Quantifying AI Risk: Yakir Golan on Turning Cyber Threats Into Business Intelligence | Ep 1145

Summary

Podcast Summary: Quantifying AI Risk – Yakir Golan on Turning Cyber Threats Into Business Intelligence

The Digital Executive | Coruzant Technologies
Date: November 14, 2025 | Episode: 1145
Guest: Yakir Golan, CEO & Co-founder of Kovrr
Host: Brian (Coruzant Technologies)

---

Episode Overview

This episode explores the rapidly growing need for quantifying AI and cyber risk at the enterprise level. Yakir Golan, CEO and co-founder of Kovrr, shares how his background in Israeli intelligence inspired a data-driven, systematic approach to risk. Golan details why moving from qualitative, subjective risk discussions to measurable, financial quantification is a game-changer, the barriers organizations face in that journey, and what the future of AI risk management will look like amid new regulations and increasing automation.

---

Key Discussion Points & Insights

1. Shaping a New Approach to Risk (01:40–04:21)

• Background Influence:
  • Golan’s intelligence experience taught him to “look at how small signals connect to larger patterns” (02:04) and to approach risk as “dynamic, interconnected and constantly evolving.”
  • Noted gap: Valuable threat data remained hidden from target organizations, inspiring him to “bridge that divide” by structuring raw data into actionable insight.
• From Military to Enterprise:
  • Emphasized the move from static, assumption-based risk models to a discipline of “continuous data collection, modeling and validation” (03:35).
  • Aim: Democratize access to real-time risk intelligence, equipping businesses with “the same level of situational awareness and quantifiable insights that intelligence agencies rely on” (03:55).

2. The Power and Challenges of Quantifying Risk (05:22–08:05)

• Why Quantify?
  • Golan: “When you quantify risk, it stops feeling abstract. Suddenly it turns into numbers people can talk about… The board can discuss and talk about. We all see the same picture” (05:28).
  • Quantification brings a “shared language” enabling precise prioritization, improved alignment, and better budget decisions.
• Barriers to Adoption:
  • Feels unfamiliar to many—parallels early days of cyber risk maturity.
  • AI adoption is moving faster than governance frameworks, making the starting point feel “fuzzy, even overwhelming” (06:35).
• How to Get Started:
  • “You do not need to start from zero. You can use the same governance playbook that works in cyber… begin with a structured control assessment… identify gaps and owners, add quantification as your data and intelligence advance and treat this as iterative practice” (06:54).
• Immediate Benefits:
  • Fast improvements in alignment and investment decisions, moving AI risk “from theoretical worry to a managed business issue” (07:57).

3. Underappreciated AI “Tail Risks” and Modeling Strategies (08:47–10:58)

• Examples of Tail Risks:
  • Rare but damaging events such as “large scale model manipulation, data poisoning in training sets, or even a systematic outage tied to a major AI service provider” (08:55).
• How Enterprises Should Start Modeling:
  • Start with “one or two clear high priority scenarios that everyone can understand” (09:15), e.g., model failure in business processes or data exposure by a third-party tool.
  • “The goal isn’t to capture everything at once, it’s to build the first directional view… tangible enough to begin shaping mitigation plans, funding, and risk strategy” (09:29).
• Quantification Matures Over Time:
  • Gradually add metrics like average annual loss, downtime duration, and the financial impact of AI-driven misinformation.
  • This approach enables boards to set clear risk thresholds: “No AI related event with more than 5% chance of exceeding a $5 million loss should be accepted” (10:27).
• Iterative Process:
  • Each modeling cycle “builds confidence, improves accuracy and helps leaders stay ahead of those high impact AI events instead of being surprised by them” (10:53).

4. Future of AI Risk Quantification and Regulatory Landscape (11:46–14:23)

• Global Trends:
  • Golan: “Boards, investors, and regulators are no longer satisfied with qualitative statements like ‘we’re monitoring AI risk.’ They want measurable evidence and clear demonstration of exposure, controls, and the potential financial impact” (12:11).
  • The EU AI Act and SEC cybersecurity disclosure rules are accelerating this transformation.
  • Example: European Central Bank now demands banks model the effects of major disruptions, “financial risk modeling becoming regulatory expectation” (13:22).
• What “Good” Will Look Like in 5–10 Years:
  • Being able to answer:
    1. What are our AI-related exposures?
    2. How much could they cost under realistic scenarios?
    3. What actions most effectively reduce exposure within our defined risk appetite?
• Kovrr’s Vision:
  • “Bringing financial discipline to technology risk,” allowing organizations to communicate exposure “in business and capital terms… to give leadership a quantified view that supports regulatory readiness, investor transparency and operational resilience” (13:54).

