There is finally a bright spot in the AI governance conversation, and it comes from an unexpected place: the companies themselves. Michael Brady joins Paul Marco for a candid, financial-services-grounded conversation about AI governance, shadow AI, third-party risk, and why defense remains one of the hardest jobs in cybersecurity.

The episode centers on an encouraging finding from the 2026 World Economic Forum Global Cybersecurity Outlook: 64% of organizations now have a process to assess the security of AI tools before deployment, nearly double the 37% reported in 2025. Michael, a CIO and CISO in the financial services industry with over 25 years of experience across verticals ranging from armored cars to satellites, brings a practitioner's eye to the number. Paul draws the line from written policy to operational reality, pressing on whether these processes are actually trained, executed, and enforced inside the business, or whether they are simply AI-generated artifacts sitting in a governance folder.

You will discover why Fannie Mae and Freddie Mac's AI governance letters are forcing the entire mortgage banking ecosystem to formalize its posture, why vendor renewals have become one of the most under-managed risks in financial services, and why cascading subprocessor terms and conditions are quietly transferring AI data exposure down a chain that most legal teams cannot keep up with. Michael walks through how healthcare underwriters that turned AI fully on and removed humans from the loop ended up making biased decisions that cost them their business, as a cautionary tale for any organization tempted to let AI replace human judgment in high-stakes workflows.

The conversation widens into the cloud parallel, with Michael and Paul tracing how AI adoption is moving at a velocity that makes early cloud adoption look slow, and why that velocity is itself a risk factor. The group examines why shadow AI, personal accounts, and fly-by-night wrapper tools remain a major blind spot even in mature programs, why sales teams are being overwhelmed by shiny-object technology bundles, and why prompt injection and model manipulation are only the first wave of a longer attack surface problem. Michael also makes a strong case for managed services and global threat visibility, arguing that no single organization can staff its way through the current pace of change.

Michael and Paul close on the deeper reality underneath all of it: the asymmetry of cyber defense, the invisibility of successful protection, and the budget conversations that follow when nothing goes wrong. It is a practical reminder that cybersecurity leaders are judged by outcomes they can rarely show, and that AI will not change the fundamental math of defending complex, human-built environments.

Essential listening if you care about AI governance, shadow AI, third-party and subprocessor risk, financial services cybersecurity, or the future of defense in a machine-accelerated world. If you are responsible for protecting people, systems, or data, this conversation gives you both the optimism and the operational urgency to think more clearly about what comes next.

https://www.talas.io/podcast