Axonius Adapt25 | Luis Valenzuela, InComm Payments

Clips
News
More from Axonius Adapt25

Luis Valenzuela

Director, Data Governance and Data Loss Prevention

InComm Payments

From shadow IT to singular truth: Axonius reshapes cybersecurity visibility

Fragmentation isn’t just a technical issue in cybersecurity — it’s an existential one. Shadow IT, software-as-a-service sprawl and disconnected tools leave teams squinting at their environments through fractured lenses, with no clear cybersecurity visibility into what’s safe or exposed.Axonius’ Dean Sysman talks with theCUBE during Axonius Adapt25.“That’s led to dozens of different tools that organizations need to use, and each one only sees a part of the picture, a part of the one piece of that puzzle of the organization,” said Dean Sysman (pictured), co-founder and chief executive offer of Axonius Inc

play_circle_outline Data governance in the payment industry, focusing on AI, sensitive data, and protection

play_circle_outline Importance of practical training and human-driven processes in data governance

play_circle_outline Challenges of discovering sensitive data in SaaS applications and ensuring security

play_circle_outline Implementing Cyber Risk Quantification in Organizations: Leveraging Real Data, Statistical Analysis, and Cyber Insurance Insights

play_circle_outline Maximizing Revenue and Saving Costs with IT Peer Prioritization and Strategic Security for CISOs

Info
Transcript

Luis Valenzuela, InComm Payments

Luis Valenzuela

Director, Data Governance and Data Loss Prevention InComm Payments

Luis Valenzuela, Director of Data Governance at InComm Payments, offers insights from Axonius Adapt 2025. Valenzuela, an expert in data governance and data loss prevention at InComm Payments, participates in a discussion on theCUBE during Axonius Adapt 2025. In this conversation, they illuminate the complexities of data governance, focusing on the intersection of cybersecurity and compliance within the rapidly evolving payments industry.

Valenzuela provides an overview of their role at InComm Payments, emphasizing responsibilities in data protection an... Read more

explore Keep Exploring

What are the key areas of focus in maintaining governance around data, and how do you anticipate these changing with the increasing implementation of tools? add

What approach do you use when creating a data governance standard document to ensure practicality and understanding within the company? add

What is the challenge facing the speaker in terms of managing and securing corporate data spread across various SaaS applications? add

What approach is being used to introduce cyber risk quantification into the organization in a subtle way? add

What advice is given to CISOs in terms of tying security initiatives back to revenue or cost savings? add

bolt Powered by CUBE AI

Luis Valenzuela, InComm Payments

search

Rebecca Knight

>> Hello, everyone in Cube Nation, welcome back to theCUBE's coverage of Axonius Adapt 2025 here in Dallas, Texas. I'm your host, Rebecca Knight, sitting alongside my co-host and analyst, Jackie McGuire. Jackie, our first ever show together.

Jackie McGuire

>> I know, it's so exciting to be here.

Rebecca Knight

>> And cybersecurity is your wheelhouse, so we're going to be talking data governance.

Jackie McGuire

>> And I'm a governance nerd, so I'm actually really excited for this one. I think anybody who's heard me knows that I love compliance and governance.

Rebecca Knight

>> I don't think that that sentence has been uttered too many times before. But with that, I would like to introduce our guest. He is Luis Valenzuela, Director, Data Governance and Data Loss Prevention at InComm Payments. Thank you so much for coming on the show, Luis.

Luis Valenzuela

>> Hello, thank you for having me. Excited.

Rebecca Knight

>> So tell our viewers, why don't you just start by telling our viewers a little bit about InComm Payments and what you do. What's your role there?

Luis Valenzuela

>> Yes, so InComm Payments is one of those companies that is not known by name, but if you have ever given a gift card to a relative, chances are it came from us. So, we are a card issuer and a card acquirer, and we have a big segment of the market for gift cards. And we also have other related applications, like HSA cards. We have a dual card where you can have your medical expenses coming from one side of the account, or your personal from one card. So, most of what we do is in the payment industry and creating new technologies. And my role within the cybersecurity team, I report to the CISO. I'm responsible for data governance, data protection, data loss prevention, and I help with other aspects in connection with the GRC side, because I used to be in that side of the house. I help with the operations, incident management sometimes, different other areas as part of the CISO leadership team.

Jackie McGuire

>> Okay, and it must be an incredibly critical process because gift cards are kind of like cash, right?

Luis Valenzuela

>> Yes.

Jackie McGuire

>> So if you have data that's compromised, I mean, it'd be like somebody walking into the vault of a casino, right? And being able to just walk out, so.

Luis Valenzuela

>> Somebody said that we print money, in a sense, yes.

Jackie McGuire

>> And I imagine that with the types of payments that you handle, you have all kinds of different compliance and regulation bodies that are looking at you all the time.

