Why Prompt Filters Fail & How to Explain AI Risk to the Board | Cezary Piekarski, Standard Chartered.

Is the cybersecurity industry repeating the same mistakes with prompt injection that it made with buffer overflows decades ago? As attackers iterate through 50 to 60 prompt filter bypasses daily, attempting to artificially separate instruction from data is becoming a futile effort. In this episode, Ashish sits down with Cezary Piekarski, Group CISO of Standard Chartered. Cezary shares his techno-optimist view on how AI will ultimately benefit defenders, while also unpacking the hard realities of securing an enterprise that ingests 50-plus terabytes of observable data every single day. He explains why reactive security operations are dead, why User Behavior Analytics (UBA) often fails at scale due to stochastic human behavior, and why deception technology must be built directly into your ecosystem to actually work. Cezary shares his thoughts on executive communication, detailing a proven three-step framework for explaining complex AI risks to a board of directors without relying on fear-mongering. Finally, we explore why the tension between AI data hunger and user privacy is largely a "fake dilemma" for security teams.

Questions asked:

(00:00) Introduction: The Futility of Prompt Filters & AI Attack Evolutions(02:30) Cezary Piekarski’s Background and Role at Standard Chartered(03:30) What "Security as a Business Enabler" Actually Means(06:30) The Techno-Optimist View of AI in Cybersecurity(08:50) Why Reactive Security and Manual Triage Are Dead at 50TB/Day(11:30) Doing Deception Technology Right (No More "Surplus Bug" Buying)(15:20) The Flaws of UBA and Behavioral Anomaly Detection(22:30) The Buffer Overflow Analogy: Why Prompt Injection Needs an Architectural Fix(27:30) Under-Discussed Threats: Image-Based Prompt Injection & Data Poisoning(30:00) A 3-Step Masterclass for Explaining AI Risk to the Board(34:30) Why the AI Privacy vs. Security Debate is a "Fake Dilemma"

Resources spoken about during the episode:

Cyber security and fraud safety | Standard Chartered