Princess Okoro, Manager, Security Governance, Risk and Compliance at Trainline, makes the case that adding AI to a broken process only makes the process worse. She shows how her team uses a ChatGPT policy review agent as a first pass with a human checking every finding, and why AI governance is the next problem to solve.
Guardrails matter as much as the prompt. Princess Okoro tells the agent what it must not do, anchors it to named standards such as ISO and PCI DSS, and instructs it to come back with questions when it is unsure instead of hallucinating. The same thinking shows up in Ask Infosec, an internal custom GPT that answers policy questions for the business, and in a growing map from policy to control to risk that feeds a unified control framework at Trainline.
Tooling comes with trade-offs. Trainline is implementing a GRC platform chosen because it handles risk better than the alternatives, and Princess Okoro expects her team's future to blend that platform with AI tools rather than wait for one product to solve everything. She also notes that many GRC platforms lean toward compliance and SOC 2, while the conversation in the UK centers on risk.
Next on her list is AI governance. With ISO 42001, the EU AI Act, and the NIST AI framework offering nothing she can lift and shift, Princess Okoro is working out the minimum controls required, because no organization can do everything, and how GRC can serve a business that is pushing hard on AI adoption.
For security and risk leaders, the takeaway is plain: GRC earns its seat when it serves the business, and AI helps only after the process underneath it works.
Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/
Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline | On LinkedIn: https://www.linkedin.com/in/princessdavidokoro/
Trainline | https://www.thetrainline.com/
The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq
Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore all of the programs.
princess okoro, trainline, sean martin, grc, ai in grc, ai governance, policy management, ai agents, human in the loop, control mapping, pci dss, iso 42001, risk management, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast
Using AI to Cut GRC Busywork Without Cutting Out the Human | A Redefining CyberSecurity Podcast Conversation with Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline
[00:00:00] Sean: And hello everybody, you're very welcome to a new episode of Redefining CyberSecurity. This is Sean Martin, your host, where I get the privilege and pleasure of speaking with some really cool people about topics that I think are cool. They're certainly important but not everybody likes to nerd out on security and risk management like I do, and governance, risk, and compliance is a broad picture like I do.
But thankfully, Princess Okoro is on, and she and I are gonna have that chat today, and hopefully it will inspire some people to think differently about governance, risk, and compliance in the world of AI and how it affects our business and the security and IT ops programs that we're running. So Princess, thank you so much for joining me.
[00:00:40] Princess Okoro: Amazing. Thank you, Sean. Thanks for having me. I am glad to be here
[00:00:43] Sean: It's a pleasure to meet you and to have you on the show and yeah, all the way from London. You're cooler this week. I know you had the heat wave. We're gonna, we're gonna have that heat wave in New York now, so I'll, I'll be feeling what you felt [00:01:00] a week or two ago.
[00:01:02] Princess Okoro: Hopefully
[00:01:03] Sean: I know. Yes. We'll stay, we'll stay cool. I think that's a motto that every security professional needs to hold dear. Stay cool. So I saw a post. Many, many of my conversations are driven by things that make me think, and when people write something that I think is meaningful and it gets me to think about it a bit, I wanna have a chat with them, and that's what happened here.
So you made a post on LinkedIn looking at GRC and the impact of AI and all the fun stuff that comes with that. So we're gonna talk about that post and some of your views and some of the work you're doing there. Before we get into that a few words about who you are, Princess, and what inspired you to write that post?
[00:01:44] Princess Okoro: Amazing. Thanks. Thanks, Sean. My name is Princess, Princess Okoro. By day, I am a security governance risk and compliance manager at Trainline. So we are one of UK's leading train booking [00:02:00] platform. So my job is to make sure that risk controls compliance and not just tick box exercises and they are aligned to how the business operates.
So how engineering is built, how regulatory requirements are handled, et cetera. But before moving into Trainline, I used to be a senior security consultant. I did that for, about seven years, give or take. So I did actually start my career in digital forensics and incident response then moved to governance risk and compliance by chance, and then I stayed there for, seven years. So I had done consulting for different businesses. So startup scale-up critical national infrastructures, OT security. So I've had the feel of what it feels like to work within GRC from multiple angles. So either from the consulting side and obviously coming in-house, which I'm currently at now. And one of the things that you see is once you move from consulting to become, [00:03:00] An in-house GRC person, security person, it's kind of different. I think the first thing is there's a culture shock initially, and then you realize that there's, 110 things that needs to be done. and you will probably know that the average security team is under-resourced, right? similar to GRC, the average GRC team is under-resourced. So currently my focus now is I came in as a senior risk specialist, and my focus now is building the GRC program around a couple of transformation project that we are working on. And one of the things that we are trying to leverage as well as govern is how we can use AI to obviously cut down some of the groundwork as well. 'Cause in reality, a lot of things that GRC people do is kind of like a glorified admin work, if I'm being honest. And I think most people can attest to it. recently I think around January or so, I spent some time, I got the Mac Mini when OpenClaw was a thing just ' cause I was [00:04:00] curious. And it was more so to understand 'cause I feel...
