Submit Podcast or Channel

AI Security for Business: Human Risk, Data Hygiene and Safer AI Adoption with Fable Security’s Nicole Jiang

October 23, 20260 comments♥ 0
00:00When AI process, when you give a prompt, if you give a clear prompt, you have to process tokens.There's a cost associated with every prompt or every question.One thing open AI, I believe, has said, is there are people, I'm one of those people.I'll be like, can you please do this thing for me?Thank you.And they said, if you add please and thank you, it takes up more tokens.Just be direct.Just remove all the pleasantry.
00:20That's crazy for me.I'm Canadian.I say sorry.I say thank you.I say please.All the time.Turn out, that's not good for AI.Toronto's costly.
00:31win by following the playbook. You win by rewriting it. 700 episodes deep with the people whoactually built something real. No theory, no fluff, no shortcuts. This is right about nowwith Ryan Alford. Companies are adopting generative AI tools faster than almost any technologywe've seen. The productivity upside is real, but so are the risks. Today's guest is working at theintersection of AI adoption and cybersecurity, helping companies understand why the biggest threatsaren't always hackers, their human behavior. Nicole Jang is the co-founder of Fable Security,and today talking about how organizations can embrace AI without accidentally exposing their mostvaluable data. Nicole, welcome right about now. Thanks for having me. Great to meet you. I know
01:21you're in Boston today. We're in South Carolina. We got the East Coast covered, and we're going to talkall things AI security. It's funny, Nicole, this is something that's been on my mind. I was havingflashbacks when the internet started getting going and we started Googling everything and we startedputting all our stuff on social media it dawned on me this was probably like a 2004 or five we sureopenly giving up a lot of information what is happening all this stuff and now sort of had the sameepiphany a few weeks ago which is why I love having the opportunity to have you on the show is like yeahmaybe we need to think about this a little more than we are not to slow it down but just be awareI'm sure we love looking at things we've posted 10 15 20 years ago is a good throwback
02:00but also just like, oh, wow, there's a lot of things on the internet that we shared.Yeah, exactly.And so now we're telling AI our deepest secrets so it can help us solve puzzles, write contracts,all that stuff.And it's like, well, where is that data going?I have a feeling you might tell us.But Nicole, I'm anxious on this topic because it's like so real for me.I'm owning businesses and you use it.
02:19So let's set the table, give everyone a little bit of your background, what got you into Fablesecurity and cyber security and all that good stuff.My name is Nicole Jang, co-founder, CEO Fable Security.we've built a human risk platform that shapes secure employee behavior.Behind the scenes, we leverage a mix of AI, ad tech approaches to understanding employee behaviorin an enterprise.We deploy just in time personalized interventions.When we see employees doing some things that might expose more risks than necessary for
02:47organization, we do this better than typical annual security compliance training, which iswhat the industry status quo looks like.Our approach is relevant, personalized.It really drives at the risky behavior at time.when things are happening, almost like that just in time coach.The reason why we started this business had a lot to do with my previous background,with me and my co-founder, Saney came from a ad tech background.So making ads super relevant, super clickable, convert people from buying things,
03:14not even know that they want.Our sheer background also came from abnormal securities, another startup before that wewere founding members of.We leverage AI to look for fishing attacks.Fishing became super prevalent in today's age.AI unfortunately supercharges attackers.They literally have the tools to send you really targeted fishing threats.And saying I both realized that we really want to focus on a human layer to teach people to better defend themselves from not just bad fishing, but also all sorts of social engineering attacks, all sorts of things that people may do that introduces risk, not just the enterprises, but also for themselves.
03:49And so that's the reason why I became super interested in not just cybersecurity, but ways to protect people and ensure that we can all be.more productive and more effective as we work.I'm glad we have people like you.Some people get annoyed about tech security, back channels.Oh, they're putting the guardrails on everything.I tend to be rule blaker, but I actually really appreciate the people that actually put theguardrails up that need to be there to help us from ourselves and especially from the bad guys.Thank you for the service to our cyber community.
