Your Auditor Is Testing the Wrong Thing | Schellman's Doug Barbin on Process Audits, SOC 2, & AI Agents

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Doug Barbin, President and National Managing Principal at Schellman, to take apart one of the oldest habits in compliance: pulling a sample of 25 change tickets from a year of thousands of deployments and calling it assurance. Doug's answer is simple — audit the process, not the results.Drawing on 17 years at Schellman and nearly a decade at VeriSign before that, Doug explains why compliance and security were never opposites, why every breached-but-compliant company still benefited from its program, and how AI and agents are changing what auditors look at. Doug covers:Why sampling change tickets misses the point in a cloud and AI release cadence.How to audit an enterprise with 18 different build environments.What automation should cover first — and why 30% can still save hundreds of engineer hours.How auditors evaluate AI agents doing work like backups.If you're running an audit program for a modern engineering org — or sitting on the other side of the table from an auditor — this episode shows what good looks like.Key Takeaways:Sampling 25 changes out of 500,000 isn't assurance. Modern audits should test the SDLC, build environments, and enforcement mechanisms that ship the code.If automation enforces approvals before every push, you don't need to sample for approvals. You validate that the process works.Compliance is not the opposite of security. Mature teams use it to show their work to customers; frameworks like PCI, DORA, and NIS2 already assume you'll be attacked.Automation doesn't need to hit 100%. Thirty percent that covers the evidence eating 200 engineer hours is a huge win — start with identity and access, then change control.When an AI agent does the work, auditors examine its identity, permissions, and configuration, then check the logs to confirm it ran.What You'll Learn:Why "audit the process, not the results" changes how evidence is gathered and testedHow compensating controls like Slack notifications and fast rollback can satisfy separation of duties at a small companyWhere AI is already helping auditors, and where it's just getting startedWhy screenshots are fading and live observation is taking their placeHow technical auditors need to be — and how the CPA exam is adding IT assuranceThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest: Doug Barbin | President | SchellmanConnect on LinkedIn: https://www.linkedin.com/in/douglasbarbin/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Omar Santos, Distinguished Engineer for AI Security at Cisco, for an unusually concrete look at what it takes to run autonomous offensive security safely — and what breaks when you try.Omar co-chairs the Coalition for Secure AI, chairs the CSAF technical committee, led the DEF CON Red Team Village, and has authored more than 25 books. He walks through the architecture his team actually runs: the three-modality evaluation loop that turns static analysis findings into working exploits, the sandbox and kill-switch design for agents interacting with live systems, and the budget agents that stop a three-day run from burning tens of thousands of dollars in tokens. The conversation covers model alignment and agent drift, harness engineering, context compression and long-term memory, Cisco's open-source Foundry Security Spec and Project CodeGuard, where traditional machine learning still beats an LLM, and what happened at DEF CON when seven teams solved every flag.Key Takeaways:Agents running unattended over a weekend are returning zero days complete with exploits, unit tests, regression tests, and CWE classification.You will never have a perfect harness — the goal is a self-improving one that selects better models and burns fewer tokens each run.Model alignment and agent drift are different problems that compound: a model told to act like an attacker will do whatever completes the task.The highest-leverage move is converting what an agent discovered into a deterministic rule you can run at scale without tokens.Evaluation is not one size fits all — offensive security, SOC operations, and compliance agents each need a different definition of done.What You'll Learn:How a three-modality pipeline (static analysis → live system interaction → working exploit) removes false positives by definitionWhy the sandbox question is an infrastructure question, not a Docker questionWhat Cisco's Foundry Security Spec contains: eight agent roles, five extensions, ~130 functional requirements, and a constitutionHow to think about long-term memory when a vector database, a markdown file, and Postgres all now workWhere traditional ML classifiers still belong in an agentic stack, exposed as toolsThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest: Omar Santos | Distinguished Engineer, AI Security | CiscoConnect on LinkedIn: https://www.linkedin.com/in/santosomar/Links Mentioned In Episode: Foundry Security Spechttps://project-codeguard.org/https://becomingahacker.org/loop-the-claude-code-command-that-is-changing-the-conversation-about-software-engineering-46a16eb4be30https://www.langchain.com/blog/multi-needle-in-a-haystackRate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Sunil Agrawal, CISO at Glean, to discuss why the traditional "security as friction" narrative is outdated. Sunil explains his philosophy that security functions as the brakes on a car—not to slow you down, but to provide the safety net that allows you to move faster.Drawing on three decades of leadership at companies like Netflix, Adobe, and Qualcomm, Sunil unpacks the critical shift in the post-Mythos threat landscape. As the window between vulnerability and