Advertise on podcast: Compliance Unfiltered With Adam Goslin

PCI is evolving, and AI is reshaping payment security, vendor accountability, and compliance. Todd Coshow and Adam Goslin preview the PCI Europe Community Meeting in Edinburgh, exploring emerging AI risks, governance challenges, and the importance of industry collaboration. Discover why attending matters, how to maximize networking opportunities, and what to expect from this year's event. Plus, learn why stopping by the TCT booth could help make compliance suck a little less!

AI can automate compliance, but what happens when it automates bad compliance faster? Todd Coshow and Adam Goslin explore the dangers of scaling broken processes, weak evidence, and checkbox-driven compliance through AI. Discover why automation without proper foundations creates more problems than solutions, where AI genuinely adds value, and why human oversight remains essential. Learn how to identify automation opportunities, avoid costly mistakes, and build smarter, more effective compliance programs without sacrificing accuracy, accountability, or security.

Fresh from the 20th PCI North America Community Meeting, Todd Coshow and Adam Goslin break down what had the PCI compliance world talking. From AI and compliance fatigue to manual evidence collection and the annual audit scramble, they explore the challenges teams still face—and what’s changing. Hear why continuous compliance, smarter automation, multi-framework management, and responsible AI governance are becoming essential for organizations looking to reduce friction, improve accountability, and make compliance suck a whole lot less. Episode Transcript: Well, Adam, we’re officially back from the 20th PCI North America community meeting. Give me your overall impression. What was the energy like this year and what stood out to you? Adam Goslin: Well, I can tell you one thing for sure. I forget who it was. I had a conversation with somebody that was complimenting you on starting the pod with a different, “Oh, Adam’s the sparkle of your sterling silver,” or whatever you come up with. They’re like, “I don’t think we’ve ever heard Todd say the same thing twice. It’s pretty impressive.” So yeah, you were getting some shout-outs. Todd Coshow: Appreciate that. Adam Goslin: The show was a little bit smaller than I expected. Now, I know it was in Canada, so people have to actually travel internationally to be able to get… Todd Coshow: Shout out to Vancouver. Incredible city. Adam Goslin: Oh, hell yeah. Hell yeah. We got us some absolute rockstar poutine while we were up there. It was definitely a good time. Beautiful place, beautiful city. We were very, very lucky. The days of the conference were absolutely gorgeous. It was blue sky and sunny. Sometimes when you head to the northwest of the US, Seattle area, southwest Canada region, it tends to be a little wet sometimes. Todd Coshow: It can get a bit gloomy. You’re not wrong. Adam Goslin: Yeah, no, it held off. It was great. It was a little bit smaller. I’d say there were maybe two-thirds of the normal crowd. Todd Coshow: Sure. Adam Goslin: This year they didn’t have some new version of PCI or whatever. It was their 20-year anniversary, so there was a lot of hoopla around that and whatnot. I’m hoping that next year it’ll be in Vegas. One of the side notes that we got out of the conference was it sounds like, from the release timing for the next version of PCI, they were not specific if, right now we’re on 4.0.1, so are we going to 4.1? Are we going to 5? Don’t know yet. But whatever it is, I believe they’re going to have that ready to start previewing next year. So one, being in Vegas, someplace easy for everybody to get to, lots of fun stuff to do in that area, and if they’re gonna be releasing a new version of PCI, I’m really hoping that the numbers are up over where they normally are. The one person that I do wanna give a shout-out to is good old Gina at PCI. She’s always been involved in helping to coordinate and orchestrate the show. She does a fricking rockstar job. Todd Coshow: Absolutely. Adam Goslin: That lady needs a raise, for sure. She’s always very attentive and helpful and all that fun stuff, so I wanna give her a shout-out too. There was a high amount of engagement at the show. Because it was smaller, it has an ancillary impact, which is that the quality of those conversations tends to go up. Todd Coshow: Yeah, it does. Adam Goslin: So that part was cool. Vancouver was kind of like a homecoming for me because the very first show that we did as TCT where we had a booth was… Todd Coshow: Oh, cool. Adam Goslin: My wife, Kit, and I manned the booth in Vancouver in 2019. So it was kinda cool seeing it come to a full-circle moment on the 20-year anniversary, etc. A couple other people I wanted to give a shout-out to. First is Heidi and Jeff. Thank you so much for the annual gift box. Quite frankly, I started tucking into it before it even made it back home. So that was much appreciated. And a special shout-out to Paul.