04:19This stuff is, I think about the curve of internet and then social media and then the speedwith which we could do these things with bandwidth increases.AI is on all that on steroids.It's like moving so fast.Are companies moving faster than their security frameworks?When I look at customers that we serve today,we're seeing interesting diversions.Companies that have been this industry of the past 10 years looking at cyber,
04:45I see a lot of companies going through digital transformation.So if you ask 10 years ago, it's like moving from on-prem set up to cloud, right?So that was a big shift.We're seeing companies that are.forward thinking, they're more mature, they are really technology driven. They're getting so much moreupside from AI. And then we're also seeing companies that might be a generation that they've been aroundover 100 years. They have a solid business. They're maybe not as tech enabled or digital transformed.They're a bit slower. So we're seeing adoption curves in various ways. And so that's the shape of the
05:15companies. And then from a security perspective, it's also around how companies view security. Everyoneis security. There are compliance requirements. There's a baseline. There's a lot of now commonlanguages on what needs to be done from a security level. But I do see that companies who arereally thinking about investing in digital AI technology transformation, they really doubletriple down in their security investments. And then some may still be checking in the box. I reallysee the divergence of companies based on their tech sabbiness, their belief in modernizing.Now, from a particular companies that are really adopting AI, you really do, I think it reallydepends on the people. People in the company, for example, if you're very developer-centric,
05:54company. You just see like a ton of crazy things that people can do with AI. They're tinker and they'retrying. And the organization allows them to do that. They take on the risk for innovation and thetradeoffs might be risk. For some other ones, they're worried about, for example, their healthcarecompanies, you're worried about HIPAA, financial. You care about PCI, PII. They're real like financialbusiness consequences if you tinker too much. We also see other companies will create playground orsandbox for people to play. And then it's a balance.of letting people try things out, innovate,but also not break the bottom line for the business.
06:29We're seeing all of those,but we are seeing more and more companies,just their time is spent on trying AI,being more productive.And if you're in this like marathon pace,somewhere at the beginning,at one end and some are kind of trailing,and I think that space will become larger as we go.
06:51Some people have to go slower due to risk, risk tolerance, data.And then some are stodgy and need to be movingfaster they're going to be irrelevant and then there's the ones that are moving really quickthat are really nimble i can speak small business but i talked to cisco i mean some of the largestcorporations of the world so i'll speak from kind of both ends of it as small business i had18 to 20 employees in 2021 i really grew faster that i wanted to i worked in manhattan i hadteam of 100 people directly or indirectly reporting to me i didn't want to i didn't start mybusiness going on our sure i just did not want to manage that many people part of it was intentional kind of
07:29scale back. But what the last few couple three years has done is not replaced those people because Ikind of scaled the business away from them. So it wasn't, oh, I just replaced all these people withAI. No, it allowed me to do some things to maybe accelerate the de-scaling because I could take on more.I now have a gentic AI throughout my businesses as a small business. And I know I'm probably ahead onthe small business curve because I've worked nationally and have this background. But I also have started to pause and go,okay, where's all this data going?And I know Open AI or chat, GPT, opening out, okay, they've got security measures.I've read as much as I can stand with the legal jargon that's in all this stuff.
08:10It's funny because I own a publishing company on the podcast network side.And then I own an agency.And so I'm developing tools thinking about that data.And then I've got the podcast network side with publishing.And I'm going, well, what about all this content?How's that being digested and then used?And why aren't we getting paid for it?That's a whole other topic.
08:26There's a lot of people asking these types of questions right now, like,myself at all levels, which is this is great.I'm comfortable moving fast, but sometimes you don't know what you don't know.But I know I don't know something that I might should know about where all this data is goingand what I need to be thinking about.That's what we got you here, Nicole.What do we need to be thinking about and what kind of sense of information are peopleaccidentally sharing with AI tools?
