Everyone agrees automation in data security is necessary. The harder question is whether teams are comfortable extending it to remediation, when the fix touches data owned by HR, legal, engineering, and every other department. Security is the steward of these changes, not the owner of the data.
Teleskope founder and CEO Lizzy Nammour joined David Spark, producer of the CISO Series, and Dan Walsh, CISO of Datavant, on Defense in Depth to work through it. Here are the key takeaways from her answers.
Key takeaways
Notify the owner first, then enforce if nobody acts
Lizzy described Teleskope's approach as scan the data, map the owner, and notify them with guidance on what the remediation should be. If the owner doesn't respond or approve, a reversible automated enforcement kicks in. Her view on the alternative, notifying owners and hoping they act: in her experience it never actually happens, because fixing security issues isn't the data owner's or the HR team's day-to-day job.
Reversibility is what makes automation safe
Lizzy shared that early versions of the platform simply redacted sensitive data, for example in Zendesk. Customers asked what happens if a redaction goes wrong, and that feedback shaped the product. Reversibility depends on setup. For redaction, you can create an unredacted copy, quarantine it, redact the original, and delete the copy after 30 days if no one complains.
Crawl, walk, run
With customers, the first step is showing them what's wrong. The second is notifying the owner with a suggested fix and a one-click button to remediate, and enforcing after a set SLA if they don't. Some customers move to fully automated remediation, especially for SaaS apps and unstructured data. For systems like production databases, they still want a human in the loop with an SLA approach.
Trust grows with fidelity
The fear sits between walk and run, not between crawl and walk. As teams trust the accuracy of the findings and see that actions like revoking access to a Google Drive file are easily reversible, with the right guardrails they may trust the system to run on its own.
The politics show up when policies don't exist
Some customers don't have a written data retention or data classification policy, so they're starting from zero. That's when you see everyone in the kitchen, from security to legal to business owners, trying to define retention: the data team wants to keep data as long as possible, and legal wants to keep it as little as possible.
Ownership comes first
Lizzy's favorite listener quote in the episode, from Isabella Boggs of IBM, made the point that you need to define data ownership before anything else: without knowing who the owner is, there's no way to take the crawl, walk, or run approach. What she likes is that it's pragmatic. Try to get owners to do the right thing, and if they don't, do the right thing automatically.
Listen to the episode
Listen to "The Office Politics of Remediation" on Spotify, and learn more about the CISO Series.
Full transcript
Episode: The Office Politics of Remediation, Defense in Depth (CISO Series)
[00:00] Everyone agrees automation in data security is necessary, but are we comfortable extending that to remediation when multiple departments will be responsible? You're listening to "Defense in Depth." Welcome to "Defense in Depth." My name is David Spark, I'm the producer of CISO Series, and joining me as my guest co-host, a frequent guest, and sometimes co-host, it is Dan Walsh, CISO of Datavant. Dan, say hello to the audience.
[00:33] Hello. Looking forward to today's conversation. Yes, we have a really good topic. But first, I want to mention our sponsor, Teleskope. Teleskope understands the context of your business, filters out noise, and natively enforces governed remediation. More about that a little bit later in the show. Let me get to our topic. And I'm excited about this because it gets to something that is like, well, there's
[00:57] a problem, fix it, right? Shouldn't it just be that simple, Dan? Yes? In theory, everything is that simple. In practice, it rarely is. Okay. So the shift everyone is chasing is letting agents take control. No longer will a human approve the change at the moment the change needs to be made. Hopefully. So the human will orchestrate AI tools to make changes on their
[01:19] own. What complicates the issue is these just-in-time updates need to happen all over the company in every single department. That's key. That means each department will be responsible. Was this all fixed before there were autonomous agents? Of course not. So this problem has not globally been fixed beforehand, but we have to work with the political system we have. So Dan, I'm going to just set you up and
[01:44] ask you, how do we navigate the politics around automated remediation when security should only be the steward of these changes, not the actual owner? And I'm sure you've dealt with this before automation. Yes? Yeah, absolutely. I mean, I think what comes to mind really is the whole shift of security outlines the guardrails and the frameworks for the company to operate in.
[02:05] The constraints might be another way to put it. And so in concept, it should be that. And I think, but I also think the reality of it, going back to the political side of it, is that many times the business departments, you know, need additional assistance or handholding with that. And so that's where the politics come into play. And they expect it to be security's job, not necessarily their own job.