What happens when your compliance champion suddenly disappears? Todd Coshow and Adam Goslin explore the hidden risks of building a compliance program around one go-to person. From tribal knowledge and scattered evidence to undocumented processes and failed handoffs, discover why single-person dependency can derail your next audit. Learn how clear ownership, documented procedures, distributed responsibility, and a centralized source of truth can create a resilient compliance program that survives resignations, vacations, turnover, and the unexpected. Episode Transcript: Today, Adam, we’re gonna talk about a fateful day, and that is the day that your compliance champion leaves. Every successful compliance program seems to have that one person who knows where everything is, understands every control, remembers every audit finding, and somehow keeps the entire program running and the coffee cups full. But here’s the question, Adam: If your compliance manager quits tomorrow, would most organizations’ compliance programs survive? Also, why do so many compliance programs become dependent on one single person? Adam Goslin: I just had this visual of people running down the hallway screaming. It’s cats and dogs and da, da, da, da. I think it’s a little extreme to go, would they survive? Well, yeah. There’s that expression out there, right? “Everybody’s replaceable.” That’s what they think. It doesn’t mean… Now, could they be replaced? Sure. But at what cost is really the question. Todd Coshow: Exactly. Adam Goslin: Most companies kind of have that central figure. Quite honestly, the main reason why for a lot of organizations that it ends up funneling down to this one person is that, at the end of the day, most organizations are managing their stuff manually. There’s too much going on. There’s too many control owners. There’s too many hands in the pie. There’s too many assessors. There’s too many states this stuff can be in for everybody to go sticking their fingers in the midst of all of the tracking, etc. If you’re using a manual system, then you’re almost forced into this notion. But not even almost forced. For every single company that I’ve ever seen that has either completely manual or hodgepodge manual and internal systems, etc., it ends up eventually gravitating to that single individual. The reason is simple. Organizations keep getting burned as they are trying to manage their programs. Somebody went in there to go and make mass updates to their stuff. Let’s pretend we’re using an Excel sheet. I go, “Oh, I need to mark these 10 things in this state.” Inadvertently, the person that’s going in to make their 10 things update accidentally blasts 57 items in the process and overwrites their statuses, etc. When you’ve got shared sheets, etc., it is not if you’re going to have a problem, but when or how many times you’re gonna experience a problem. It forces organizations to move into this notion where they’ve got the one ring to rule them all, type of deal. So you end up with that go-to person. The other thing is that whoever that central figure was, they’ve learned a lot, right? Year over year over year. It’s knowledge building that basically accumulates between their ears. I’ve been through so many audits, and I’ve learned what the assessors are looking for and their feedback. I’ve got boots-on-the-ground operational experience of running the program, etc. That person that’s at the center of the compliance efforts, they literally amass an unbelievable amount of data, information, experience. It isn’t experience that this person could just poof, walk away, and somebody else is just gonna inherit it. It’s not the reality. Over time, the knowledge, data, and information moves out of documented processes and things along those lines and lands up in somebody’s noggin.

PCI has evolved from checkbox audits toward continuous assurance, but are organizations truly keeping pace? Todd Coshow and Adam Goslin explore how AI, cloud-native payments, software supply chain risk, and operational compliance are reshaping payment security. They explain why continuous evidence beats annual screenshots, what the PCI Community Meeting in Vancouver can offer, and how teams can turn compliance into practical, measurable risk reduction. Ideal for security leaders and compliance professionals worldwide. Episode Transcript: Adam, join us at the PCI North American Community Meeting in Vancouver, British Columbia, Canada. 20 years later, I have to ask you, Adam, has PCI actually made payments more secure? Adam Goslin:Oh, I mean, there’s no doubt it had a dramatic impact. You got to remember back in the day, it was the absolute Wild West. The card brands were just getting their asses handed to them, and something needed to be done. The level of change from when this whole adventure first started to now is pretty startling. I think in many ways it was necessary. I think that the card industry as a whole forced a lot of organizations to start leveling up, start taking this stuff seriously. I believe it was astronomically helpful as we’ve headed into this arena. Certainly, we’re seeing a lot of shifts in the marketplace where we’re moving away from a checkbox approach, etc. It’s hard to remember. I was looking up, when did PCI V1 officially get released? It was middle of December in 2004. Todd Coshow:Oh, wow. Adam Goslin:It was like the first version of it, type of a deal. It was 2006 that the PCI SSC was officially formed. Then they started to make enhancements. But there have been a whole myriad of different changes and modifications to the standards over that time. The payments arena really has made a fairly startling shift from just checking the box, annual validations, into more of a continuous security or, as we here at TCT like to call, operational mode, type of a deal. The acceleration of AI, both for the white hats and black hats, has enabled attackers to move as quickly as defenders. So it remains a very, very vibrant and exciting arena. Todd Coshow:No doubt. Well, what do you think the biggest conversations at this year’s community meeting will be? Adam Goslin:Yeah, I think there’s a lot. New and exciting things happening in the payment space will certainly be one. Bar none, a big participant will be a lot of topics surrounding AI. AI, its use and benefits and all that fun stuff. Honestly, I’m kind of hoping that somebody whips a little bit of realism in there about the dangers of AI as well. I think I’ve mentioned once or 80 times about AI zombie walk. I think there’s a lot of signs in the marketplace right now that the AI zombie walk mentality isn’t necessarily the best idea in the grand scheme of things. I think there’s a lot more reasonability starting to enter into the mix. That’s what I’m hoping at least. Certainly, a lot of discussions around operational compliance, automation of evidence collection, various ways to streamline your engagements, looking at threat intelligence and attack trends as they’re going. Certainly, one of the cool parts about being at the conference is getting updates direct from the council, what’s happening, what’s coming soon to a theater near us, all of that fun stuff. We’ve got all that coming our way as well. Todd Coshow:Indeed. What’s one thing every first-time attendee should do in Vancouver? Adam Goslin:Well, number one, I’m just gonna underscore this big time.