Luis Valenzuela

>> We abide to probably 15 different compliance frameworks or government things, NYDFS, PCI, HIPAA, high-tech, definitely, it's one of our heavy areas of work.

Jackie McGuire

>> I know there's a lot of people at home twitching.

Luis Valenzuela

>> Yes, yes, yes compliance.

Jackie McGuire

>> Because I can only imagine, there's companies like, man, we have to deal with HIPAA. And then there's companies like, man, we have to deal with FINRA. You guys are kind of the full spectrum of things.

Luis Valenzuela

>> And when they conflict in some way, it's interesting.

Jackie McGuire

>> Yeah, yeah, that's a, I can't say I would want to change positions. So we were talking before we started filming about compliance and governance and data governance. And I'm going to say AI because it's hard to have a conversation without it, but I've been looking at AI more from the data perspective, and that it's creating a lot of data. And so I want to hear how you think about these new projects that are going to potentially be creating a lot of sensitive data, and where you see blind spots in the enterprise for controlling that. So, what are you focused on, in terms of maintaining governance around data and how you see that changing as we start to implement more and more tools?

Luis Valenzuela

>> Yeah, so I'm focusing on a handful of areas that we have determined to be the most critical ones. This is such a new area that we don't even have tools, we don't even have experts. It's, everybody's trying to make it as we go. And if we think about the two main groups of AI, of actual applications, in the one hand you have machine learning, which is, you grab a bunch of data and determine or the algorithms determine patterns to make decisions. And then on the other hand, you have LLMs, which is basically an auto-complete heavy. In both you are using data from somewhere, and my concern is sensitive data. And in both you are producing, there's an output of data that potentially could be sensitive data. So, we have concentrated on a couple of initiatives. We have an AI committee in a company where anybody who's going to work on an AI application or bring an AI application goes to that committee. And some people who have great expertise in the legal side, in the data side and the technology side help to carry that conversation and figure out, okay, what risks do we have? Where do we go? So that's one aspect. We also suggested some aspect of changing the NDA, typical NDA that every company has. And the question is, can we put some verbiage there to start protecting ourselves from our partners using our data to feed their models, right?

Jackie McGuire

>> Yeah, so feature extraction.

Luis Valenzuela

>> And it's a very basic concept. I didn't come up with it, I heard it on a podcast. I listen to all kinds of podcasts, so I'm like, hey, that's good idea, let's try it. Another area we're working on is protecting the users from intentionally or more likely accidentally putting sensitive data in gen AI engines. So we have a series of controls. We started from governance, so we created those directives where we tell people, "This is against the rules," number one. Number two, we try to promote that across the company with pictures, with posts, with links, so people are aware that there's a danger there. And number three, we're looking at into technical capabilities and tools to, even if they try to do it, to tokenize somehow or block when necessary, when there's potential sensitive data being exfiltrated. So those are the main three areas that to start, we're trying to generate an impact that is something that is meaningful where we are. We don't want to block, we don't want to say don't, because people will use AI. And the way I see it is generally speaking, depending on which numbers you use, if this is going to give 40% extra productivity to companies, they will go for it. Oh, by the way, it might be 20% hallucination or 30% chances sensitive data will be exfiltrated. Companies will take that chance. So at this point we are just trying to work with the business and try to make things secure, but also profitable.

Rebecca Knight

>> So, that is what you're doing to make sure that you are fixing your blind spots. But we know that rapid detection is what is needed. How are you uncovering these gaps across these very diverse and fragmented IT landscapes?

Luis Valenzuela

>> Yeah, so in part, the problem is not a new problem. The area that we are looking at is new, but technically, it's the same problem we've had or the same challenge we have in data governance for years, which is, what's the sensitive data? How do you discover? 20 years, 10 years ago maybe you asked the owners of business units and said, "Hey, you have sensitive data. Where do you have it? How do we protect it?" Now we use tools to go and some of them based on AI algorithms to go and find that sensitive data. PHI, PII, PHI in our case, company secrets. Some of them are easier to be found because they're mathematical matches, like credit card, 16 digit numbers, line check, fairly easy. Social security numbers, not so easy. A little easier, but not so easy because now we're talking about nine digit numbers. That could be a social security or an invoice number-

Jackie McGuire

>> A phone number, yeah.

Luis Valenzuela

>> ... or a phone number, right?

Jackie McGuire

>> Yeah.

Luis Valenzuela

>> Then you go to driver licenses, totally impossible because there are all kinds of different structures in the different states, and this is just in the United States, where some might have a letter, some may have five letters, some may have two digits, it's a mess. So, even tools have a hard time finding the right data, and we are like, how do we know? So, there's a combination of technical tools and processes where if you do education with the users, that can be improved greatly. And one approach we use is when we talk about the data governance standard, the document. We try not to make it this 100-pages, thou shalt type of document, but something very practical that has a picture. And at the end, all I need is for everybody in the company to understand what is sensitive data and the types, and what's the protection that they need to have. That's all.

