Shuchi Sarkar, Chief Marketing Officer at AAA Club Alliance, Recognized as 2026 Brand Innovator of the Year!

The Millennium Alliance is proud to announce that Shuchi Sarkar, Chief Marketing Officer at AAA Club Alliance, received the 2026 Brand Innovator of the Year Award at our Transformational CMO Assembly, held October 15–16 at the JW Marriott by The Galleria in Houston.

See the full list of winners and learn how you could be our next nominee—visit our Awards Page!

About Shuchi Sarkar

Shuchi Sarkar is a growth-minded marketing executive with over 20 years of experience leading brand positioning and strategy across the globe, from scrappy startups to Fortune 50 giants. Whether building from scratch at Creo and Bud Love or transforming legacy systems at AWS and HP, she has built high-performing teams, launched category-defining products, and driven measurable business outcomes.

Her background spans B2C, B2B, and B2B2C, and she has operated across the U.S., EMEA, APAC, and India. Along the way, she has led award-winning creative campaigns, scaled AI-driven content operations, repositioned global brands, and built GTM engines that generated millions in revenue and pipeline growth.

People describe her as both bold and grounded. She believes in strategic risk-taking, but also in showing up with compassion, transparency, and a relentless commitment to excellence. She is at her best when leading transformations: rebuilding underperforming teams, reviving brand equity, or creating something that’s never been done before.

#MillenniumLive: AI in Finance: How AI Agents Are Transforming Finance Workflows and Teams with Concourse

We’re excited to welcome Matthieu Hafemeister, Co-Founder & CEO of Concourse, on MillenniumLive to discuss what AI transformation actually looks like inside the finance function, why trust has to come before speed, and where CFOs should start. Drawing on his experience in fintech investing and operations, Matthieu shares how finance leaders can deploy AI agents to automate workflows, build trust through governance and auditability, measure ROI, and empower teams to focus on higher-value strategic work. Listen now and discover where AI is delivering real results today and how CFOs can take practical steps to accelerate AI adoption across their organizations. Also catch Matthieu at the Transformational CFO Assembly in Austin, Nov 4-5.

More about the guest:

Matthieu Hafemeister is the co-founder and CEO of Concourse, the platform where enterprise finance teams build production-ready AI agents. Before Concourse, he was on the fintech investing team at Andreessen Horowitz and led growth at Jeeves, where he saw firsthand how much of the finance function still runs on manual work. Concourse has raised ~$20M from Standard Capital, a16z, CRV and Y Combinator, along with angel checks from CFOs at companies including OpenAI, Cursor, Vercel and Carta. Today Concourse works with 100+ finance departments, from high-growth companies to Fortune 500 teams like Palo Alto Networks, deploying alongside them with a team of ex-CFOs and forward-deployed AI engineers.

Listen on Spotify, Apple, Amazon Music

About Concourse

Concourse is AI agent platform for finance.

Concourse accelerates the AI transformation of finance teams at Palo Alto Networks, Front, Carrot, Tecovas, Persona, Coalesce, Curbwaste, Descript, Lightmatter, Curbwaste, Deck, and hundreds more.

Concourse is backed by Standard Capital, a16z, CRV, and YC.

To learn more, visit www.concourse.ai

Inside the Marketing, Brand & Advertising Assembly: Key Insights & Takeaways

Brand vs. Performance Marketing: What Four Marketing Leaders Told Their Peers

Four marketing leaders from four very different businesses sat on one stage in Houston and landed on the same fix: stop treating brand and performance as separate jobs. They also agreed on something else. None of them said they’d fully solved it.

The conversation was our Day 2 keynote panel at the Transformational CMO Assembly, “Unified Objectives: Bridging the Gap Between Brand Building and Performance Marketing.” It was moderated by John Deighton, Professor at Harvard Business School, and the panelists were all delegates: Shuchi Sarkar, Chief Marketing Officer at AAA Club Alliance; Andrew Miller, CMO, Americas at Johnson Controls; Kelly St. Myer, EVP Sales & Marketing at Wyndham Hotels; and Erica Meagher, Head of eCommerce at Beiersdorf Canada Inc. A membership organization, a hotel company, an industrial manufacturer and a consumer goods portfolio. Same problem.

