Cyera Executive Rick Holland explains how AI is moving from experimentation to trustworthy adoption while leading vendors want government to treat cyber defense as an emergency even as they are accelerating the risk. And a Revolut breach has laid bare and authentication gap.

AI Experimentation to Trustworthy, Measurable Adoption

For security leaders, the challenge of AI has become managing the speed at which AI is entering the enterprise while confronting data, identity, and governance problems that organizations have struggled with for years. Rick Holland, CISO and Data and AI Security Officer, at Cyera, sat down with Tech Channels at Black Hat to discuss how AI is expanding before many companies have fully addressed shadow IT, agents are gaining access to data whose source of truth may be unclear, and security teams are being asked to govern technologies that continue to evolve at an extraordinary pace. According to Holland, “the pace of change, the velocity is overwhelming.”

Unions Turn School AI Rules into Contract Terms

The US Federal Trade Commission (FTC), the federal agency that enforces consumer protection and privacy rules, spent this summer closing a case over an edtech breach that exposed data belonging to 10.1 million students. Three months later, the argument over how much trust schools should place in technology companies has moved squarely onto AI. New York City has imposed a one-year moratorium on student-facing generative AI for nearly 600,000 pupils from 2-K through eighth grade, while disabling AI features in dozens of previously approved products. A week after that announcement, Microsoft and two major teachers’ unions chose a different lever: instead of restricting access to AI, they wrote limits on what the technology can do with student data into the contracts schools sign with vendors. Microsoft, the American Federation of Teachers and the United Federation of Teachers have unveiled a National AI Safety & Privacy Standard that US districts can incorporate directly into Microsoft customer agreements.

Revolut Breach Exposes the Authentication Gap in Government Data Requests

Why steal customer records when you can convince a bank to hand them over? Revolut disclosed sensitive data to miscreants after receiving fraudulent requests from what appeared to be a compromised government email account. Whoever controlled the account turned its official status into access to customers’ private information. Revolut released the data believing the requests were genuine, while its own banking infrastructure and customer funds remained unaffected. The group claiming responsibility later said the operation had lasted roughly six months, although that timeline has yet to be independently verified. Italian authorities are now investigating whether a certified PEC email account associated with the prefecture of Reggio Calabria was compromised.