---

Notable Quotes & Memorable Moments

• On Risk Modeling Roots:

  “You’re trying to look at how small signals connect to larger patterns and how one detail on its own might not mean much, but together they all can tell a story.”
  — Yakir Golan (02:04)

• Quantification’s Core Value:

  “Numbers give everyone a shared language… you can rank exposure, see which controls are actually moving the needle and direct budget to the places with the highest return.”
  — Yakir Golan (05:36)

• On Starting the Journey:

  “You do not need to start from zero… begin with a structured control assessment… treat this as iterative practice rather than [a] one time project.”
  — Yakir Golan (06:54)

• Tail Risks:

  “What matters most isn’t identifying every possible scenario, it’s how you start modeling them.”
  — Yakir Golan (08:54)

• Regulatory Shift:

  “Investors and regulators are no longer satisfied with qualitative statements like ‘we’re monitoring AI risk.’ They want measurable evidence and clear demonstration of exposure, controls and the potential financial impact.”
  — Yakir Golan (12:11)

• A Vision for the Future:

  “Quantification will move from a best practice to a regulatory investor expectation... good AI risk management will mean being able to answer three questions clearly: What are our AI-related exposures, how much could they cost under realistic scenarios, and what action most effectively reduce the exposure within our defined risk appetite?”
  — Yakir Golan (13:33)

---

Timestamps for Important Segments

• 00:00–01:06: Intro, guest bio
• 01:40–04:21: Yakir’s background; how intelligence shaped his approach to risk
• 05:22–08:05: Why quantification is transformative; barriers to change
• 08:47–10:58: Modeling for rare/high-impact (“tail”) AI events; practical steps to start
• 11:46–14:23: The evolving regulatory/board landscape for AI risk; Kovrr’s forward-looking vision

---

Tone & Style

The conversation is direct, analytical, and accessible—balancing technical insight with very practical advice for enterprise leaders. Golan’s responses are measured and detailed, reflecting a strong belief in leveraging intelligence methodologies for actionable, business-ready risk management.

---

Summary for Listeners

This episode compellingly argues that quantifying AI and cyber risk is no longer optional—it's becoming a regulatory, board, and investor mandate. Yakir Golan, drawing on his intelligence background, outlines how organizations can move from abstract, subjective assessments to a measurable, shared understanding that informs budget, strategy, and mitigation. He offers practical frameworks for getting started and illustrates how the best-prepared organizations will iteratively adapt to rising threats, new technologies, and regulatory expectations. For enterprises looking to future-proof their AI and cyber risk management, this conversation is both a warning and a roadmap.

Transcript

[A]

Foreign. Welcome to Coruscant Technologies, home of the Digital Executive Podcast. Do you work in emerging tech? Working on something innovative? Maybe an entrepreneur? Apply to be a guest at www.corazon.com brand welcome to the Digital Executive. Today's guest is Yakir Golan. Yakir Golan is the CEO and co founder of COVID A global leader in cyber and AI risk quantification. He began his career in the Israeli intelligence forces and later gained multidisciplinary experience in software and hardware design, development and product management. Drawing on that background, he now works closely with CISOs, Chief Data Officers and other business leaders to strengthen how organizations understand and manage both cyber and AI risk at the enterprise level. Yakir holds a Bachelor's in Electrical Engineering from the Technion Israel Institute of Technology and an MBA from IE Business School in Madrid. Well, good afternoon Yakir. Welcome to the show.

[B]

Thank you Brian. Pleasure to be here.

[A]

Awesome. I appreciate it. My friend and I know you're hailing out of Israel right now. I'm in Kansas City, so we've got about eight hours between us, but I appreciate you making the time to do this is Kir. Let's jump into your first question. You began your career in the Israeli intelligence forces and then moved into software and hardware and product roles before founding cover. How did you how did that background shape your thinking about risk systems and what enterprise organizations truly need when it comes to cyber and AI exposure?

