Most security leaders treat AI as a new threat category requiring new defenses. Rohit Parchuri, SVP and Chief Information Security Officer at Yext, pushes back hard on that. His argument: if your foundational controls are solid, AI does not require you to rebuild anything. What it does is amplify whatever you already have, gaps included, which makes the real question not "what new controls do we need?" but "how well are we actually executing on what we already built?"

Rohit walks host Ben Gibert through how Yext is operationalizing this at scale: threat-modeling AI as just another system with inputs, processing, and outputs; building AI security testing directly into the existing CI/CD pipeline rather than standing it up as a separate track; investing heavily in data classification and taxonomy to solve DLP before deploying any AI tool internally; and establishing an AI Excellence Committee with cross-functional representation to run a single governance funnel across every AI request in the company. He also makes the case that the CISO who earns a seat at the AI strategy table is the one who deeply understands the business value chain, not just the threat landscape.

Topics discussed:

Threat-modeling AI as a system instead of a threat category
Why existing security controls are sufficient for AI today
Integrating AI security testing into CI/CD without adding process overhead
Data classification and taxonomy as prerequisites for safe internal AI adoption
Using an AI Bill of Materials as a transparency mechanism
How Yext's AI Excellence Committee runs a single governance funnel
Build vs. buy decision-making for AI security tooling
What separates strategic CISOs from tactical operators in the age of AI
The CISO's role in enabling AI adoption rather than blocking it