EP 16 — KPMG’s Orson Lucas on Why One-Time Security Investments Tend to Fail

The world of data security has fundamentally changed, yet many organizations still approach it as a one-time project rather than an ongoing journey. In this episode of The Future of Data Security, Orson Lucas, Principal at KPMG, draws on his 20+ years of experience to challenge the "one-and-done" approach that dooms many security initiatives. After witnessing the evolution from obscure privacy regulations to strategic business differentiators, Orson walks Jean through why even the most sophisticated organizations struggle with fundamental data governance and how the rise of AI assistants is creating unprecedented new risks.

Orson discusses why privacy is fundamentally a data governance problem, how to balance comprehensive security with practical investment limits, and why the most effective security strategies build on existing technology ecosystems rather than creating parallel systems. He also shares candid insights about how AI assistants like Microsoft Copilot are changing the risk equation by inheriting user permissions to access sensitive data that humans would never realistically browse through.

Topics discussed:

• The critical shift from viewing data security as a one-time project to an ongoing journey requiring continuous investment, as threat landscapes constantly evolve even when controls remain static.
• Why fundamental data discovery (what you have, where it is, how it flows) remains the most challenging yet essential foundation for effective security, with organizations often attempting to "boil the ocean" rather than taking a risk-based approach.
• The evolution of enterprise security governance structures, with privacy teams increasingly functioning as second-line policy setters while security teams handle operational implementation.
• How "hanging access" creates major security vulnerabilities when departed employees leave behind orphaned permissions with no clear ownership, especially in unstructured data environments.
• The emerging risk paradigm where AI assistants inherit user permissions but access far more data than humans realistically would, turning theoretical access risks into actual exposure.
• Practical strategies for managing shadow AI by creating internal, managed alternatives that provide similar functionality with proper security guardrails rather than simply blocking innovation.
• Why effective security strategies often build upon existing technology investments rather than creating parallel systems, using tools like DLP for broader data discovery purposes.
• The limitations of viewing data residency as merely a compliance checkbox, with more sophisticated organizations focusing on broader supply chain integrity and provenance issues.
• How balanced security partnerships require understanding stakeholder priorities across legal, privacy, security, data governance and marketing teams to achieve organizational alignment.
• Approaches for managing third-party risk as vendors increasingly integrate AI features without proper opt-in controls or transparency about data usage for model training.