For decades, cybersecurity has been built around finding problems and alerting humans to fix them. Lizzy Nammour believes AI could fundamentally change that model: the future of security may be no alerts at all, because software can understand what's wrong and fix it before a human ever needs to intervene.
Lizzy started as a software engineer on a three-person data security team at Airbnb, trying to secure ten years of data that engineers kept collecting faster than anyone could map. She went on to found Teleskope so companies can fix data risk automatically instead of drowning in alerts.
In this episode of The Flywheel, M13 Managing Partner Karl Alomar sits down with Lizzy to talk about why AI turned data security from a compliance exercise into an urgent problem. Here are the key takeaways.
Key takeaways
Data security has to be preventative
Incident response comes too late for data security. As Lizzy put it, if the data was already breached, "what do you do next?" Good data security means understanding the systems engineers and every other employee use, and applying proactive controls.
Alerts nobody reads don't make you safer
Many companies tried early DLP tools and gave up because they were too noisy. The alerts went to an email address no one looks at, or a Slack channel holding "hundreds of thousands of alerts." Finding more problems doesn't make a company more secure if no one can act on them.
Why Airbnb had to build its own
At Airbnb, a three-person data security team was trying to secure ten years of data from a company that scaled from zero to a hundred very quickly. GDPR made the gap obvious. The tools on the market at the time had high false positive rates, couldn't scale, and handed over reports of where sensitive data lived, leaving the team asking how to delete or protect it.
AI spreads data faster, and makes it easier to find
Everyone from engineers to marketing to HR now uses AI, and those tools can reach sensitive data. AI assistants like Claude generate artifacts on laptops and in the cloud, moving data much faster and in a much more obscure way than a human could. The same tools also make sensitive data easier to find: ask an assistant with access to Google Drive for payroll information and it answers faster than anyone could search for it.
Where AI helps most: reasoning with business context
Classifying petabytes of data isn't where the largest language models help, because they'd be too slow. The real shift is a reasoning layer that decides whether a piece of data is risky in the context of the business, mimicking what a data security engineer would do, and then acts on that decision.
Context decides risk
A tax advisory firm storing Social Security numbers is business as usual. A company like Airbnb should probably never store them. Generic tools can't tell the difference, which is why they leave teams with dashboards and manual work.
The CISO job moved from blocking AI to enabling it
Two years ago the question was how to block ChatGPT. Now the board expects the business to use AI, so CISOs need to be more technical and more business-oriented at once. AI scale-ups that grew faster than Airbnb often have no security until Series C or later, so their security leaders have to build basics like MFA and EDR while also defending against new AI threats.
Knowing about a risk you can't fix makes you liable for it
Lizzy said DSPM tools often ended up as shelfware, because teams couldn't operationalize them. Customers don't want to know they have a problem unless they can fix it, since knowing and not fixing creates liability. It's not only external risk either: at one Teleskope customer, the CEO's W-2 was accessible to everyone at the company.
What comes next: proactive, automated security
Lizzy expects security to move from reactive, alert-based work to proactive, automated security, like a copilot, with humans always in the loop. Across data at rest, data in motion, access, and identity, she described the company Teleskope is building as a data control plane that enforces security governance on an organization's data across the stack, as automated and agentic as possible.
Listen and watch
Watch the full conversation above on YouTube, or follow The Flywheel on Spotify and Apple Podcasts. Learn more about M13.
Full transcript
Episode: The Future of Security is Data Security, The Flywheel (M13)
[00:00:31] Karl Alomar (M13): Hi, everyone. I'm Karl Alomar, Managing Partner at M13. For decades, cybersecurity has been built around finding problems and alerting humans to fix them. Today's guest believes AI could fundamentally change that model. The future of security may be no alerts at all because software can understand what's wrong and fix it before a human ever needs to intervene. Lizzy Nammour is the founder and CEO of Teleskope. She first encountered this problem as an engineer at Airbnb, where even one of the world's most sophisticated technology companies had to build its own tools to understand and protect sensitive data.
In this episode, Lizzy and I get into why finding more threats doesn't necessarily make companies more secure, whether AI is creating more data risk than humans can possibly manage, and the uncomfortable question at the center of autonomous security: how much authority should we actually give AI to protect our data? Here's my conversation with Lizzy. So Lizzy, welcome.
[00:01:22] Lizzy Nammour (Teleskope): Thanks, Karl.
[00:01:23] Karl Alomar: Thanks for being here. We are gonna talk about all things data and security today.
[00:01:28] Lizzy Nammour: Great. I'm excited.