08:49I have a couple of thoughts on this and I've been thinking quite a bit about it.If you think about AI in its like purest, purest form, not even technical gardens.What does AI do for you?AI is running.Ray has giving you insights faster than a human analyst.Free to reach 20 block posts, surface insight, you can now say, read all of them,giving the insight, asking your questions, paint palm, be my reasoning partner.AI can automate certain things for you before you have to do step 1 through 20 to get to a task.
09:14Now you can automate those things running the background.These things are human instructed.The way you want some things to be done requires hyper-clearity on the outcome you're looking for.And AI is just extracting data, content, information that you have,your system today.So when I think about the two risks,if you don't know what you're looking forand you ask the stupid question,
09:34that exposes risk in ways that you may knowan employee does this,you go, why are they asking this question?Can they? Should they be asking this question?Damn, if they ask this question,they might get the answers nowand the answer is so easy.This is like a new set of things
09:46that folks are worried about.The other piece is, I think AI also makes it,if you think about it, right?Every AI service wants faster adoption.So they say,integrate with all your tool stack.We can do all these things.People don't think,
09:58knowing thinks about permission.No one thinks about data. They think about adoption, easy click, one click. If your house is not clean, like if your database is not clean, if your systems are not clean, a lot of companies don't think about that. You can ask a question and you get the answers because the underlying data is chaotic on its own. When I see our customers and maybe for you, Ryan, getting your jobs done, getting your task done, it's awesome. But then who did the data cleanup in the first place? There's also just this fundamental regardless of AI, regardless of how we use, there is still fundamental data hygiene, security hygiene, things.day that we've got to figure out. All these advancements, it's putting the security foundation into amassive test. And attackers knows that. And so they really try to exploit now with additional vectorsin a faster way through AI, through prompting. That's why when I think about security practitioners,they might feel a little stressed knowing that their house needs to be in order to support all theseevolution of technology. Superhero movies, it's like, well, who has the superpowers? Who are themutants? The good guys and the bad guys have the same superpowers. Who's using them best? The bad guys are using these tools.
10:59to take all these other stuff to advance their criminal behavior or they're sneaking around or whatever they're doing,no matter how nefarious or non-nefarious it is.As the good guys, we've got to use these same superpowers to both protect it and to use it for what we're ultimately using it for.It's like anything else.The bad guys seem to always be at least even and sometimes one step ahead of us.Not that we're all perfect.I'm 100% sure I'm not a criminal.I'd be called a cheater in a few board games every now and then.
11:25But, I mean, it was true, Nicole.I just like to win.It's like I feel like we're playing chess, right?Attackers can be offensive.We're defensive.And it's just a mindset is kind of different.And so that's why inside where you also see offensive teams who's trying to break systems ahead of time.We can think like attackers too.
11:41And actually AI unlocks that, really.I think it's a huge value add for security teams.But also, unfortunately, attack surface expands.We also just have to work really hard and be very creative when it comes to how to better protect.You mentioned something about how direct what outcomes we want.And usually it's my own lack of clear.that causes the AI's bad behavior or bad outcome that I didn't want.But anyway, I digress.
12:03I just wanted to come on here.On this episode, it made sense and admit that sometimes I mean to my AI person trying to get it to be more efficient.When AI process, when you give a prompt, if you give a clear prompt, you have to process tokens.There's a cost associated with every prompt or every question.One thing Open AI, I believe, has said, is there are people, I'm one of those people.I'll be like, can you please do this thing for me?Thank you.And they said, if you add please and thank you.
12:28Thank you. It takes up more tokens. Just be direct. Just remove all the pleasantry. That's crazy for me. I'm Canadian. I say sorry. I say thank you. I say please all the time. Turn out. That's not good for AI. Try to cost.This episode is brought to you by High Level.Make sure to check out the link in the show notes to sign up for your 14-day free trial.If you run a business, you know leads rarely arrive when it's convenient.A call comes in while your team is helping another customer.Someone reaches out, but the follow-up gets delayed.An invoice sits unsent or a promising lead gets stuck in the wrong stage of your pipeline.I've built enough businesses to know that growth has a way of exposing every gap in your systems.