On this week's Compliance Unfiltered, PCI engagement chaos doesn’t have to be the norm. Todd Coshow and Adam Goslin explore how smarter compliance workflows can eliminate repetitive evidence collection, QA bottlenecks, and annual audit scrambles. Learn how request lists, automated evidence mapping, and operational mode streamline PCI and multi-framework compliance while reducing human error. From year-round evidence collection to better assessor workflows, discover how the right platform and processes can save time, improve accountability, and make complex compliance engagements far less painful. Episode Transcript: Now, I have to ask, why did this topic speak to you, Adam? Adam Goslin:Well, we’re heading toward that time of year where we’re all gonna be heading over to the PCI community meetings, both in the US and the EU. The reality is a lot of people that are in the compliance arena, a lot of them tend to use a kind of rinse-and-repeat style approach. It’s almost like you get into your lane, right? I got my thing, and I do it this way, and I’ve always done it that way. For some of these organizations, “We have always done this this way since the dawn of time.” It’s cool to have a good, rock-solid process you can depend on, right? But in the same sense, I made this company to help people. I love helping people. I love making their lives better, giving them solutions that’ll actually help, all of that fun stuff. So we wanted to take the opportunity to go through some of the advanced capabilities that few assessors are really leveraging to their fullest capability. Hopefully, even if you’re a seasoned Compliance Unfiltered listener, I’d suggest thinking about your process, how you do what you do, some of the stuff we’re gonna bring up, where it could be applicable, and hopefully this particular session turns out to be helpful. Todd Coshow:Absolutely. Well, let’s start with telling the listeners more about request lists and some of the benefits when handling multiple certifications. Adam Goslin:Sure thing. I’m sorry, I got completely distracted by a shiny object. I went and did a quick lookup. “And they tell two friends, and so on.” It was not an STD, fans that are keeping score. It was a famous phrase from 1970s and ‘80s television commercials for Faberge Organics shampoo. So for those of you keeping score on Adam’s memory card, you can put the red mark on that side of the paper, shall we say. Anyway, sorry, I’m back now. Todd Coshow:So request lists. Adam Goslin:Yes, request lists. A lot of people tend to walk into this notion of the request list as, “My engagements aren’t all that challenging. They’re not all that difficult, so I don’t need a request list. I really only need my request list for these super complicated engagements, etc., and we don’t have engagements like that, so we’re not gonna bother.” But the reality is, I challenge the listeners to just think about it. Actually, now that I think of this, I’ll give a pro tip on this one too. When you go in and do an engagement on the TCT portal, for those that haven’t really inspected what happens, you can hit the full export button, and that will produce kind of a full export of the entire track, all the report texts, explanations, which attachments went where. One of the files that comes out of that is like a document spreadsheet. Basically, what it is, it’s a unique list of the documents that were leveraged on the engagement, and in the next column over, it tells you how many places was that document used. As a test, I would just suggest go do that for one of your recent engagements. Go look at that file because what you’re gonna see is that there are single pieces of evidence that are attached to multiple requirements, and in some cases, the evidence is attached to hundreds of items.

On this episode of Compliance Unfiltered, AI can speed up policy drafting, but it can also create hidden compliance risk when no one validates the result. Listen, as Todd Coshow and Adam Goslin discuss why AI-generated policies often fail in audits and incident reviews, and how to use AI for drafting without losing accountability. Episode Transcript: Today, Adam, we’re gonna talk about what compliance problems arise when AI is writing your policy. So if AI wrote your security policy and no one really reviewed it, whose policy is it? Adam Goslin:I love the compliance problems. That was good. Before I go there, every time that you’re like, “Hey, tell a few friends that may be interested in what we’re doing here,” I always had that thing. I don’t remember what the frick commercial it was back in the day, but it’s like, “And they too tell two friends, and they tell two friends, and so on and so on.” I forget what the hell the topic was. It was like some PSA or something. Todd Coshow:Sounds like a pyramid scheme. I don’t know. Adam Goslin:Nah. I’m gonna be forced to go figure that out now. Anyway, if you just go jam it into AI and it spits out a policy and nobody’s taken a look at it, whose policy is it? AI is becoming a good productive tool for compliance teams. It isn’t a problem to have AI go take a whack at the first draft. The problem is, and quite honestly, this is the same issue that organizations have had now for some time. For some time you’ve been able to go out to whatever, I’m just gonna make it up, like www.writemycompliancepolicyforme.com, and you too can fill in blanks and get some steaming pile of garbage as a policy. Some people literally do. I’ve been doing engagements, and we’re going through the policy for the annual review, etc., and there’s literally placeholders left in the damn policy for where things that they should have filled in, obviously. They didn’t do anything other than take a half-hearted whack at find and replace a couple of times and called it a policy. It’s really no different. When you’ve got AI blasting out the first draft and then you just go ahead and put your signature on the dotted line, it’s not terribly useful. Quite honestly, one of the biggest problems that poses when you’re trying to go through your engagement, the relationship between people going through compliance and the folks that are gonna be assessing compliance, it’s one where there is a certain amount of built-up trust that happens between those parties. There is absolutely no better way to erode any notion of trust building when you’re just serving up what usually is one of the earliest things. Normally when you go and sit down, you go through the overview of the company and what is the scope, and the assessor’s asking all sorts of questions so they can get their arms around it. But the very first thing that they’re actually looking at generally is the policies. Do you wanna start it off on completely the wrong foot? Go have AI write the initial draft and put your signature on the bottom line, or go grab a template policy and you haven’t really reviewed it. Policies are more than just well-written language. It’s literally a written commitment about how the organization is actually operating. If leadership is signing off on policies that aren’t reflective of reality, aren’t reflective of coverage for the various standards that you’re ostensibly going up against, if it isn’t reflecting how you’re actually doing what you’re doing, etc., you’re creating compliance risk in advance of your assessor walking in to bat you over the head. It’s really not a good look when you’re sitting there at your annual assessment or onsite and running square into that wall.

