Most of the Things Accessing Your Data Aren't People Anymore

‍

‍

Host: Fahad Diwan, Director of Product Marketing, Exterro

Guest: Rudy Ristich, Chief Information Security Officer and Chief Privacy Officer - Avant

‍

Ask your teams what data they hold and you get their best guess, on the day you asked.

Host Fahad Diwan talks with Rudy Ristich, Chief Information Security Officer and Chief Privacy Officer at Avant, the Chicago-based consumer lender. Holding both roles is still rare, and it puts every question back on the same thing: the data, and the controls around it.

Why do stakeholder interviews produce inaccurate inventories even when everyone is trying? What changes when classification is technical and continuous rather than a point-in-time snapshot? How is AI making phishing, deepfakes and identity fraud harder to defend against in consumer lending? And when a growing share of what logs into your systems is a machine or an AI agent rather than a person, what does access control even look like?

Rudy covers all four, plus how a small team keeps pace with frontier labs shipping new capabilities every other week.

For security leaders, chief privacy officers, data governance teams, and anyone whose remit spans both.

‍

Subscribe on Your Preferred Podcast Platform

Apple Podcasts | Spotify | YouTube

‍

Episode Transcript

Fahad Diwan (00:05.326)

Hello everyone and welcome to Data Xposure, our podcast for data risk leaders. My name is Fahad Diwan, and today we're exploring a very exciting topic impacting financial services firms all over the world. How they're handling this proliferation of data in cloud environments. We're gonna explore how the new chief information security officers and chief privacy officers are throwing out the old playbook, leveraging new technologies.

‍

And navigating the risks and rewards of AI. And I'm so, so happy. We have such a great guest for us here today, Rudy Ristich from Avant, the Chief Information Security Officer and Chief Privacy Officer. Welcome, Rudy. Thank you so much for joining us. So, for our audience, can you let us know more about your role and how you came to be?

‍

Rudy Ristich (00:49.654)

Thank you, and grateful to be here.

‍

Rudy Ristich (00:57.016)

Be in it. Sure. So I'm the Chief Information Security and Privacy Officer with Avant, and our mission is to remove the barriers to borrowing for the middle class.

‍

Fahad Diwan (01:05.624)

That's amazing. That's a really admirable vision and mission. How did you come to be a chief information security officer and chief privacy officer? I've seen people hold one title or the other, but not both. you know? So tell us.

‍

Rudy Ristich (01:18.06)

More. It's it's becoming a little bit more and more common for us to share the role of information security and privacy officer. I know I'm not alone, but I'm probably one of the first people out there that do so. So what ties it all together is effectively the element of data and the controls that we put around data. So I came into Avant to build the information security program. since we're a tech forward company, a lot of it has to do with how we enable controls around our data ecosystem. so it was a natural fit to take on that responsibility as well.

‍

Fahad Diwan (01:47.096)

That's fascinating. And you're right. It is all about the data. Back in my consulting days, I would tell people the difference between information security and privacy was information security is you're protecting the box that the data is in. And then privacy is you're making sure that the data is being used properly within that box. Yeah. Is that kind of how you see it?

‍

Rudy Ristich (02:05.152)

It's a perfect analogy. The privacy side of of my remit is are we using the consumers' information fairly and are we abiding by the rules and regulations there? So I love what you have there.

‍

Fahad Diwan (02:15.232)

And so what are your strategic priorities in in this role?

‍

Rudy Ristich (02:18.968)

Yeah, in the role understanding effectively all the data that Avant processes about our consumers, where does it land at the end of the day? what obligations do we have to fulfill for the consumers and for the regulators? And how can we do that at scale? because we're a rapidly growing company and we do a lot of what we do with a small but effective team.

‍

Fahad Diwan (02:41.41)

So how do you do it at scale? Are you leveraging any technologies in your role to be more effective with the small and mighty team that you have?

‍

Rudy Ristich (02:49.518)

Yeah, a lot of technologies with respect to automation, classification, AI stuff effectively. the Optics three sixty platform is something that we're currently rolling out, and we're excited about the capabilities it's gonna bring to the team, how we're gonna be able to scale what we need to do across a massive data set to know more about where our data goes once it leaves like our core structured systems.

‍

Fahad Diwan (03:10.968)

So could you talk to us more about how you envision using Xtero Optics three sixty?

‍

Rudy Ristich (03:15.766)

Yep. effectively we have a l as many suppliers and data systems as we do employees in the corporate environment. So having so many makes it, you know, quite the burden to do for a human to do that day in and day out on their own. what the technology is going to enable us to do is classify the information more accurately than a human would be able to do and take and tabulate on their own. And then once we're more confident in the actual

‍

classification and labeling of the data that we have, wrap a a good data lifecycle and data hygiene program around that information.

‍

Fahad Diwan (03:53.336)

That's amazing. That's amazing. And when I was doing so it's sounds like you in your role and Avant are really leveraging technologies to be more effective. When I was doing consulting before, we would to understand what data we had, we had to do it manually. We would interview different stakeholders and ask them, hey, what data do you have in your department? How are you using it? What do you think are some of the pitfalls of that approach?

‍

Rudy Ristich (04:19.546)

primarily accuracy. I think it's and it's not that people are lazy or or not in good nature, but they're answering to the best of their ability and understanding of what a certain type of data is, or what personal information might be, or what sensitive information might be. And even in our experience, if you give them a definition, they might misinterpret it. So if we're able to technically describe the information that we're seeing or use classifiers to

‍

Look at that information and make a postulation and have a subject matter expert look at it and review it, it's much better than an at-large data owner within the organization.