Jackie McGuire

>> I love that.

Luis Valenzuela

>> It is actionable.

Jackie McGuire

>> And make it simple.

Luis Valenzuela

>> Exactly, so if the tool missed it when the scanning that we did, when the owner knows, and so they label it, this is restricted, and now we can make protection based on that label. I didn't know that was restricted, but if the owner said it, he's the data owner, we believe it. So, we try to make the best with what we have.

Jackie McGuire

>> Yeah, I love the focus on training. That's something that I think there's been a misconception in the enterprise that's kind of a holdover from the early 2000s and 2010s of, there are certain jobs in the enterprise that are tech jobs that touch sensitive data, and that's just not reality anymore. Everybody in the enterprise is touching data. We have bring your own device, we each have laptops, especially with the rise of remote work. And so I think oftentimes the training piece is what companies overlook in that yes, you can have as many tools as you want, but if somebody screenshots something, they need to know if what's in that screenshot is sensitive data or not, and we often overlook that. I actually want to go back to a really interesting, I'm going to take it all the way back for about five minutes, because you mentioned an issue we call feature extraction with your AI. And so I did a talk at RSA last year about bringing security teams and the rest of enterprise teams together to build more secure AI projects. And we were talking about different compromises of large language models, and we mentioned feature extraction almost as like the third, like a side note. This is not happening, we don't see this much in the wild, and then all of a sudden you have DeepSeek that comes out and it's like, oh, well DeepSeek may have been extracting features from OpenAI. So, I think it's really fascinating to think about just in the last year, and I think you're one of many companies I've heard that from in that, so many companies have put so much time, effort, and money into these models that that's become just in a matter of under a year, a huge issue. So, I just wanted to highlight that because I think it's one of the major ways the market is starting to shift in that as we invest more and more in these models, there are more incentives for adversaries to try to take what you've spent a lot of money on as cheaply as possible. So, I just wanted to bring us back to that to highlight it because I love that you guys are actively focused on that. What else is kind of top of mind for you right now as you look into the future, as you look into a more connected enterprise, but particularly with more layers of abstraction? Because that's what I see happening in software right now, is everybody wants to be a platform, and so we're putting these layers of abstraction on top of things. What are you focused on as kind of the next big challenge in data governance, in maintaining control over data?

Luis Valenzuela

>> Well, one area that I've been looking at very heavily is the sprawl of SaaS data in SaaS applications, where 20 years ago, all of the corporate data, HR, finance, everything was in one of the servers of our server farm within the building that has firewalls around and all of the DR. Everything's there, so it's secure, right?

Jackie McGuire

>> Yeah.

Luis Valenzuela

>> Move 20 years later, and especially the last few years it's been growing, more of that corporate data, let alone production data is in some SaaS application, it's in Salesforce, it's in Word, all of these applications. And the difference is that 20 years ago, as long as we have encryption and we have maybe labeling, if somebody was advancing over at that point, we can protect it. Now, we have no idea what data is where, what kind of protection. We can apply one encryption or one firewall for everything because we have 20, 30, 50, 100 different websites that our users are going to upload data. Then it becomes like managing 500 different environments. That's what I'm looking at right now. Okay, how do we in the most effective way, do the inventory of all of the SaaS applications our company uses, have the level of visibility we need as to where sensitive data resides? Because not all needs to be looked at, but where do we have employee records, customer records, PCI, all of that? And then after that, what do we do to make sure it's protected? Because SaaS applications have been breached for the last five, 10 years, very known ones. So, that's kind of my next challenge. How do we protect that data and make sure that the next time one of those guys get compromised, our data is secure?

Jackie McGuire

>> Yeah, that's a challenge because you almost have to develop parallel standards because some of that is running in your cloud organizations, right? And then some of these SaaS things are actually running in somebody else's cloud organization.

Luis Valenzuela

>> Yes, they all are.

Jackie McGuire

>> There's only so much you can do and only so much you can ask them or the vendors willing to divulge about their security posture. So, that kind of secondary and tertiary layer of risk, I see vendors starting to get into that space to explore that, but we've gotten to a place where SBOM is probably not going to cover things anymore.

Luis Valenzuela

>> And in this case, we're talking about a SBOM times a 100. So we might come to the point where in as much as everything moves more into technology and AI, this might be one of those things that we need to revert to a more process-driven, human-driven process, where we will have to maybe go back to the identify the owner, have a meeting, have a document, have some sort of more manual process, to be able to know where the data is, how we control it, and find some point in between where we can have a level of security that is acceptable without impeding the business. Because I can go to tell everybody, "You cannot put data in any SaaS unless we approve it," they will find a way around it, for sure. And there are certain applications that there's only one provider that does it well and that's it. So we try to protect our data, we try to control that, and we hope all of these providers have a good security process and that is resilient, basically.