Think PCI compliance is something you can outsource? Think again. Todd Coshow and Adam Goslin break down the biggest misconceptions about PCI DSS, from third-party payment processors and SAQs to merchant versus service provider responsibilities. Learn why outsourcing payment processing doesn't eliminate your compliance obligations, how scope really works, and why treating PCI as a one-time paperwork exercise creates unnecessary risk. This episode is essential listening for merchants, service providers, and anyone navigating PCI compliance for the first time. Episode Transcript: Now, Adam, a long time ago in a land far, far away, there was a time where you asked the question, “What is PCI?” So bring the listeners up to speed on that. Adam Goslin:Everybody gets their start somewhere, and PCI was definitely mine. I had kinda made my way up the IT management ranks. Boss comes by. Don’t ask me why, he decided to print the entirety of the PCI standards, but literally drops a four-inch deck of paper on my desk and says, “Hey, we need to get compliant with this.” I’m looking at the cover page, and it says PCI on it, and I literally said, “What’s PCI?” So that was my entree into the land of security and compliance. I sat there staring at this volume of information and wondering, “What the hell do I do with this? Where do I go? How do I start?” etc. It’s part of why I decided to step into the space to help people, because I clearly remember just how overwhelming it felt to be looking at that much stuff, not having any clue what the hell it was, what it meant, what it’s for, does it even apply to us, etc. All the way around, it was very overwhelming to step into the compliance arena not already having been initiated. TCT has, both I and TCT have kinda specialized in PCI since our inception, and the consulting work that I was doing for folks in the space, the history of the consulting practice goes back even further than PCI’s existence. As we were sitting there and contemplating the types of things that organizations new to the space are facing, we decided to put together this almost like a frequently asked questions when you’re getting a compliance program off the ground. Frequently asked PCI questions when you’re getting a compliance program off the ground. Todd Coshow:Does PCI apply to merchants who outsource all payment processing? Adam Goslin:It’s one of the common questions that I’ll get. They’ll be like, “Oh, well, we don’t touch anything. We go ahead and outsource all of our payment stuff to blabbity-blah. That’s not my problem, and PCI doesn’t apply to us.” The answer is you’re wrong. Companies that are not storing, processing, transmitting, or receiving cardholder data, they still are subject to the PCI DSS. One of the biggest misunderstandings is, sure, there’s some technical elements of how you’ve done what you’ve done in terms of the connectivity. The devil’s always in the details. If you have a merchant account that is in any way, shape, or form receiving payments via credit cards, then you too get to fill out your PCI paperwork. That’s one of the biggest misunderstandings that organizations have. Honestly, a lot of the big names that have come out in the space over time, the Stripes, the Squares, the Intuits, if you will, back in the day, it was like the Wild West. “Well, I’ll just go get a Stripe account, so I don’t have to worry about this.” “Go process my stuff through Intuit, that way I don’t have to worry about it.” The unfortunate part is that those organizations were on this mad race to get people to jump over to their platform and process their stuff via their platform, but they weren’t really doing a great job with enforcing, mandating that people were actually following the PCI DSS. That kind of became a problem for a while because they were able to go in and easily turn it on, etc., and there wasn’t any enforcement arm that was coming at them.

