# From Reaction to Prediction in AI Security with Evan Kirstel

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 17 Dec 2025, 14 min.

Audio: https://www.buzzsprout.com/2248577/episodes/18365591-from-reaction-to-prediction-in-ai-security-with-evan-kirstel.mp3

Security teams have spent years operating in reaction mode. Alerts fire, analysts scramble, and incident response often moves at human speed while adversaries move faster. In this episode of ClearTech Loop, Jo Peterson sits down with Evan Kirstel to talk about how generative AI is changing that reality. Evan shares practical examples of how AI powered triage is shrinking incident response timelines from hours to minutes and why speed, when paired with better analysis and guidance, can fundamentally change outcomes. The conversation goes beyond faster detection and digs into what this shift really means for security teams and CISOs: AI is enabling analysts to move from reacting after the fact to predicting threats as they emerge. Entry level SOC teams are being up leveled with remediation paths and decision support, not just alerts. Security and privacy controls can be embedded into AI development early without slowing innovation, and in many cases, actually accelerating it. And CISOs are being pushed into a broader governance role as AI becomes both a critical capability and a growing threat surface. If you’re trying to understand how AI is reshaping security operations today and what leaders need to be thinking about next, this episode brings clarity to the conversation. 👉 Subscribe to ClearTech Loop on LinkedIn: https://www.linkedin.com/newsletters/7346174860760416256/ Key Quotes “They can cut incident response times from hours to minutes. Just like an emergency room, minutes matter.” — Evan Kirstel “I think this gives us a chance to really up level our more entry level SOC folks, and it gives them remediation paths. It doesn’t just find things, it gives solutions to the problem.” — Jo Peterson Three Big Ideas from This Episode 1. AI powered triage changes the math of incident response AI is compressing detection, analysis, and decision cycles. When response moves from hours to minutes, outcomes change and teams gain back control during critical moments. 2. Proactive security starts with better guidance, not just faster alerts AI is helping teams predict and prepare, not just react. By offering remediation paths and context, it allows SOC analysts to make smarter decisions under pressure. 3. Governance becomes a core CISO responsibility in an AI driven world As AI adoption accelerates, CISOs must balance speed with guardrails. Embedded security, privacy by design, and clear governance frameworks are now essential to maintaining trust and reducing risk. Episode Notes / Links for Suzie to Fill Out 🎧 Listen: in the player above ▶ Watch on YouTube: https://youtu.be/BFkpNCOQfnw 📰 Subscribe to the ClearTech Loop Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/ Resources Mentioned • NIST AI Risk Management Framework https://www.nist.gov/itl/ai-risk-management-framework • The Evan Kirstel Show https://www.youtube.com/@EvanKirstel • ClearTech Research Insights https://cleartechresearch.com 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_01: Hey everyone, thank you so much for joining.
[0:09] SPEAKER_01: I am Joe Peterson.
[0:11] SPEAKER_01: I'm vice president of Cloud and Security for Clarify 360 and the chief analyst at Clear Tech Research, and I am here with the man, the myth, the legend, Evan Kerstell, Tech Influencer Extraordinaire.
[0:25] SPEAKER_01: Hi, Evan.
[0:26] SPEAKER_00: Hey Joe, great to see you again.
[0:28] SPEAKER_01: Thank you so much for making time to visit.
[0:31] SPEAKER_00: Always, of course.
[0:33] SPEAKER_01: Guys, in case you somehow are not familiar with Evan, I don't know how that could be.
[0:39] SPEAKER_01: Evan has over 600,000 followers in tech across multiple platforms and is a go-to voice for all things tech, including cybersecurity.
[0:53] SPEAKER_01: So, you know, again, welcome, Evan.
[0:56] SPEAKER_00: Thank you so much.
[0:57] SPEAKER_00: Great to be here.
[0:59] SPEAKER_01: So, in keeping with the Clear Tech Loop hot take approach, we're going to ask Evan three questions about AI security and get his take on things.
[1:12] SPEAKER_01: So let's get right to it with the first one.
[1:15] SPEAKER_01: How can cybersecurity professionals leverage generative AI to break out of that sort of traditional tools and tech mindset and drive more innovative thinking and execution in their security programs?