Rebecca Knight

>> So, I want to pick up a little bit on what you were saying, especially in relation to what Dean Sysman, who is the CEO obviously and founder here at Axonius said on the main stage this morning, about creating this movement toward actionability. So having the visibility, but then also being able to extract the insights to be able to execute on them.

Luis Valenzuela

>> Yes.

Rebecca Knight

>> What was your take on his idea of starting this movement and is it so deeply necessary at this point in time?

Luis Valenzuela

>> No, I totally agree. From the particular standpoint that... I've been having some conversations recently, both internally and with vendors that offer services to us, and my question or my conclusion came to the point like, do I need to know more weaknesses? It's not like I don't know where we have weaknesses, right? I'm trying to figure out how we cover our weaknesses, and so is every one of my peers, and how do we find budget? How do we cover it in most effective way? The problem is not that we don't know of vulnerabilities or issues of wind, the problem is that we don't know what to do with what we already know.

Jackie McGuire

>> When everything's a critical alert, nothing's a critical alert, yeah.

Luis Valenzuela

>> Right, so at some point, I ask in a meeting, "Do we really need more evidence or do we need to fix first what we know exists?" Right? Now, we have what we believe is a very mature security program and we take care of our bases, but still, yes, I could find or get a tool, get more of those. The question is, how do we go to that next step where not only we know what's wrong, but either we get a solution from the vendor, or we come up with a solution and we start addressing and reducing? I love when I can report to management, okay, last week we had this many, this week we had this many, and this week have... Or if we had the same it's because they came new ones, right? I think that's the challenge. And in some way, in security, since cybersecurity is not the number one risk to a company, there are other higher risks like interest rates, markets, political, geopolitical stuff, sometimes being good enough or some people call it minimum acceptable level or however you want to name it. Sometimes being in the 80% is fine because you're covering all of your bases. There's always an X percent that you can get to. Obviously, depending on the... If we're talking about XDR, we want 100%, but generally speaking, we cannot let perfection to be the enemy of good enough. And so we try to include that idea into the approach. And I totally agree with what he said, it's better to get from a tool something that we automatically remediate, than to just get more alerts.

Jackie McGuire

>> Yeah, I think it's really interesting that you point that out because no two company's security stacks are the same, and I think there's a lot of retail therapy and that we had this issue, then we're going to buy this tool, and this is going to solve the issue. And it's like with that created six additional issues, six pools of data that now somebody needs to be responsible for. And I do, I think that we've gotten to a point where we are inundated with problems and there needs to be a better way to assess the criticality of those problems on a per entity basis, because criticality of internal firewall logs for you may not be the same as internal firewall logs for a data center or a clean room. And so I could not agree more, that we need to move to where we're actually... Everything's broken. We've all been to the oil change places where they give you a $1,200 bill because you can always find things to fix. The question is, what are the important things to fix, right?

Luis Valenzuela

>> Yes, what the highest risk. And I was just in the previous talk that we just had, I was mentioning how I'm bringing cyber risk quantification into our organization in a little sneaky way, because it's not the official way, but I'm making it a point when I ask for budget or request action from a group, I don't talk about millions in loss, or I just say, "We have potentially a $5 million exposure here, that only will take you X." And by that, and I'm using real data, I'm using statistical data, cyber insurance type of data, DFIR, all of these, I made my calculations in advance. So when I'm saying this, it's not that it's not true, and I'm telling, "Hey, you want to accept the risk that if we get popped on that particular device, you are the one who say no. So we lose $5 million. Are you okay with that?"

Jackie McGuire

>> CISOs, take note. Everything has to tie back to revenue or cost saved, cost avoided. Yeah, if you don't... yeah.

Luis Valenzuela

>> So that has helped me to get other peers within the IT team to help me to get a ticket done, a patch, whatever it is that we're asking them to do. And that kind of builds into the big picture of, where do we put the few resources that we have available?

Jackie McGuire

>> Strategic security.

Luis Valenzuela

>> Yeah.

Rebecca Knight

>> I love it, great advice, great advice. As you said, CISOs, take note. Luis, thank you so much for coming on theCUBE, a really fascinating conversation.

Luis Valenzuela

>> All right, thank you. It was fun.

Rebecca Knight

>> I'm Rebecca Knight, for Jackie McGuire. Stay tuned for more of theCUBE's live coverage of Axonius Adapt. You're watching theCUBE, the leader in enterprise tech news and analysis.