Passing an audit doesn't mean you're secure. In this episode of Compliance Unfiltered, Todd Coshow and Adam Goslin expose the critical gap between compliance and real cybersecurity. Learn why controls can pass every audit yet still fail to stop modern attacks, and why continuous validation is replacing point-in-time evidence. Discover how organizations should test resilience through penetration testing, red teaming, tabletop exercises, backup recovery, and control effectiveness—not just documentation. If you think "audit passed" equals "risk reduced," this episode will change the way you measure security forever. Episode Transcript: Today’s topic, Adam, is one that I feel like too many folks are familiar with, and that is the company still got breached despite all of your controls working. So what happens when every box is checked, every control passes the audit, and the attacker still gets in? Adam Goslin:Controls can operate as designed, but still end up failing to protect the organization. Compliance is measuring whether or not a control exists and if that control was executed. Security measures whether that control actually reduced the risk. One of the earlier euphemisms that you would hear a lot is compliance doesn’t equal security. What those people were getting at is that just because I have checked this box that says this thing’s in place doesn’t mean I’m actually secure. The control working doesn’t necessarily mean the organization’s protected. We need to make a shift from control execution to control effectiveness so that we can gain risk mitigation. There’s also the possibility, and this happens to fewer of those organizations, but there’s a possibility that you’ve got a zero day out there. But even in the case of a zero day, you’ve got a myriad of other controls that ought to be effective, where those detection mechanisms still have the ability to identify, “Hey, Houston, you got a problem.” Whether it’s identifying control bypass through monitoring of central logging, unusual user activity with behavioral analytics, file integrity monitoring if you’re seeing files changing within the environment, failed attempts from inside the network as attackers are trying this, trying that, and trying the other thing. There’s a reason why, even with zero days, it ends up seeing the light of day. It’s about mitigating the amount of time between, “Houston, we got a problem,” and knowing that you have a problem. Todd Coshow:What’s the difference between a control operating as designed and a control actually being effective? Adam Goslin:When it’s operating, you’re checking the box. This thing happened. But when a control is effective, it means that the risk was meaningfully reduced. You can have every single person in your organization going and attending security awareness training and seeing their quarterly security reminders and the piece of paper that’s taped up on the inside of the bathroom door, and yet employees still fall for phishing attempts. Maybe you’ve got a situation where an organization went in, ran their vuln scans, but they left vulnerabilities unpatched for a period of time. There’s gonna be some period of time between recognition that I have a vulnerability and getting it cured, and depending on how long of a span that is. It doesn’t necessarily have to be just critical vulnerability. A lot of people will obviously focus in on critical vulnerabilities. But what they seem to miss in their vulnerability management is that oftentimes I can take two or three medium-level vulnerabilities and conjoin them to create something that’s far more impactful.

AI regulation is no longer a future problem. It’s creating legal, financial, and product risk today. Todd Coshow and Adam Goslin break down the evolving AI regulatory landscape, from FTC enforcement and the growing patchwork of U.S. state laws to California’s sweeping AI legislation and the EU AI Act. Learn why AI compliance is now a business-critical issue, how third-party AI doesn’t shift liability, and what organizations must do to avoid enforcement, reputational damage, and costly mistakes. Essential listening for compliance, security, legal, product, and business leaders. Episode Transcript: Today, Adam, we are going to do a deep dive specifically about government AI regulations that could apply to your company. There are a lot of moving parts related to AI these days. Get us started on this one, Adam. Adam Goslin:Sure thing. As AI has left the barn and is starting to become a barn burner of sorts, it’s more integrated into our lives. Government entities are realizing that they need to regulate the use for both consumer and citizen safety. There’s new government laws that are constantly being introduced. Organizations are gonna find themselves trying to accommodate a bunch of different laws that aren’t aligned with one another. This reminds me a lot of how breach notification laws started splaying out within the US, with having state-level regulations and there being a ton of complication coming into that arena. We’re heading down the same path with the AI arena. Both in the US and EU, there have been AI laws and regulations that have been enacted that will affect businesses today, even if you aren’t located within those jurisdictions. The problem is that failures for complying with those regulations could result in millions of dollars in fines for a given company. It’s definitely something that the folks out there are gonna wanna pay attention to and keep their ear to the ground on. Todd Coshow:What do we have in the US at the federal level right now related to AI? Adam Goslin:Some, not a ton. There isn’t yet a federal-level law that’s regulating AI. But there’s two different governing arms of AI regulation in the US, namely coming into play in terms of there’s a federal executive order out there. There’s also a Federal Trade Commission, or FTC. Those two are laying the foundation for the eventual federal AI. The FTC isn’t exactly taking prisoners, so to speak. We’ll start with the executive order. There was an executive order put out that just came out on June 2nd of ’26, promoting advanced artificial intelligence innovation security. That’s the closest thing we have to really a federal-level edict at this point in the game. The key provisions within that directive included a frontier model framework that was directing federal agencies, including NSA, CISA, to put together classified benchmarks for advanced AI. It also establishes a voluntary process for developers to grant the government early access to covered frontier models for up to 30 days in advance of the public release. For those that aren’t in the know, what’s an AI frontier model? It’s a really large general-purpose AI system that represents the bleeding edge or state-of-the-art in AI technology. The frontier models are trained on vast data sets. It often costs organizations either tens to hundreds of millions of dollars to develop. Those systems will possess advanced reasoning and planning capabilities for predictive work, multi-step workflows, debugging code, solving complex novel problems. They can also act as digital agents that use external tools, otherwise known as APIs, and trigger autonomous action. That executive order is pushing for the creation of an AI cybersecurity clearing house. It’s a voluntary collaboration with the AI industry and critical infrastructure operators to coordinate vulnerability scanning, patch distribution, threat validation, creating a central repository that’s fed into by a bunch of different organizations.