13:14That's why high levels voice AI and managed AI agents caught my attention.High levels voice AI can answer incoming calls, qualify leads using information from your websiteor uploaded documents, and even book or reschedule appointments.When your team is busy, voice AI can keep that conversation moving instead of letting a potentialcustomer slip away.Then high levels managed AI agents can handle multi-step actions across your CRM.They can update pipeline stages, send invoices, and execute follow-up secret.across SMS, email, and social.
13:48That means fewer repetitive tasks for your team and a more consistent process for every leadcoming into the business.For me, the real value of AI isn't adding another complicated tool.It's using technology to handle the work that slows your team down so your people canfocus on building relationships, serving customers, and growing in the business.If you're ready to create better systems and get more from every opportunity, use the link inthe show notes to sign up for your 14-day free trial.And I'm from the south, so I kind of do the same thing.
14:15I do.I had the pleasantries on the front end, but then when I'm mad at it, I'm like, you know,this is really costing me more time and hours today.Your whole purpose in life is to save me time and energy.And all you've done is, it's called, anyway.What I'm hearing from you is that's great.Maybe you felt better.It's just costing you more money because you're just using tokens.
14:32It's causing you money, but hey, if it works, it works for you.Like, ultimately, it's about you.It's less about the AI.But yeah, just say too many prompts, make it short, be efficient, walk me through.what you're going to do differently.I love it.Hey, good tip for anyone out there.I'm not the only one.
14:46I'm not the only one that admits things.Talking to Nicole Jangs,he's the co-founder of Fable Security.Nicole, do we need to be scared of the external attackersor we need to be scared of the platforms themselves?And scared the real word.Let's just say, let me start that from a positive.Do we need to be more thoughtful of the outside attackers
15:02or more thoughtful about the platforms themselvesand what the negative might come from these things?Well, you think about the negative of the platform to clarify.Like, what comes in mind for you, Ryan?that data I'm giving them. Like if I'm asking it to do a very sensitive draft of a contract that I'llthen run by my lawyer, yes, I do. I'm not replacing the lawyer completely, just some of those hours.Just being honest, I'm direct. That's why people like this show. So I'm giving it sensitive informationto do a task. Fairly sensitive. I'm not giving it by a blood type today. Where is that going?
15:32Where is that being stored in the server of heaven cloud that it is?To me, it's about where that data goes and what are the potential positive and also more important than negative outcome that might happen from it.Your tools, your data today probably lives on Google.It lives on your payroll application.It lives in your customer CRM.Your information is already like store somewhere in the cloud by a vendor.AI is really just another vendor that's going to store, process and figure out your data.And over time, right, as more people use that information and store their information in AI tooling as well,
16:06like think of it as another version of cloud. Over time, we're also going to be more and more mature from a security perspective on how to segment data, how to properly protect privacy, super, super important for everybody. We're really seen the early stage of AI. If you look at, for example, Anthropic, they're already thinking about cybersecurity and baking that within on how they work down the line, right? There's less and less worry around that security side. The external attack vector is what we should all worry about more. So it's really about how people would take your information and do it in a way that it's not how you intended.for them to come off. So when we see the threat landscape today, we see people acquiring ourcustomers' information. They pretend to be employees' bosses. They call them and they say, you're introuble. Come online, log into the site, give me your password's credential. Hey, you're a client ofmy, I see your invoice income through. Can you use this link and give us millions of dollars becauseit didn't get translated? When your information is being abused for purposes that are really badby threat actors, that's when like risks really happen.And so just like how you're storing your data in various platforms and they get popped or they get targeted,
17:12AI is another place where your information can get targeted, if not unfortunately, faster because they're all hooked up right to each other.When I think about the threat landscape, I just think about we all adopt tools and enable us to be more effective, create more outcome, allows us to be more creative as well.But I do worry about the external where attackers will just use it for other creative purposes that you and I talked about that aren't great.So it's that two battle, right, of the good AI usages and maybe the bad AI usages.Are the traditional cybersecurity tools even equipped to deal with this kind of risk?With my knowledge in cybersecurity and I admit we're always changing, we're always learning.The traditional security tools are really thinking about protecting certain layers.So I came from protecting the email layer.