[B]

Yeah, that. That experience in the intelligence process really shaped how I think about risk and systems. You're trying to look at how small signals connect to larger patterns and how one detail on its own might not mean much, but together they all can tell a story. That perspective has stayed with me and guided me the same way I see cyber and AI risk today. Dynamic, interconnected and constantly evolving. Of course, you can't look at any single event in isolation. You have to understand how it fits into the broader ecosystem. During that time, I also saw how much valuable data exists in the hidden layers of the Internet, what's called particularly on the Dark Web, and how little of it was actually reaching the organizations being targeted. That gap between available intelligence and accessible insight here really stuck with me. And when I move into software and hardware later in my product roles, I became focused on how to bridge that divide. How to take raw, fast changing data and turn it into structured models that could emulate real world behavior and quantify exposure. Whether that means modeling a cyber incident or AI system failure, the goal was to make something abstract and measurable. Over time, I noticed another Gap emerging in enterprises. Which security team had a lot of technical data, but leadership were struggling. They didn't have a clear way to translate into a business context to understand what an exploited vulnerability or a flawed AI model might actually mean financially, operationally, business wise. And most risk management approaches were still very much static, built on assumptions rather than real intelligence and data. And I want to bring that discipline of continuous data collection, modeling and validation that I learned early on into enterprise risk management. And that idea became the foundation actually to cover when we started. And from the start our goal has been to democratize access to real time risk intelligence and apply to cyber first and now to AI exposure. And we wanted to give organizations the same level of situational awareness and quantifiable insights that intelligence agencies rely on, but also in a way that's practical for business leaders and that's the driving force of COVID helping enterprises manage cyber and AI risk proactively with evidence and clarity instead of reacting to the ASTRO effect.

[A]

Thank you, really appreciate that. And I think it's important. Both of us served in the military and I think it served us well. We learned a lot and I took away that. Your learning perspective from your military experience really made a big impact and you took that with you when you went into the civilian world. I like the goal here. You were trying to make everything measurable and all the work you were doing with that continuous data collection while always looking at ways to lower that risk and the cyber risk, the AI risk. And I think that's important. So thank you for sharing and Yakir Covert recently launched AI Risk assessment. I'm sorry, AI Risk Assessment and AI Risk Quantification module which gives organizations a way to model potential loss and build visibility around AI risk. Why do you believe moving from qualitative risk claims or concerned about AI risk to quantified metrics is a game changer? And what are the biggest barriers organizations face in making that transition?

[B]

So when you quantify risk, it stops feeling abstract. Suddenly it turns into numbers. People can talk about, engineers can talk about it, GRC people, leaders can talk about it. The board can discuss and talk about. We all see the same picture and we can make decision without guesswork or subjectivity. Numbers give everyone a shared language and then AI risk from theory to something you can measure, compare and act upon. You can rank exposure, you can see which controls are actually moving the needle and direct budget to the places with the highest return. That shared language addresses the real problem because for years risk conversations lived in subjective scoring. Red, yellow, green, high, medium, low, Each team had a different definition which made the alignment tough and basically slow decisions. Which is the toughest outcome? Quantification Slipstack. It connects cyber and AI exports the financial operational outcomes the same way you evaluate any other business risk. It creates one language across security, grc, finance and the leadership of the organization. So why isn't everyone doing it today? Well first, it feels new. ARIS today reminds me of cyber a couple of decades ago. People sense it matters, but it still sounds niche or academic. Meanwhile, the reality is that AI is already added through day to day operations which means the stakes are real. And second, adoption is outpacing governance. Teams are ruling out gen AI features and pirates quickly. Policies, controls and oversight are still catching up. And in that environment, the starting point can feel fuzzy, even overwhelming. Well, the good news I have to say is you do not need to start from zero. You can use the same governance playbook that works in cyber. Begin with a structured control assessment to establish visibility. And with AI that typically means using the NIST AI, RMF or the ISO 42001 frameworks. And from there you build progressively track maturity over time, identify gaps and owners, add quantification as your data and intelligence advance and treat this as iterative practice rather than one time project. When organizations take that path, two things happen fast. One, alignment improves because everyone is looking at the same measures. And two, investment decision get better because you can show which action reduce expected loss. And this is how AI risk moves from a theoretical worry to a managed business issue.

[A]

Thank you, I appreciate that and just highlight a couple of things that I thought were important. Obviously quantifying risk takes the abstract out of the conversation. Everybody can understand and ultimately you're lowering risk. It also creates that correlation with quantification, correlation between cyber AI risk to the financial aspect of the business. And I think that's really important. Yakir covers quantitative models account for rare high impact events and incident types across AI vectors. What are some of the tail risks in AI that you believe are underappreciated today? And what should enterprises begin modeling now to avoid surprises in the future?