exploit collapses from months to minutes, legacy tooling built for human triage is no longer viable. Sunil details how organizations must adapt, covering:Why "security as brakes" changes product velocity.The distinction between one-way vs. two-way doors in automated remediation.How to architect security programs for machine-speed threats.Why the conversation with the board is finally shifting from activity to risk.If you are looking to rethink your security posture for an agentic, AI-driven world, this episode provides the blueprint.Key Takeaways:The vulnerability-to-exploit window has compressed from roughly a year to 10–24 hours, and is heading toward minutes — which means remediation has to operate at machine speed.Every legacy security tool was designed for human consumption. In an agentic world, tools must generate high-confidence findings because no human is left to filter the false positives.Automated remediation belongs on two-way doors. One-way doors — anything unrecoverable — still need a human in the loop.Roughly 90% of enterprise AI work should be deterministic retrieval; the LLM should only handle the reasoning and summarization layer.Security teams were always outnumbered — 100 engineers to five defenders. AI is the first technology shift that closes that gap in the defender's favor.What You'll Learn:Why Sunil frames security as brakes rather than friction — and what that changes about product velocityHow to decide which remediations can be safely automated and which cannotWhat "making your data AI-ready" actually means once security through obscurity disappearsHow enterprises are really deploying open-weight models, and where regulation forecloses the choiceWhy identifying your crown jewels is the prioritization discipline most security programs skipThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest: Sunil Agrawal | CISO | GleanConnect on LinkedIn: https://www.linkedin.com/in/sunilcagrawal/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts:https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with James Tabron, Director of GRC Engineering at Aquia, for a conversation almost nobody in this space is qualified to have: what GRC looks like from inside an engineering org.James spent two decades in IT before building GRC programs at SendGrid, Twilio, and Snapdocs — and then did something almost no GRC practitioner ever does. He crossed the aisle. A VP of engineering hired him into the engineering organization to build DevSecOps, and within a couple of years James was a Director of Software Engineering running five teams, 33 people, and the operations behind roughly 9 figures in revenue. Today he runs GRC engineering at Aquia, building continuous authority to operate (cATO) programs in the federal space.That combination gives him an unusually blunt read on why GRC keeps producing theater. His answer isn't that practitioners are lazy — it's that the incentives are working exactly as designed. Companies are rewarded for getting a SOC 2 as fast and cheaply as possible, and the market has quietly demonstrated that breaches rarely cost you customers. Compare that to federal, where an authority to operate means a third-party assessor, an authorizing official, a 500-page system security plan, and anywhere from 150 to 700+ NIST 800-53 controls, and the picture of which environment produces more real security gets uncomfortable fast.The conversation also covers continuous controls monitoring in a cATO model, why GRC teams have never touched DORA metrics, what agentic AI actually automates in an audit cycle, why James thinks incumbent GRC tools have three to five years to justify their price tag, and the skill he believes every aspiring GRC engineer is currently sleeping on: data engineering.Key Takeaways:GRC theater is an incentive problem, not a competence problem — the SaaS market rewards the fastest, cheapest attestation, and breaches rarely produce churn.Federal ATO environments produce less theater because accountability is enforced before a system ever reaches production, not after an incident.In a continuous ATO model, every control family should have an evidence pipeline — not just the handful of controls that are easy to monitor.Agentic workflows are a natural fit for audit prep, and offloading that tactical work is what finally makes experienced GRC professionals strategically valuable.The next differentiating skill for GRC engineers is data engineering — specifically the "T" in ETL.What You'll Learn:Why a product VP with no security mandate chose to hire a GRC leader into engineeringHow to translate compliance requirements into the tools and rituals engineers already useWhat continuous monitoring actually requires versus what most programs settle forWhy traditional GRC has never measured DORA metrics — and whether it shouldWhere the build-vs-buy line really sits for GRC tooling, and who gets to cross itWhy technical acumen should come before framework knowledge in a GRC careerThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest: James Tabron | Director, GRC Engineering | Aquia LinkedIn: https://www.linkedin.com/in/jamestabron/James is also VP of the GRC Engineering Club — a community for practitioners building in this space.Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqrApple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with James Huang, Head of GRC at Gong, to explore how Governance, Risk, and Compliance has evolved from a traditional audit function into a strategic engineering discipline.Drawing on experience building GRC programs at Ernst & Young, Cisco, Salesforce, and Gong, James explains why modern GRC leaders must think beyond compliance checklists and focus instead on understanding risk, partnering with engineering, and building scalable security programs. The conversation covers common control frameworks, continuous controls monitoring, third-party risk, AI's impact on GRC, Mythos, automation, and why future GRC professionals need to become business translators rather than framework experts.Key Takeaways:Modern GRC should focus on understanding and reducing risk—not simply satisfying compliance frameworks.A Common Controls Framework only succeeds when engineering and business teams understand the risks behind each control.Continuous controls monitoring should improve security posture, not just make audits easier.AI is transforming GRC by increasing both operational efficiency and third-party risk complexity.Successful GRC leaders act as translators between business, engineering, security, and compliance teams.What You’ll Learn:Why compliance frameworks should always be interpreted through the lens of riskHow to build scalable Common Control Frameworks across complex organizationsWhat continuous controls monitoring should actually accomplishHow AI is changing vendor risk management and security governanceWhy the future of GRC belongs to technically-minded business partnersThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guests:James Huang | Head of GRC | GongConnect on LinkedIn: https://www.linkedin.com/in/james-k-huang/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts:https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Rajiv Dattani and David Meyer from Artificial Intelligence Underwriting Company (AIUC) to explore one of the biggest unanswered questions in AI security:Can organizations actually trust AI agents?As enterprises rapidly deploy AI-powered products, copilots, and autonomous agents, traditional security assessments, compliance frameworks, and cyber insurance models are struggling to keep pace. Rajiv and David explain why insurers are beginning to exclude AI-related risks, why historical loss data no longer works in the age of AI, and how AIUC-1 was designed to become a trust and assurance framework for AI systems.The conversation explores AI certification, AI insurance, agent security testing, reliability, safety, accountability, statistical risk modeling, and the growing challenge of securing increasingly autonomous systems.Key Takeaways:Traditional cyber insurance models are struggling to underwrite AI risk because historical loss data becomes obsolete as models rapidly evolve.AIUC-1 combines governance controls, technical evaluations, and large-scale simulation testing to assess AI agent security and trustworthiness.AI assurance requires more than security controls—it must also evaluate reliability, safety, accountability, privacy, and societal impact.Statistical testing and large-scale simulations may become the foundation for measuring AI risk in probabilistic systems.The AI security community will play a critical role in shaping standards, liability models, and best practices for future AI deployments.What You’ll Learn:Why many insurance carriers are beginning to exclude AI-generated risks from cyber policiesHow AIUC-1 differs from frameworks like NIST AI RMF, OWASP LLM Top 10, and MITRE ATLASHow AI agents are tested through both black-box and white-box security evaluationsWhy reliability and hallucination risks become more important in multi-agent environmentsHow AI certification may influence future insurance pricing, risk management, and enterprise adoptionThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guests:Rajiv Dattani | Cofounder | AIUCDavid Meyer | GTM | AIUCConnect on LinkedIn: https://www.linkedin.com/in/rajiv-dattani/https://www.linkedin.com/in/david-meyer-8586b17b/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts:https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Sheron Chakalakal, Head of GRC at UiPath, to explore why the future of GRC looks far more like systems engineering than traditional audit management.Drawing from his experience at Salesforce, Deloitte, and UiPath, Sheron explains why point-in-time audits and checkbox compliance are failing modern engineering organizations — and why risk-driven, continuously monitored GRC programs are becoming essential. The conversation dives into AI governance, continuous risk monitoring, customer assurance, GRC engineering, AIUC-1, and how security, compliance, and engineering teams must evolve together.This episode reframes GRC as a technical reliability function that helps companies reduce operational risk continuously instead of simply passing audits once a year.Key Takeaways:Modern GRC programs must evolve from audit functions into engineering-driven reliability functions.Risk—not compliance—should be the central language for communicating with leadership teams.Continuous controls monitoring is essential because point-in-time audits create “checkbox theater.”AI governance requires technical evaluations, agent testing, and continuous assurance beyond traditional frameworks.Future GRC leaders will need technical depth, business context, and the ability to bridge engineering with executive leadership.What You’ll Learn:Why Sheron believes compliance should be designed into products from day oneHow UiPath approaches continuous risk monitoring and GRC engineeringWhy AIUC-1 introduces a fundamentally different approach to AI assuranceHow GRC teams can become the “translation layer” between business and engineeringWhy future GRC practitioners must develop technical and systems-thinking skillsThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest:Sheron Chakalakal | Head of GRC | UiPathConnect on LinkedIn: https://www.linkedin.com/in/sheronpaulc/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Jasmine Kaur, Principal of Security & Assurance Engineering at CoreWeave, to