In Plain Sight: What Your AI Can Reach That You Never Classified
About This Episode
Jason Lee sits down with Heather Case-Hall, a 22-year veteran of the US Army, one of the Army's first cybersecurity warrant officers, and the author of Data in Plain Sight, on who can reach what: data, identity, and the agents nobody governs. Heather was named the 2026 Cybersecurity Woman Leader of the Year, selected from 7,000 candidates, and her client work centers on data security posture management and data classification.
They get into why roughly half of the leaders she talks to are confident about where their data lives and every one of them turns out to be wrong once a DSPM scan runs, why the first discovery should produce two lists instead of a panic response, why regex and pattern matching cannot tell a social security number from a Target receipt and context is the whole game, the non-human identities that arrive silently inside software updates from note-takers to Grammarly, the board that funds a million-dollar tool and then holds the keys for months, the SaaS platforms like Jira, Confluence, and Salesforce where data cannot be visualized or scrolled, only searched, and the one thing Heather wishes the C-suite understood about communicating data security in both directions.
“Probably 50 percent of the people I talk to are pretty confident of where their data is. And every single one of them finds themselves wrong.”
Heather Case-Hall, U.S. Army Veteran
In This Episode
- 01Half of leaders are confident about where their data lives, and every one of them finds out they are wrong once a scan runs. Budget for the discovery moment: two lists, what to fix right now and how to get ahead across the whole environment, not a panic response to the first five percent.
- 02Context beats pattern matching. Regex-era DLP cannot tell a social security number from a Target shelf receipt, and the word Jordan can be a person, a shoe, a river, or intellectual property. Classification without context produces false positives and false confidence.
- 03AI identities arrive silently. Almost every tool updated in the last six months added a non-human identity, from meeting note-takers to Grammarly, with access granted without anyone understanding what the grant meant. Inventory them like the service accounts they are.
- 04The board funds the Lamborghini, then holds the keys. Organizations spend millions on data security tooling and then take months to approve using it. Decide what you will do with the findings before you purchase the tool.
- 05Your data now lives where you cannot see it. Platforms like Jira, Confluence, and Salesforce hold a decade of attachments that cannot be visualized or scrolled, only searched, and searching requires knowing what to look for.
About the Guest
Cybersecurity Leader · U.S. Army Veteran
Heather Case-Hall is a cybersecurity leader, a 22-year veteran of the US Army, and one of the Army's first cybersecurity warrant officers, the Army's designation for technical experts in their field. She is the author of Data in Plain Sight, written to help organizations understand, classify, and secure their data before pointing AI at it, and was named the 2026 Cybersecurity Woman Leader of the Year, selected from 7,000 candidates. Her client work centers on data security posture management, data classification, and governing the identities that AI brings into an environment.
Get Data in Plain SightFollow the Show
The Blind Spot
Cybersecurity conversations on what happens after the risk is visible. Subscribe so you do not miss an episode.