The Future of Security is Data Security | Lizzy Nammour, founder & CEO, Teleskope

Summary

What does the future of security look like when every employee uses AI? For Teleskope founder and CEO Lizzy Nammour, it starts with data. For years, security teams focused on ransomware and incident response while data security sat on the sidelines. AI changed that. An assistant like Claude can surface a company's payroll in seconds, and AI tools copy sensitive data into places no security team has had to look before.

In this episode of The Flywheel, M13 Managing Partner Karl Alomar talks with Lizzy about why every company now has a data security initiative, why DSPM tools became shelfware, how the CISO role changed with AI, and why AI scale-ups often reach Series C with no security in place.

If you're a founder, security leader, or operator trying to understand AI data security, DPSM, or why more alerts don't make a company safer, this is your map.

Key insights

Why AI makes sensitive data easier to find

Ask an AI assistant connected to Google Drive for a company's payroll and it will find the answer faster than any employee could search for it. Lizzy explains how tools like Claude also generate artifacts on laptops and in the cloud, spreading sensitive data in ways a security team can't trace. At one Teleskope customer, the CEO's W-2 was open to everyone at the company. Lizzy calls this internal risk, and AI has made it far larger.

Why DSPM tools became shelfware

DSPM (data security posture management) maps where a company's sensitive data lives and flags the risk. When Lizzy's team talked with security leaders at companies running these tools, they heard the same story: the software was bought to check a compliance box, then sat unused, and customers switched vendors every year. Visibility alone also creates liability.

Why more alerts don't make a company safer

Early DLP (data loss prevention) tools flagged so much that security teams stopped looking. Alerts went to an email inbox nobody checked or a Slack channel holding hundreds of thousands of them. AI now moves data faster than a person can read a single alert, so Lizzy argues the work has to shift to fixing the root cause and keeping the same issue from coming back.

How the CISO role changed with AI

Two years ago, security leaders were asking how to block ChatGPT. Today the board expects every team to use AI, and the CISO's job is to make that safe. Lizzy says the role now calls for a deeper technical grasp of how AI connects to company data, along with sharper business judgment, because the company has to move as fast as its competitors.

Why AI scale-ups need security sooner

AI companies are growing faster than Airbnb did, and many have no security in place until Series C or later. Their first security leaders have to install basic controls like MFA while defending against threats AI introduced.

Related topics

What is Teleskope?

Teleskope is a data security company that finds sensitive data across a company's systems, decides whether that data is risky in the context of the business, and fixes it automatically, so companies can adopt AI securely. Founder and CEO Lizzy Nammour previously built data security systems at Airbnb. Teleskope is an M13 portfolio company.

What is DSPM?

DSPM (data security posture management) is a category of security software that discovers and classifies sensitive data across cloud and SaaS systems and reports on how exposed it is. Most DSPM tools stop at the report. Lizzy's critique is that a map of the risk leaves a security team with the same question it started with: what do we do about it?

What is the difference between DSPM and DLP?

DLP (data loss prevention) watches data in motion, such as email, file transfers and uploads, and alerts on or blocks sensitive content leaving the company. DSPM looks at data at rest, mapping where sensitive data is stored and who can access it. Both have historically produced alerts for a person to review.

How does generative AI create data security risk?

Generative AI tools connect to the same drives, inboxes and databases employees use, so anything an employee can technically access, an assistant can surface in seconds. AI tools also create new copies of data in prompts, outputs and local files. The result is more sensitive data in more places, and faster discovery of anything left exposed, by employees and attackers alike.

What is data remediation?

Data remediation is the step after finding a data risk: deleting data a company shouldn't keep, restricting who can access it, redacting or masking sensitive fields, or moving it somewhere safer. Teleskope automates remediation, including routing decisions to the people who own the data.