[B]

When we talk about tail risks and I we're really talking about those rare high impact events that can cause outsized damage. Things like large scale model manipulation, data poisoning in training sets, or even a systematic outage tied to a major AI service provider. But honestly what matters most isn't identifying every possible scenario, it's how you start modeling them. A lot of organizations assume they need massive data sets or advanced analytics to quantify iris, but that's not true. You can start small. You begin with one or two clear high priority scenarios that everyone can understand. Testing hub and not technical stakeholders alike. Maybe it's an AI model that fails in a critical business process. Maybe it's a third party AI tool that accidentally exposes customer data. The goal isn't to capture everything at once, it's to build the first directional view, sometimes tangible enough to begin shaping mitigation plans, funding, conversation and risk strategy. Once that foundation is there, you can start layering more granular metrics like average annual loss per scenario, high severity probabilities, downtime duration and even the financial impact of that bias or misinformation driven outputs. And over time, that evolving picture helps organization understand not just what could go wrong, but how much risk they are willing to tolerate. That's also the point where risk appetite becomes measurable. Boards can start setting thresholds, for example, deciding that the no AI related event with more than 5% chance of exceeding a $5 million loss should be accepted. That kind of clarity isn't possible without quantification. It shifts AI governance from being purely policy based to being performance based where you can actually measure how resilient you are. And just like with cyber, it's not a one time exercise, it's iterative. Each modeling cycle builds confidence, improves accuracy and helps leaders stay ahead of those high impact AI events instead of being surprised by them.

[A]

Thank you, I appreciate that. And your quantitative model obviously helps senior leadership and boards understand and prepare for these risks. You mentioned a few of them. Obviously there's data poisoning, there's outages, downtimes, but what this does is it helps prepare for that mitigation planning, maybe budget downtime planning, that sort of thing. And I think that's important that people are ahead of the game because this stuff is inevitable. And Yakir, the last question of the day, if you're looking ahead five or 10 years, how do you envision the role of AI risk quantification evolving with regulation? Like in Europe, the EU, AI act, new business models and more automation across operations. What will good risk management look like in the future? And how will Cover's vision support it?

[B]

We've actually seen this evolving before with cyber. So in the early days, risk quantification was what finally bridged the communication gap between technical teams, executives and regulators. It gave everyone a common language. Now the same transformation is starting to happen with AI boards. Investors and regulators are no longer satisfied with qualitative statements like we're monitoring AI risk. They want measurable evidence and clear demonstration of Exposure controls and the potential financial impact regulatory pressure is accelerating this shift. The EU AI act makes senior management explicitly responsible for AI oversight. That level of accountability means leaders have to understand risk in measurable, defensible terms. And that's exactly what quantification provides. In the U.S. for example, the SEC cyber disclosure rules already set the precedent for defining and reporting material risk. The same principle is coming to AI. Companies will soon have to quantify what constitutes a material AI event and show how they're mitigating it. In Europe, the European Central bank is taking this even further. Banks are now being asked to model how major destructions, unlike geopolitical shocks, cyber incident systemic failures would affect their capital reserves. That's financial risk modeling becoming regulatory expectation, not an optional exercise. It's only a matter of time before AI related scenarios are part of that list. So what does that mean for the future of AI risk management? In my perspective, the direction is clear. Quantification will move from a best practice to a regulatory investor expectation. Five and ten years from now, good AI risk management will mean being able to answer three questions clearly. What are our AI related exposures? How much could they cost under realistic scenarios? And what action most effectively reduce the exposure within our defined risk appetite? And that's where a cover's vision fits in. Our focus has always been on bringing financial discipline to technology risk. Just as we did with cyber, we're building the models that let organizations express AI exposure in business and capital terms. The goal is simple, to give leadership a quantified view that supports regulatory readiness, investors transparency and operational resilience. So AI becomes soaring, a managed source of value that is source of uncertainty and unpredictable loss.

[A]

Thank you. I appreciate you unpacking that for us. Absolutely. Leaders, boards, investors are wanting this quantitative level of data so that it is measurable. And how do they or how do we mitigate future AI risks? Financial risk monitoring is now a requirement, as you mentioned, and it's so important. And when you again quantify things and speak a shared language and tie that correlation between the risk to the financials in the organization, people certainly pay attention. So I appreciate that. And Yakir, it was such a pleasure having you on today and I look forward to speaking with you real soon.

[B]

All right, Brian, thank you so much. It's been a pleasure participating and I'm looking forward to keep listening to the next series.

[A]

Bye for now.