A short Sage Spotlight conversation about building security and compliance inside a fast-moving identity company, and how I think about AI's place in a modern program.
Security inside the product lifecycle
The theme I keep returning to: security should live inside the product lifecycle, stepping in as a formal process only when it matters. That's how you hold a high bar without becoming the thing engineering routes around.
Where AI actually helps
AI is most useful on the work that scales badly with headcount — triage, evidence gathering, first-pass review. It buys back the human hours for the judgment calls that genuinely need a person.