Compliance is changing fast, and many organizations are already behind without realizing it. In this episode, Todd Coshow and Adam Goslin break down why AI, cybersecurity, privacy, and third-party risk are accelerating compliance demands—and how siloed teams and compliance debt make it harder to keep up. Learn what an adaptive, continuously improving compliance program looks like, and why staying ahead starts with reducing redundancy, improving visibility, and building compliance into day-to-day operations. Episode Transcript: Today, Adam, we’re having a conversation about making sure your compliance program keeps up. Things are changing all over the place, so this is an important topic. How far behind is your compliance program, and how would you even know, Adam? Adam Goslin:My compliance program’s amazing. Todd Coshow:Answering the philosophical question, not being a smartass. Adam Goslin:A lot of organizations don’t know. Many of them have this roadmap that they’ve created. They’re measuring themselves against what they did last quarter, but in many cases, not looking ahead, not planning for the changes that are coming, not putting their ear to the ground, so to speak. Part of the problem is that the expectations are changing fast these days. You’ve got AI governance rules that are coming out. We’ve got accountability for cybersecurity ramifications expanding. You’ve got product security requirements tightening. You’ve got frameworks like PCI that could raise the bar on continuous control validation. In addition, you’ve got more and more organizations that, it’s the atypical, “We started with doing our SOC 2, and then somebody demanded that we go in, do an ISO 27001, and then somebody’s coming in and saying we need to layer this one on.” Whether it’s the existing ground shifting underneath, or brand-new stuff coming out that’s going to be applicable, as an organization, you can feel like, “We’re on track internally because we’re checking all the boxes that we planned to check back when we planned out the prior quarter, and we’re validating that we got all that stuff done.” But from the outside perspective, you’re starting off already behind the eight ball, if you will. Todd Coshow:It definitely feels that way. It also feels like regulations, especially around AI, cybersecurity, and data, are, for obvious reasons, accelerating. What’s actually driving that? Adam Goslin:Anytime you’ve got something new, especially AI, AI is new, makes people uncomfortable. Kind of a combination of boogeyman sense and Skynet vibes going on. Effectively, it’s a matter of risk is moving faster than regulators are comfortable with. AI makes changes as to how decisions are made, how data’s being used, how systems are behaving, and it’s left the regulators trying to play catch-up in real time. You’re seeing a lot of changes happening. Instead of waiting five years between big changes, you’re seeing these waves of tweaks, modifications, improvements, etc. AI governance expectations heading north. You’ve got stricter rules around breach accountability, expanded third-party risk requirements, evolving data privacy laws. It’s a lot of different things all simultaneously churning. It’s really not just this one thing is changing, this one regulation. It’s more of an overlapping and convergence of the various regulations that are out there. In many cases, it’s overwhelming teams in terms of being able to keep the finger on the pulse and keep up. Todd Coshow:Where do organizations tend to fall apart when responding to all of this change? Adam Goslin:A lot of times they’ll treat each regulation like a separate project. Over here, down aisle number one, I’ve got AI compliance stuff. Then in aisle number two is my PCI update, and aisle number three is my privacy workstream. In many cases, you’re seeing siloed efforts for folks trying to go through solving the same problems, access control, data governance, risk management, and doing it repetitively.

Compliance doesn't have to be expensive, slow, or overwhelming. In this episode, the CU Guys reveal the blueprint for building a successful compliance program from the ground up. Learn why the right people, documented processes, and purpose-built technology make all the difference, how to avoid costly mistakes that delay audits, and why proper scoping is critical to long-term success. You'll also discover practical strategies for simplifying evidence collection, improving audit readiness, and transforming compliance into a business advantage instead of a business burden. Episode Transcript: Adam, today we are ready to get serious. That’s right, we are ready to get serious about compliance. If there’s anyone that I know that’s serious about compliance, it’s you, sir. Help set the stage on this one. Adam Goslin:For a lot of organizations, when they started going up against security and compliance, they didn’t have any clue when they started just how much of an investment it was going to end up being. Maybe the organization was initially hoping they could do a check-the-box approach to compliance. “Oh, if we just put all our crap there, everything magically happens,” or whatever the snake oil salesman was busy hawking your direction at the time. But if you actually care about the security posture of your organization, then you know that approach isn’t going to make the grade. You can rest assured your customers expect to see detailed proof that you are indeed taking security and compliance seriously. More and more, it’s becoming the standard or the norm that organizations will validate and vet the organizations that they choose to trust with their data. Your organization’s going to be no different. If your organization fits into this category and it’s time to take your compliance program to the next level, then it’s a major step forward for the organization. You’re going to need to get strategic about making sure you’re covering all the bases and evaluating and addressing several parts: people resources, the processes that you undertake, as well as where your existing technological approach to compliance stands in the grand scheme of things. All of those are going to come into play as you’re going through the process. If you fall into that category, you landed on the right podcast. Todd Coshow:Indeed. As part of an organization’s leveling up their compliance program, tell me more about the people they should be looking to have as part of their compliance strategy, and some of the pitfalls that organizations run into there. Adam Goslin:It’s all about having the right people. One of the big mistakes that I’ll see organizations make time after time when they say, “Okay, we’re going to take compliance seriously,” is that, no offense to the assessors of the world, they just go hire an assessor out of the gate. They think, “The assessor knows what they’re doing, and the assessor will be able to get the answers and help to get the company’s act together.” But I wouldn’t recommend that be step one. It doesn’t work well because the assessor, as weird as this sounds to articulate, isn’t responsible for sitting and guiding the company through a compliance engagement. They may be happy to charge you a hell of a lot more to hold your hand and walk you through it. But effectively, the organizations that do that become the problem children to the assessors. It’s like, “Oh my God, this is the never-ending engagement because these guys aren’t anywhere near ready to go.” For many assessors, they’ll have a readiness notion because they’ve been burned so many times with this exact thing happening. They’ll do an assessment up front of, “Is this organization actually ready to bring in an assessor or not?” You’ll be having conversations about the things that you don’t have in place with the person who is charged with assessing your organization’s current state of compliance. You end up revealing a whole ton of dirty laundry through the process.

