Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Teri Green-Mason: “AI is Artificial. YOU are the Intelligence!”
Guest:
Teri Green-Mason
Published:
Updated:
Duration:
20 min
Episode summary
Teri Green-Mason, VP of Technology at Elevate and CIO/CISO at Lite Technology Solutions, thinks too much of the AI risk conversation stops at vulnerabilities and misses the bigger picture.
In this episode of WE’RE IN!, Teri introduces her proprietary TEST Framework, Touch, Execute, Store, Trust, a practical way for CISOs to evaluate AI risk that goes beyond a standard vulnerability checklist.
Why do humans remain the greatest attack vector, even in the age of AI? How should security leaders be teaching digital citizenship to the next generation? Why do the basics of security still matter most, even as the threat landscape gets more sophisticated?
Don’t miss Teri’s framework for thinking about AI risk like a CISO.
Listen to the episode
S4 E9 · Teri Green-Mason: “AI is Artificial. YOU are the Intelligence!”WE'RE IN! Podcast · 20 min
Key takeaways
Evaluate the workflow, not just the model Teri argues the real AI risk usually sits in the workflow around the model: what data it touches, what actions it can execute, what gets stored, and who trusts the output.
Traditional security reviews miss AI Standard review processes were built for applications and infrastructure, and AI behaves differently because it can execute workflows and influence trust while sounding accurate and being wrong.
AI is already in your environment Tools like Microsoft Copilot and Google Gemini arrive whether organizations planned for them or not, so policy discussions need to start from where AI is already in use.
Three steps for leaders now Inventory where AI is used, define governance around intentional and accidental data exposure, and train employees on responsible AI use.
Start ethics education early Teri wrote a children's book on ethics, AI, and cybersecurity because younger users face issues like deepfakes and can learn the line between ethical and unethical early.
Notable quotes
Because I think if you can't model it, you can't secure it.
…the real risk is usually the workflow around the model, right?
And unfortunately, AI is outpacing governance.
AI can analyze patterns, but humans must decide what risk is acceptable.
Questions this episode answers
What is the TEST framework for AI risk?
TEST stands for Touch, Execute, Store, and Trust. Teri built it so security teams can evaluate AI tools that touch data, execute workflows, and influence trust, which traditional application and infrastructure reviews do not cover. Read this section
How is AI changing cybersecurity?
Teri says AI accelerates both sides: attackers automate phishing and vulnerability discovery, while defenders analyze large data sets and detect anomalies faster. She sees the real shift as decision speed, with organizations that combine human judgment and AI insight coming out ahead. Read this section
Will AI replace security professionals?
Teri does not think so. She expects AI to change cybersecurity jobs but not replace them, and recommends starting with the basics and knowing exactly what data you put into AI tools. Read this section
What should security leaders do about AI risk right now?
Inventory where AI is already used, define governance around data exposure whether intentional or accidental, and train employees on responsible AI use, because adoption is happening whether leadership approves it or not. Read this section
About the guest
Teri Green is, at the time of recording, vice president of technology at Elevate, a nonprofit focused on equitable energy solutions, and CISO at Light Technology Solutions. She created the TEST framework for evaluating AI risk and wrote a children's book on ethics, AI, and cybersecurity with an accompanying digital citizenship curriculum. She previously worked at IBM and TransUnion and is finishing a doctoral degree at Purdue.
Hello and welcome to the latest episode of WE'RE IN. I'm Josh Mason, a solutions architect here at Synack. And today I've got with me Teri Green. Teri is the vice president of technology at Elevate, a, nonprofit focused around committed to equitable energy solutions. You're also at Light Technology Solutions as the CISO. And you've recently put out a book and you're doing some talks around AI ethics and you're doing some great things, Teri. Thanks for joining us.