I come from the notion that you cannot govern what you don't understand. So I spend time to understand 'cause the company I work for, they are really driving for adoption of AI. So for me, it was more so of, if I'm doing a risk assessment, I need to understand what I'm assessing. i.e. the obsession with AI was birthed from there. And then I've been in conversations in different rooms where obviously there's this whole conversation around GRC engineering how things need to change, and there's obviously a need to change. But is the midpoint that people are forgetting. So there's the extremely technical folks that obviously they've interconnected cloud, et cetera to different code pipelines and stuff.
But I think in GRC it's understanding the basics. So there was that gap as to people not really understanding the basics on how AI can be leveraged in GRC. And the way I see it is if we can gain 10% of our time back, we've had a [00:05:00] win, right? If you can obviously understand how, if you can save time in doing a risk assessment, that's a win.
So I started writing about it on LinkedIn, about what I was learning and about some of the examples of things that I am building, hence that's how you found me on LinkedIn.
[00:05:16] Sean: Yeah. super cool. And I love the drive to explore and I love what you said you have to understand what you're looking to govern. And I think that's an important piece, and I wanna know, maybe just to kinda kick things off how... So clearly you were spending time looking at AI models and how to use them in the GRC space.
You know the GRC space, but you're looking at the AI world to understand that a bit better. Do you, do you find that people truly understand GRC when they start to bring in AI tools? [00:06:00] Or are they... 'Cause I know what I think. Or are they, or are they looking to AI to make them think they understand?
[00:06:11] Princess Okoro: Yeah, I think, think a short answer is if you add AI to a broken process, it's just gonna make it worse. I don't think people understand it yet. So one of the things that I had done was more so of with the way my team is structured, so I manage a team of four. our GRC function is broken down into five different work streams.
So we have the governance and policy management, we've got the risk management, the third-party risk management compliance assurance, and then we've got security awareness and training. And different individuals are responsible for those areas. So I think for me, it was more so of like, okay, within each of those work streams, where, where can AI be most effective and where can it make us efficient? Because at the end of the day [00:07:00] you could write Claude you could, you could obviously use Claude to automate some evidence collection, and that's where it ends, right? Well, from a longevity perspective, how can you maintain that in itself? to answer your question, I don't think people fully understand yet and know where it can be useful. Hence, there is this hype. I think what is being sold now is the hype. Everyone is trying to catch up, and everyone is feeling left out as well. they're trying to say, "Okay, so AI is gonna take our jobs. I need to learn AI. I need to use AI." And everyone is just learning as well. I was in that shoes as well.
I spent the, I think January and February, if you looked at my YouTube history, everything was Claude this, Claude that, AI this, AI that, right? Until, I took a step back to understand, okay, I'm just gonna spend hours watching YouTube videos that will make the kids et cetera.
[00:07:54] Sean: So let's... And I have to look up all the rest of the posts. Sounds like you've done a lot. The... I landed on one. [00:08:00] I said, "I need to talk to you." This one's around specifically policy.
[00:08:04] Princess Okoro: Yes
[00:08:05] Sean: And so let's take a few minutes here, and then we can talk about some of the other ones as well, and if you wanna share those links, I can, I can put them in the show notes.
So you said glorified admin policy. I don't know. Policy doesn't seem like an admin task to me. But maybe creation or maybe maintenance is. I don't know. Or do... I don't know. What part's the, what part's the unglorified admin piece and why did you pick this as an area to focus on?