[1:30] SPEAKER_00: Oh gosh, where do I start?
[1:32] SPEAKER_00: I mean, there's just so much opportunity.
[1:34] SPEAKER_00: And of course, Gen AI is being baked into all the tools that we know and love.
[1:41] SPEAKER_00: And there are brand new capabilities out there that are being invented for that are Gen AI or AI native platforms.
[1:50] SPEAKER_00: So let's just I'll just start with things that caught my eye.
[1:54] SPEAKER_00: You know, certainly AI-powered triage.
[1:57] SPEAKER_00: We we all know that time is of the essence in an attack.
[2:02] SPEAKER_00: And um the the amount of time you spend on incident and response matters down to the minute, the hour, the second, and what have you.
[2:10] SPEAKER_00: So I think triage is a big opportunity.
[2:14] SPEAKER_00: Um just to call out like Microsoft Security Copilot, for example.
[2:17] SPEAKER_00: I think you know their solution pretty well.
[2:20] SPEAKER_00: They they can cut incident uh response times from you know hours to minutes.
[2:25] SPEAKER_00: Um just like an emergency room, you know, minutes matter.
[2:29] SPEAKER_00: So that that's a huge opportunity, not just in security copilot, but really all the tools related to triage.
[2:37] SPEAKER_00: Um and and speed, you know, speed is of the essence.
[2:40] SPEAKER_00: So generating not just detection faster, but detecting more faster.
[2:46] SPEAKER_00: Like I know that another company you probably know, IBM, Watson X, used JI to um kind of write and validate new detection rules in real time.
[2:56] SPEAKER_00: So you're not just detecting faster, you're you're actually analyzing faster as well.
[3:02] SPEAKER_00: Um so it's changing everything about response.
[3:05] SPEAKER_00: I think that's hugely important.
[3:07] SPEAKER_00: And I think it's also enabling analysts to predict, um, not just react.
[3:13] SPEAKER_00: So we're used to reacting in security, always in IT in general, we're very reactive, or I think AI will free up more capability and give us new superpowers to kind of um be proactive and not just reactive.
[3:28] SPEAKER_00: I know, like CrowdStrike, for example, is is um yeah, training its Gen AI on billions of endpoint signals, and it it will be able, is able to kind of flag ransomware precursors early in the process.
[3:43] SPEAKER_00: So you're not not just learning about new ransomware in the in the you know the rear view mirror, you're actually seeing what's happening and what's being created in real time.
[3:57] SPEAKER_00: Um that that's huge.
[3:58] SPEAKER_00: Also, I think um you know, training and simulation.
[4:02] SPEAKER_00: You know, we uh it's it's the old, you know, train, train, prepare, prepare, prepare.
[4:08] SPEAKER_00: You you know that from your Air Force days.
[4:12] SPEAKER_00: I think you you're always training and preparing and doing drills and um ahead of real-world exploit uh exploits.
[4:22] SPEAKER_00: I think a lot of these new models are enabling us to simulate attacks so we can simulate our responses and you know, you know, prepare before the hackers do.
[4:34] SPEAKER_00: So that I think that's um super important.
[4:38] SPEAKER_00: And and education is kind of like discovery as well.
[4:41] SPEAKER_00: I think you know, a dark trace is looking at ways to find those mythical zero-day exploits that are so dangerous and rare, but very dangerous by spotting unusual behaviors that humans just wouldn't catch, right?
[4:59] SPEAKER_00: Through sifting through, you know, billions of data points.
[5:03] SPEAKER_00: So those are a few ways, but there are so many more.
[5:06] SPEAKER_00: I just pulled some examples that I sort of read about in the news.
[5:10] SPEAKER_00: But um, you know, there's really no no limit to the opportunity for gen AI and security.
[5:17] SPEAKER_01: That was those are some really strong examples, and you make some points that are sort of layered in there that are important.
[5:24] SPEAKER_01: I think that this gives us a chance to really up-level our more entry-level SOC folks, right?
[5:33] SPEAKER_01: And it gives them remediation paths, so it offers them options, it doesn't just find things, but it gives solutions to the problem, right?