[02:26] This is going to be a great conversation. And I'm thrilled to have our guest on, who is actually our sponsor guest, the one who brought this discussion to us. It is the founder and CEO of Teleskope, Lizzy Nammour. Lizzy, thank you so much for joining us. Great to be here, David. Who owns this issue? Louis Zhang of AIA Australia said, quote, "If we don't understand
[02:53] our data, we're not doing cybersecurity well." Security's role isn't to, quote, "own data remediation," but to act as a trusted advisor, define standardized data security principles, classification-driven requirements, and provide clear and pragmatic frameworks that make right action obvious. Remediation then becomes a guided choice, not imposed control. But that only works if security, data owners, privacy SMEs, and risk owners operate as one decision-making unit.
[03:22] Alignment isn't optional. Louis, I think, sets out an Eden we all would like. Isabella Boggs of IBM said, quote, "The governance failure starts before an automation does. If the organization has not defined data ownership and policy, mapped remediation authority to asset owners through a RACI framework, and built an escalation path that is auditable and reversible, automation remediation accelerates the wrong outcome." So the crawl phase is not technical, it is
[03:54] governance. Map every data class to the owner. Define what remediation means per asset type. Build a notification-first model where security flags the risk, the owner confirms the action, and the system logs both. That is the walk. Run is when trust, audit history, and exception handling are mature enough to let automation act within defined boundaries with human override preserved. Automation should enforce the process the governance team designed, not replace the decision the
[04:23] data owner is accountable for. I think these two nail it on the head. It just seems that the politics would make this quite difficult to happen. What do you think, Dan? Well, it could be the politics, but it could also be a number of other things. If you think about it, it could be that the people that are trying to run the business weren't the ones that sort of
[04:41] set up the ecosystem that created all these problems in the first place. A lot of companies have turnover. A lot of teams wade into existing debt across the organization, whether that be technical debt or operational debt. And sometimes the ability to sort of understand where that data lies, the constraints in which it operates in. We saw this a lot with shadow IT and shadow SaaS
[05:04] products. I think, you know, there's a challenge there of trying to, you know, understand where is all your data living, which gave rise to the whole DSPM tooling that's out in the industry. So a lot of it reflects if your operations are not in harmony with the tooling that you have, it can make this very, very difficult. And I think the difficulty and the gap of that work that folks know they
[05:24] have to do, but it's very difficult for them to do, is really where the politics start to come in because it's not really part of their core job, even though it's a core operational problem for the company. Very, very good point. All right. Lizzy, you have a solution that is dealing with remediation, but I'm sure when you work with your customers, you see this play out.
[05:45] It's like, and not to knock anything you're doing, is your product can go only so far as they have to take hold and take responsibility. So I'm assuming you've tried to work your tool to better sort of manage the environments that it's operating under. Yes? Yes, 100%. And I think Isabella and Louis are saying kind of two different things. I think our approach at Teleskope is similar to
[06:13] like what Isabella is saying. It's, you scan the data, you map the owner, you try to notify the owner to guide them into what the remediation should be. And then if they don't respond or if they don't approve, that's when the automated enforcement that is reversible should occur. Whereas Louis is saying just notify the owner and guide them and hope that they follow that guidance and that they enforce it themselves,
[06:38] which what we've seen with organizations never actually happens because what Dan said, it's not their core job day-to-day to go in and fix these security issues when they are the data owner or the HR team, et cetera. Yeah. So I think reversibility is key. Oh, and by the way, I hear this all the time. The thing is, correct me if wrong, sometimes reversibility isn't possible.
[07:01] Correct? Yes? It just depends on how people set it up. So for example, if someone wants redaction, right? What they could do is they could create an unredacted copy, quarantine that, redact the original one, and then after 30 days, if no one complains, then delete the unredacted version. So things like that where you may take an extra step could enforce reversibility. How do we approach governance?