[00:08:35] Princess Okoro: So with the policy bit, so When I started writing on LinkedIn, it was more around AI use cases for GRC or use case of AI and GRC. And I was going through, as I mentioned, how my team is structured. So the first work stream was policy. So I, that's why I started with the policy bits. And it just happened to be that we are going through a policy refresh currently in my organization. So that was the best [00:09:00] buck for our money, if I'm being honest. And I think about last month or the month before, I think May or so, there's a new functionality on called Agents. You would have access to that if you are on the enterprise plan. And what this does is, as opposed to, it makes creating of agents slightly easier using agents on ChatGPT. So it was something that I started to explore. So the logic behind the policy reviewer agent was, obviously, we've all reviewed policies before. It takes time. You need multiple people to review the policy. In some instances, the policy do not really map back to the controls. So let's say you are complying to ISO, PCI, DSS, NIST, et cetera. And what the agent does was through a set of policy checklist that was created connects to at least Yammer also for Confluence, et cetera, [00:10:00] and the repository for where the policies are held on SharePoint.
So historically, let's say you wanna review a policy. Most people will just copy the policy on ChatGPT and say, "Okay, can you review this policy for me? Where are the gaps," right? It's gonna give you some answers. But there was a couple of outputs that was specific to what we wanted. So like what you need to check for, ambiguous wordings gaps in policy mapping, some bits that are outdated.
So for example, I might look at a policy, and I would not know that like a GDPR reference of 19 something is out of date because there's so much so you can remember. So a couple of things that somebody might have gone through a review and skip, so it did that. So an example was we ran the data classification policy through it as a first pass.
So the idea is this policy review agent acts as a first pass, then a human confirms it, right? [00:11:00] the plan is not to get humans out of the loop. You know, there's always gonna be humans in the loop definitely. But what it's found out was a couple of things that even if I had reviewed the policy myself, I might have missed. And this is where AI becomes quite beneficial. So the way, the way it was structured was looking at The scope and the standards, the executive summary, missing clauses, controls gap, et cetera. And then apart from the structured outputs, right, I also told what's it called? Specified the things that it should not do.
So it's very important. So whilst we are, okay, review this, there are some guardrails as well that you need to put in place, right? To be very, very specific. as opposed to letting AI do random things, it needs to be very specific. That's when it becomes quite useful. So in this case, its work was the ChatGPT agent was responsible for policy review and control gap analysis in this context. And what that had done [00:12:00] is, obviously, at the first pass, we saw what was missing, then the reviewers goes to validate it, and this reduced the time because did, it did spit out all those things for data classification policy in, two or three minutes. And ideally, that would've taken, a few days of chasing people to review stuff.
[00:12:19] Sean: Ah, right.
[00:12:20] Princess Okoro: Yeah
[00:12:21] Sean: So I want, I want your thoughts on two things. So you mentioned somebody's going and auditing. Maybe you can describe that process as well because Yeah, I guess we'll call it what everybody calls
[00:12:37] Princess Okoro: Yes Yes.
[00:12:41] Sean: hallucinations, right? Stuff, stuff gets in there that shouldn't be. It happens. Or stuff gets missed or rewritten in a different way. It doesn't quite hold the context or, or really fit what's trying to be accomplished. So there's that piece of it. And so accuracy and integrity and the whole auditing process.
But then also you [00:13:00] mentioned that you're looking at this from an efficiency perspective, taking days and hours and bringing it down to minutes, which is super cool. Do you also find, maybe this-- I'll ask the second question again later 'cause I'm bundling two, but do you also find that the chasing a better outcome is also possible?
Where the... I mean, the ultimate goal is to have a policy that's actionable, right? Not just, not just as written. So I'll go back to the first one, then I'll ask the second one for you again. So more around the quality and the accuracy and the integrity and the whole audit process for what you've done.
Describe that for us.
[00:13:41] Princess Okoro: So from, from integrity, obviously we're worried about it has hallucinating, right? So there was a reference file created with checklist and a policy index of things to look out for things not to look out for. Things in simple terms, like the recommendation has to [00:14:00] be obviously based on the ISO standard that was referenced in as part of being that agent, the NIST bits. It do not... It's as basic as do not hallucinate. If you are not sure about something, come back to me with questions. So it could come back with questions, "Okay, you need to chase up on A, B, and C stuff." And the agent does not, action the policy, it provides recommendation. So it doesn't automatically go and just change bits, et cetera. I think that's where the limitation is. I would know if a team member says, "Okay, they've done a review," and agent did the review, I would question it you need to validate some of those things. So with the reference file, it's had some of the things it looks out for and that was more so of the guardrail that was put around what it can do. And obviously you're anchoring to a couple of standards in itself. So the output is gonna be the same across each policy. So it's putting the same structured output. So that was the uniqueness around this. [00:15:00]
[00:15:00] Sean: And then in terms of outcome,
[00:15:03] Princess Okoro: Yeah
[00:15:04] Sean: so to that question now did you find either purposefully tackling it as a better outcome, or did you find that you found better outcomes? I guess, and maybe an example, 'cause what I'm thinking of is...