17:57There's people who protected the identity layer, the firewall, the network, the endpoint layers, like your devices.Traditionally, a lot of tools look at what are the data?the bad things that are coming in, we decide if it's good, if it's bad, and then we do something about it.They don't stop people from doing stupid things. They look at things that are stupid and they say,hey, you should people do something about it. We can remove this bad email. We can remove this badmalware. I fable what we're trying to do is to say, look, everything really comes back to people.People click on the phishing email. People share a document. People probably put in a document somewherein the first place that they're not thinking about the permission and why it might be sensitive beyond
18:32your lawyers. And can we do something to just have that one second pause? I can prevent a lot ofdownstream problems. Can we just ask people to turn on certain caution when you're using AI to dosomething? Can you just write one prompt that says, hey, are there security consequences relatedto this? Like, should I be worried? I can go a long way. A human behavior can go a long wayin mitigating these risks. I bet you most AI users today have no, like they don't think aboutcybersecurity. They don't think about the consequences until like frankly, he shit. Yeah. That's why youtalk about human risk management.That's really what we're talking about because...
19:07That's right.It's not the machines.It's the problems to people, damn it.We can always get better.It sounds like a training thing, Nicole.I don't know how good they are.The bigger companies, obviously, sometimes they train too much, I think.But I don't know about with AI if there needs to be a layer further, potentially at a lot
19:33of places where there's training employees differently in the AI world.Then there's this balance.You talked about this earlier.I mean, it was a lot more eloquently said,but I'll say my best,which is the balance of enablement versus risk.Start with training, I guess, like the humans.We've got to train these humans how to use these robots.
19:51When I think about training,I actually think about it in a very different way.If you think about training, right,it's like someone created a bunch of really knowledgeable thingsthey want to share with you.A lot of security trainings today don't work.And here's the reason why.If I asked you, Ryan, like,
20:03do you care about your personal security?Yeah.Do you care about looking,being secure on the internet. I think you do. You don't want to lose your passwords. You don't want tolose your financial information that you store digitally today. Nobody wants that. Like everyone wantsto be safe. So then you're like, okay, cool. Like your company is trying to make you safe. And here's abudget training. It's two hours, three hours. It's really painful. You're like, where did itwrong? People just want each other to do the right thing. When I think about the training piece,
20:30I really think about it as, okay, someone's trying to protect you and they don't know how totalk to you. Here's a bunch of slides in training and really bad videos to keep.you safe. It's like going to a bad lecture, even though you're here to learn. When I think aboutsecurity, I also think about it as such a complex subject with complex specialists who don't alwaysknow how to break it down. So my job is to break it down for people. Our approach is less of training.It's more about coaching, more about intervention, smart enablement. We'll tell you things that you reallydo need to know in very simple terms. They're not just good for the company. They're good for individuals,just good hygiene in general. And if we can break down that communication barrier and boil really
21:07technical subjects into simple matters. People will adopt secure behavior because nobody wants to beunsafe and create problems for organizations or for themselves. My goal is to demystify what trainingreally means in our world and how we approach it, actually in the ad tech way. I feel likeyou're probably really well versed in the world of ads, how you get viewers to pay attention.You can optimize for topics and interests and relevance for your audience. For cyber, it's thesame thing. I don't need everybody to change passwords. I only want people who have poor password.hygiene to really figure out how to do that.If I know the information, then I don't have to tell someone who's really on top of their
21:43security on things that they already, they think is super basic.But for some people, it might just save their entire bank account, life savings.That targetedness is just like ads that would drive change or drive adoption.That's our unique spin on how to use our technology for a greater good.But it should feel very simple from everyday perspective.We're not harping on people to be like, do the training.It's more like, guys, here are the things you can know to protect yourselves.It would go a long way for the company, for their teams, for themselves, and that's my hope.