explore how AI-native infrastructure is fundamentally reshaping GRC.Drawing from her experience at companies like SAP, Google, and now an AI hyperscaler, Jasmine explains why traditional GRC models are failing in high-velocity, ephemeral environments—and what needs to replace them. From “GRC as infrastructure” to the rise of agentic GRC, this conversation dives into how compliance must evolve from a reactive audit function into a real-time assurance capability embedded directly into systems.Key Takeaways:Traditional GRC models break in AI environments because systems are ephemeral and disappear before audits can validate them.Compliance should be treated as a byproduct of strong risk modeling and control design—not the end goal.GRC must evolve into an infrastructure-level capability that continuously emits assurance signals.Agentic GRC is the next evolution beyond automation and CCM, enabling decision-capable systems with human oversight.Future GRC teams must operate more like engineering and reliability functions rather than audit teams.What You’ll Learn:Why AI infrastructure makes traditional audits ineffectiveWhat “GRC as infrastructure” actually means in practiceHow to move from point-in-time audits to continuous assuranceThe difference between automation, CCM, and agentic GRCHow to position GRC as a proactive, business-critical functionThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest:Jasmine Kaur | Principal of Security & Assurance Engineering | CoreWeaveConnect on LinkedIn: https://www.linkedin.com/in/jask31/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Val Dobrushkin, Director of GRC at Tricentis, to challenge one of the most overlooked failures in modern security programs: third-party risk management. Drawing from his experience building GRC programs at ForgeRock, NoName Security, and beyond, Val explains why most organizations are still stuck in compliance theater and how GRC teams can evolve into true business enablers.This conversation dives into the disconnect between frameworks and reality, the limits of SOC 2, the role of GRC in revenue and M&A outcomes, and why solving for today while building for the future is the key to long-term success.Key Takeaways:Third-party risk management is fundamentally broken due to over-reliance on questionnaires and weak enforcement of meaningful controls.SOC 2 is too flexible and inconsistent to be relied on as a true indicator of security maturity.GRC has a unique advantage over security in directly demonstrating business value and revenue impact.“Solve for now, build for later” is critical for startups and fast-growing companies preparing for IPO or acquisition.Strong GRC programs can directly influence company valuation by identifying contractual and compliance gaps early.What You’ll Learn:Why questionnaires and annual vendor reviews fail to capture real third-party riskHow GRC teams can prove revenue impact through customer trust and assuranceThe hidden role of GRC in M&A, IPO readiness, and contract validationWhy most GRC metrics fail and what meaningful measurement should look likeHow to implement a “solve now, build for future” strategy in fast-growing companiesThis podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest:Val Dobrushkin | Director of GRC | TricentisConnect on LinkedIn: https://www.linkedin.com/in/dobrushkin/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450

In this episode of Security & GRC Decoded, Raj Krishnamurthy sits down with Dylan O’Dell, AVP Information Risk Officer at Manulife, to challenge one of the biggest assumptions in the industry: that GRC is working as intended. Dylan argues that most organizations are stuck in control-centric thinking and missing the true purpose of risk management — translating data into business decisions.Drawing from his background in Lean Six Sigma and large-scale enterprise risk, Dylan breaks down why GRC needs to evolve beyond audits and control testing into automation, orchestration, and storytelling. This conversation explores how modern GRC teams can reduce operational friction, quantify real risk, and actually influence business outcomes.Key Takeaways:GRC today is overly focused on control testing rather than true risk management and decision-making.Automation should eliminate manual audit friction — not just make existing processes faster.The future GRC professional must combine technical awareness with storytelling, influence, and business understanding.Risk management should be rooted in probability and financial impact — not pass/fail compliance.GRC teams can unlock funding and influence by tying their work directly to revenue, cost savings, and business outcomes.What You’ll Learn:Why the “three lines of defense” model often breaks down in practice.How to translate technical data into meaningful business risk narratives.What modern GRC automation should actually look like (beyond tools).How to position GRC as a revenue enabler — not just a cost center.Why “start with why” is critical for influencing stakeholders and reducing friction.This podcast is brought to you by ComplianceCow — the smarter way to manage compliance. Automate evidence collection, eliminate screenshots, and scale your program with confidence. Learn more: https://www.compliancecow.comWatch more episodes: https://www.compliancecow.com/podcastConnect With Our Guest:Dylan O’Dell | AVP Information Risk Officer | ManulifeConnect on LinkedIn: https://www.linkedin.com/in/dylan-odell-72a06412b/Rate, review, and share if you enjoyed the show!Subscribe to Security & GRC Decoded wherever you get your podcasts:Spotify: https://open.spotify.com/show/5pigcMwOrYIA6d9OOOsxqr?si=416b82ab5c474683Apple Podcasts: https://podcasts.apple.com/us/podcast/security-grc-decoded/id1795144450