[00:15:19] Princess Okoro: Yeah
[00:15:20] Sean: I don't know if I can even think of an example that's real, but yeah, a policy that talks about, 'cause you have awareness training too, so maybe, maybe programs around phishing campaigns and how to, how to manage, yeah, exposure of personal information.
I don't know. I'm making something up. Then do you see a connection between the outcome and the policy that actually drives an action to better controls or better awareness training, or do you... Can you make, draw those dots, make those lines, connections?
[00:15:50] Princess Okoro: So with this specific reference, it was a data classification policy that was put through the agent as an example. And [00:16:00] obviously the PCI DSS had a refresh recently. The policy did reference to some updated wardens, et cetera some controls that is not reflective in the updated version of PCI DSS.
I wouldn't have spotted that ideally. So that was one. And in itself, with the way it grades the recommendation, so what I had recommended was like based on the recommendation for the edits, what's the most riskiest, right? So what would, what would it mean us if we need to get ISO and we don't have this control statement on there?
So it gives the recommendation based on that. So the idea is not to go and recommend and change all the policy edits, right? But it's more outcome driven. So within our use case, we're an ISO house for PCI DSS. Those are the key key frameworks that we are keen about. So your policies need to make sure that the controls have been there. And then the bottom bit as well that did not exist in the policy before, is the policy to control mapping, which it kind of does well as [00:17:00] well. 'Cause we're trying to build like a unified control framework. So i.e., the policy maps to the control, the control maps to the risk. You've got like a continuous loop, et cetera, on how things tie together. So we're beginning to paint this picture with this. So this is just a, an example of where this can be beneficial.
[00:17:18] Sean: Yeah, I love it. And speaking of pictures, you have a diagram in this particular post,
[00:17:24] Princess Okoro: Yes,
[00:17:24] Sean: I think it's gonna be important for people to look at that and kinda look at your flow and all the elements that are part of it. Picture's worth a thousand words. Lot of audiences might look at a picture and read it in a different way.
So who,
[00:17:40] Princess Okoro: mission
[00:17:41] Sean: who, who is your audience for the work that you're doing with your team, and are you able to communicate differently and/or perhaps better
[00:17:51] Princess Okoro: Yeah.
[00:17:51] Sean: that you have
[00:17:52] Princess Okoro: Yeah.
[00:17:53] Sean: this work being done?
[00:17:54] Princess Okoro: I'd say internally another [00:18:00] example that was created by a member of my team was it's called Infosec, Ask Infosec, I think. Ask Infosec. And what was done was all the policies that have been maintained where this is, this is not even ChatGPT agent, it's your ChatGPT, GPT, right?
That you create, that anyone can use. And we've got all our policies loaded on there. And what people do is, rather than come to the Infosec or GRC Slack channel to ask "What does this vendor need?" You just need to ask, "Okay, is this a high-risk vendor? Does this fulfill PCI DSS requirements?" And you get an instant answer. So that is something that has been quite useful because that kind of communicates in a simple non-technical way to the business users as well. So from a communication of policies, et cetera, it's been easier to communicate those to the business or the, or to save us time from people asking us back and forth question when we've got a reference.
So I think from a [00:19:00] policy question and answer perspective, it's been very, very helpful because people can just go to the GPT, ask questions. What data can I add in, what data can I add in ChatGPT? Is it highly confidential, confidential? Those basic questions that can be asked be answered already, so this has saved that time.
People still reach out to ask more questions if I'm being honest, but this has saved that initial time as And I feel like outside of work, one of the things that this me posting has done, it's opened people to the possibilities of what they could do, I'd say. 'Cause the way I see it is there is no single use case in AI, right?
That can solve everyone's problem. There's no single prompt that can solve everyone's problem. The people that are making the most out of AI now are the people that are going in with an experimentation mindset, right? So I think for me it's if I write about what I've done, someone can be like, "Oh, this is good, but I can do better."
Right? Do you get what I mean? So it's just like [00:20:00] opening people to the possibilities of things that can be done. And as I mentioned previously, historically, GRC is like a glorified admin work. How you're chasing people, you are... lot of things are manual. And as I would always say, GRC is the easiest within security that AI can be applied to, because it's the most basic things that you need to do for you to start seeing like a an efficiency gain, to say the very least.
