The Briefing with Dr. Tuboise Floyd
The Briefing explores artificial intelligence, cybersecurity, quantum technology, and the decisions shaping business, government, and everyday life.
Hosted by Dr. Tuboise Floyd, the show brings technology leaders, executives, founders, and practitioners into candid conversations about emerging technologies and their real-world consequences.
Every conversation begins with a question worth examining. What should organizations invest in? Which risks are acceptable? What evidence deserves our trust? Who has the authority to decide, and who remains accountable when conditions change?
From AI governance and cybersecurity to quantum computing, post-quantum readiness, critical infrastructure, national security, and the future of work, The Briefing examines how technology changes the decisions people make and the responsibilities leaders carry.
Guests share firsthand experience, challenge assumptions, and explore the tradeoffs behind consequential decisions. The conversations are grounded in practical experience, informed disagreement, and a willingness to follow the evidence wherever the discussion leads.
The Briefing is for executives, technology professionals, entrepreneurs, policymakers, and curious listeners who want to understand where technology is heading and what those developments mean for their organizations, communities, and lives.
Produced by Human Signal, an independent media and decision assurance platform.
Find the decision. Follow the evidence. Name who owns it.
Watch, listen, and explore:
https://humansignal.io/thebriefing
Advertising, sponsorship, and business inquiries:
thebriefing@humansignal.io
This podcast uses the following third-party services for analysis:
OP3 - https://op3.dev/privacy
Site
RSS
Apple
Data updated on 08/11/2026
Recent rankings
Latest chart positions across Apple Podcasts and Spotify rankings.
Shared links between episodes and podcasts
Links found in episode descriptions and other podcasts that share them.
Can You Trust AI-Generated Maps? | Christy Monaco on AI Accountability
Season 3
Tuesday, November 3, 2026 • Duration 54:57
Can You Trust AI-Generated Maps? | Christy Monaco
What happens when AI-generated information looks authoritative, but the evidence behind it cannot support the decision?
In this episode of The Briefing, Dr. Tuboise Floyd sits down with Christy Monaco, Chief Operating Officer of the Open Geospatial Consortium (OGC), to examine artificial intelligence, geospatial intelligence, open standards, and the accountability required when technology informs consequential decisions.
Drawing on more than three decades of experience across the intelligence community and the geospatial industry, Christy explores a fundamental problem: the difference between having information and having enough confidence in that information to act.
The conversation begins with the intelligence assessments preceding the 2003 Iraq War. Christy discusses how confidence, uncertainty, and underlying evidence shaped consequential judgments, and why the lessons remain relevant as organizations increasingly depend on AI-generated information.
From there, the discussion moves to AI-generated maps, the limitations of large language models in interpreting spatial data, and the difference between technical compliance and factual accuracy.
A map can meet a technical standard and still contain incorrect information. An AI system can generate a convincing answer without providing the evidence necessary to defend a decision.
For leaders approving, procuring, or certifying consequential technology systems, that distinction matters.
IN THIS EPISODE
Intelligence, Evidence, and Confidence
What the intelligence failures surrounding Iraq's weapons of mass destruction teach us about uncertainty, analytical standards, and the danger of overstating confidence.
When AI Gets the Map Wrong
A discussion of a reported incident involving an inaccurate AI-generated map displayed during a government presentation, including where verification should occur and what remains unknown about the internal review process.
Why Geospatial AI Is Difficult
Christy explains why language models can struggle with spatial relationships, coordinates, geographic references, and the underlying data that makes maps reliable.
Standards Do Not Guarantee Accuracy
How open standards establish shared definitions and interoperability while leaving factual verification and consequential judgments to accountable decision-makers.
AI, Flood Evacuations, and Public Safety
A practical scenario involving a city preparing for a flood, where infrastructure data, location information, uncertainty, and human judgment influence emergency response.
Integrity, Provenance, and Trust
Why leaders need to understand where information originated, how it was processed, whether it was independently validated, and what assumptions remain.
