Dr. Adi Hod

The through-line

Hod's consistent argument is that data is simultaneously an organisation's most valuable and its most dangerous holding, and that the usual response to that tension is to lock it away. "Data is not only the most important or valuable asset in your organization it's also the most risky asset in the organization," he says, because "data is a representation of our business representation of us of what we like what we don't like what we desire" [1]. From that follows everything else he argues: that security and governance have historically been separate markets, that neither alone unlocks usage, and that a data security platform has to sit as "the link between the security and the governance which enable ultimately the democratization of the data" [1]. His framing of the destination is political rather than technical: the transformation he describes is moving an organisation "from an autocracy to democracy in terms of using the data," and from something "messy to something very organized and manageable" [2]. He also treats the addressable problem as universal, holding that "every organization that has enough data to keep safe and secure will need a solution like velotics" [2].

On democratization as a working practice, not a slogan

Hod treats data democratization as an operational question with a specific mechanism rather than a buzzword. The unit of control is the transaction: "identify in each Transaction what kind of data is involved who are the user what's the purpose of the usage and enforcing policy" [1]. The user experience he describes is self-service, with the platform selecting and applying the right policy and masking, hashing or anonymizing sensitive fields so that the requester "will receive the data seek promptly and securely" [1]. The point is that access and protection stop being a trade-off: employees can use data in scenarios previously ruled out without compromising security [1]. Alongside the risk argument he raises a productivity one, citing US studies putting the cost of managing privacy alone at roughly 1.5 percent of an employee's salary, which makes governance a drag on output as well as an exposure [1].

On explainable AI and keeping the human in the loop

Hod's diagnosis of low trust in AI decisioning is that opacity is the cause: "you don't really know why algorithm or machine decide a and not b" [1]. His answer is explainability applied to policy recommendation. When Velotix suggests which rules or policy to enforce, it interacts with the data owners and explains "how exactly and why the system suggests" [1]. That feedback, on whether the suggestion was right or wrong and what else is needed, is captured and folded back into the training data, "so the next time our algorithms are doing much better job" [1]. He presents this as a compounding loop rather than a one-off safeguard: iteration produces a more accurate system, which builds trust, which in turn permits a higher level of automation [1].

On maturity levels and meeting organisations where they are

Hod argues that building a full data security policy is often "too advanced" relative to where an organisation actually sits, and he sorts customers into three levels plus one [2]. At the lowest level there is no perception or predefined rules and processes, with a single person responsible for data security and usage; the right first move there is discoverability, establishing what information exists, adding some automation and giving visibility before any automated management is built [2]. In the middle sit organisations that recognise data as an important asset they need in order to build their businesses and predict, and that have policy in place but run it through heavily manual processes; these use policy or purpose-based access control, which yields good visibility into how data is used and what security is applied [2]. At full maturity, with data management systems already in place, the aim is a machine learning agent that observes actual usage and builds the organisation's golden source of policy [2]. The "plus one" is generative AI: conventional data access is people to machine, and Hod frames the current revolution as a question of how you respect your data DNA in that new context [2].

On regulation and scale as the forcing function

The case for automation, in Hod's telling, is that manual governance cannot keep pace. He describes "a highly Dynamic environment over 200 regulation changes per day," which is why the underlying approach relies on machine learning and deep learning rather than static rule maintenance [2]. The scale problem is the same story from the other side. His first engagement, with Deutsche Bank, involved an institution trying to build a security system that would increase data usage across multiple sites, multiple regulators and massive volumes of data held in different structures and locations; the work was to gather the information, regulations and rules from everywhere and build a single system ensuring safe use of data [1][2]. He has also taken these arguments about security and privacy to industry audiences, appearing as a guest around PwC Luxembourg's Cybersecurity & Privacy Day 2023 [3].

Takeaways

• Data is both the most valuable and the most risky asset an organisation holds, because it represents the business and the people in it [1].
• Security and governance are separate markets, and you need both: the platform's job is to be the link between them that makes democratization possible [1].
• Enforcement should happen per transaction, resolving what data is involved, who the user is and what the purpose is, then masking, hashing or anonymizing accordingly [1].
• Trust in AI decisions depends on explainability plus a feedback loop from data owners, which improves the training data and permits progressively more automation [1].
• Match the intervention to maturity: discoverability and visibility first, then policy or purpose-based access control, then a machine learning engine that derives a golden source of policy from actual usage [2].
• Over 200 regulation changes a day makes manual policy maintenance untenable and is the core argument for machine learning and deep learning [2].
• Generative AI is the emerging fourth case, shifting the question beyond people-to-machine access to how organisations respect their data DNA [2].
• Privacy management alone has been costed at around 1.5 percent of an employee's salary, making governance a productivity issue as well as a risk issue [1].