[00:01:29] Karl Alomar: I'm excited too. I know this gets you up in the morning every morning, right?
[00:01:32] Lizzy Nammour: It does.
[00:01:33] Karl Alomar: So, where... I mean, it's such a changing world. Maybe we can start with just kinda, like, the origins of security, data, how those intertwine. Like, what are your thoughts on what's gotten us to the place where we are now, pre-AI, let's start with?
[00:01:48] Lizzy Nammour: Yeah, 100%. I think obviously, like, we came from a world where people were gathering data in the world of, like, big data, right? They thought that data was gonna be the key to their kingdom. They could sell this data. All this data was gonna make them a super successful company. But then they forgot to think about the implications of, like, what does that data actually bring you? Is that data actually useful, or are you just collecting more data to just collect more data? So that was probably, like, even pre-2015 era. Then came the compliance regulations, when people started to think, hmm.
[00:02:21] Karl Alomar: GDPR came out in Europe.
[00:02:23] Lizzy Nammour: Exactly. Of like, okay, all these consumers are giving these companies their data. They should be the ones that own their data, that can tell the company what to do with their data. So that's when companies started to take a step back to think, okay, maybe I should start minimizing the data that I'm collecting. Maybe I should start knowing what customer data lives where.
[00:02:42] Karl Alomar: Or even track and find your customer's data so you can do something with it.
[00:02:46] Lizzy Nammour: Exactly. And now data security is all about AI and making sure people can adopt AI safely.
[00:02:52] Karl Alomar: We're gonna get to AI, 'cause I think that's a whole other ball of wax to unravel. But historically, I think security has always been thought of as kinda like medicine in some ways, where when you get sick, the security will try and fix it.
[00:03:09] Lizzy Nammour: Yeah, incident response.
[00:03:11] Karl Alomar: More incident response. More kind of like grassroots, but not really preventative, not really thinking about the architecture of security. Is AI really the turning point of that, or was there some semblance of that with GDPR and some thinking about, well, wait a minute, we need to create... I mean, there's been some pretty bad leaks out there historically, right? So at what point do you think the market started waking up to that idea?
[00:03:32] Lizzy Nammour: There had always been leaks, but obviously compliance regulations started giving a monetary value to what a fine looks like. And now leaks, let's say even regardless of GDPR and compliance regulations, do cost organizations a lot of money.
[00:03:49] Karl Alomar: At the end, it's all about the money, right?
[00:03:50] Lizzy Nammour: Yeah, a lot of money, but also a lot of shareholder value, 'cause their stocks plunge, but that doesn't last that long.
[00:03:56] Karl Alomar: I think the introduction of GDPR kind of introduced the idea that, wait a minute, as a customer you should care about your data. You should care 100% about what happens to it.
[00:04:05] Lizzy Nammour: Because before, no one really thought about it. They're like, well, I'm just gonna give my credit card number. What's gonna happen? Now unfortunately, most companies have your credit card number.
[00:04:13] Karl Alomar: And I think the younger the generation you are, the more sensitive you are to these things. I'm in an older generation. I am probably way too loose with my data.
[00:04:20] Lizzy Nammour: But I think data security in particular is where it has to be preventative, and where you actually have to understand the systems that engineers use, that every other employee in the company uses, to apply good proactive controls. 'Cause incident response, it's too late. Your data was already breached. What do you do next?
[00:04:41] Karl Alomar: And a lot of the legacy systems have really still focused on detection and incident response rather than solving the underlying problem. Right?
[00:04:52] Lizzy Nammour: And in the past, I think with data security specifically, people weren't investing too much in it. The risk wasn't really known to the business or to the board yet, and people were more focused on other aspects of security, like incident response.
[00:05:12] Karl Alomar: Physical security.
[00:05:12] Lizzy Nammour: Physical security. More ransomware types of attacks, more attack-based issues. And I think data security was kind of put to the wayside. A lot of people maybe had tried DLPs when they first came about, but then realized, oh my gosh, it's too noisy. It's not useful. There's too much data. Too many alerts. I'm just not gonna do anything about it.
[00:05:30] Karl Alomar: What am I gonna do with it? Like, what happens with the alert?
[00:05:33] Lizzy Nammour: I'm just gonna ignore it, put it in the stockpile of, you know, alerting this email address that no one looks at, or this Slack channel that has hundreds of thousands of alerts, and that's it.
[00:05:44] Karl Alomar: So you first really started realizing this problem in your time at Airbnb, right?
[00:05:51] Lizzy Nammour: Yes.
