Schellman's Avani Desai: Compliance Is a Byproduct of Security

On this episode of Responsible Disclosure,

we sit down with Schellman CEO Avani Desai to talk about 25 years in cybersecurity audit, from her start as a pen tester to leading one of the largest specialized assessment firms for cybersecurity, privacy, and sustainability, and why compliance should be a byproduct of real security.

We get into Schellman research showing 74% of companies believe they can pass an AI assessment while about 27% have the controls in place, what the rise of fast, low cost SOC 2 reports means for the trust behind them, the red flags to listen for when choosing an auditor, and why continuous auditing is finally within reach after decades as a pipe dream. We also talk about how vulnerability management became a check the box control, why fear drives more behavior change than incentives, and how the US data economy produces trillion dollar companies. Plus: the story of how Avani got here, and the hyped term she says nobody can define.