[5:44] SPEAKER_01: So that's kind of cool as well.
[5:46] SPEAKER_01: So lots of good things.
[5:48] SPEAKER_01: Um, second question: how can organizations embed security and privacy controls into their AI model development without slowing down innovation?
[5:59] SPEAKER_00: Yeah, that's key.
[6:00] SPEAKER_00: Uh, you know, we we've got to make security uh sort of baked in from the beginning.
[6:06] SPEAKER_00: It's it's so often still an afterthought on a lot of the model training.
[6:11] SPEAKER_00: And um, there's some interesting work being done by startups whose name escapes me, but they're they're training models with differentiated privacy from the beginning.
[6:21] SPEAKER_00: So they can kind of shield sensitive data from exposure right at the front end in turn of uh versus leaking it out uh the back end.
[6:31] SPEAKER_00: So it's sort of you know built-in data controls.
[6:34] SPEAKER_00: I think OpenAI actually has enterprise AIs that ensure zero retention of data.
[6:41] SPEAKER_01: Yeah.
[6:41] SPEAKER_00: Because you don't want the model to hang on to your data if you're in healthcare, you're in finance, you're in a lot of industries.
[6:49] SPEAKER_00: That's an absolute no-no.
[6:50] SPEAKER_00: So I think even the big players are waking up, have woken up to this problem.
[6:57] SPEAKER_00: So I think it really is, you know, secure frameworks.
[7:01] SPEAKER_00: Um and I think that can actually mean faster launches because you don't need all that verification and testing SQA on the back end uh to discover and fix all the problems that you've created on the front end.
[7:14] SPEAKER_00: I think like Salesforce, for example, they have automated security reviews into Agent Force releases.
[7:20] SPEAKER_00: So it's it's just sort of integrated automagically into the process.
[7:26] SPEAKER_00: Um there's a lot of like automated compliance happening now, too.
[7:30] SPEAKER_00: That's that's pretty cool.
[7:31] SPEAKER_00: Like compliance, again, is like one of these things a lot of engineers, you know, data scientists kind of don't necessarily think about at the beginning.
[7:40] SPEAKER_00: So something like an Amazon bedrock will auto-enforce um certain policies and practices during model training, like HIPAA and GDPR and other SOC2 for you know, other frameworks, which you know is a big help.
[7:55] SPEAKER_00: I think that will be a big deal, uh just putting it out of out of not something you don't have to worry about.
[8:01] SPEAKER_00: It sort of becomes a checkbox.
[8:03] SPEAKER_00: And also in testing, amazing work being done with uh testing cycles and you know, how do you help developers not just develop code, but flag security vulnerabilities as they code?
[8:16] SPEAKER_00: So it's not like one of those typical, you know, develop test cycles, but it's it's it's sort of happening in real time with like GitHub co-pilots doing that.
[8:28] SPEAKER_00: So that that's kind of cool as well.
[8:29] SPEAKER_00: So again, so many opportunities, and it just it's just gonna require a brand new rethinking of embedded security and how you develop and test software.
[8:39] SPEAKER_00: And um I tell you, it's just amazing what's happening there with automated code gen.
[8:44] SPEAKER_00: And I think the security around it is as important as the tools that are being rolled out.
[8:50] SPEAKER_01: Right.
[8:51] SPEAKER_01: And that's those are such great points.
[8:53] SPEAKER_01: And, you know, I like that we're seeing sort of collaboration between teams.
[9:00] SPEAKER_01: You know, five years ago, there wasn't a network security engineer.
[9:05] SPEAKER_01: The title didn't exist, really.
[9:07] SPEAKER_01: I mean, maybe isolated here and there, but it wasn't sort of a norm title.
[9:12] SPEAKER_01: And the same thing happens with developer security, right?
[9:17] SPEAKER_01: So now you've got a dev security person that maybe sits between the security team and the dev team, and that can sort of help and coordinate and provide a bridge.
[9:28] SPEAKER_01: So that's all good stuff that's occurring.
[9:31] SPEAKER_01: Um, last question.