Synthetic Imagery and Authentic Evidence
The legitimate use of synthetic images in AI training, the risks of manipulated geographic information, and the importance of distinguishing authentic observations from generated representations.
MUDDI and the UK's National Underground Asset Register
How shared geospatial data models can help organizations combine infrastructure information and reduce costly errors.
Discrete Global Grid Systems and Agentic AI
How OGC's work with DGGS, interoperable data services, and AI-enabled clients is addressing challenges in geographic reasoning and computational scale.
Open Standards and Public Governance
Why Christy favors transparent, consensus-based standards development involving industry, government, academia, and other stakeholders.
THREE QUESTIONS BEFORE YOU SIGN
Christy closes the conversation with three questions every leader should ask before approving an AI system that uses location-based information:
1. Where did the information come from, and how current is it?
2. What was observed versus inferred, and did someone other than the builder or author check it?
3. Who was authorized to act on the information, and what happens if it is wrong?
These questions apply far beyond geospatial technology.
They matter to executives, CIOs, CISOs, AI governance professionals, procurement leaders, public officials, risk officers, and boards responsible for consequential technology decisions.
The central issue is Decision Assurance: Can you follow the evidence, understand the uncertainty, and identify who owns the decision?
Christy Monaco brings more than three decades of experience spanning intelligence, national security, technology, and geospatial leadership.
Her career includes senior leadership at the National Geospatial-Intelligence Agency, where she served as Chief Ventures Officer, helping connect government innovation with emerging technologies and industry partners.
Today, as Chief Operating Officer of the Open Geospatial Consortium, she helps advance an international organization dedicated to open geospatial standards, interoperability, and trusted information sharing.
The Briefing examines consequential decisions involving artificial intelligence, quantum technology, cybersecurity, governance, risk, and public trust.
Through conversations with leaders, technologists, policymakers, and subject-matter experts, the program explores what happens between technological capability and organizational responsibility.
The Briefing is a Human Signal production.
Find the decision. Follow the evidence. Name who owns it.
The Briefing maintains independent editorial control over its programming. Guest appearances and professional affiliations do not imply endorsement of Human Signal's underwriting partners.
Find the decision. Follow the evidence. Name who owns it.
This podcast uses the following third-party services for analysis:
OP3 - https://op3.dev/privacy
If AI Does Everything Better, What Happens to Us? | Daniel Rodgers
Season 3
Friday, October 30, 2026 • Duration 46:38
What happens when artificial intelligence becomes so useful that we stop questioning the decisions it makes?
Daniel Rodgers, former engineering and technical program leader at Microsoft and Google and author of Killswitch, joins Dr. Tuboise Floyd on The Briefing to explore a future in which AI delivers extraordinary results while human beings gradually surrender their judgment, autonomy, and control.
The danger may begin long before a system goes rogue.
Daniel shares an experience from his time at Google, where a launch-review process designed to protect reliability grew into an expanding checklist. As pressure to launch increased, completing the process began to matter more than examining the decision itself.
The checkboxes were checked. But who owned the decision?
That experience opens a larger conversation about AI governance, automation bias, human oversight, and what happens when organizations confuse approval with accountability.
Drawing on his novel Killswitch, Daniel explores a difficult choice: If superintelligent systems become essential to healthcare, infrastructure, economic stability, and everyday relationships, would humanity still be willing to shut them down?
In this conversation:
Why AI success can create dependence more effectively than AI failure
How human-in-the-loop approval can become a formality
What Daniel witnessed about checklists and launch decisions at Google
Why automation bias weakens human judgment
The difference between assigning responsibility and exercising control
Agentic AI, artificial general intelligence, and the limits of oversight
The personal cost of delegating decisions, creativity, and relationships
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
The Next Guy's Problem: Quantum Security and Executive Accountability | Dr. Garfield Jones
Season 3
Saturday, October 24, 2026 • Duration 58:05
The Next Guy's Problem: Quantum Security and Executive Accountability
Guest: Dr. Garfield Jones, D.Eng. | Senior Vice President, Research and Technology Strategy, QuSecure
Quantum computing could fundamentally change the security of today's encrypted information. Organizations face a difficult question: How do you prepare for a threat whose exact arrival date remains uncertain, but whose consequences may already be accumulating?
