Sean McMillan sits down with Kraig Faulkner, Field CTO at Infolock, at Black Hat USA 2026 to discuss the data security risks hiding beneath the AI hype. They dig into how AI is changing access to sensitive data, why traditional controls may no longer be enough, and why knowing where your data lives is becoming more important than ever.

Key Takeaways

• AI is creating a data visibility problem.
• You can’t secure AI without understanding your data first.
• AI isn’t “set it and forget it.”

Here is their conversation.

SM: The first thing we like to ask people is just, what is your role? Tell us a little about yourself and what brings you to BlackHat.

KF: Yeah, so I'm the field CTO at Infolock. Infolock is a data risk management advisory firm. So we manage DLP, manage DSP, data classification, all the things around data security.

What brought me to BlackHat is to meet with everyone, see old colleagues, see new colleagues, meet with partners, and just experience what BlackHat has to offer. So--

SM: Yeah. And as you no doubt have noticed, there is plenty of actual literal noise happening out there. And then when you leave the convention, there is still noise in the industry. From your perspective, what's the noise that everyone's losing sight of the picture? What's everyone yammering about?

KF: Yeah, everyone's yammering about AI. I'm sure that's been everybody's answer.

But I'm going to spin that a little bit. So the reason why it's hot and I care about it so much is because we look at it from a different perspective. We look at it from, what is your data? What is the context of that data leveraging DLP and DSPM tools to understand what that data is and how it ties back to the business?

So we want to understand the context of the data. AI has just made more data, and it's made people care about that data now. And so now we're really evangelizing, hey, all of this data that you're using, creating, curating, we need to secure it and put guardrails in place. So that way, it is used effectively. It's secure. You're not getting rid of your crown jewels, things like that.

So for us, it's all about the data within AI, not so much the agents or hype or anything like that. So that's definitely hot for us right now.

SM: And, I mean, you see so many booths. Just from here, you can see 100 that have AI in their title. It's really everywhere. Now it's just like, look, we're an AI company. Every company is an AI company. So how has that changed your perspective? How has that been a challenge for what you do?

KF: Yeah, I think honestly, I don't know if it's been as much of a challenge as it's been an opportunity for me to learn and grow. So the ability to--

I do a lot of thought leadership and blogs and podcasts and things like that. And going and finding some of those things, finding events, things like that, it took a lot of man hours. I don't have to use those man hours anymore.

We have AI that can go and curate the internet and find those things for us, be able to find what's relevant to what I need to speak on and go and find those events and things like that. So I actually have really enjoyed the productivity gain that I've gotten out of using AI. Now, on the flip side of that, my family is also using AI.

So there's a scary aspect of it, too, of the layman, if you will, is using a technology they literally know nothing about.

SM: It's magic. It's a genie in a bottle. Absolutely.

KF: Yeah.

SM: My kids don't touch it. Yeah, they know about it. They don't touch it.

I dabble. My wife dabbles. But then you up the risk, and we look at other generations dabbling in it. And I think that that's a place where they don't have those same kind of data concerns that a big organization that would seek out your services would. And I think that's the new world.

KF: Interesting point, though, we saw, I don't know, 10, 15 years ago with ransomware then shifting to extortion and then doing all these other tactics. And it went from personal people to businesses. Now we've seen it go back to individuals again. Is that what's going to happen with AI? You see what I'm saying?

SM: Yeah, I see it already. I see it not just in the cybersecurity industry, but friends of mine that are in totally other job roles. And I see their bosses implementing AI, and they're not checking all the boxes. They're just like, hey, now we can do this, so let's do it. And so I think that's probably a big wake-up call for a lot of organizations--

KF: It is. And to see that, holy smokes, we need something like what you're doing because plausible deniability is gone.

SM: It is.

KF: With all the tools we've seen come out because of AI, the visibility and exposure of data now within an organization, AI doesn't know where to go look for information. It just looks at all of it. Well, that completely eliminates our legacy rollback role-based access controls that we've implemented in every technology from the beginning of time because AI goes around all of those controls and looks at everything. So it's a very interesting dynamic we're in now of what's going to happen and where it's going to go forward.

SM: Well, everyone's so focused on implementing AI and all that stuff. So if that's clearly got some noise to it, where's the signal? What do people need to be getting right?

KF: I think first and foremost, you got to understand where your data is. In order to have a successful AI strategy and have your employees and your business partners, third parties using these tool sets, you've got to understand where that data is. There's many stories out right now of third parties getting breached and impacting the original company's data, the partners' data.

We're seeing things in healthcare where they're using AI for modeling and things like that. I actually have a friend that her husband recently had surgery, and they modeled what they were going to go do surgery on and actually only modeled 50% of what they needed to do surgery on. And actually, it was a more intense surgery once they got in because they relied on AI to model what it was that they were doing, and they missed the connection with the MRI to the AI model. There was something there that--

SM: I feel like every conversation comes back to implementing AI, monitoring it. Implement it smartly, and keep an eye on that AI.

KF: Yeah, for sure. Set it and forget it is not something we can do in the realm of AI. And I think we've gotten really comfortable as an industry on set it and forget it. So we've got to get back into that mentality of really just back to the basics of good security hygiene, good IT hygiene, understanding what our business is doing, all of that.

SM: Yeah, absolutely. That's the key. Well, I think we often ask what the signal is, what the noise is. And it all does tie back together, I think. Often, when I ask, what's the signal, it's like, well, they just said it.

KF: Exactly. Well, and it's interesting, too, that signal, we've been concerned about threat for a long time. Then we started being concerned about identity. And now AI is merging both of those concerns at the same time because it's a potential threat, but it's also an identity right now.

I've changed my talk track to talking about entities. It's not about humans anymore. It's not about workers. It's not about process.

It's about entities because there's so many entities now that can interact with a business, both human and non-human. So--

SM: Yeah, I think it's key knowing where your data is, how it works, and not just asking ChatGPT how you can implement AI because you know there are people who do that.

KF: And you're going to get a wonky answer or what it thinks is the right answer or most common answer. There's a lot that we need to learn.

SM: For sure. Well, you ready to get back out there and do some learning? Let's leave our comfy little booth, get back to work.

KF: All right.