Oct 29, 2026 · 40 min
Govern AI before security spending outruns control
EP 80: Govern Before You Buy: Walter Haydock on AI Governance, Risk, and Agent Security
Organizations face growing AI risk, but effective governance starts with accountable decisions and an inventory—not a rush to buy tools.
- 1Define risk appetite and enforceable policies before expanding AI use across the organization.
- 2Sequence governance around people and processes before investing in specialized security tools.
- 3Match human oversight to data sensitivity, decision timing, and the reversibility of agent actions.
Don't miss
Haydock explains why indirect prompt injection makes human oversight a design choice tied to sensitivity, timing, and reversibility.
The brief
Walter Haydock frames AI security as a governance problem before it becomes a tooling problem: organizations need an inventory, built-in controls, and policies people can actually follow.
The central tension is between unmanaged experimentation and blanket bans. Haydock’s answer is to define risk appetite, use quantitative assessment where possible, and preserve clear accountability.
Drawing on his Marine Corps experience, Haydock applies Decide, Communicate, Act to AI governance, arguing that cross-functional input should not become accountability by committee.
Agentic systems raise a sharper threat: indirect prompt injection can arrive through external content, so human oversight must reflect sensitivity, timing, and reversibility.
His budget advice is deliberately unglamorous: inventory every AI system, review existing controls, establish governance fundamentals, and question whether self-hosting adds security or merely cost.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.