At CISA, Dr. Jones led the agency's post-quantum cryptography initiative and helped shape federal guidance for preparing critical infrastructure and government systems for the quantum era.
With 25 years of military service and extensive experience in national security, intelligence, systems engineering, and academia, Dr. Jones brings a perspective shaped by the realities of implementing technology across complex organizations.
The conversation begins with the quantum threat and moves into the decisions organizations must make to prepare.
What does post-quantum migration actually cost? Where does cryptography hide inside existing infrastructure? What happens when a critical technology vendor has no credible migration plan?
And when executives knowingly accept the risk of vulnerable cryptography, who signs the decision record?
Dr. Floyd challenges the incentives that allow organizations to postpone difficult security decisions, including executive compensation, CISO tenure, competing budgets, and the temptation to leave unresolved problems for the next person.
IN THIS EPISODETHE QUESTION AT THE CENTERABOUT DR. GARFIELD JONESABOUT THE BRIEFINGPRODUCTION CREDITSThis podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
Who Can You Trust? AI, Cybersecurity & Starting Over | Keisha Bent
Season 3
Sunday, October 18, 2026 • Duration 30:47
Who do you trust when everyone claims to be an expert?
Keisha Bent has spent years working in technology, project management, and compliance. Now she's pursuing a new direction in cybersecurity and privacy, studying at Florida State University's College of Law and building her podcast, Oh Hell No, Not My Data.
In this episode of The Briefing, Dr. Tuboise Floyd talks with Keisha about career transitions, AI privacy, cybersecurity, professional credibility, and the work of independent media.
The conversation begins with a practical question: When an organization approves an AI tool, how do employees know what they're actually permitted to do with it?
From there, we explore human oversight of AI, the risks of autonomous agents, and the difficulty of separating credible expertise from impressive credentials.
Keisha shares what happened when a podcast guest couldn't answer questions about their claimed area of expertise, how she handled the conversation, and why curiosity remains central to her approach.
We also discuss her decision to pursue cybersecurity and privacy law, the transferable skills that make career changes possible, and what goes into building an independent podcast.
Toward the end, Keisha offers advice for anyone starting something new:
“Don't follow trends. Don't follow the hype. Follow your interests.”
In this conversation:
Breaking into cybersecurity through compliance, privacy, and transferable skills
AI governance, employee training, and appropriate use of approved AI tools
Human-in-the-loop oversight and AI agents
How to evaluate expertise and ask better questions
Changing careers and pursuing graduate education
Building an independent podcast with patience and purpose
Defining success on your own terms
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
Post-Quantum Readiness: Can You Find Your Cryptography Before Quantum Does? | David Pollak
Season 3
Tuesday, September 22, 2026 • Duration 55:42
Everybody keeps asking the same quantum question:
When is Q-Day?
But that may not be the question that matters to the person who eventually has to sign the migration plan.
Before an organization can replace vulnerable cryptography, it has to know where that cryptography exists. And before leadership tells a board that the problem can be fixed, somebody has to determine whether a replacement actually exists.
In this episode of The Briefing, Dr. Tuboise Floyd sits down with David Pollak, Founder and CEO of Spice Labs, for a practical examination of post-quantum readiness, cryptographic discovery, CBOMs, software supply-chain risk, and crypto agility.
Pollak argues that traditional source-code and network scanning can reveal pieces of the problem without necessarily producing a complete, correlated view of the cryptography embedded across applications, libraries, containers, virtual machines, third-party components, certificates, and dependencies.
The conversation gets to a larger leadership question:
What evidence would you be willing to sign your name to?
Pollak describes the role of a Cryptographic Bill of Materials (CBOM) in identifying cryptographic libraries, where cryptography is being invoked, how algorithms are configured, and the cryptographic material contained inside software.
The discussion also examines why crypto agility matters. Pollak compares hard-coded cryptography to putting a jacuzzi motor behind drywall: when something changes, you have to tear into the system to replace it. Crypto agility creates the equivalent of an access door, allowing cryptographic algorithms to be changed with substantially less disruption.