Believe it or not, I'm I'm big on history. If you could tell like during history month. And when I kind of like, when we thought about how so many things, everything you looked at, whether it was TV, whether it was the hustles back then, I'm kind of telling my age, you know, I look younger than what I am. But the truth of the matter is, looking at these TV shows, they actually it was the first time I was able to see people that looked like me become lawyers and doctors and not just basketball players. And I'll never forget, fell into the library one day and I fell upon Ada Lovelace. Ada Lovelace, even though a lot of us don't talk about it, she was actually the first computer programmer and she was a woman, right? And to be able to kind of think about back in the days, how those things were kind of looked over and just made me want to be able to kind of put myself on the net so I can make a difference.
That's huge. You are currently finishing up a a doctoral degree at Purdue. What's it like being kind of at the the top on the academic side as well on cybersecurity?
I'm gonna tell you like this. To be honest, I don't have not one cert, Josh. Okay? But I I am working on my sixth degree. I don't know if you know, I worked from the CIO. And the only things that were consistent in my life was church and education. So those are the things that kind of hold close to me. I'm actually be pursuing my CISSP in October. I actually won ISC2 certification scholarship. So I'm doing it. But, and it's only because I don't wanna ask my team to do something I'm not willing to do.
That's huge. And you've been at some of the, like, the the big companies in the industry before you even got into the the CIO or CISO Scott quite a while
at Yeah. I 11 worked at the IBM, the TransUnion, and then I had this moment, right? And I realized these people were paying for my brain. And even though you had so many people talking about, like wanting to sit at the table, I was never one of the people that wanted to sit at the table. I was kind of pushed into leadership relatively early. I was a junior in college when I got my first role. I was the assistant chief engineer at LALE, the number one radio Spanish radio station in Chicago. And I had interned at WE'RE So I was like one of those things that we've seen that thing I touched is kind of go to go. And I just kept going with it.
That's awesome. That's amazing. It's 2026. The thing everyone is talking about is AI, everywhere. And you have... You dove in and learned a lot and you've been kind of guiding a lot of things in AI. You came up with a framework. Tell us about it.
So words. Right? The framework is called TEST. Touch, execute, store, and trust. The reason I kinda did this is because I saw so many security teams being asked to be able to kind of implement AI like it was monitoring toolsets and monitoring technology, and they had no true way to evaluate the associated risks. When you think about our standard or traditional security review process, Well, that was only really for applications and infrastructure. AI doesn't behave that particular way. It has a different component to it. And unfortunately, it's a big decision to set where it's actually touching data. It does have the power to execute workflows. But my biggest thing is it can actually influence trust. And can you imagine having a tool that can push something out and sound so accurate and be so wrong, right?
AI had that possibility. So it's a reason why I created this framework so that we can actually evaluate the associated risks. Because I think if you can't model it, you can't secure it.
That's huge. And it goes beyond the vulnerabilities. You're hitting on some of the ways AI is being used, being trusted, being turned into an advisor in a lot of ways beyond just the ins like vulnerabilities that has inherently. Those who have tuned in to other WE'RE IN podcasts, I've been talking to a lot of our Synack Red Team members who have found some vulnerabilities in chatbots, in different AI models, and yours is about the usage.
Yeah. So when you think about this, I think about it all the time. I just actually was sitting in a thesis. I just was a table leader for a CISO dinner and we had more than 40 CISOs and CIOs from Missouri at these particular dinners, some of the biggest companies. And they're all plagued by this thing in AI. And I step back and I say, well, think about it right now. Cybersecurity, we never had a full grasp on it. For a long time cybersecurity people said the wrong thing. They said people were 70% of the problem. They were unpredictable. They were the weakest link. Well, and they're actually the greatest vector in the era of AI, there's a bit of associated risk. So if you couldn't fix them then, how do you actually fix it now where they're actually putting things inside of your two sets? AI is accelerating faster than we can blink.
Well, AI is accelerating both sides of cybersecurity. You have attackers using AI to automate phishing, vulnerability discoveries faster than ever before. And then on the other side, you have defenders who can also analyze massive data sets. They can detect anomalies a little bit quicker and they can respond to threats faster. But the real shift isn't the technology, it's actually decision speed. So organizations that actually learn to combine human judgment with AI insight are the ones that will win in my opinion.