On this week's Compliance Unfiltered, Todd Coshow and Adam Goslin unpack why spreadsheets are one of the biggest risks to a compliance program. They share real-world stories of version chaos, scattered evidence, and audit-day scrambling, then explain how a centralized system gives teams real-time visibility, better control, and confidence in their compliance status. Episode Tracking: Today, we’re going to chat about the biggest risk, in my opinion, possibly in some other people’s opinion, to your compliance program, and that is, dun, dun, dun, the spreadsheet. That’s right. The spreadsheet is the biggest risk to your compliance program. It’s almost as difficult as it is for me to say. Now, Adam, if you were in the middle of your onsite and your assessor asked for specific evidence, how long would it take organizations to actually find it? Adam Goslin:If we’re talking about my engagement, how long would it take? Seconds. But for a lot of people that are rocking off spreadsheets, longer than anybody wants to admit. This goes back quite a ways, way back in the day when I was doing consulting before the existence of TCT and being forced to use that horrifying effing spreadsheet. I was in some onsite sessions with clients where the assessor was like, “Go ahead and show me this.” All of a sudden, it’s crickets. People are scrambling. They’re looking at their watch. “Hold on a second. I think it’s over here.” They go and look over there. “Okay, I’ll find it. If it’s not there, it’s got to be over here. Give me a couple more minutes.” No, it’s not there either. “You know what? Evan knows exactly where it’s at. Give me one second.” Ring, ring, ring, ring. His phone went to voicemail. “Anyway, look at the time. It’s 10:45 in the morning. Isn’t it about time we went and grabbed lunch?” It was an effing nightmare. A lot of people think that they know where things are until they’re under the gun and have to prove it. If I’ve got to scan across email threads, shared drives, different versions of documents that exist in 18 different spots, Slack messages, text messages, voicemails, network shares, and whatnot, you’re not just stepping up to the plate and proving a control out. You’re trying to reconstruct history at that point in the game. It’s astoundingly uncomfortable when the assessor is asking for stuff and you can’t just put your finger on it. It really degrades their sense that the people they’re talking to actually have their act together. Todd Coshow:I can definitely appreciate that. Spreadsheets are still everywhere in compliance, but why are they such a problem? Adam Goslin:Spreadsheets weren’t designed to manage living, breathing systems. We’ve talked before about the levels of complexity that exist within these things. A spreadsheet is static, and compliance isn’t. There could be one or more compliance standards I’m going up against. The organization could have one or more locations they’re going up against. The organization could have one or more applications they’re going up against. You could have workflows that flow from control owners to internal QA, over to a consultant, up to an assessor, to assessor QA, to complete. It could be in any of those states. If I start multiplying all the cross-sections, with a spreadsheet, literally one poor soul has to manage the sheet if you want to try to keep anything sane. The spreadsheet isn’t showing you what’s happening right now in your compliance program. It’s showing whatever the last person did that went and typed it in.