22:09Nicole, we need some AI hygiene. We need some AI toothpaste.Hygiene is automatic. These things that you do because I don't think we have that today quite.I think smart people are going when you think about it, great companies like yours, helping us get there.We need an easy button for this thing.I actually have physical Fable Brennett's hand sanitizer that we share with conferences.There you go.You know, I'm going to start your cyber hygiene with some physical hygiene at a busy place.Like, here you go, spray.
22:35I thought it's pretty clever.Yeah, it is clever.Good job.Hey, look at you.You're a marketer too.Honestly, we're a cybersecurity team spoke person in the organization.I was just talking to a customer and they said that the CEO, the presidents of their company,they heard about what all the security things that we're doing through Fable.
22:50Oh my gosh, that's awesome.If we can amplify all the work and get people's attention, that's the starting point to get people to change.I was very proud after hearing that's a snippet from our customer.Natural security for artificial intelligence.There you go.Exactly.Real people helping the AI world that we live in.As we close out here, Nicole, I always like quick tips, actionable stuff.
23:13For anyone that's listening, small, medium, we got executives, running big companies.We got entrepreneurs run startups, maybe a handful of things, easy things people could doto maybe have a little more AI hygiene in their cybersecurity.We're all going to be superior prompters as we acquire skills in the AI world.My recommendation is number one, totally fine to be curious.But number two is also just ask the question of should I be concerned about the data?AI, can you please sanitize my data, sanitize my queries, and make sure that the AI can do the security-minded work for someone.I think the second thing is remember, don't give out your credit card information.
23:50Don't give out your passport.Don't give out your blood type, Ryan.Let's just do the same thing in the AI world and make sure that the information you care about, just ask for it to omit and AI would do the job for you.Regularly go through, hey, our thing.being shared that it really shouldn't be.AI can probably find out about that really quickly for you too, and then you can take action.Those are good hygiene to just ask and prompt almost like part of your regular workflow.Those are good. It's so funny. Everything's meta with this because AI can assist in whatever
24:16thing we're trying to solve that might be related to AI. It's sort of, I don't know,this meta circle. I always find myself in. I'm like, I'm trying to worry about this with AI,but can AI help me? And it seems like it can.AI is like your reasoning partner and just does so much. I'm really excited about the outcome.the future of where this technology can go.Nicole, tell everyone where they can learn more about Fable Security yourself and stay in touchor learn any of the sharing you might be having universally.You can learn about us at fablecurity.com.
24:46Our website shows a lot about what we do when it comes to protecting human risk, understandingemployee behavior, and figuring out ways to share targeted interventions that can elevate youroverall security hygiene, whether it's AI adoption, whether it's sharing sensitive data, whetheris also just defending against external threat actors.We are based in San Francisco, California.Our office is right in the heart of downtown.We work in person.We love being there to collaborate.
25:12So if you're ever in town, our door is open.I really appreciate you for coming on.Let's do it again soon.Absolutely.Let's stay in touch to Cole.I'd love to have you on every now and then.This is a very topical thing, real thing.This things evolve.
25:25Yeah.Have a fabulous rest of the day.Thank you.Great to you.Thank you for having one of the show.Yeah.You're a good time.Take care.
25:31Thanks.see you. Here's the truth. Information doesn't change your life. Execution does. So don't just listen tothis episode and move on. Take the idea. Make the call. Launch the thing. Fix the problem. Build whatyou keep talking about building. For more, follow Ryan Alford on Instagram at Ryan Alford.And watch or listen to every episode at Ryan is right.com.This is right about now.Now quit waiting.Go win.