S4 E12

Balancing Innovation and Risk: Governing AI in the Enterprise

As organisations grow through acquisitions and AI becomes part of everyday work, technology leaders face a difficult balancing act: enabling innovation while keeping risk under control. For businesses operating across hundreds of locations, maintaining consistency, protecting sensitive information and giving teams the right tools can quickly become complex.

In this episode of CXO Secrets, David McClelland sits down with Brent Forrest, CISO at Crash Champions, to explore how security leadership evolves in a rapidly growing, decentralised business. With Crash Champions expanding from around 40 locations in 2020 to more than 650 across 38 states, Brent shares how he approaches security at scale, manages third-party risk and helps the organisation navigate the opportunities and challenges of AI.

Brent discusses why sharing security documentation with third parties can create unnecessary exposure, how to approach security across physical repair environments, and why AI governance needs to keep pace with adoption. He also explores the rise of shadow AI, the importance of using enterprise-approved tools, and why AI should enhance human capabilities rather than replace them. Throughout the conversation, Brent reflects on the role of curiosity, practical risk management and people development in building a stronger security function.

Topics include:

Scaling cybersecurity across a business that has grown from 40 to more than 650 locations
Maintaining security consistency across a decentralised organisation
Managing cybersecurity risks during acquisitions and rapid expansion
Rethinking third-party risk assessments and security questionnaires
Why sharing network diagrams and internal security policies can create additional risk
Finding safer ways to demonstrate security controls to third parties
Addressing operational technology security in collision repair environments
Establishing AI governance as adoption accelerates across the business
Understanding the risks of shadow AI and unapproved tools
Why enterprise-approved AI tools matter for data protection
Balancing AI innovation with security, privacy and governance
Using AI to review policies and identify opportunities for improvement
Why AI should enhance human capabilities rather than replace people
Keeping security controls practical as technology and business needs evolve
Developing teams and helping people grow within cybersecurity
Balancing business enablement with responsible risk management

Back to All Episodes