[00:05:52] Karl Alomar: That was pre-AI, right?
[00:05:54] Lizzy Nammour: Pre-AI. Yeah.
[00:05:55] Karl Alomar: How did that manifest? Like, how did you end up getting interested in security, and what was the challenge that you were facing at Airbnb when you started looking at it?
[00:06:03] Lizzy Nammour: I'm a software engineer by trade, so I went to Airbnb. At the time at Airbnb, it was kind of like reverse pitches: the teams would pitch to you what work they were working on. And I got really excited about the data security team because it was a team of maybe three people focused on helping Airbnb secure all of the data that they've amassed over the past 10 years. And Airbnb was one of these big scale-ups that went from zero to 100 very, very quickly, and just had engineers that were shipping code, collecting more data, and no one knew what was going on.
[00:06:39] Lizzy Nammour: And security was there to kind of control this, first by understanding and then enforcing the right controls.
[00:06:45] Karl Alomar: And you were able to build actually a really good system that went into production.
[00:06:48] Lizzy Nammour: Yeah. And the reason was obviously Airbnb was a global company. We had Airbnbs all over the world. GDPR was kind of like the impetus of, okay, we have all of this data. We don't know where it is. And we had tried all of these different systems that existed at the time, but they had a lot of false positive rates. They couldn't scale, and they couldn't actually help us comply with those regulations. They were just like, hey, here's reports of where your sensitive data was, and we were left with, okay, now what? How do we delete it? How do we protect it? How do we enforce the right controls?
[00:07:19] Karl Alomar: So you were kind of trying to fix the process from end to end, rather than just trying to spot-check problems.
[00:07:26] Lizzy Nammour: Yes. And Airbnb was a unique organization where on the security team, a lot of them were software engineers. In most organizations, it's not that. A lot of the security engineers don't have traditional software engineering backgrounds. They tend to buy software versus building it themselves.
[00:07:43] Karl Alomar: I see. So, AI comes along and changes everything. And I think it probably has a bigger effect on the impact of these data sets than anything else. That's probably the biggest direct impact that AI had. Maybe you can paraphrase in your mind, as you saw that coming, what was the shiver down your spine? And then also, what was the light at the end of the tunnel? Those two aspects to this that are both good and bad. How did you see that?
[00:08:20] Lizzy Nammour: I mean, obviously the bad is now everyone uses AI, from your engineers to your marketing org to HR to every person at the organization. And all of those folks have access to sensitive data one way or another. And now that they're using AI, or building their own models and training them on sensitive data, it's even harder to know where that data is actually ending up, and to track that lineage.
[00:08:47] Karl Alomar: And the AI itself, I assume, is moving that data around too.
[00:08:50] Lizzy Nammour: Exactly. And it's very much a black box: where is it moving it to, where is it actually storing it. Now, a lot of people's laptops have sensitive data because you're using Claude. It's generating all of these artifacts locally and in the cloud. So it's a very interesting world where it's propagating data much faster, and in a much more obscure way, than a human could.
[00:09:15] Karl Alomar: So essentially you're getting massive data sprawl.
[00:09:17] Lizzy Nammour: Yes, massive.
[00:09:17] Karl Alomar: And it's in areas where you never really had to look before. Is that kind of how you're thinking about it? And what about the other side?
[00:09:23] Lizzy Nammour: And it's easier to also find that sensitive data.
[00:09:25] Karl Alomar: That's the good side, right?
[00:09:26] Lizzy Nammour: No, and bad, because if you think about it, if someone says, hey, show me all of payroll information at Teleskope, and you prompt your Claude with that question, and your Claude has access to your Google Drive, it's gonna be able to find the answer to that question much faster than you could ever search for that data yourself. So the risk is worse, because AI can surface this information much more easily than before.
[00:09:51] Karl Alomar: But that also introduces the potential for a solution.
[00:09:55] Lizzy Nammour: For sure, and I think less so from a classification perspective, because ML models have existed for a long time. In order to classify petabytes of data, you're not able to use the largest of the language models because it would be too slow to classify all of your sensitive data. Where AI really helps is this reasoning layer, which is what we use at Teleskope. So not just classifying data, but deeming: is this risky, is this not, kind of mimicking what the business thinks, mimicking what a data security engineer would do, and acting with that business context.
[00:10:38] Lizzy Nammour: And that's where we're seeing a huge shift with AI. It's not just, hey, you use ML to produce results. You can have AI contextualize those results in the context of the business and make decisions now.