So I think the word is like understand what, how your GRC system is structured. It might be that you need at least a rural to help with triaging tickets, right? We've got that someone is currently experimenting that in my team. So based on the tickets that come, it's routed to the different whether it's product security.
It could be that in itself. It could be like a basic basic workflow that would solve that. But then before you can do all this, you need to have your process in place. And at the [00:21:00] end of the day, you might not need a full-fledged autonomous agent. You might just need standard that actually work, and that's what you might actually need at the end of the
[00:21:09] Sean: Yeah
[00:21:10] Princess Okoro: And if you are looking at it from a program perspective, it might be this year your focus is to see if you have 20% time saving. Next year, you're seeing how you go into great stuff, then you leverage your tools, et cetera. But then if you go with a mindset of you want to fix and automate everything, you'll probably crash
[00:21:32] Sean: That's what I like to do. I like to do the whole thing all at once.
[00:21:38] Princess Okoro: Always
[00:21:38] Sean: Marco, Marco gets mad at me, my co-founder. He's like, "Not everything needs to be automated." I'm like, "I know, but it's fun.
[00:21:45] Princess Okoro: time,
[00:21:45] Sean: But it's fun."
[00:21:46] Princess Okoro: when I was playing with Claude, I was... I building at the time? I think I was building something, right? He just started with like a basic prompt. I was like, "Oh my goodness, I could do this." I was on my laptop till 3:00 AM. I think my partner was like, "You need to go to bed now." "You need [00:22:00] to go to bed now. This is, this madness, right?"
[00:22:02] Sean: Yes.
[00:22:03] Princess Okoro: No more
[00:22:04] Sean: Yes. That happens. Yeah.
[00:22:06] Princess Okoro: weekend. Yeah.
[00:22:06] Sean: Yeah, Claude tells me it's time to go to bed, which is a bad thing. And I tell it... No, I tell you when it's time to go to bed, not the other way around. I wanna ask you this, and you can share as much or as little as you're comfortable with. But 'cause when I was in London, and it's not specific to London or Europe or the InfoSecurity conference there, but something's been brewing in my mind and some conversations I had with some CISOs off the record,
[00:22:34] Princess Okoro: Mm-hmm.
[00:22:35] Sean: At some dinners, kind of led me to this idea that people are gonna do...
Well, and actually some even said they're doing what you're doing for different parts of their, their operations. So you're looking at GRC. Others were looking at, you know the SOC, and others were looking at endpoint management and things like that. I feel that people are [00:23:00] gonna do what... and teams are gonna do what you're doing, which is, "I'm not gonna look for an off-the-shelf platform," quote, unquote, "that's gonna give me a frame to work within.
I'm gonna find how my business operates, and I'm gonna look for the most effective ways
[00:23:16] Princess Okoro: Mm-hmm.
[00:23:17] Sean: to do better with these little things." To your point, you're not, you're not gonna build the whole thing. You're gonna look for specific areas. Did you... This is where you can share a little little as much as you want.
SharePoint means you're a Microsoft shop. You have access to Copilot and other things, but you mentioned some other tools. I'm just wondering, did you look at GRC platforms to help with some of this stuff? Did you look at the MS environment to kinda plug in and use things that are already there and, I don't know, kinda describe that process for me.
[00:23:52] Princess Okoro: I'm kind of six month, six months and some change or seven months into my role. The first three months was to improve our risk management [00:24:00] process, et cetera. The next focus as well was obviously building high performing team as I stepped in as a manager. And we are currently implementing a GRC platform as we speak, but it's not fully operational.
So, i.e., it's a conversation around are we gonna wait until this is... You know, it takes three months and some change to implement a GRC tool. Are we gonna wait until this is operational or see what we can leverage, right? And what you would notice is most of this GRC tool, it would not solve every of your problem as well. Because this thing about GRC-ing your way, right? and then there's a GRC platform, So it's like, where does that... So I think what I see is for people to make the most, you probably would use a GRC platform and Also built to connect. So I know some of these GRC tools like Vanta, they've got MCP connectors now that you could [00:25:00] push and pull data, there's et cetera to and from. it's that balance. So where we sit currently now, so we're currently implementing the GRC platform, but I wouldn't say a GRC tool would do everything for you. So with the policy review bits, obviously the GRC platform that we are implementing, it does a bit of that, but not into, to great detail. So it's more so of helping to write a policy. It does bi-directional sync as well to, our policy is being sat, et cetera. But not to that full extents as except you meet the person and they are the people that have created the tool and they are willing to apply that specific use case. And also one of the things I've seen with most of this GRC platform is most people focus on compliance, a lot of focus on compliance, SOC 2. And I keep saying it, right, in the UK, if you want to break into the UK markets, can we stop having conversation about SOC
[00:25:58] Sean: Mm-hmm. I know
[00:25:59] Princess Okoro: It's an American thing. [00:26:00] And people would pass ISO without even having a GRC tool. What the UK is focused on mainly is risk, and I don't think it's gotten a lot of traction, if I'm being honest.