The conversation then moves from discovery to measurement.
For Pollak, readiness cannot simply be a green spreadsheet or completed Jira burndown. Organizations need evidence of what has actually been compiled into software and a way to measure whether cryptographic posture changes as remediation proceeds.
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
Passing the Test Is Not Staying Compliant | CMMC, AI & Governance with William McBorrough
Season 3
Tuesday, September 15, 2026 • Duration 56:27
Passing the test and staying compliant are two different jobs.
A defense contractor can spend months preparing for an assessment, pass it, and begin losing ground almost immediately.
Why?
Because assessment readiness is not the same thing as operating a sustainable compliance program.
In this episode of The Briefing, Dr. Tuboise Floyd sits down with William McBorrough, CISO and Lead CMMC Assessor, MCGlobalTech for a conversation about what happens every day after assessment day.
William has seen the problem from both sides: building cybersecurity compliance programs and assessing whether organizations can actually operate what they documented.
The conversation starts with CMMC and the Defense Industrial Base, then moves into governance, evidence, executive accountability, technology procurement, and AI.
Because whether the system is a cybersecurity compliance program or an AI use case, the underlying question is remarkably similar:
Can you prove that what you say is happening is actually happening?
FULL SHOW NOTES
Passing the test is not staying compliant.
A company can spend a year preparing for an assessment, pass it, and watch the program begin coming apart afterward.
The people who built it return to their regular jobs.
The documentation stops matching the work.
The next assessor may discover an organization that was compliant once.
That is the problem at the center of this episode of The Briefing.
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
Q-Day: Building the Quantum Future with Katie Arrington of IonQ
Season 3
Monday, September 7, 2026 • Duration 54:52
Someone may already be copying your encrypted traffic. They cannot read it yet. Q-Day is when that could change.
Katie Arrington, Quantum Technical Evangelist at IonQ and former senior technology and cybersecurity leader at the Department of War, joins Dr. Tuboise Floyd for a plainspoken conversation about the decisions leaders must make before cryptographically relevant quantum computing arrives.
Katie has stood on both sides of the desk. She previously performed the duties of chief information officer for the Department of War and served as deputy chief information officer for cybersecurity, overseeing defense-wide cyber strategy, governance, and compliance. Today, she is helping explain the technology that could reshape the systems she once helped defend.
In this episode:
What Q-Day means for public-key encryption
Why “harvest now, decrypt later” creates risk before quantum computers can break encryption
How organizations should approach post-quantum cryptography and cryptographic inventories
Why leaders will have to decide what gets upgraded, rebuilt, or left behind
How quantum sensing, timing, and networking could reshape modern conflict
The difference between artificial intelligence and quantum computing
How trapped-ion quantum computers work
Why fidelity and fault tolerance matter
Where humans belong in an AI- and quantum-enabled future
What quantum and AI could mean for jobs and workforce development
The hardest question is not whether quantum is coming. It is who decides what must be protected first—and what evidence supports that decision.
About Katie Arrington
Katie Arrington is Quantum Technical Evangelist at IonQ. She previously performed the duties of chief information officer for the Department of War, advising the secretary on enterprise information management, cyber assurance, and emerging technology policy. She also served as deputy chief information officer for cybersecurity and as chief information security officer for acquisition and sustainment.
About The BriefingPartner disclosureThis podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
AI Writes Your Cybersecurity Policy in Seconds. It's Also Wrong. | William McBorrough, MCGlobalTech
Season 3
Saturday, September 5, 2026 • Duration 00:32
AI can produce a polished cybersecurity policy, control plan, or assessment response in seconds. But polished is not the same as correct.
In this episode of The Briefing, Dr. Tuboise Floyd sits down with William McBorrough, founder of MCGlobalTech, to unpack why expertise still matters when an AI-generated answer looks convincing but is operationally wrong — and what that means for every leader approving, procuring, or certifying technology decisions that carry real consequences.