In this episode of Compliance Unfiltered, The CU Guys breakdown one of the most important compliance skills: learning how to say no to customers. Adam explain why organizations should protect internal security documents, route all requests through a centralized process, and use NDAs when prospects start asking detailed technical questions. The conversation also covers the value of using a portal to manage compliance work, keep evidence organized, and streamline future engagements. Plus, they review major security news, including recent breaches, critical vulnerabilities, and a cautionary AI mishap that deleted production data in seconds. If you want practical guidance on protecting sensitive information without hurting relationships, this episode is for you. Episode Transcript: It is that time again. That’s right, ladies and gentlemen, security reminder time for Q3 of 2026. As always, Adam, we’d like to tell the folks at this point in the conversation that we appreciate them. We’re thankful for their time and their energy. As always, we say, give us a rating or review on your favorite podcast app of choice, Spotify, Apple, whatever it happens to be. Let the folks know that you like us. It helps the podcast greatly. Also, feel free to reach out to us at [email protected]. Give us your ideas for show topics, your perspective on the things that we are or aren’t doing that you love, and anything else you would like to share with us. Adam, for Q3 security reminders, we are getting started with learning to say no to customers. Tell us more. Adam Goslin:In the grand scheme of things, it is a capability that some organizations struggle with. Our focal topic this time around is compliance reporting. What do you not want to share with your customers and, more aptly put, telling them no? When a customer is asking for proof you’re compliant with a particular standard, you need to make sure you’re providing the right information to satisfy their request. There’s a ton of your information that nobody outside of your company has any right to see. It’s critical that the listeners and their personnel understand exactly what to share and what not to share when third parties are asking for various elements of proof. This issue comes up all the time. A lot of organizations just straight hand over whatever they ask for and keep their big clients happy. It’s important that folks know their rights, educate their employees, know what to provide, protect the company, and do things properly. Certainly, safeguarding internal reports is one arena we’re going to get into. As an example, if you’re going up against PCI DSS and doing a full Report on Compliance, or a ROC, or going through a Self-Assessment Questionnaire D, those are internal reports. There’s a myriad of information within them that external entities don’t have any right or reason to see. In PCI’s case, they provide an externally facing summary report that’s known as the Attestation of Compliance, or AOC, which summarizes the compliance posture and is very well suited for external distribution. The same general premise applies for every compliance standard. If you’ve got detailed reports revealing granular details about the internal environment, tools you’re using, how your systems are configured, etc., don’t distribute those. Only issuing your externally appropriate summary of your security posture to third parties is appropriate. The next arena I want to touch on is a centralized distribution channel. One of the problems folks have is managing those inbound inquiries appropriately and making sure that there is a central function to handle any of those inquiries and for distributing any of your security and compliance documentation.

AI agents are driving efficiency, but also introducing serious, often unseen security risks. As adoption accelerates, unvetted access, prompt injection, and poorly controlled environments can expose sensitive data and disrupt operations. This episode of Compliance Unfiltered breaks down the key threats and shows how to mitigate them using proven principles like least privilege, input validation, and isolated execution. Learn how to secure AI deployments and turn a growing risk into a resilient advantage. Episode Transcript: You’ve been talking about the AI zombie walk for some period of time now. What perils are folks walking into with AI agents? Adam Goslin:We’ve got the democratization of agentic AI on the march. Anybody can get the latest tools and create these incredible AI agents that can do almost anything you can imagine. It’s part of the main reason why the agentic AI move can be a substantive risk for the organization as well. One of the big problems they’re having right now is that, while security and compliance folks understand the risks of AI, there are a ton of frontline users that are just clicking buttons and building tools and making things automated and better. There isn’t, in a lot of cases, any thought to the security implications of what they’re in the process of doing. Thinking about security isn’t an element of day-by-day workflow, and that’s where this notion of agentic AI comes in riskiest, if you will. Leveraging platforms for building these AI agents without a security background, I’d liken it to giving a three-year-old an arc welder. It might be able to figure out how to turn it on, but can you imagine the untold damage that they could do with it? You put a powerful AI tool in the hands of people that don’t know about protecting data, layers of security, and how to appropriately restrict access. They’re not going to know how to use it safely. There are a lot of considerations when it comes down to building AI agents in a secure fashion. But most of it honestly comes down to security principles. It’s possible for employees to build those safely, but there needs to be that marrying of the security and compliance-style mindset in conjunction with what’s going on. Todd Coshow:What type of efficiency risks are folks running into? Adam Goslin:AI agents are often used for personal efficiency and internal workplace functions. To give some examples: consolidating, summarizing, and filtering across multiple email accounts; automated execution of auto-replies; analyzing workflows and calendars for identifying efficiencies; gathering up data; and preparing written summaries of client projects. These things may seem harmless, but just consider the risk of letting the AI agent loose on your calendar. How much data did you just expose as a result of clicking, “Sure, you’re going to have full access to my calendar”? The agent has access to your client lists, client contacts, emails, signatures, phone numbers, and cell phone numbers. All of that starts to come into play as you’re granting blind access to Office 365, as an example. Maybe that extends to OneDrive and SharePoint. Maybe, depending on the user and their access levels, they could be granting a ton of access. Even things that seem innocent, such as tracking birthdays or anniversaries, could similarly produce greater levels of exposure than you were even considering. The company needs to consider what is the data and information that’s exposed to the AI engine, how do we want to use it, and whether or not that data is secluded from other things. If you’re moving from a free version to a paid version of AI, your users may still be jammed into some gigantic public pool of data storage. Even when the AI vendors are claiming, “We don’t hand your data over to public AI models,” you need to look closely at what they are doing, such as utilizing the information that’s gleaned from the individual users when it comes to training their engines.