Norman J Levine

Five Ways GRC Professionals Are Actually Using AI & the One Place I Will Not Put It

About a year ago, a risk analyst on one of my client teams told me she had just reviewed a 94-page SOC 2 report in twelve minutes. She used Claude. She did it at her kitchen table at 9 PM because she had two kids and the workday had long since ended.

Don’t Wait for Q-Day: Why the Quantum Threat Is Already Here

There is a date that does not yet appear on any calendar. Cybersecurity experts refer to it as Q-Day, the moment when a quantum computer becomes capable of breaking the encryption that protects nearly all sensitive digital communications worldwide. No one knows the precise timing. Estimates vary from a few years to possibly a decade or more.

The Invisible Third-Party: AI as a Vendor Risk You're Probably Not Managing

Imagine a scenario that unfolds hundreds of times daily across organizations of all sizes and sectors. A senior analyst, facing a tight deadline, pastes the text of a confidential vendor contract into an AI-powered tool. She seeks a quick summary, perhaps highlighting key terms or comparing it with a previous agreement. The tool responds promptly. She gets the information she needs in seconds and moves on.

Q-Day: The Coming Day That Will Rewrite the Rules of Digital Security

Every time you check your bank balance online, send an email, or make a purchase with a credit card, your information is encrypted, a mathematical shield that keeps your data protected from prying eyes. This encryption has worked extremely well for decades. The algorithms safeguarding your most sensitive data would take today’s most powerful traditional computers millions of years to crack. However, a new typeof machine is emerging that could change everything.

When AI Becomes the Auditor: What Claude Code Security Signifies for TPRM & GRC Programs

The numbers came quickly. On February 20, 2026, Anthropic introduced Claude Code Security. Within hours, JFrog dropped nearly 25%. CrowdStrike and Cloudflare each fell about 8%. Losses extended to GitLab, Palo Alto Networks, and Zscaler. It was the second time in a month that a single AI announcement had rattled the entire cybersecurity industry.

The Shadow AI Crisis: Why Enterprise Governance Is Failing & How to Fix It

Almost half of all GenAI use now occurs through personal accounts like ChatGPT, Claude, Perplexity, and others, entirely outside corporate oversight or control. This isn’t about a few rogue users acting in secret. We’re seeing widespread bypassing of approved tools across entire organizations, with the average company experiencing 223 shadow AI incidents each month, twice as many as just a year ago.

The Governance Problem Hidden Inside Modern Hiring

There is a growing problem in how applicant tracking systems are being used in hiring, and it is one that deserves more honest scrutiny. Too often, ATS platforms are treated as decision engines rather than what they actually are: administrative tools designed to support process, not replace judgment.