⚠️ THE CORE PROBLEM:
Large language models optimize for fluency, not accuracy. When the output is a security control, a compliance response, or a risk assessment, a confident wrong answer doesn't just waste time — it creates exposure.
🎯 IN THIS EPISODE:
• Why AI-generated cybersecurity policies look right but fail operationally
• The expertise gap: what LLMs can't replicate about security judgment
• Where AI actually helps in compliance, audits, and control development
• How to vet AI output before it becomes policy, plan, or certification response
• AI governance frameworks for leaders who approve consequential technology
👤 ABOUT THE GUEST:
William McBorrough is the founder of MCGlobalTech, a cybersecurity and governance, risk, and compliance (GRC) firm. He works with organizations navigating security assessments, compliance frameworks, and the operational reality of turning policy into protection.
🔗 RESOURCES & LINKS:
→ Watch The Briefing: https://humansignal.io/thebriefing
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
They're Already Stealing Your Encrypted Data. Q-Day Is When They Read It. | Katie Arrington, IonQ
Season 3
Tuesday, September 1, 2026 • Duration 03:46
Your encrypted data is being copied right now. Not read — stored. Waiting for the machine that can open it. That machine has a date: Q-Day. Estimates land between 2027 and 2028.
This is the trailer for Q-Day: Building the Quantum Future — the episode of The Briefing where Dr. Tuboise Floyd puts the hardest question in cybersecurity to Katie Arrington: you've got one budget and two bills. Do you pay to protect data against a threat that hasn't arrived, or buy into quantum computing that hasn't fully delivered? She has stood on both sides of that desk as the senior cyber official defending the Department of Defense, the largest enterprise on earth, and now as Quantum Technical Evangelist at IonQ, the company building the machines that change everything she used to defend.
If you run a company, a security team, or a board agenda — this conversation is about you.
🎙️ FULL EPISODE: September 8, 2026 — The Briefing with Dr. Tuboise Floyd
WHAT YOU'LL HEAR:
• "Harvest now, decrypt later" — the attack happening today
• The real timeline for quantum computers breaking RSA encryption
• Post-quantum cryptography: what migrating actually costs
• Quantum networking, quantum sensing, and what comes after
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
AI Fails Because of Broken Governance, Not Bad Models | Dr. Tuboise Floyd
Season 2
Wednesday, June 17, 2026 • Duration 01:22
AI Fails Because of Broken Governance, Not Bad Models
Description:
Most institutions will not fail because of a bad AI model. They will fail because of the governance structure around it.
AI does not invent new blind spots. It automates the ones your institution already has. The Workflow Thesis is a three-layer framework, governance, protocols, and work processes, that keeps human oversight in place, catches failure early, and holds an audit trail, across federal agencies, universities, and enterprises, without buying new software.
I am Dr. Tuboise Floyd, Founding Pedagogical Theorist of AI Governance and founder of Human Signal. I reverse-engineer real AI failures and teach the structures that prevent them.
More:
The AI Governance Briefing podcast → theaigovernancebriefing.com
The Workflow Thesis on SSRN → ssrn.com/abstract=6644860
Human Signal → humansignal.io
Subscribe for weekly AI governance breakdowns. Then tell me in the comments: where is AI automating a blind spot in your institution right now?
TAIMScore™ measured for trust: https://humansignal.io/#measured-for-trust
──────────────────────────────────────
ABOUT THE HOST
──────────────────────────────────────
This podcast uses the following third-party services for analysis: OP3 - https://op3.dev/privacy
Why an AI kill switch presents an ethical dilemma
What Daniel's novel Killswitch reveals about consent and autonomy
The central question:
If AI can make better decisions than we can, what are we willing to sacrifice to remain in control?
This is a conversation for technology leaders, executives, governance professionals, policymakers, and anyone considering what human agency should mean in an AI-driven world.
About the guest
Daniel Rodgers is a former engineering and technical program leader at Microsoft and Google and the author of Killswitch, a science-fiction novel exploring superintelligence and human autonomy.