Is the right way to use that? You've created a book on AI ethics. Is that the first way of like putting this into something that you could hand to someone?
To be honest, I started with our smallest data set. Right? To be able to kind of shift the norm, just like we think about it. Because the book that I created was the first ever children's book to teach ethics and AI cybersecurity and then I build a digital citizenship curriculum to it, right? To be able to kind of build upon those nuances. But you start with the kiddos because they're the future, they are the new generation. And right now they are dealing with things like deepfakes. They don't know how to spot those out. So I started with them because that is the set of people we couldn't control when we were trying to. But if we just started younger and started teaching them what ethics really looks like, because there's a thin line between ethical and unethical, I think we have a stronger chance of having a stronger population.
That's huge. I think about if folks had told us when, you know, we were first in our... In the first AOL chat rooms, you know, a long time ago, What to be worried about and how to actually handle things and be smart about all of this technology. How many fewer problems would we have now? Can't go back and fix things, but we can make things better going forward by working that problem from the from the start. I I love that.
Yeah. And look, and I'm beyond this. If you ask me right now what worries me most about AI, it is an AI itself, right? It's how quickly you see organizations deploying AI without fully understanding how it touches the actual data, the decisions and the trust boundaries. So AI doesn't just process information. It employs decisions at scale. And I look at it like this means that governance and security, they must evolve just as fast. And unfortunately, AI is outpacing governance.
That's so true. It's a tool like any other, but it's a tool that doesn't come with all of the instructions on what you can use it to do. And it it does seem like the hammer that works everywhere.
It's it's really good that we have people who are taking the time to figure all this out because, I don't think there's enough of us who, you know Not. Think about it at that level.
Oh, no. I'm too busy. But you're you're presenting on this at at a lot of talks. You're one of the few people who's presenting at SANS upcoming AI summit in DC in a couple months, in a couple weeks.
Listen. Check this out. I got this... You know, I'm kinda corky, like, when it comes to marketing. So in my afterlife... Not my afterlife because it was why I was working at IBM. I was actually Grammy nominated. So I actually was a a artist, right? And I always go back to writing, which is why I actually go to what I'm strong at. I'm a good writer, right? And it's probably all of the thesis statements, know, going to Penn State for my master's was hard, right? But I would say this, I got this quirky thing I tell people, AI, it's artificial, you are the intelligence. And it's just kind of giving them some practical tools that they can actually utilize. So the hopes is you have these leaders come in, they'll be able to have a practical tool they can be able to utilize, evaluate their risks associated and be able to kind of figure out the right questions to ask when actually trying to figure out what tools that's associated to AI to put in their environment.
Because most organizations are not focusing on the model. So I'm trying to basically teach them, hey, the real risk is usually the workflow around the model, right? So lesson literary, what's the data in session in the system? What actions can it execute? What's getting stored? What trust the output? And that's how we come up with TEST. They'll have some workflows and sets to utilize walking out of that meeting. And I'm excited. That's awesome.
they might It's not be artificial. They are the intelligent. So garbage in, garbage out. Remember we said that for years. They're not watching what they're actually putting in these data sets. You can still manipulate the output. But this is why I say when you have things like AI that can actually produce things and you trust the outcome. Right now, it don't even do real algorithms and people don't even know that it's based on the LLM. That's the technical paralysis that people are not really understanding. And then quantum is coming. It's not moving faster, right? Because the transistor in which the LLM are sitting on is still obsolete at this point. And once that's exploded, we're never going to be able to catch it. So just being okay with knowing that they can't solve every problem, just being focused on the problems in which they can solve and look, smoke us on the small wins.
