AI Governance in Practice: Securing, Defending, and Thwarting AI Threats

Jason Lee, Managing Director at Z Cyber, goes deep on the three focus areas of NIST's Cyber AI Profile (IR 8596): Secure, Defend, and Thwart. This isn't framework theory — it's operational reality.

Part 2 of the AI Governance series. Watch Part 1: https://www.ztekcyber.com/resources/ai-governance-framework-nist-hitrust-certification

What you'll learn:
- Why AI components are unmanaged assets in most organizations (0:30)
- Shadow AI: the attack surface nobody's inventoried (1:30)
- Prompt injection and model supply chain — the two vectors to press on now (2:45)
- AI in the SOC: real capability, real governance gaps (4:00)
- Decision authority matrices for AI-assisted security tools (4:45)
- AI-generated phishing, deepfake fraud, and compressed exploitation timelines (5:30)
- Why resilience — not just detection — is the board-level question (6:30)
- Priority tiers: how to actually execute against the framework (7:00)
- Three things to do this week (7:30)

Key insight: "The worst outcome of AI in the SOC is analysts who treat the model as the authority. Your people need to know when to push back."

Resources:
- NIST IR 8596 (full document): https://nvlpubs.nist.gov/nistpubs/ir/2025/NIST.IR.8596.iprd.pdf
- Full breakdown: https://www.ztekcyber.com/resources/ai-governance-secure-defend-thwart-operational-guide
- Part 1 — NIST Cyber AI Profile Overview: https://www.ztekcyber.com/resources/ai-governance-framework-nist-hitrust-certification

Three things to do this week:
1. Start your AI inventory — you can't govern what you haven't found
2. Review your incident response plan for AI-enabled attack scenarios
3. Run a tabletop exercise with an AI attack scenario

Subscribe for Part 3: How the Cyber AI Profile maps to CSF 2.0 — starting with the Govern function.

Schedule a consultation: https://www.ztekcyber.com/get-started

Видео AI Governance in Practice: Securing, Defending, and Thwarting AI Threats канала Z Cyber