Security magazine: Tell us about your background and career.

Johnson: I earned my Bachelor’s degree in Computer Science, and the majority of my professional career was spent traveling the country and the world helping companies build cybersecurity programs and performing security assessments within the energy and financial sectors. Specifically, critical infrastructure protection (CIP) standards and various PCI program standards (PCI-DSS, PA-DSS, PCI P2PE). 

I’ve been the CISO at Bluefin Payment Systems for the last six years, where I’m responsible for information security across the enterprise. I also lead our PCI-DSS, PCI PIN, PCI P2PE, and ISO-27001 compliance programs. 

Security: How can organizations be certain their own AI can be trusted with sensitive data?

Johnson: Many organizations are rushing to implement AI models without giving a thought to actually securing the data moving through these increasingly complex ecosystems. Part of the problem is that most organizations haven’t done the basic work of mapping their data and don’t have a clear picture of where sensitive data lives, how it flows, or where it ends up once it’s fed into an AI system. This isn’t just a security issue; it’s a governance and compliance one. Regulations like GDPR require organizations to know what data they have, why they’re processing it, and where it’s going. If a company can’t answer those questions before feeding data into an AI model, they’re not just risking a breach, and they’re likely out of compliance already.

Organizations need to treat AI with the same scrutiny as any other security tool, and they often don’t. Most importantly, companies need to make sure they have a secure infrastructure layer in place that protects sensitive data as it travels across platforms.

While it’s important for AI agents to meet certain security protocols, it’s up to organizations to devalue their data so it is worthless to bad actors even if it is compromised. Ultimately, it’s a lot easier to trust AI models with sensitive data if organizations know that data is tokenized and encrypted on the back end.

Security: In an era of hackers increasingly leveraging AI-based attacks, how can organizations protect themselves and their data against evolving threats?

Johnson: As companies use AI to improve efficiency and data analysis, hackers are reaping the same benefits as they leverage AI to conduct more sophisticated attacks. Traditional security strategies focused on securing perimeters and ensuring data was stored properly. While those are still important, modern security strategies require securing sensitive data as it moves across ecosystems. With data in transit more than ever as it moves between systems, platforms, and AI models, there are more opportunities for hackers to compromise sensitive data. And using AI is just making it easier for them to do so. 

The key for organizations to protect themselves in this environment is to focus on securing data in motion, not just when it is being stored. With hackers leveraging AI-based attacks, it’s critical for data to be useless to them no matter where in the system they are able to access it. If data is tokenized and encrypted, all AI is helping hackers do is get to something useless faster. 

Security: Reactive security strategies catch up with the current acceleration of cyber threats. What strategies can security leaders focus on to mitigate these risks?

Johnson: Security teams will never be able to keep up with evolving threats if they are only focused on reactive strategies. AI is vastly expanding attack surfaces, fundamentally increasing the number of systems and workflows organizations must secure. It’s critical for organizations to build security strategies that proactively reduce data exposure. That means staying current on emerging AI security best practices and, in many cases, fighting fire with fire by implementing AI-driven defensive tools that can keep pace with AI-driven attacks.  

Organizations need to move beyond static, detection-based defenses and toward embedded infrastructure, data-in-motion protection, and orchestration-aware security to keep pace with these evolving threats. Increasingly interconnected ecosystems require reducing exposure itself, not simply detecting bad activity after the fact. Thorough, well-thought-out risk scoring also helps organizations stay ahead of threats instead of only reacting once something is already compromised. 

Security: Is there anything we haven’t discussed that you would like to add?

Johnson: With AI models and transaction processes ever evolving, data protection needs to be flexible and scalable to adapt as organizations do. Part of the challenge is pace: new AI applications are being implemented and interconnected far faster than security layers and tools can keep up, leaving gaps between adoption and protection. Security must be deeply embedded within the flow of data, providing a stable, reliable foundation that organizations can depend on as their environments change. Static security is putting sensitive data at risk, and scalability and interoperability will define security strategies that keep data safe and keep companies in control of their data in today’s fast-paced commerce environment.