AI Security for Business: Human Risk, Data Hygiene and Safer AI Adoption with Fable Security’s Nicole Jiang

When AI process, when you give a prompt, if you give a clear prompt, you have to process tokens. There's a cost associated with every prompt or every question. One thing OpenAI, I believe, has said is there are people, I'm one of those people, I'll be like, can you please do this thing for me? Thank you. And they said, if you add please and thank you, it takes up more tokens. Just be direct. Just remove all the pleasantry. That's crazy for me. I'm Canadian. I say sorry. I say thank you. I say please. All the time. Turn out that's not good for AI. Turn out it's costly. It's costly.

You don't win by following the playbook. You win by rewriting it. 700 episodes deep with the people who actually built something real. No theory, no fluff, no shortcuts. This is Right About Now with Ryan Alford. Companies are adopting generative AI tools faster than almost any technology we've seen. The productivity upside is real, but so are the risks. Today's guest is working at the intersection of AI adoption and cybersecurity, helping companies understand why the biggest threats aren't always hackers, they're human behavior. Nicole Jang is the co-founder of Fable Security, and today talking about how organizations can embrace AI without accidentally exposing their most valuable data. Nicole, welcome to Right About Now. Thanks for having me. Great to meet you. I know you're in Boston today. We're in South Carolina.

I'm sure we love looking at things we've posted 10, 15, 20 years ago. It's a good throwback, but also just like, oh, wow, there's a lot of things on the Internet that we shared. Yeah, exactly. And so now we're telling AI our deepest secrets so it can help us solve puzzles, write contracts. All that stuff. And I was like, well, where is that data going? I have a feeling you might tell us. But Nicole, I'm anxious on this topic because it's like so real for me. We're owning businesses and use it. So let's set the table. Give everyone a little bit of your background. What got you into Fable Security and Cyber Security and all that good stuff. My name is Nicole Zhang, co-founder and CEO of Fable Security.

We've built a human risk platform that shapes secure employee behavior. Behind the scenes, we leverage a mix of AI, ad tech approaches to understanding employee behavior in the enterprise. We deploy just-in-time personalized interventions. When we see employees doing some things that might expose more risks than necessary for our organization, we do this better than typical annual security compliance training, which is what the industry status quo looks like. Our approach is relevant, personalized. It really drives at the risky behavior at time when things are happening, almost like that just in time coach. The reason why we started this business had a lot to do with my previous background with me and my co-founder. Sany came from an ad tech background. So making ads super relevant, super clickable, converts people from buying things, not even know that they want.

Our shared background also came from Abnormal Security is another startup before that we were founding members of. We leverage AI to look for phishing attacks. Phishing became super prevalent in today's age. AI, unfortunately, supercharges attackers. They literally have the tools to send you really targeted phishing threats. And Say and I both realized that we really want to focus on the human layer to teach people to better defend themselves from not just bad phishing, but also all sorts of social engineering attacks, all sorts of things that people may do that introduces risk, not just enterprises, but also for themselves. And so that's the reason why I became super interested in not just cybersecurity, but ways to protect people and ensure that we can all be more productive and more effective as we work.

I see a lot of companies going through digital transformation. So if you ask 10 years ago, it's like moving from on-prem setup to cloud, right? So that was a big shift. We're seeing companies that are forward thinking, they're more mature, they are really technology driven, they're getting so much more upside from AI. And then we're also seeing companies that might be generational, they've been around for over 100 years, they have a solid business, they're maybe not as tech enabled or digital transformed, they're a bit slower. So we're seeing adoption curves in various ways. And so that's the shape of the companies. And then from a security perspective, it's also around how companies view security. Everyone needs security. There are compliance requirements. There's a baseline. There's a lot of now common languages on what needs to be done from a security level.