About The Briefing
Hosted by Dr. Tuboise Floyd, The Briefing examines artificial intelligence, cybersecurity, quantum technology, governance, risk, and the decisions shaping our future.
Find the decision. Follow the evidence. Name who owns it.
Dr. Jones responds candidly, examining the responsibilities of security leaders and the executives who hire them, establish organizational priorities, and control the resources necessary to act.
The result is a conversation about technology, leadership, institutional responsibility, and the decisions that will shape organizational security for years to come.
Harvest Now, Decrypt Later: Why encrypted information collected today could become vulnerable in the future.
The Cost of Quantum Readiness: Funding post-quantum migration while managing existing cybersecurity priorities.
Cryptography Hiding in Plain Sight: Understanding dependencies across networks, applications, identity systems, devices, and legacy infrastructure.
When Your Vendor Isn't Ready: Evaluating vendor roadmaps, migration commitments, and the consequences of remaining dependent on unprepared providers.
Who Signs the Decision Record? Documenting accepted risks and identifying the executives responsible for those decisions.
The Next Guy's Problem: How CISO tenure, leadership incentives, and organizational culture influence long-term security decisions.
Cryptographic Agility: Building the ability to discover, manage, and replace cryptographic technologies as requirements change.
What Leaders Should Do Now: Education, planning, prioritization, and practical preparation for post-quantum migration.
"If leadership knowingly leaves a system on vulnerable cryptography because replacement is too expensive, too disruptive, or technically impossible, what should be documented?"
"Who signs the decision record?"
The discussion that follows exposes a fundamental challenge in cybersecurity governance: organizations can recognize a risk, understand the consequences, and still struggle to assign responsibility for addressing the problem.
Previously, he served as Associate Chief of Strategic Technology at CISA, where he led the agency's post-quantum cryptography initiative and contributed to federal preparation for emerging quantum threats.
His professional background includes 25 years of military service, systems engineering supporting national security and intelligence agencies, and teaching computer science and systems engineering.
The Briefing with Dr. Tuboise Floyd explores artificial intelligence, cybersecurity, quantum technology, and the decisions shaping business, government, and everyday life.
Through candid conversations with technology leaders, founders, and practitioners, Dr. Floyd examines how emerging technologies move from possibility into practice.
Each conversation follows the choices people face: where to invest, which risks to accept, what evidence to trust, and who takes responsibility for the outcome.
Find the decision. Follow the evidence. Name who owns it.
The Briefing is an independent Human Signal production.
About the guest
Keisha Bent is the host of Oh Hell No, Not My Data, a podcast exploring cybersecurity, privacy, technology, and the professionals working across these fields.
About The Briefing
The Briefing with Dr. Tuboise Floydexplores artificial intelligence, cybersecurity, quantum technology, emerging technology, and the decisions shaping our future.
Independent conversations at the point of decision.
Find the decision. Follow the evidence. Name who owns it.
Host: Dr. Tuboise Floyd
Guest: Keisha Bent, Host of Oh Hell No, Not My Data
Floyd and Pollak also examine the procurement problem: an organization can address its own code and still inherit cryptographic exposure through someone else's software. That makes vendor evidence, supply-chain auditing, CBOMs, and third-party attestation increasingly important to buyers.
And when the conversation reaches the decision a CISO, CIO, CTO, or board can make now, Pollak offers a deceptively difficult answer:
Decide what can be dropped.
Prioritization requires saying no. If everything is important, nothing is. Leadership therefore needs to know what matters, what does not, and document that decision.
The result is a different way of thinking about post-quantum readiness.
It does not begin with predicting Q-Day.
It begins with knowing what you have, knowing what can be replaced, knowing what cannot, determining what evidence demonstrates that the work was actually completed, and putting a name next to the decision.
IN THIS EPISODE
• Why cryptographic discovery comes before post-quantum migration
David Pollak has spent nearly two decades building open-source systems and examining how software is composed. He created Lift, one of the early major Scala web frameworks, helped advance Scala adoption across industry and academia, and later worked as a distinguished engineer on dependency analysis and enterprise software risk.