So you'd see that
[00:26:12] Sean: Yeah
[00:26:12] Princess Okoro: most... So the tool we ended up leveraging from the review that was done did risk better than the other platforms, right? Or they were just at the point of doing risk better than the other platform. And that was why I went for the tool, 'cause for us it's more so of like the way I see the GRC program is assume that we don't need to comply with any of this ISO, how would you manage security? a risk-based approach, right? so hence why I went for the tool. So I think the future of what that would look like for my team would be a blend of the tool, of using the GRC platform, and also what we can do to, what's it called, with some of the AI tools that we have. Because the business is pushing to [00:27:00] be AI literate hence,
[00:27:02] Sean: Right?
[00:27:03] Princess Okoro: et cetera, why the hunger from my side, et cetera.
[00:27:07] Sean: Yeah. It's fantastic, and thanks for, thanks for sharing that. And yeah, we're coming up on time here. And so maybe I'll, I'll close with this. And I kinda want maybe kind of a view. You talked about the GRC platforms. This is not necessarily about that, but kinda what's next for you and your team, and maybe in the context of other leaders that are listening to this episode who might gain from your experience of, "We were able to accomplish this because we got buy-in from the executive leadership team, and therefore we're gonna do these things next."
I don't know. What's next for you, I guess, is the open question?
[00:27:50] Princess Okoro: One of the things that is keeping me up at night, not really, I still get good sleep, is the conversation around AI governance, right? [00:28:00] I think that's the next big topic, and obviously most of the AI governance conversation kind of falls within GRC to some extent, 'cause obviously there's the policy bit, there's the governance, there's the risk assessments as well.
So in my organization as well, we are, as I mentioned, we are trying to be on the frontier of AI adoption. with that in itself means that you need to get your controls to a specific level. You need to be able to communicate what that risk is to the business in a way that is leveled up and the business understands it. There needs to be governance around that in itself. So I think for the next few months, there's a lot of work that will be done around AI governance and understanding where it sit, understanding how GRC can serve the business better when it comes to the governance around AI in itself. So whether we're building agents designing what that AI agent governance framework looks like, designing what the minimum controls look like as well. I spent time in consulting, [00:29:00] so I read all this framework. With the, with the ISO 42001 EU, obviously EU AI Act is mandatory NIST's AI framework, et cetera. There is nothing that is very bespoke that you can lift and shift, right, from an AI governance perspective. So what this means is you really need to take time to understand what is the minimum control required, when it comes to AI governance, 'cause you can't do everything.
And
[00:29:27] Sean: Right
[00:29:28] Princess Okoro: business accepts in hindsight. So it's defining what that looks like and how GRC can support the business better
[00:29:38] Sean: Yeah. I'm so glad you just ended with that, 'cause I was gonna go back. I heard it earlier and I was like, those are the magic words when GRC serves the business better.
[00:29:45] Princess Okoro: That's so good
[00:29:45] Sean: And yeah, Princess, it's so cool to connect with you and to chat with you. I'm gonna keep following all your posts and
[00:29:55] Princess Okoro: you. Thank you
[00:29:56] Sean: reading what you share, and you are welcome back anytime you [00:30:00] want if you have updates or other, other key findings you wanna share with folks and
[00:30:03] Princess Okoro: once we get to the point of, we've adopted AI well, we've gone through all the whole madness maybe, 'cause I think that we've spent, I spent a lot of time on the whole, cloud implementation, cloud rollout, kind of sector. So there's a lot of lessons as well learnt from that aspect in So yeah, excited for-
[00:30:23] Sean: good stuff. Well, thanks for pioneering this space and taking your team to the frontier and sharing your story with us. It's,
[00:30:32] Princess Okoro: Yeah.
[00:30:33] Sean: cool.
[00:30:33] Princess Okoro: Thanks
[00:30:34] Sean: So thanks a million, and everybody listening, watching, thanks for joining. Please connect with Princess Okoro and stay tuned for more episodes on Redefining CyberSecurity.
Thank you, everybody
[00:30:46] Princess Okoro: Thanks and bye then.