[07:33] Dutch Schwartz of NISO said, quote, "You have to get real with governance. It's an operational imperative." The good news is we're starting to get language for this. OWASP's work on agentic AI and the new top 10 for agentic applications give us a risk vocabulary for agent goal hijack, tool misuse, and memory/context poisoning. CSA's Agentic Trust Framework, the recent Five Eyes guidance, and NIST AI agent standards efforts
[08:00] all push in the same direction: extend identity, least privilege, and continuous verification to non-human identities and autonomous workflows. And JJ Davey of Planet said, quote, "Governance, operations, and ownership are the three core areas that cause issues downstream that require security intervention or management of systems, which often materialize as exposures. We are often just automating system management. True protection comes from disrupting, removing, and exploitable conditions. Often, this is process or operational
[08:33] related." So I like what Dutch says because it says, hey, you know, we don't have to fly blind. There are some sort of guidances in this. And JJ offers some more direction in here. I believe there's been a lot of fear because people don't know where to start, but they're pointing out like there are places to start, both Dutch and JJ. What do you think, Lizzy?
[08:52] Yeah, I think the issues with these guidance is that they're not context-specific to the company. And so it's kind of hard to take them and say, okay, where do I start for my company specifically, and how do I apply them without getting buy-in across the organization? But definitely, there are best practices that people could use as a default to figure out what should they start asking internally, like start the discussion, and
[09:14] then get aligned across the org. I think also the other thing is we see AI moves so damn fast, and that we know even if we create guidance today, we know this is going to drastically change in six months. When am I saying six months? In one or two months. Like there's a fear to do anything because it's all going to change.
[09:32] Isn't there, Dan? Potentially, there could be some analysis paralysis, but I think that if you look at the top 10 for agentic AI or OWASP framework, a lot of it is like just the basics that extended within the new AI reality. And so I think the challenge is really less of, is it going to change? I think it's more of these companies are developing products and features that governance is
[09:57] not a part of that, right? The governance is either taken for granted or expected, right? So if you're in a regulated industry, it's expected. If you're in a non-regulated industry, it's kind of taken for granted. And so it's really important for security professionals to outline the value proposition of governance. And I think we're going to see that come up as there are more, you
[10:16] know, AI-related breaches, the volume of misconfigurations, vulnerabilities rise, you know, and I think we're going to be shifting from human in the loop to governance in the loop and making sure that as quickly as AI is executing, that there's guardrails and governance in that to protect the data. Lizzy, I want to come back to you on this as well. Let's go back to like what you see from your customers.
[10:36] Are they looking to you for advice on what to do next? Or are they like, we're pretty clear on what we need to do. How are you going to help us do what we need to do? I think you have those two exact different types of customers. One, they know exactly what they want out of your tool.
[10:51] They know, okay, I want, you cannot have any secrets in Slack or you cannot share anything externally in Google Drive. And so they've got good policies and they know that they can enforce them and that they know that they have the buy-in at the organization to kind of like force those controls. And then we have the other customers that are just like, I have no clue what's going on.
[11:12] I need you to help me show me what's going on, but also I need you to tell me how to fix it and what are the best practices and how are your other customers fixing these issues and what are they prioritizing first? And this goes back to a line that we've heard all the time from vendors is that when they deal with customers, everyone feels like they're a special snowflake.
[11:30] Yes? Yeah, but it's very interesting to talk to them, especially the ones that know what they want because we learn from our customers. Give me one quick thing you've learned from your customers. A lot of things. I think one, they've really helped like kind of shape the product in terms of the reversibility aspect of things. When we first started our platform, we did not have reversibility.
[11:51] We were just like, okay, if we're scanning Zendesk, we're just going to redact sensitive data from Zendesk. And then some of our customers were like, what if that redaction went wrong? What do you do? And then these sorts of things of like, how do we understand, like how would they do this manually so that we can replicate the manual workflow within our platform? If you're a security leader, here's a scenario you
[12:11] probably recognize. Your team has security tooling. It surfaces findings, fires alerts, builds dashboards, and somehow the backlog just keeps growing. That's a problem Teleskope was built to solve. Not better visibility, but actual remediation. Teleskope is a data security platform that doesn't just find exposure, it fixes it automatically in real time without routing everything to a ticket queue for a human to clear. The platform understands business context.
[12:43] So instead of matching patterns and flooding your team with low signal alerts, it prioritizes what actually matters for your environment and enforces policy natively across cloud, SaaS, on-prem, and AI tools like Copilot and ChatGPT. Customers like Ramp, Polymarket, and Chevron Phillips use Teleskope to cut remediation time by 10X and resolve AI data risk in under two seconds. If your current tools show you the problem, but not the fix, check out teleskope.ai.