[9:33] SPEAKER_01: How should the CISO be thinking about AI adoption, not only in terms of its use to secure emerging threats, because we kind of talked about that a bit, but more from the organizational governance perspective.
[9:46] SPEAKER_01: Like how do they find balance?
[9:48] SPEAKER_00: Yeah, I don't think CISOs have much balance these days.
[9:52] SPEAKER_00: What a what a job, huh?
[9:53] SPEAKER_00: I wouldn't want that job.
[9:55] SPEAKER_00: Tough job.
[9:55] SPEAKER_00: Yeah, tough job, even tougher job, um, kind of overwhelming.
[10:00] SPEAKER_00: You know, what I'm hearing, you know, I'm sure you're hearing the same on your show, but from my show is, you know, using AI to secure AI, you know, is a big theme.
[10:10] SPEAKER_00: I think even about things like um deepfakes and and uh fake IDs.
[10:15] SPEAKER_00: And I mean, there are like 30 Evan Kerstells on social media, uh, you know, crazy stuff, and that's only gonna get work worse, worse with um deep fakes, voice and video deep fakes.
[10:27] SPEAKER_00: So I think some of like what DeepMind is doing around synth ID to secure um images and videos with watermarks is really cool.
[10:37] SPEAKER_00: And I think we're gonna need more on that so you don't have these you know investor calls that are completely faked.
[10:42] SPEAKER_00: You can kind of differentiate uh between what's real and what's not.
[10:48] SPEAKER_00: Um I think you know, uh systems are putting up more guardrails that will keep everyone on a certain path and that provides governance so they can fast track deployment without um you know going off the rails, pun intended.
[11:06] SPEAKER_00: So like JP Morgan has a whole AI governance framework that they use internally to develop new chatbot applications, and everyone's on the same page, so no one's sort of going rogue and has to worry about compliance uh problems after the fact.
[11:23] SPEAKER_00: Um so that that's kind of of cool.
[11:26] SPEAKER_00: Um and again, AI, you know, AI as an enabler we talked about, but also as a um as a kind of a threat hunter, it's out there doing work that you can't do.
[11:37] SPEAKER_00: You can't all spend all your days on Twitter and Reddit forums looking for, you know, following new challenges.
[11:44] SPEAKER_00: You only have so many time, so much time of the day.
[11:47] SPEAKER_00: Of course, AI has an infinite amount of time to find new threats, identify those.
[11:52] SPEAKER_00: You can kind of outpace adversaries that might be targeting your organization or organizations like yours.
[11:59] SPEAKER_00: So I think that's really interesting.
[12:02] SPEAKER_00: And um, I really like the work that you know companies are doing to go on the offense.
[12:08] SPEAKER_00: You know, like with Palo Alto networks, they're using Gen AI to sort of automate red teaming and stress testing and pen testing.
[12:17] SPEAKER_00: So you don't just have to wait to be attacked and respond, but you can think more proactively and offensively about threats.
[12:26] SPEAKER_00: And um, you know, the the whole like communication and collaboration dynamic is probably changing and has to change faster, like how the CISO reports to the board on security risks and you know engages with the wider team on customer trust and brand teams that have to deal with reputation.
[12:47] SPEAKER_00: So it's not just like you're sitting in your siloed office and you're just talking to your IT and security people all the time.
[12:54] SPEAKER_00: That's sort of wider communication.
[12:55] SPEAKER_00: I know Walmart is breaking down a lot of those barriers across the CISO to the board.
[13:00] SPEAKER_00: And so, yeah, all this is uh is um necessary, good.
[13:06] SPEAKER_01: I think you make a great point.
[13:07] SPEAKER_01: And maybe, you know, we're all growing and learning as we go here, but it seems to me that maybe the big thing will be that this is going so quickly that it's gonna force some of those silos to come to fall down, and it's gonna force communications right quicker, um, which is which are good things.
[13:29] SPEAKER_01: So as always, it's a joy to talk to you.
[13:32] SPEAKER_01: Thank you so much for the time.
[13:34] SPEAKER_01: And everyone, thank you for turning for tuning in, and we'll see you next time.
[13:39] SPEAKER_00: Thanks so much.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.