[00:10:52] Karl Alomar: And actually actively remediate problems.
[00:10:54] Lizzy Nammour: Exactly, and that decision-making piece is where AI is really helpful.
[00:11:00] Karl Alomar: So I'm assuming your best friends in the world are all CISOs at this point.
[00:11:04] Lizzy Nammour: Yes. All of them.
[00:11:07] Karl Alomar: How have they evolved? Like, what's the profile of a CISO pre-GDPR versus a CISO in the world of AI? What are you seeing as the core meaningful skill sets and core meaningful tasks that those professionals have to undertake?
[00:11:25] Lizzy Nammour: I think you just have to get with the times. Two years ago, some talks were like, how am I gonna block ChatGPT from my organization? Now no one has these conversations anymore. Everyone needs to leverage AI. The board is forcing them to. So either they get on the bandwagon and figure out how to make sure their employees can use these tools securely, or they don't. So I think CISOs now have to have a more technical background to understand how the whole organization works. How does AI actually connect to data? What are the new attack vectors now that AI is introduced? But they also have to be more business-oriented, because the business needs to use AI to move as fast as their competitors. And CISOs need to make sure that they're enabling their business to do so, but in a secure manner.
[00:12:12] Karl Alomar: And there's also, I guess, a new operational function of actively remediating and actively kind of curing the system. It's not just a policing function, which maybe it was 10, 15 years ago.
[00:12:24] Lizzy Nammour: Because people cannot keep up, I think. Obviously now with AI, AI is moving data faster than a human could even look at an alert. So it's not just about reviewing alerts, it's about actually remediating the underlying issue and the underlying root cause so that it doesn't happen again.
[00:12:45] Karl Alomar: And so, if you're a CISO taking a new position, what are the first and foremost things you're thinking about these days as you walk into a new organization and you're trying to lay the groundwork of what you need to set up to make sure that this organization is secure?
[00:13:03] Lizzy Nammour: It just depends what type of organization they're joining. What's interesting is now you have a lot of these AI scale-ups that have scaled so quickly, much faster than even Airbnb, but that have no security whatsoever, because no one thinks about security until they're at Series C, D, E, et cetera. So they have to lay the groundwork for traditional security controls, like MFA, like EDR, all of these things that organizations should have, but also think about the newer threats that AI is bringing on. So you kind of have to do both at the same time.
[00:13:38] Karl Alomar: So let's talk a little bit about the gap that you've seen, the solve that you're trying to put on the table. With Teleskope, obviously, this came out of your experiences at Airbnb. And I guess it was in that transition period where AI was beginning to take hold of the problem set. So what was the trigger that made you feel like, wait a minute, there's something here that needs to be solved globally, not just within a single organization?
[00:14:08] Lizzy Nammour: I think, one, every organization has data that they need to protect. And two, what really gave the trigger is that a lot of security tools, not just in data security, were focused, again, on alerting and dashboards that show you your risk, but that didn't actually help you resolve that risk, or help you understand what that risk means to you, to contextualize that risk. An example is, if I'm a tax advisory firm, storing Social Security numbers is business as usual. That's not a high-risk thing for me, because I'm doing this to run my business. But another company like Airbnb should probably never be storing Social Security numbers. So we looked at these tools, they were very generic. They couldn't actually help you reduce that risk. You were left to do that all manually, and no one has the team to do so. So that really led me to start a company that didn't focus on just dashboards and alerts, but on thinking about what the risk is and how we want to reduce that risk automatically for our customers.
[00:15:10] Karl Alomar: So obviously when you started, it felt like a green field opportunity. But there were some players in security, even to this day, that are trying to solve that problem. Where do you think they're going wrong? What insight are you bringing to this that allows you to feel confident that you have that winning solution?
[00:15:30] Lizzy Nammour: I think, one, we're the only ones that come from an operator background. Everyone else in the data security space, and most security tooling, comes from business folks or folks that see a trend and just want to follow that trend. So the trend in data security was data security posture management, which just means, hey, we're gonna map out your posture and figure out what your risk is.
[00:15:52] Karl Alomar: When you say it out in full, it doesn't quite sound like it solves the problem, right?
[00:15:55] Lizzy Nammour: It doesn't. No, no, no. It just shows you the problem. And what's bad is that customers don't want to know they have a problem unless they can fix it, 'cause now they're liable, because they knew they had an issue but chose not to fix it.
[00:16:08] Karl Alomar: So see no evil, hear no evil, you're okay. But if you wanna actually do your job properly, you need to actually step in.