[13:15] That's T-E-L-E-S-K-O-P-E dot A-I. Where do we begin? Tim Malone of JB Hunt said, quote, "Having a defined appointed owner at or near the top is important to do the following." So it sets it up sort of a crawl, walk, run situation. Crawl, help set where the guardrails should be. And then security slash GRC can help enforce via human interaction. Walk, pre-approve certain low-risk conditions or delegations where it makes sense
[13:52] for some basic automation. And then test out more advanced stringent remediation first via monitor mode. Then once the owner is comfortable with number and types of automation that would have happened, you could advance into the fully enabled stage, which would be run. Auditability and visibility are, of course, key throughout the entire maturity process. Egon Lenz of Newbank said, quote, "The shift from visibility to automated remediation is indeed
[14:20] where the brutal politics surface." I couldn't agree more on that. I found that the crawl phase is less about automated enforcement and more about automated contextual notification. Instead of auto-remediating, we provide the data owner with the exact policy violation and a one-click button to remediate. We track if they act within an SLA, and if they don't, then the automated policy enforcement kicks in.
[14:43] It turns security into a provider of guardrails rather than a blocker, which significantly lowers the friction. I love these crawl, walk, run methodologies, but the idea of let them see in a one-click remediation. Have you been able to see or do any of that yourself, Dan? In bits and pieces, I mean, we've been able to see it in some of the ways that we manage our program at Datavant.
[15:07] You know, I think what's really important, which the second quote nailed, which was, what are the policies? What do we have to do? And are those policies informed by your customers and your regulators and your security posture? And so I think first and foremost, it's like, what are the policies? Because that's going to inform how you think about the guardrails and how you think about the governance of it, and then how
[15:26] you have those conversations, and then how you close the gap between, okay, this is what we want to do, here's what we're doing in practice. You know, what are the gaps that we then have to kind of close in order to get from crawling to walking and then getting to a position where we can run and we feel very confident that's a mature process.
[15:43] And when we have a mature process, that's when we can go faster and automate it. Is there any policy that you didn't think about in a manual format that like, oh, we have to think about it in automated that we didn't think about it as manual? I would say where a human is kind of spinning between two applications, right? Or they're kind of spinning the chair from one application to another, or
[16:05] there's some human input that needs to make a decision around moving data from one application to another or taking a piece of information, doing some sort of a review or adding information to it and then moving it on. So I think where you start to get into workflows is where that type of situation can come up. I also think that making sure that you don't have asymmetry
[16:26] in your company around from application to application, if there is a system that you've automated a process and that system has more up-to-date information than another system, then you can cause data conflicts. And so being mindful of that, making sure that the speed is timed appropriately so there's no sort of conflicts or collisions around the data is also very important. Do you crawl, walk, run with your customers, Lizzy?
[16:51] 100%. I think the first step is just showing them what's wrong. The second step is exactly sending a notification to the owner, telling them what the suggested remediation should be, letting them click a button to remediate, and if not, enforce it after a specific SLA. And then in some cases, we've seen people run where they kind of remove the data owner notification, especially for systems that aren't production systems
[17:19] like databases that power the application. So especially in like SaaS apps or unstructured data, people are comfortable with the run approach, but for other systems, they always want that human in the loop with the SLA approach. Yeah, and I can totally see that happening to everybody here. You know, this is the reason we're having the conversation. The concern is definitely between walk and run. It's not between crawl and walk.
[17:45] It is fear, but I got to assume that once they're doing it through walk and they're just clicking button, button, button, button. Then they're like, let's run. 100%. Then that fear starts to subside. Yes? Yes, especially if they start to trust the fidelity of your findings, right? Because that's one of the reasons they don't want to crawl or run, especially as they start to see, okay, this type of action
[18:09] is not actually that dangerous. So for example, revoking access to a Google Drive file. Worst case, it's very reversible. You re-grant the access. You're not destroying data. So I think once they gain fidelity in the action and they gain fidelity in the finding, then they start to trust the system. And with the right guardrails, they may trust it to just run on its own. What would a successful engagement look
[18:37] like? Mark Engelson, CISO over CSC said, quote, "Yes, we should all be gaining comfort with automated mitigation." What we literally were just talking about. This is the way stewardship can also invoke direction, just like a wine sommelier provides an action path for your palate. I don't know if anyone has compared wine choices to cybersecurity, but here Mark Engelson does it. So can a data steward, as far
[19:08] as mitigation controls, as these automated mitigations become more transparent, effective, and efficient, the business will gain trust and further partner. I'm sure a model for this is getting perfected somewhere. So I will toss to you, the whole conversation here is around the politics. Let me ask you, how visible do you see the politics when you are working as a vendor with a customer? Like, how much do you see of this?
