Would Toyota release a car without a seatbelt?

That's the question Sara Abak keeps coming back to. No carmaker would ship a vehicle without safety features, yet the most powerful software ever built ships with no regulation at all. Every single cyber leader she speaks to is worried about frontier AI models.

So the sharper question becomes:

How do you secure the enterprise when AI is moving faster than the rules around it?

In this episode of Agents After Dark, Matt Doughty sits down with Sara Abak, CISO across energy and critical infrastructure, to break down what security leadership actually looks like in the AI era.

Together they discuss:

• Her case for regulating frontier AI like any other product that can cause harm at scale, and why unsafe releases should be paused, not innovation blocked
• How she turns around security cultures in complex organisations: anchor in what the business actually does, because you can't protect what you can't see
• Why CISOs get the "department of no" reputation, and how building trust at board level beats laying down the law
• Why AI features in your ERP or board paper platform stay switched off until they pass a risk assessment
• Shadow AI in practice: locking down what staff can paste into public AI tools, coaching at the point of upload, and quarterly behaviour reporting so decisions are anchored in data and facts
• Why standalone responsible AI programs rarely get funded, and why anchoring AI work inside an existing project with legal, HR, and IT at the table is what actually moves things forward
• How a clinical psychology degree shapes the way she reads the room, wins support, and accepts what she can't change

Her three-part answer to frontier AI risk: regulation, layered foundational controls so you're never the easy target, and holding your vendors accountable. And one rule that applies to all of it: never waste a good incident.

This conversation is a practical guide to enterprise AI security for any leader trying to enable adoption safely while the technology outruns the rulebook.

About Sara
Sara Abak is a Chief Information Security Officer with over 20 years in information security and risk, currently CISO & Industry Leader (Energy & Water) at Grampians Wimmera Mallee Water and Founder of Orca One, a fractional CISO advisory.

Previously CISO and Chief Privacy Officer at Intellihub, she has secured critical infrastructure across Australia and New Zealand spanning IT and OT, led ISO 27001 certification with zero non-conformances, and was recognised as a Most Influential & Top 100 Cyber Security Leader across ANZ in 2025. She is a certified AI governance leader and ISO/IEC 42001 Lead Implementer.

About Prefactor
Catch your agents' mistakes before they reach customers.

We evaluate every step your agents take, live. Mistakes get caught as they happen. Not in a Slack thread at 1am on a Tuesday.

Learn more at prefactor.ai