But I do see that companies who are really thinking about investing in digital AI technology transformation, they really double, triple down in their security investments. And then some may still be checking the box. I really see the divergence of companies based on their tech savviness, their belief in modernizing technology. Now, from a particular companies that are really adopting AI, you really do. I think it really depends on the people. People in the company, for example, if you're a very developer centric company, you just see like a ton of crazy things people can do with AI. They're tinkering, they're trying and the organization allows them to do that. Right. They take on the risk for innovation and the tradeoffs might be risk. For some other ones, they're worried about, for example, their healthcare companies, you're worried about HIPAA, financial, you care about PCI, PII.

They're real like financial business consequences. If you tinker too much, we also see other companies will create playground or sandbox for people to play. And then it's a balance of letting people try things out, innovate, but also like not break the bottom line. for the business. We're seeing all of those, but we are seeing more and more companies, just their time is spent on trying AI, being more productive. And if you're in this like marathon pace, some are at the beginning, at one end and some are kind of trailing. And I think that space will become larger as we go.

I'm comfortable moving fast. But sometimes you don't know what you don't know. But I know I don't know something that I might should know about where all this data is going and what I need to be thinking about. That's why we got you here, Nicole. What do we need to be thinking about and what kind of sense of information are people accidentally sharing with AI tools? I have a couple of thoughts on this and I've been thinking quite a bit about it. If you think about AI in its purest, purest form, not even technical jargon, what does AI do for you? AI is running. AI is giving you insights faster than a human analyst. Free to read 20 blog posts, surface insight. You can now say, read all of them, give me the insight, ask me questions, ping pong, be my reasoning partner.

AI can automate certain things for you. Before, you have to do step 1 through 20 to get you a task. Now you can automate those things right in the background. These things are human instructed. The way you want some things to be done requires hyper-clarity on the outcome you're looking for. And AI is just extracting data, content, information that you have in your system today. So when I think about the two risks, if you don't know what you're looking for and you ask a stupid question. That exposes risk in ways that you may know an employee does this. You go, why are they asking this question? Can they? Should they be asking this question? Damn, if they ask this question, they might get the answers now.

And the answer is so easy. This is like a new set of things that folks are worried about. The other piece is, I think AI also makes it If you think about it, right, every AI service want faster adoption. So they say, integrate with all your tool stack. We can do all these things. People don't think, no one thinks about permissioning. No one thinks about data. They think about adoption, easy click, one click. If your house is not clean, like if your database is not clean, if your systems are not clean, a lot of companies don't think about that. You can ask a question and you get the answers because... The underlying data is chaotic on its own. When I see our customers, and maybe for you, Ryan, getting your jobs done, getting your tasks done, it's awesome.

But then who did the data cleanup in the first place? There's also just this fundamental, regardless of AI, regardless of how we use, there is still a fundamental data hygiene, security hygiene thing that we got to figure out. All these advancements, it's putting the security foundation into a massive test. And attackers knows that. And so they really try to exploit now with additional vectors in a faster way through AI, through prompting. That's why when I think about security practitioners, they might feel a little stressed knowing that their house needs to be in order to support all of these evolution of technology. superhero movies it's like well who has the superpowers who are the mutants the good guys and the bad guys have the same superpowers who's using them best the bad guys are using these tools to take all this other stuff to advance their criminal behavior or they're sneaking around or whatever they're doing no matter how nefarious or non-nefarious it is as the good guys we got to use these same superpowers to both protect it and to use it for what we're ultimately using it for

We also just have to work really hard and be very creative when it comes to how to better protect. You mentioned something about how direct, what outcomes we want. And usually it's my own lack of clarity that causes the AI's bad behavior or bad outcome that I didn't want. But anyway, I digress. I just want to say that. wanted to come on here on this episode at Made Sense and admit that sometimes I'm mean to my AI person trying to get it to be more efficient. When AI process, when you give a prompt, if you give a clear prompt, you have to process tokens. There's a cost associated with every prompt or every question. One thing OpenAI, I believe, has said is there are people, I'm one of those people, I'll be like, can you please do this thing for me?

Thank you. And they said, if you add please and thank you, it takes up more tokens. Just be direct. Just remove all the pleasantry. That's crazy for me. I'm Canadian. I say sorry. I say thank you. I say please. All the time. Turn out that's not good for AI. Turn out it's costly.