At Spice Labs, Pollak is applying mathematical methods to software and cryptographic discovery to produce verifiable records of system composition and help organizations understand the software, dependencies, and cryptography their systems actually contain.
ABOUT THE BRIEFING
The Briefing with Dr. Tuboise Floyd is an independent Human Signal production examining consequential decisions across artificial intelligence, quantum technology, cybersecurity, governance, and emerging technology risk.
Real conversations. Higher stakes.
Find the decision. Follow the evidence. Name who owns it.
This episode includes a partner message from MCGlobalTech, a Human Signal partner, for the CMMC Assured Enclave.
Commercial partnerships and underwriting do not determine guest selection, questions, analysis, or editorial conclusions.
Dr. Tuboise Floyd sits down with William McBorrough, CISO and Lead CMMC Assessor, to examine what happens when organizations build cybersecurity compliance programs around assessment day instead of the operating capability required for every day after it.
William describes this as a sustainability problem.
Organizations frequently buy audit-readiness services, tools, consulting, and managed services designed to get them through a point-in-time assessment. But when the audit becomes the goal, organizations can immediately begin drifting once the assessment is over because the ongoing activities required by the compliance program were never built into normal operations.
That leads to one of the central arguments of the conversation:
CMMC is a governance problem.
Cybersecurity compliance requires more than a mandate. Governance is a discipline requiring people, skills, processes, accountability, and the capability to perform the work repeatedly.
And an assessor can see the difference.
If an organization's policy says access is reviewed every month, an assessor doesn't simply want to read the policy.
Where are the records?
What process was followed?
Who performed the work?
Can the organization demonstrate that the activity actually occurred?
An assessor is looking for evidence that the program is operating, not merely evidence that somebody documented one.
Then the conversation crosses into AI.
William explains why security leaders increasingly find themselves responsible for AI risk because AI is already entering organizations. Rather than serving as the traditional "voice of no," he describes the security leader's job as finding a secure path to legitimate business objectives.
That raises another governance problem:
How do you use AI without simply turning it loose?
William explains how MCGLOBALTech approaches AI inside its compliance operations.
The organization governs AI by use case, not simply by declaring a particular AI product acceptable. Different uses of the same tool can create very different risks.
There are also boundaries.
AI is not used on client data inside MCGLOBALTech's client environments. AI is instead used for specific approved operational purposes outside those prohibited uses.
And there is an important operating rule:
Do it manually first.
William's team develops the process manually, operates it, validates that the process produces the desired outcome, and only then determines how AI can accelerate or automate it.
The process is not created by AI.
AI is applied after the organization understands the process and knows what a valid outcome should look like.
That distinction matters because AI can produce something that looks convincing even when it is wrong.
As William explains in the conversation, asking AI for a heart-surgery plan may produce something that looks excellent to someone who isn't a heart surgeon.
Expertise is what allows someone to recognize whether the output is actually valid.
The same discipline required for sustainable cybersecurity compliance begins appearing again in AI:
Defined processes.
Clear boundaries.
Validated outputs.
Evidence.
Human judgment.
Accountability.
The episode also gets personal for executives.
CMMC and federal cybersecurity requirements eventually reach the people whose names stand behind what the organization says is true.
William advises CEOs operating in the federal space to examine their contracts, understand the security obligations contained in them, and determine whether their organizations actually possess the capability to meet those obligations.
He also discusses the responsibility of the senior official affirming an organization's compliance information and the importance of having evidence behind what leadership is being asked to stand behind.
The question isn't simply:
Did we pass?
It is:
Can we prove we're still doing what we said we do?
The assessment is a day.
The program is every day after.
