As enterprises race to bolt AI onto every business process, security leaders are being forced to answer a harder question than "should we adopt it" — it's "who's accountable when it goes wrong." To unpack this, The Cyber Express sat down with Harsha Reddy, Head of Information Security at Veterinary Emergency Group (VEG).

With nearly two decades in security leadership — including senior roles at Lixil and American Standard before joining VEG — Harsha brings a practitioner's view of where AI is genuinely changing the CISO's job, and where it's mostly just hype and shadow adoption.

Watch the Full Interview:

Harsha Reddy Explains Why AI Will Replace Tasks, Not Defenders

Harsha pushes back on the narrative that AI will hollow out security teams, pointing to Gartner research showing that while most fields are projected to lose jobs to AI, cybersecurity is expected to gain them. In his view, the technology is mainly absorbing the "toil" — log review, alert triage, evidence gathering — that keeps analysts from actually defending.

Also listen to S1 Episode: Awareness and Education at Young Age is the Answer to Cybersecurity Skill Gap

“It's the analyst who refuses to use AI that will get replaced by an analyst who uses it,” he says.

On adoption, Reddy points to a 2024 Microsoft-LinkedIn survey in which most executives called AI critical to their business, yet a majority had no formal plan and most had employees already bringing in their own tools. That gap, he argues, is why so many organizations are now dealing with AI-related data leaks. "Many organizations started onboarding AI like software when they should be onboarding it like staff." His fix isn't more restrictions — blocking AI just pushes it into the shadows — but guardrails, an internal AI enablement committee, and measuring actual business value instead of token consumption.

The conversation also digs into deepfake-driven fraud, why training employees to spot deepfakes is “a losing bet” at machine speed, and how he decides when to greenlight a new AI tool versus telling a business unit “not yet.”

The conversation closes with our newly introduced rapid-fire round "Express Shots" — Claude vs. ChatGPT, passkeys vs. passwords, and Reddy's prediction for the biggest cybersecurity threat of 2030.

💾

Amarbir Singh, Senior Director – AI & Cloud Solutions, AHEAD Building a secure cloud foundation for AI has become a top priority as enterprises move quickly to put AI at the center of how they operate. However, the rush to adopt AI is also reshaping the security agenda. The World Economic Forum’s Global Cybersecurity Outlook 2026 finds that 94 percent of organizations now see AI as the most significant driver of change in cybersecurity this year, while the share with processes in place to assess AI tools before deployment has risen from 37 percent to 64 percent. That is an encouraging sign. It suggests enterprises are beginning to match AI ambition with stronger assurance. The challenge now is to build the secure, scalable cloud foundation that allows this progress to continue without creating more risk and complexity.

Why a Secure Cloud Foundation for AI Matters More Than Ever

Too often, enterprises make that job harder for themselves. Attackers tend to work with discipline. They standardize, repeat and refine. Enterprises often do the opposite. They add tools, customize around every edge case and accumulate exceptions until their environments become harder to understand and harder to defend. In that kind of estate, every new control can create another blind spot. Building a secure cloud foundation for AI is not just about adding capability. It is about reducing unnecessary complexity, improving visibility and making deliberate choices about what truly needs to be there. That matters because many organizations are now stuck between urgency and overload. The market moves fast, threat categories keep shifting and new frameworks and vendors appear almost every week. In that environment, hesitation can feel prudent, but it often becomes the bigger risk. Security and cloud leaders do not need perfect certainty before they move. They need a clear direction, a practical operating model and the discipline to iterate. The era of fixed multi-year plans is giving way to shorter roadmaps that can adapt as the threat landscape changes. Progress now matters more than perfection.

Moving Beyond Traditional Security Operating Models

This is where traditional execution models begin to fall short. Annual policy reviews, slow approval chains and static response plans were built for a slower world. They are poorly suited to a landscape where AI adoption, cyber risk and business priorities can all shift within a quarter. Security cannot function as a document that gets reviewed once a year. It has to function as a living operating model across the business. That means decisions happen faster, ownership is clearer and incident response is tested often enough that teams know what to do when pressure is real. The shift that matters most is a shift from tools to outcomes. Security maturity is still too often measured by how much technology has been bought rather than what risk has actually been reduced. But tools are inputs, not outcomes. What matters is faster patching, lower exposure, stronger identity controls, clearer accountability and a more resilient business. Vulnerability management should reduce the attack surface. Identity controls should let a distributed workforce operate safely and consistently. Resilience architecture should protect the services the business truly depends on. If a control does not support a meaningful outcome, its value should be questioned. The same logic applies to cloud foundations in the AI era. Resilience should be designed around actual business need, not assumed as an abstract virtue. Some applications justify multi-region or even multi-provider architectures. Others do not. Building beyond the point of business need adds cost and complexity without adding meaningful protection. The stronger approach is to calibrate resilience to risk, not to fashion. Identity is equally central. A zero trust model anchored in strong identity, multifactor authentication and disciplined access controls gives enterprises a consistent way to secure users, workloads and data across environments. At the same time, visibility and observability have to improve. Enterprises need to know where data is moving, where AI is being used and where new dependencies are emerging. Without that visibility, governance becomes reactive. With it, governance becomes an enabler of safe adoption rather than a brake on progress.

Using AI to Improve Security Without Replacing Human Judgment

AI itself should be part of this foundation, but not as a substitute for judgement. Used well, it can improve efficiency, accelerate detection and help teams manage growing operational demands. But people still need to stay firmly in the loop. The goal is not automation for its own sake. The goal is better decisions, faster response and stronger control in an environment that is only getting more dynamic. The enterprises that scale AI securely will not be the ones that chase every new tool or wait for the market to settle. They will be the ones that simplify where they can, standardize where it matters and build cloud foundations that are governed, observable and designed around business outcomes. In the AI era, trust will depend less on how loudly an organization talks about innovation and more on whether it has built the foundations to sustain it securely at scale.