This episode is brought to you by HighLevel. Make sure to check out the link in the show notes to sign up for your 14-day free trial. If you run a business, you know leads rarely arrive when it's convenient. A call comes in while your team is helping another customer. If someone reaches out, but the follow-up gets delayed, an invoice sits unsent, or a promising lead gets stuck in the wrong stage of your pipeline. I've built enough businesses to know that growth has a way of exposing every gap in your systems. That's why High Levels Voice AI and managed AI agents caught my attention. High Levels Voice AI can answer incoming calls, qualify leads using information from your website or uploaded documents, and even book or reschedule appointments.

When your team is busy, Voice AI can keep that conversation moving instead of letting a potential customer slip away. Then High Level's managed AI agents can handle multi-step actions across your CRM. They can update pipeline stages, send invoices, and execute follow-up sequences across SMS, email, and social. That means fewer repetitive tasks for your team and a more consistent process for every lead coming into the business. For me, the real value of AI isn't adding another complicated tool. It's using technology to handle the work that slows your team down so your people can focus on building relationships, serving customers, and growing the business. If you're ready to create better systems and get more from every opportunity, use the link in the show notes to sign up for your 14-day free trial.

Yes, I do. I'm not replacing the lawyer completely. Just some of those hours. Just being honest. I'm direct. That's why people like this show. So I'm giving it sensitive information to do a task. Fairly sensitive. I'm not giving it my blood type today. Where is that going? Where is that being stored in the server of heaven cloud that it is? To me, it's about where that data goes and what are the potential positive and also more important than negative outcome that might happen from it. Your tools, your data today probably lives on Google. It lives on your payroll application. It lives in your customer CRM. Your information is already like stored somewhere in the cloud by a vendor. AI is really just another vendor that's going to store, process and figure out your data.

And over time, right, as more people use that information and store their information in AI tooling as well, like think of it as another version of cloud. Over time, we're also going to be more and more mature from a security perspective on how to segment data, how to properly protect. Privacy is super, super important for everybody. We're really seeing the early stage of AI. If you look at, for example, Anthropic, they're already thinking about cybersecurity and baking that within on how they work. down the line, right? There's less and less worry around that security side. The external attack vector is what we should all worry about more. So it's really about how people would take your information and do it in a way that is not how you intended for them to come off.

So when we see the threat landscape today, right? We see people acquiring our customers information. They pretend to be employees bosses. They call them and they say, you're in trouble. Come online, log into the site. Give me your password's credential. Hey, you're a client of mine. I see your invoice income through. Can you use this link and give us millions of dollars because it didn't get translated. When your information is being abused for purposes that are really bad by threat actors, that's when risks really happen. And so just like how you're storing your data in various platforms and they get popped or they get targeted, AI is another place where your information can get targeted, if not unfortunately faster, because they're all hooked up right to each other.

When I think about the threat landscape, I just think about we all adopt tools that enable us to be more effective, create more outcome, allow us to be more creative as well. But I do worry about the external where attackers will just use it for everything. Other creative purposes that you and I talked about that aren't great. So it's that two battle, right, of the good AI usages and maybe the bad AI usages. Are the traditional cybersecurity tools even equipped to deal with this kind of risk? My knowledge in cybersecurity, and I admit we're always changing, we're always learning. The traditional security tools are really thinking about protecting certain layers. So I came from protecting the email layer. There's people who protected the identity layer, the firewall, the network, the endpoint layers, like your devices.

Traditionally, a lot of tools look at what are the bad things that are coming in. We decide if it's good, if it's bad, and then we do something about it. They don't stop people from doing stupid things. They look at things that are stupid and they say, hey, you should do something about it. We can remove this bad email. We can remove this bad malware. At Fable, what we're trying to do is to say, look, everything really comes back to people. People click on the phishing email. People share the document. People probably put in a document. document somewhere in the first place that they're not thinking about the permission and why might be sensitive beyond your lawyers. And can we do something to just have that one second pause that can prevent a lot of downstream problems?