IN THIS EPISODE
• CMMC and the compliance sustainability gap
• Passing an assessment versus sustaining compliance
• CMMC Level 2
• What CMMC assessors actually look for
• Evidence versus documentation
• Governance versus audit readiness
• NIST 800-171 requirements
• Cybersecurity inside the Defense Industrial Base
• Small-business compliance challenges
• Governance as an operating discipline
• Executive accountability and attestation
• Security obligations inside federal contracts
• AI governance
• The CISO as an AI governance leader
• Governing AI by use case
• ChatGPT, Claude and Microsoft Copilot
• Separating AI experimentation from controlled environments
• Manual validation before AI automation
• Validated outputs versus convincing outputs
• Continuous review of AI use cases
• Why technology-first procurement fails
• What CEOs should examine now
GUEST
William McBorrough
CISO, Lead CMMC Assessor
MCGLOBALTech
William McBorrough is a cybersecurity and compliance leader whose work spans building, operating, and assessing security governance programs.
He has spent more than 16 years building security compliance programs and has supported defense contractors around NIST 800-171 requirements and cybersecurity compliance.
His work has included organizations ranging from five employees to 5,000 employees, while MCGLOBALTech also serves federal government organizations.
William is also an associate professor of cybersecurity at the University of Maryland Global Campus, serves on the EC-Council Global Advisory Board, publishes the SMB CISO Insights newsletter, and is the author of Beyond Compliance, a governance roadmap focused on sustainable CMMC.
ABOUT THE BRIEFING
The Briefing with Dr. Tuboise Floyd is independent media examining the decisions underneath consequential technology.
AI. Quantum. Cyber.
The technology is only the beginning of the story.
Find the decision.
Follow the evidence.
Name who owns it.
Independent media. Real conversations. Higher stakes.
A Human Signal Production
Hosted by Dr. Tuboise Floyd
Creative Director: Jeremy Jarvis
Watch and listen:
humansignal.io/thebriefing
EDITORIAL / PARTNER DISCLOSURE
MCGLOBALTech is a paying Human Signal partner, and Dr. Tuboise Floyd has performed contract advisory work with the firm.
The partnership does not determine guest selection, questions, editorial conclusions, favorable treatment, or endorsement. Editorial questions and conclusions remain independent.
The Briefing with Dr. Tuboise Floyd examines consequential technology decisions across artificial intelligence, cybersecurity, quantum technology, and emerging risk. Creative Director: Jeremy Jarvis.
Find the decision. Follow the evidence. Name who owns it.
This episode is underwritten by Founding Decision Assurance Partner MCGlobalTech.
MCGlobalTech built the CMMC Assured Enclave to help small and midsized defense contractors operate their cybersecurity and compliance obligations after the assessment. Learn more at https://cmmcassured.com
The views expressed by the guest are her own. Discussion of companies, markets, or securities is for informational purposes only and is not investment advice.
→ Subscribe to The AI Governance Record (biweekly analysis for leaders who approve, procure, or certify consequential technology): https://www.linkedin.com/newsletters/the-ai-governance-record-7438000159642292225
This Briefing is underwritten by Founding Decision Assurance Partner MCGlobalTech. Underwriting does not determine analysis, findings, or guest selection.
GUEST: Katie Arrington — former DoW Chief Information Officer (performing the duties), former Deputy CIO for Cybersecurity, former CISO for Acquisition & Sustainment, former state legislator, and senior leader at Exiger, Booz Allen Hamilton, Centauri, and Dispersive Networks. Now Quantum Technical Evangelist at IonQ.
The Katie Arrington episode of The Briefing is underwritten by Founding Decision Assurance Partner MCGlobalTech. Underwriting does not determine analysis, findings, or guest selection.
Dr. Tuboise Floyd, PhD is the Founder and Chief Sensemaking Officer of Human Signal, Editor in Chief of The AI Governance Record, and a TAIMScore™ Certified Assessor. He holds a PhD from Auburn University and is a member of the HISPI Advocacy & Education Working Group (Project Cerebellum).
──────────────────────────────────────
CONNECT
──────────────────────────────────────
Website: humansignal.io
Podcast: theaigovernancebriefing.com/podcast
LinkedIn: linkedin.com/in/drtuboisefloyd
Email: tuboise@theaigovernancebriefing.com
Govern the machine. Or be the resource it consumes.
Discover shows related to The Briefing with Dr. Tuboise Floyd, based on actual content similarities. Explore podcasts with similar topics, themes, and formats, backed by real data.