[19:35] I think a lot, especially when you're kind of a partner to the customer. So for example, some of our customers don't even have their security policies written down. Like they don't have a data retention policy. They don't have a data classification policy. So sometimes they're really starting from zero. And that's when you see like all the cooks in the kitchen, from security to legal to the business owners, kind of all
[19:59] trying to define what should the retention be like. The data team obviously wants to keep the data for as long as possible, but the legal team is trying to keep it for as little as possible. So it's just very interesting to see the internal dynamics. And we usually see it when they start from zero and when they don't even have their written policies defined. Dan, you're not one of those companies, are
[20:21] you? No, we most certainly are not. But hold it. Have you worked in an organization like that before? I haven't because I spent my entire career in regulated industry. So I think that's. Okay. I'm going to guess that Lizzy's customers that are like that are not regulated. And if they are, they won't be in existence for long.
[20:37] Okay, so let me ask you, and you can talk about colleagues, you don't have to say specifically about your own business, but in what ways do politics manifest themselves when you're trying to move essentially remediation into an automated phase? What are the things that come up, I guess? I think the one thing that comes up a lot is kind of understanding the universe of things to be remediated.
[20:58] Like when we think about remediation, we'll say, okay, that is definitely a problem. And we can point to a few egregious examples. But being able to scope to the full scope of what actually needs to be remediated, the full universe of those things, I think that's key. And I think that sometimes the politics of that falls between the security team and say the engineering team or the security team and like
[21:19] an operations team, because the security team is going to say, well, it's your data, it's your product, it's your database. You need to be able to tell us like to the nth degree the scope of it. And the business or the operations and engineering team is saying, well, you're the one who brought the problem to us, so you should tell us what the problem is. And so I think that can happen
[21:38] quite a bit. I also think that you're also competing with other priorities. So if you're working with an engineering team, they have a product roadmap to deliver against. They're building features. They're shipping, you know, software that's going to return an investment to the company from your customers. And this is not planned work. This is, call it KTLO or security debt or technical debt reduction.
[22:00] And it is not revenue generating per se. It's certainly loss avoidance, but it's not revenue generating. And sometimes because it's not revenue generating, it's hard to put a dollar number on that on probability of loss, although I'd encourage people to try to think about that. So I think those are two reasons why the politics of this is so difficult. Could I throw out that another potential political concern is just the fact
[22:23] that security is creating a lot of CYA stuff for themselves. Like they're throwing things to different departments saying, here are issues that need to be remediated, or this is something that needs to be automated for remediation ultimately. And they've been doing that in the past, but now it's going into automation and there's fear. Look, we're telling you about this. We're advising you about this.
[22:45] There's a paper trail about this. And then just because there's paper trails and it's connected to regulations, there's a lot of CYA stuff going on. And that itself, again, this is my own my theory. Disagree with me if you believe, but that itself creates sort of political tension. What do you think, Dan? I think if that's the situation, you're going about it
[23:08] the wrong way. So what I would tie it to is I would tie that to a risk. Like let's say you have multiple products in your company. They should have a risk report card, you know, that says, hey, here are the risks. We want to inform you about what risk you have. We certainly recognize that security risk is not the only risk you're dealing with.
[23:23] There's product risks, there's legal risks, there's financial risks, there's execution risks. But the goal as a CISO or the security leader is to raise security risk and communicate it in a way that it's on par with the other risks of the organization. So the organization can tackle the risks that are facing the organization the most in that order, recognizing that you may not get to a security risk because
[23:43] there might be a financial risk that's more pressing. And so when you communicate it like that and you just make it another one of the things that the company has to do, because if they go to remediate that thing, and let's say it's an engineering team, then they're not working on developing the product and getting out that new feature out the door that's going to generate revenue.
