In this episode of "Full Tech Ahead," host Amanda Razani interviews Ward Balcerzak, Field CISO at Sentra. They explore how AI is fundamentally transforming data security posture management (DSPM) and exposing long-neglected operational hygiene, such as outdated access rights and forgotten data repositories.
Balcerzak highlights the evolution from basic Large Language Models (LLMs) to fully Agentic AI systems capable of autonomous reasoning. He warns that threat actors are using advanced frontier models to chain together low-and-medium severity vulnerabilities to breach perimeters and exfiltrate IP.
To counter these AI-driven external attacks and internal data overexposure, Balcerzak advises business leaders to move past "opening the floodgates," establish strict data provisioning based on specific use cases, build trust-based partnerships across departments (Legal, HR, Privacy), and master basic data and identity security fundamentals.
Key Quotes
- "Sentra... we are a data security posture management software vendor. And what that really is, is we're finding where your sensitive data is at, what it is, how it's exposed."
- "AI is exposing things that we forgot about for the last twenty years or we ignored... hygiene, data hygiene, access rights."
- "Frontier models are able to chain exploits together in a way that humans really didn't think about... You need to focus on the mediums and lows, first and foremost."
- "Security leaders... you need to find your champions out there in the organization... Start reaching out... make them your best friends."
Takeaways
- Address Medium and Low Vulnerabilities: Traditional vulnerability management focuses exclusively on high and critical risks. However, threat actors now leverage AI models to string together multiple minor, unpatched exploits into sophisticated breach pathways, making low-and-medium vulnerability remediation mandatory.
- Avoid Opening Data Floodgates: Deploying copilots or agentic AI across an entire corporate dataset by default creates severe overexposure. Companies must restrict training and input data to a minimal, highly specific subset tailored strictly to defined business outputs and permissioned user roles.
- Bridge the Security-Business Communication Gap: Security professionals cannot protect an organization without understanding operational goals. CISOs should establish non-transactional, human relationships with non-technical leaders in Legal, HR, Privacy, and specific business units to identify champions and align security posture with actual daily usage.
- Master Identity and Data Fundamentals: A strong AI defense relies on basic digital hygiene. Organizations must clean up authentication infrastructure (such as Active Directory) to enforce need-to-know access, tokenize or encrypt sensitive data in databases, and run continuous discovery to locate forgotten corporate data assets.
Find Amanda Razani on LinkedIn. https://www.linkedin.com/in/amanda-razani-990a7233/
Follow the FTA LinkedIn Page: https://www.linkedin.com/company/full-tech-ahead/
Visit the FTA website: https://fulltechahead.com/
Check out the Substack Channel: https://fulltechahead.substack.com/