‍

Fahad Diwan (04:55.486)

I completely agree. And I would often say that data record is better than data recollection. So it's easy it's much better to have a computer scan and tell us what's present than relying on a human's memory, even when they are well intentioned. People don't remember what data they have in their environment or they may not have the time to go out and scan all the different data types they have.

‍

Rudy Ristich (05:17.634)

Yeah. And that's another great thing. The other thing is when you sit down, you talk with an individual, you get a point in time assessment of what they believe at that point in time. And with something that's more technical and scanning based, we can do it in real time at the moment that we care about it rather than what happened a year ago, eighteen months ago, or whenever you last had your inventory taken.

‍

Fahad Diwan (05:38.72)

Right, with technology, your data inventory is evergreen, it's constantly being refreshed and up to date. Yeah. And so in your role, I imagine, you're not only working with data across different data systems, but as a chief information security officer and chief privacy officer that has to manage data for an entire organization, you must be working with a number of different people. How do you get everybody on the same page? How do you align everyone?

‍

Rudy Ristich (06:02.092)

Yeah, it's it's a big cross functional job and I have the support of a wonderful legal and compliance team and a CIO office that has AI champions that helped get the word out and we all get together on a bi weekly basis and kind of discuss what what does the business need, what's the business trying to achieve with their various objectives, especially in the area of AI, and just having that open, constant dialogue you know.

‍

formally in person and then ad hoc literally on a daily basis as we need to discuss emerging capabilities because all these frontier labs are launching new capabilities on a weekly, bi-weekly basis. And sometimes it it's something that you know we do get our hands around pretty quickly. And a lot of times we wanna enable the business to take advantage of the capabilities as soon as they're released as possible. And sometimes it's like, hey, we gotta pump the brakes, learn a lot more about okay, what are the ins and the outs of this

‍

Type of a capability, you know, how does it last against the contractual provisions that we have and look at it from a holistic risk lens?

‍

Fahad Diwan (07:06.858)

I love that. So one way you make sure that your team is aligned is you meet regularly with the CIO on a bi weekly basis and you identify how they wanna leverage the data and then you give them advice or you implement the necessary controls for them to be able to do so safely.

‍

Rudy Ristich (07:23.252)

Find a way to get to use it safely and within the the guardrails that we've set up to make sure we're always abiding by the law.

‍

Fahad Diwan (07:30.754)

Fascinating. And so with this point about safety, AI is introducing new risks to an organization, and many of those risks are with respect to information security. What type of novel AI risks are you seeing in your role and how are you addressing them?

‍

Rudy Ristich (07:48.962)

Yeah, I think, you know, some of the more novel risks, you know, especially in the consumer lending landscape, better ability to like pretext and trick people via business email compromise and phishing type attempts. You know, it's trivial now for someone to go use these tools to research people deeply and get a really targeted kind of message in front of someone that could be leading to a nefarious end. also in the area of fraud for our organization, deep fakes.

‍

identity spoofing, for government documents and IDs and things like that. Like the the countermeasures that we have in the area of verifying identity are always shifting and we're always looking for newer solutions there. So those are the

‍

Fahad Diwan (08:33.89)

Those are the novel risks that you're dealing with. And on the flip side, how are you leveraging AI to be more effective, to be better at protecting the information within Avant?

‍

Rudy Ristich (08:45.378)

Yeah, our team is using AI as readily as our internal team is using it to produce content and material for the organization. So and you know, a lot of it has to do with having the right humans in the loop and the right humans designing and writing the harnesses that are working around this model. But, you know, we're using it to speed up the analysis of our infrastructure. It's very complex. it's finding some interesting things on a routine basis. And it's also helping us find gaps that we might have in

‍

capabilities that are available to us that we haven't yet turned on. And so there's this self-improving type of a process that we've seen. you know, I I think like anyone in my position, their programs have seen an influx of like vulnerability reports generated by AI. So we're on like the receiving end of you call it like the AI slop report. So it's like you kind of like fight that leverage with the same leverage that you have. so being able to more readily process that information.

‍

Via AI and the same thing as we evaluate our vendors, like you can tell some of our questionnaires are being filled out by models, but we're also using models to analyze other swath of reports that we request from our suppliers and then consolidate that so that our analysts doing the risk recommendation and review can do that in a fraction of the time it used to take them to review all those documents manually.

‍

Fahad Diwan (10:07.448)

That's fascinating. So your team is really leveraging AI to its full potential to make sure Avant is safe and secure. Yep. For our listeners who've heard this podcast so far and are digesting all of your insights, what would you say would be the main three things that they can do to keep their data more secure?

‍

Rudy Ristich (10:25.96)

at an enterprise level, understand what you have, implement fundamental controls, meaning zero trust, multifactor authentication around that data. Don't let any one credential access the data. The more you move into a cloud native environment like Avant operates in, identity is the perimeter. So understand the identity not only of the humans that are interacting with the environment, when was it last refresh?

‍

But what's the identity of all the agents and machines that are operating with your environment too? 'Cause that's just as important.

‍

Fahad Diwan (10:59.744)

It's a it's a funny time we live in. We have to identify the humans and these new digital sentient beings floating around in the organ.

‍

Rudy Ristich (11:06.84)

They're working on your behalf, so effectively they they might as well be a another worker, right? So

‍

Fahad Diwan (11:12.43)

Well, thank you so much, Rudy. Thank you so much for your time and your insights. It was a pleasure having you, and I can speak for our listeners as well. That's Rudy Ristich from Avant, Chief Information Security Officer and Chief Privacy Officer. Thank you all so much for listening. Please remember to subscribe wherever you get your podcast. Again, this is Data Xposure. Until next time.

‍