A 70% decision means you're 70% sure; at 85% certainty, it's probably too late.
1. The Mastering Risk Management Podcast's Episode 119 covers AI risk, governance and ISO 42001 readiness with StackAware founder Walter Haydock.
2. Host Anthony Wilson interviews Haydock, a Naval Academy, Georgetown and Harvard Business School graduate who served as a Marine Corps reconnaissance and intelligence officer, a National Counterterrorism Center analyst and a House Homeland Security Committee staffer.
3. Haydock's thesis is that AI risk follows the same cybersecurity principles of confidentiality, integrity and availability, and that organizations wrongly treat AI as "almost a type of magic."
4. He credits the Marine Corps with teaching formal likelihood-and-impact risk matrices plus the "70% decision" rule, noting that an 85% decision is treated as 100% and is usually too late.
5. He says many organizations put employees in a "double bind" between business pressure to use AI and "draconian" policies that people ignore, and he has seen a supplier contract clause banning any AI use on customer data.
6. StackAware's offering has three stacked stages: an enterprise AI risk assessment, a governance program with policy and procedures, and design of controls for ISO 42001 certification.
7. Inventories of AI systems regularly surprise clients, he says, because of third-party, fourth-party and "nth party" sub-processors, and sometimes it is impossible to tell what happens at the fifth-party level.
8. Haydock states that business teams, not security and compliance teams, should set risk appetite because they carry the company's mission, and that the risk assessment should drive which controls get built.
9. He reports that his customers sit in the top 10% for AI sophistication, while the other 90% "aren't thinking about it at all" and are the most likely to get burned, and he describes AI tools that become shelfware when employees prefer their own.
10. Suited to security leaders, risk managers and executives building AI governance.
