Rules don’t scale. Architecture does. F5’s Lori MacVittie makes the case for putting security policy in the infrastructure—not the app—and for treating AI as its own threat surface. If your program is still chasing strings with rules, you’re already behind.

If your “AI security” strategy is a pile of brittle rules, you’re governing yesterday’s system. In this no-fluff conversation, Lori MacVittie argues for a structural fix: move policy and enforcement into the architecture where they can evolve without redeploys—then govern AI as a distinct threat surface (prompts, context, responses, completions, agents), not just another API.

She also shows how to use LLMs for what humans are bad at: fast pattern discovery. Her real-world example? A packet capture fed to an LLM surfaced a noisy IoT device in minutes—compressing mean-time-to-repair by skipping the rule-writing slog.

Reality check: AI adoption is outrunning AI security. If you’re still reactive, you’re late.

Quick explainer for non-practitioners: Regex (regular expressions) = rule-based string pattern matching; useful for forms, brittle against attackers who mutate text. Lori’s point: shift to semantic signals (meaning/behavior), not just string matches.

In This Episode

• From rules to semantics: why regex won’t save you—and how AI helps detect semantic patterns of abuse.
• Put controls in the architecture: keep secure coding by default, but move policy/enforcement/governance out of the app to avoid security debt and dev drag.
• Govern the AI loop: prompts, context windows, responses, completions, agents—the surface is broader than APIs or the network stack.
• Adoption vs. security: the Road Runner problem—AI is sprinting ahead of the controls.
• Practical win: use LLMs to accelerate discovery in telemetry (e.g., packet captures) and cut MTTR.

Guest Bio

Lori MacVittie is a Distinguished Engineer & Chief Evangelist in F5’s Office of the CTO. She writes and speaks extensively on modern app delivery, AI-driven operations, and security governance.

Think your security strategy is airtight? Think again.

In this episode, Brad Moldenhauer — VP and CISO-in-Residence at Zscaler — lays out the brutal truth: most companies are underestimating the financial and existential risks lurking in their systems.

He’s not pulling punches.

From AI that predicts attacks before they happen to material risks that could bankrupt you overnight, Brad explains how the old-school view of cyber is blinding businesses to what really matters — and how to fix it before it's too late.

In This Episode:

• Why your “cyber strategy” could trigger an extinction-level event
• The business risk mistake even seasoned CISOs still make
• How to stop spending $100 to fix a $5 problem
• Why ignoring AI governance might be your last mistake
• The one shift that turns CISOs into true executives

Why You Should Listen:
If you’re a CISO still talking controls instead of customers — you’re already behind.
This isn’t just another tech talk. It’s a wake-up call from one of the most strategic minds in cybersecurity.

ClearTech Loop Ep. 8 with Rob Bair, CISO-in-Residence at Zscaler

Episode Summary
Cybercriminals are running fake AI startups — and users are downloading ransomware straight from what looks like “innovation.” In this episode, Rob Bair (Zscaler) breaks down how ransomware has gone corporate: polished websites, SEO poisoning, even English-speaking help desks guiding victims through payments.

This isn’t a hoodie-in-the-basement threat anymore. It’s a professionalized extortion business — and it’s moving at machine speed. Rob explains why defenders can’t win at human speed, why AI must be in the loop, and what CISOs should expect in the next 12–18 months.

What You’ll Learn in This Episode:

• How ransomware crews are turning fake AI startups into bait
• Why ransomware is now a professionalized industry with customer support
• Why manual patching is dead — and what CISOs must do about it
• The 12–18 month horizon for AI-driven cyber threats

About the Guest
Rob Bair is CISO-in-Residence at Zscaler, advising on emerging threats and resilience strategies. He also serves as an investor and advisor at Autonomous Cyber, a board member at Rebel Space Technologies, and advisory board member at ISARA Corporation and BOSS Controls.