We can always get better. It sounds like a training thing, Nicole. I don't know how good they are. The bigger companies, obviously, sometimes they train too much, I think. But I don't know about with AI, if there needs to be a layer further, potentially at a lot of places where there's training employees differently in the AI world, then there's this balance. And you talked about this earlier. I mean, it was a lot more eloquently said, but I'll say my best, which is the balance of enablement versus performance. Risk. Start with training, I guess. Like the humans. We got to train these humans how to use these robots. When I think about training, I actually think about it in a very different way. If you think about training, right, it's like someone created a bunch of really knowledgeable things they want to share with you.

A lot of security trainings today don't work. And here's the reason why. If I ask you, Ryan, like, do you care about your personal security? I'm like, yeah. Do you care about looking, being secure on the internet? I think you do. Yeah. Yeah. You don't want to lose your passwords. You don't want to lose your financial information that you store digitally today. Nobody wants that. Like everyone wants to be safe. So then you're like, okay, cool. Like your company's trying to make you safe. And here's a budget training. It's two hours, three hours. It's really painful. You're like, where did it go wrong? People just want each other to do the right thing. When I think about the training piece, I really think about it as, okay, someone's trying to protect you.

And they don't know how to talk to you. Here's a bunch of slides and training and really bad videos to keep you safe. It's like going to a bad lecture, even though you're here to learn. When I think about security, I also think about it as such a complex subject with complex specialists who don't always know how to break it down. So my job is to break it down for people. Our approach is less of training. It's more about coaching, it's more about intervention, smart enablement. will tell you things that you really do need to know in very simple terms. They're not just good for the company. They're good for individuals, just good hygiene in general. And if we can break down that communication barrier and boil really technical subjects into simple matters, people will adopt secure behavior because nobody wants to be unsafe and create problems for organizations.

Organizations are for themselves. My goal is to demystify what training really means in our world and how we approach it. Actually, in the ad tech way, I feel like you're probably really well versed in the world of ads, how you get viewers to pay attention. You can optimize for topics and interests and relevance for your audience. For cyber, it's the same thing. I don't need everybody to change passwords. I only want people who have poor password hygiene to really figure out how to do that. If I know the information, then I don't have to tell someone who's really on top of their security on things that they already they think is super basic. But for some people, it might just save their entire bank account life savings.

I actually have physical Fable Brennett's hand sanitizer that we share with conferences. There you go. You know, you're going to start your cyber hygiene with some physical hygiene at a busy place. Like, here you go, Spree. I know it's pretty clever. Yeah, it is clever. Good job. Hey, look at you. You're a marketer too. Honestly, we're a cybersecurity team's spokesperson in the organization. I was just talking to a customer and they said that the CEO, the president of their company, they heard about what all the security things that we're doing. Through Fable. Oh my gosh, that's awesome. If we can amplify all the work and get people's attention, that's the starting point to get people to change. I was very proud after hearing that snippet from our customer.

I think the second thing is, remember, don't give out your credit card information. Don't give out your passport. Don't give out your... Blood type, Ryan. Let's just do the same thing in the AI world and make sure that the information you care about, just ask for it to omit and AI will do the job for you. Regularly goes through, hey, are things shared that it really shouldn't be? AI can probably find out about that really quickly for you too. And then you can take action. Those are good hygiene to just ask and prompt almost like part of your regular workflow. Those are good. It's so funny. Everything's meta with this because AI can assist in... whatever thing we're trying to solve that might be related to AI.

external threat actors. We are based in San Francisco, California. Our office is right in the heart of downtown. We work in person. We love being there to collaborate. So if you're ever in town, our door is open. I really appreciate you for coming on. Let's do it again soon. Absolutely. Let's stay in touch, Nicole. I'd love to have you on every now and then. This is a very topical thing, real thing, as things evolve. Yeah. Have a fabulous rest of the day. Thank you. Great to see you. Thank you for having me on the show. Yeah. You're a good time. Take care. Thanks. See ya.

build what you keep talking about building. For more, follow Ryan Alford on Instagram, at Ryan Alford. And watch or listen to every episode at ryanisright.com. This is Right About Now. Now quit waiting. Go win.