I would say start with the basics, right? Same thing with cybersecurity. We was actually looking for the newest tool set. It's the same thing when you think about how we went through the big cloud adoption. Remember you had so many organizations, little lackadaisical. They didn't want to get their data up. They were to have them come down. It's the same thing. It took some knowledge. It took some training. However, you have to be a little bit more intentional when you're dealing with tools like AI because it's moving at a rapid speed and it can actually move quicker and still. So you just have to be able to kind of get your foot wet and stop thinking it's going to replace security professionals because I don't think it is. I do think it will change security, cybersecurity jobs, but it won't replace them. So I don't know. So people have to start with the basics. That's what I tell people, start with the basics. Know what you're actually touching and understand what you're putting into the toolset.
What is PII? I don't want to hear that name the damn thing. Is it the social security number? Is it the name? Is it the address? Name it. Stop giving all these acronyms and actually name what you're actually studying about.
Yes. Yes. The the jargon and the acronyms that we hide behind, now we used to try to make life maybe easier or it's either, it's either trying to make life easier or trying to gatekeep. I don't know. I'm hoping it's to make life easier. Unfortunately, it also does the other. And I'm with you. If we are straightforward with our language and, explain it to folks, everyone will get it. And, what you pointed out, the person who understands how to use AI is gonna be the one who ends up succeeding in the future is not the person who's worried about AI replacing them. A lot of leaders have said that. I, my buddy Jason Haddix, he's been leaning into AI and he, he said the exact same thing on another recording that I did with him.
And you two are not singularities either. This is the common theme. It's always the person who understands how to use the toolset, who knows how to use the technology that doesn't need to worry about the technology, right?
Yeah, but this is what I like, it's about the basics. Like, if you think about cybersecurity, it's fundamentally about judgment, context and ethics, right? And AI can analyze patterns, but humans must decide what risk is acceptable. You cannot give that power to a toolset or you'll be dealing with the breaches we've been dealing with. Like, remember we had a breach, the AI tool went in and accepted something and then we realized that it wasn't my company, but it was a company that was over the years. They had a really big AI breach and that's because they weren't allowing it to execute. You can't eradicate the human element and that's how you stop the tool. That's where humans just sit.
That's so true. That's so true. And that's the, that is like the root of security isn't. It's the, the fact of if we don't actively plan for it, then we've made a decision that we're okay with whatever happens if you know, we don't plan for it.
You know what I'm realizing though, Josh, I've been in technology for about... I've been in this arena for about eighteen years and I've been an executive for thirteen. And one thing is, I've always, people don't like the truth. I don't care what industry you're in. But AI is already inside most organizations, whether they wanted it or not. And they're still sitting here talking about AI policy, right? But if you use in Microsoft, you got Copilot, they force it on you. If you use in Google, you got Gemini, they force it on you. So like you have to be realistic about where you are in the organization and they don't even understand the tools that that's using them. Just, but they're still buying them, you know?
Yep. Yep. If we're not conscious of it, if we don't make policy around it, put procedures in place, you run into the same issues you do when you don't do that around security or proper It's gonna bite someone in the butt.
I got this one thing, like in relation to my framework, I always say, when you think about what should leaders be doing right now about AI risk, and that is three They simple should inventory where AI is already being used inside the environment. Like I just gave two examples. They should define the governance around that data exposure, right? Is it intentional? Is it accidental? Because it does happen, right? And then train your employees on responsible AI use, right? Because whether leadership approves it or not, like I said, it's happening. You
So you can actually go to my website, CodeQuest, it's called theethicsengine.com. So the children's book that you did mention, it has sold over 45,000 copies, or is it 47,000, something like that. And it is sold everywhere as well. So from Walmart to Barnes and Noble, and I didn't expect it. I'm not even getting the residual from it. I'm taking the money to put it towards scholarships for kiddos, because educational institutions are having some issues there. Or you can follow me on LinkedIn, real simple, Teri Green. I'm just simple Teri Green.
Awesome. Teri, thanks so much for joining us today. This has been wonderful. This has been great information for folks. And, yeah, folks, if, you want to hear more, follow on LinkedIn and her website and grab the book. If you're enjoying this, tune in next time and look for us on YouTube and all the places that WE'RE IN PODCAST is playing.