[00:16:13] Lizzy Nammour: And so we spoke to a lot of security folks at different companies, and we realized that DSPMs were becoming shelfware. People had them to kind of check the box, but they weren't actually using them. The tools were churning every year because no one figured out, how do I operationalize this data security problem? How do I actually get value out of my tool to reduce the risk? So we saw that there were competitors, but no one actually liked the competitors. And no one was actually using the competitors to reduce their data security risk, and so that's what we wanted to do.
[00:16:46] Karl Alomar: Great. And so, you've had some great experiences. As I said, your best friends in the world these days are CISOs. How have they responded? What's the market telling you about where you are and the opportunity you have?
[00:16:59] Lizzy Nammour: I think we've seen great market pull, again, from even traditional organizations that have had other data security platforms, and they said that it was night and day, because not only are we helping them understand their risk, but we're helping reduce the workload, the menial workload that no one on the team likes to do, and we've freed up their time so that they can focus on more important tasks. And we've also been working with very fast-growing AI-native startups, and what they like about us is, again, we're focused on automation. We fit the way that they like to work. And we're doing everything in the background. The security team doesn't have to stop the engineers from producing data and moving data. We can help protect everyone in the background.
[00:17:46] Karl Alomar: So I don't wanna be a fearmonger, but I'm gonna just throw this question out there. Because I think you obviously saw a big problem that has real potential for kind of disastrous outcomes if it's not handled. So just tell the audience out there, what happens if they don't solve this problem for their organizations?
[00:18:02] Lizzy Nammour: I mean, so many things, and things you may not think about. With one of our customers, we found that the CEO's W-2 was accessible to everyone at the company. I wouldn't want everyone to know what my salary was. I don't think you would want everyone at your company to know either. So not just customer data, but intellectual property, things that are actually sensitive, now with AI are much more easily surfaced to everyone at your organization. So it's not just about external risk, it's internal risk.
[00:18:33] Lizzy Nammour: So I think AI has made the data security problem an urgent problem to solve now for most organizations, and we're seeing that with our customers. Everyone has a data security initiative now, whereas three years ago that was not the case. You still had to educate the market as to why data security was important.
[00:18:50] Karl Alomar: What you're doing sounds amazing, but obviously you're still in the first inning. So rather than focusing on what your company's gonna do in the future, where's the industry gonna go? What are you trying to solve towards? Where do you think we'll be five, 10 years from now? How does this market look? How is this integrated into society?
[00:19:11] Lizzy Nammour: I think it has to move from, again, reactive alert-based security to proactive automated security, kind of like a security copilot. I think a lot of folks are scared of AI just taking action without humans in the loop. We will always need humans in the loop, but how can security tools automate as much as possible and understand as much about the business as possible to make good decisions? And I think that's where we're moving to.
[00:19:37] Karl Alomar: Across a massive plane of coverage.
[00:19:40] Lizzy Nammour: Exactly. For data, it's not just data at rest, it's data in motion. How is data moving? Obviously there's access and identity. So across all the security stack, it's definitely gonna move from this alert-based reactive approach to a proactive, integrated, and automated approach.
[00:19:56] Karl Alomar: So obviously you defined what DSPM is, and I don't think Teleskope is DSPM. What is the company you're building, and not today's company, but what is the company you're building in the future? Where do you think this becomes?
[00:20:10] Lizzy Nammour: In my opinion, we're building the data control plane, so enforcing security governance on an organization's data across the stack. Wherever that data is coming to and moving towards, we want to build that data control plane and make it as automated and agentic as possible.
[00:20:29] Karl Alomar: And you wanna make happy CISOs.
[00:20:30] Lizzy Nammour: Yes. Happy CISOs. Exactly. Nowadays, CISOs lose their job every year, every year and a half. Tooling is supposed...
[00:20:39] Karl Alomar: Because they're not securing their data properly.
[00:20:41] Lizzy Nammour: Yes, exactly. Or because... no, I mean, again, companies don't wanna invest in tooling. It's a long story, but it's a very hard job now to be a CISO. You're damned if you do, damned if you don't. And if an incident happens, you're on the line. So if you surround yourself with good tooling and good folks on the team, then hopefully that should make a good security program.
[00:21:07] Karl Alomar: Well, that's fantastic. Thank you so much for your time.
[00:21:09] Lizzy Nammour: Thank you. This has been a joy.
[00:21:10] Karl Alomar: Been a joy. And we will speak again soon.
[00:21:13] Lizzy Nammour: Thank you so much.
[00:21:14] Karl Alomar: Thank you.
