Most AI Security Is Theater. Here’s What Actually Works | Joshua Copeland | Security Mondays | S2 E5

Hi, I'm Eva Benn. Every Monday morning I bring you some of the best global security leaders to talk through what's actually top of mind, the threats they're seeing, the tools they're using, and the decisions they're making right now. Every episode is designed to give you practical things you can go and implement in your organization this week. Walk into most organizations and you'll find security that photographs well. Clean dashboards, a passed audit, a binder of policies. Joshua Copeland calls a lot of this security theater, and he's been blunt about it for years. He co-wrote a piece called Cloud Security Theater arguing that vendor best practices are written to look good in a slide deck, not to stop the way attackers actually move. His line: compliance shows you followed the recipe; resilience shows you can improvise when the recipe stops working. Joshua now runs security at an AI company, so he sees the AI version of this up close. Teams are buying AI security tools fast, and a lot of that spend lands as a better-looking dashboard rather than lower risk. In this episode he gives security leaders the questions to ask before they sign off, the controls worth pulling out because they add risk, and the handful of numbers that tell you more than any audit score. I'm doing my part by bringing you some of the best global leaders in the security industry every Monday, with practical tools and resources you can go use this week. What you'll walk away with: • How to tell if an AI security purchase reduces risk or just produces a nicer dashboard • The questions to ask in the room before you approve a new AI security tool • What to measure instead of compliance scores and audit pass rates • A test you can run this week to see if your org is actually resilient • One thing to stop doing now, and one thing to double down on If you find this helpful, I'd appreciate a thumbs up, subscribe, and share. It helps more people find the show. Connect with Josh: • LinkedIn:   / joshuacopeland   • His book, Unpopular Opinion (Amazon): https://www.amazon.com/UNPOPULAR-OPIN... Resources we mention in the video: • Cloud Security Theater (essay he co-wrote): https://blog.jpsoftworks.com/cloud-se... • His five municipal security strategies, SmarterMSP: https://smartermsp.com/municipal-cybe... • Status: Secure podcast appearance: https://open.spotify.com/episode/1vwI... • dnsUNFILTERED, episode 38: https://www.dnsfilter.com/podcast/epi... • Tulane faculty profile: https://sopa.tulane.edu/about-sopa/ad... Chapters: 00:00 — What Security Theater Looks Like in the AI Era 02:36 — Why So Much of Cybersecurity Is Just Performance 06:19 — 5 Questions to Ask Before Buying an AI Security Tool 08:32 — Why Compliance Doesn't Mean You're Actually Secure 12:32 — The Metrics That Actually Matter 15:21 — Why Security Transformations Keep Failing 18:37 — What a Boring but Effective Security Program Looks Like 22:05 — The AI Risk Most Security Leaders Are Missing Want to hear from more voices in AI security? Security Mondays is a proud partner and supporter of the AI Cyber Magazine. Find it in any Lufthansa or Delta lounges. Not traveling soon? Get your copy here: https://aicybermagazine.com And follow along for more free cybersecurity education. 🤗 LinkedIn:   / evabenn   Instagram:   / evabennofficial   TikTok:   / evabennofficial   Website: https://www.evabenn.com/