[23:59] So I think when you position it that way, that's how you get around some of those politics. I also think you're talking about extremely mature organizations, the way you describe. I mean, look, I think you could create that on a spreadsheet, even if you're running a startup, right? And what precedes all of that is having a good relationship. Like you have to have a good relationship and, you know, not lead with
[24:17] fear, uncertainty, and doubt, but really build a relationship so people understand that you're invested in the company. You're not just trying to cover your rear end. I'm assuming you've seen customers that don't even have that spreadsheet, Lizzy. Yes? Yeah. And I think the main thing is like it's also hard to kind of know what the priorities are across the different orgs.
[24:33] For example, if we're scanning Google Drive, every team of the company has data in Google Drive, and they may all have their different priorities that it's hard to rank security controls as what priority it is for each of those teams. But the teams also don't want the security team to do the automated remediation because they get worried that the team, the security team may mess things up and that
[24:56] they won't be able to use their data anymore. So it's kind of like they don't want them to do the action for them, but they also don't want to do the action manually, which is where the crawl approach makes the most sense. Well, this brings us to the portion of the show, and we're going to start with you, Lizzy, where we look at all these wonderful quotes here and we ask
[25:14] you, which one was your favorite and why? And Lizzy, did you pick one? I think I still really like Isabella's because it's true. You need to define data ownership because otherwise you can't really start anywhere. And if you don't know who the owner is, then there's no way to take the crawl, the walk, or even the run approach because who should look at the
[25:32] audit trail of what happened? But I still like it because it's very pragmatic. It's not saying, oh, let's hope that every data owner will do the right thing if we tell them what the right thing is. It's like, we'll try to get them to do the right thing. And if they don't, we'll still do the right thing automatically. Excellent. I like that. All right, Dan, your favorite quote and why?
[25:53] I like Mark Engelson's quote. The last one. Yeah. You know, he talks about stewardship can also invoke direction. Ultimately, that's what we are, is we're stewards for our company. And do we just happen to be overseeing security? And so we should feel empowered to provide direction. I think our business partners are desperate for that and making sure that we're building that relationship to be like that trusted partner.
[26:13] Because if we do that, that's going to be our best chance of moving this type of work along. Well, Mark also made an analogy to wine sommelier. So my question is, are you also pairing this remediation with a white or a red? Probably not. Maybe some stinky cheese or something. There you go. All right. Well, we have come to the end of the show.
[26:31] I want to thank your company, Lizzy. That would be Teleskope. Remember, for your data security needs, get true remediation. Not just finding your vulnerabilities, but get them automatically remediated. Check out what they're doing over there at teleskope.ai. Remember, that's T-E-L-E-S-K-O-P-E dot AI. Teleskope.ai. And when you go, let them know that you heard about them from the CISO Series. Now, Lizzy, first, I want you, if you
[26:59] have any offer, anything special you want to tell us about Teleskope, and let us know if you are hiring as well. We're definitely hiring across all roles, engineering, marketing, sales. So please, please apply or reach out to me directly on LinkedIn. And yeah, thank you so much for having me, David. This was awesome. Well, we love having you on. We love that you're supporting the
[27:18] CISO Series as well. So go to teleskope.ai. I'm sorry, I'm assuming you have some kind of a job board. Yes? We do. teleskope.ai/careers if that's easier. And can people reach out to you directly on LinkedIn? Yes. Yes, definitely. Okay. We'll have a link to her profile page. And similarly, I believe you are hiring at Datavant as well, Dan.
[27:38] Yes? We are. We are. Go to the careers page at datavant.com. We're always hiring. We have a couple of security roles open, so welcome folks to apply. And may people reach out to you directly? Yeah, absolutely. All right. Great. Well, thank you very much. And we greatly appreciate everyone listening. You know what I'm going to say. We greatly appreciate your contributions and for listening
[27:59] to Defense in Depth. We've reached the end of Defense in Depth. Make sure to subscribe so you don't miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn, or on our site, cisoseries.com, where you'll also see plenty of ways to participate, including recording a question or a comment for the show. If you're interested in sponsoring the
[28:26] podcast, contact David Spark directly at david@cisoseries.com. Thank you for listening to Defense in Depth.
