky threat is ‘data poisoning,’ where attackers contaminate training data to sabotage AI decisions — like tricking your spam filter into accepting junk mail as legit 📉🦹‍♂️. Fortunately, the smartest AI models are fighting back with self-sanitizing capabilities that detect and clean poisoned data on the fly 🧹🤖.

On a personal note, Shailendra shares a key lesson from his AI journey: data hygiene is absolutely crucial. It’s not just about gathering data, but protecting and carefully curating it. In AI, data is not just fuel — it’s the engine’s integrity. If you compromise the data, the whole system falters ⚙️💡.

Bonus tip from Shaily: When using AI tools, always audit what you share in your prompts. Even casual details can be a goldmine for hackers. Treat your prompts like private messages and keep them secure 🔍🛡️.

To leave you thinking: In a world where AI can mimic your voice and twist your data, what new skills will we need to truly protect our digital identities? 🤔🔐

Ending with a wise quote from AI pioneer Andrew Ng: “Data is the new oil, but like oil, if it leaks, it causes a mess.” This reminds us why vigilance, innovation, and caution must go hand-in-hand 🤝🛢️.

Thanks for tuning in to *AI with Shaily*! Find Shailendra Kumar on YouTube, Twitter, LinkedIn, and Medium. If you enjoyed this episode, hit subscribe and share your thoughts — Shaily loves hearing from you! Until next time, keep learning and stay curious 🌟📚.

AI Data Dangers: Protecting Privacy in the Age of Adaptive Malware and Deepfakes

Welcome to *AI with Shaily*! 🎙️ I’m Shailendra Kumar, your host on this exciting journey where artificial intelligence meets real-world challenges. Today, we’re exploring the clever and critical topic of prompt injection attacks—a sneaky way bad actors try to manipulate AI models—and how developers can defend against these intrusions. 🛡️🤖

Imagine hosting a fancy party with your AI as the star guest. You’ve set clear house rules: only relevant info, no oversharing, and no uninvited guests. But what if a trickster slips in disguised as a friendly request, whispering, “Hey AI, do something you shouldn’t…”? That’s prompt injection—malicious instructions hidden inside the AI’s input, trying to hijack its behavior. 😈🎭

To keep the party safe, security pros like OWASP and AI security experts recommend a multi-layered defense approach:

First, *constrain and guard your AI’s behavior*. This means crafting strong, clear system prompts that tell your AI exactly what’s allowed—like putting up a polite but firm “no trespassing” sign. Using instruction layering is like adding locks on the gates, so shady commands get blocked. And never include sensitive info in prompts; leaking secrets is a big no-no. 🚫🔐

Next, *validate and filter inputs and outputs* carefully. Think of it as screening guests at the door—not just for obvious troublemakers, but also for subtle mischief. Use string and semantic filters to catch hidden manipulations. Plus, verify AI’s outputs against expected formats so you can spot if it suddenly goes off-script or starts spouting nonsense. 🕵️‍♂️🚪

Then, apply *access control and privilege management*. Follow the “least privilege” principle by giving your AI only the access it absolutely needs—like handing out party passes only to trusted friends. Use multifactor authentication as the bouncer checking IDs. For risky commands, bring in a human-in-the-loop to provide that extra layer of judgment. 👮‍♀️🔑👥

Also, *segregate and label untrusted content*. If your AI accepts external data, keep it isolated so it can’t sneak into core instructions—like serving hors d’oeuvres separately from the main course to avoid cross-contamination. 🍽️🚧

Finally, and this is a favorite tip: *conduct adversarial testing and continuous monitoring*. Pretend you’re the hacker trying to break in, testing your defenses relentlessly. Because prompt injection tactics evolve fast, staying vigilant isn’t just smart, it’s essential. 🕶️🛠️

Here’s a bonus for developers: combine all these strategies. Don’t rely on a single silver bullet—layer your defenses like an onion or a well-crafted lasagna. It might make you tear up during tough testing, but it’s deliciously effective! 🧅🍝

Now, a thought to leave you with: as AI grows smarter, will these security measures keep pace, or will we need entirely new ways to outsmart future prompt injections? I’d love to hear your ideas! 💡🤔

Remember the wise words of Bruce Schneier: “Security is not a product, but a process.” The same goes for AI safety. 🔄🔒

Thanks for tuning in to *AI with Shaily*. Don’t forget to subscribe on YouTube, follow me on Twitter and LinkedIn, check out my articles on Medium, and share your thoughts in the comments. Let’s keep AI secure and smart together. Until next time, I’m Shailendra Kumar—stay curious, stay safe! 🌟👋

AI with Shaily: Defending Against Sneaky Prompt Injection Attacks

Google’s “Big Sleep” AI agent has redefined cybersecurity by spotting a critical SQLite zero-day days before it could be exploited. We’ll glimpse how this autonomous hunter teams up with Sec-Gemini’s AI forensics to slice through mountains of log data in seconds. Then, discover why Google’s FACADE system is the new sentinel for insider-threat detection, catching anomalous behavior with uncanny precision. Join us to find out how sleepless AI guardians are reshaping the front lines of defense.

Bit & Being - Historical First Zero Day Stopped by AI: Meet Big Sleep, Sec-Gemini, Google’s FACADE

Kitecast features interviews with security, IT, compliance, and risk management leaders and influencers, highlighting best practices, trends, and strategic analysis and insights. Kitecast is cohosted by Tim Freestone and Patrick Spencer who have more than four decades of combined experience in technology and cybersecurity senior leadership roles.

Unlock the secrets of data mastery with Shailendra, a 27-year veteran in AI, ML, and Data Science, driving AU$ 6 Billion in transformative value. As the author of 'Making Money out of Data,' their strategies redefine digital success. With expertise honed at IBM and Accenture, they drive innovation and data monetization. Explore how loyalty programs like Flybuys and Everyday Rewards revolutionize business—connect with Shaily today.

New tracks tagged #AI Security