The same idea ran through the workshops and keynotes around it: marketing’s credibility now depends on connecting the pieces. That means the funnel, the org chart, the data and the brand’s promise.

Key takeaways

  • Boards want one number from marketing: revenue and growth. Separate brand and demand scorecards make that number harder to deliver.
  • The panel described the same fix in different words: one owner or one north star for the full funnel, and one shared scorecard with sales.
  • Attribution models help, but they’re a guide. They’re only as good as the data and shared definitions behind them.
  • AI is now part of how people find brands, so consistency across Google, social, Reddit and your own site is a trust signal for machines as well as people.

What delegates told us before they arrived

Before the Assembly, delegates in the CMO track filled out a needs assessment where we asked for their department’s key objectives.

Growth led by a wide margin. About two in three named revenue and growth as an objective, and it was the top answer at every seniority level. After that, the list was crowded:

  • About four in ten named digital, martech and systems integration.
  • About one in three named AI adoption, and about the same share named efficiency and operating model changes, or customer engagement and retention.
  • About three in ten named launches and go-to-market.
  • Just over one in four named brand awareness and preference.
  • About one in six named measurement.

Two things stand out. Most delegates weren’t picking one priority: about seven in ten named three or more areas. And AI rarely stood alone. Only a couple of delegates listed it as their only objective. It showed up next to growth, efficiency and customer goals. The Day 2 panel started with growth, so we will too.

You’re being measured on one number

The panel’s starting point was that the boardroom wants revenue growth from marketing and not much else. Shuchi Sarkar put it bluntly:

“Your boardroom asks you for only one measurement, and that is the revenue impact and growth that marketing is delivering.”

She added that many business leaders no longer have patience for the traditional metrics. “Everybody wants to know what’s your revenue growth and what have you impacted at the end?”

Andrew Miller’s team at Johnson Controls works to a short list of four metrics: dollar value of revenue, dollar value of pipeline, number of opportunities created, and number of leads generated. “Those are the four things.”

A marketing leader at a global technology company said the same shift in a workshop discussion: “Marketing is moving beyond generating leads and influencing revenue. The question now is how marketing can have a seat at the table when it comes to generating revenue.”

Why it matters for a CMO: if your scorecard has twelve metrics and your executive committee reads four, you’re debating in a language they don’t speak. The panel’s answer was to pick the numbers your leadership team already cares about, then build the brand case in those terms.

Brand and demand shouldn’t have separate owners

When Sarkar took the CMO job at AAA, she made it a condition that brand and demand generation sit together. In her words, “do not separate brand and demand generation,” because splitting them creates different KPIs, with brand watching awareness and consideration and demand teams measured on the funnel.

Miller was candid that Johnson Controls isn’t there yet. “We do not have this right, by the way, yet,” Miller said. The brand team sits in Zurich, creative in Ireland and digital in Milwaukee, while Miller runs Americas campaigns from Chicago. The data points to a cost of the split: “The effectiveness is going down on lead gen, which means we’re not doing enough on the brand side and measuring the right things.”

What do you do when you can’t change the org chart? Erica Meagher’s answer was to find allies. If media is performing but product pages on Amazon are suppressed because of out-of-stocks, “that is burnt media budget.” Meagher’s prescription: set a shared north star in budget planning, meet regularly to course correct, and “find your champions within the organization.”

Sales is the other half of the handshake. Sarkar noted that in many organizations “there are no SLAs with sales, so marketing holds all accountability.” Miller’s team has a phrase for it, “There’s no daylight between marketing and sales,” and a monthly operating review where marketing reports on the same red-or-green template as every other function. Kelly St. Myer closed the panel on the same point: “if your sales and marketing team are having your meetings separately and you’re not coming together as a unified team, how are you going to be successful?”

In the workshops, other delegates added that marketing’s scope is part of the problem. “Anything that’s not operations has somehow fallen into my organization,” said a technology marketing leader. “On one hand, it creates consistency across the brand, but on the other, the team is absolutely overwhelmed.” A digital leader at an energy company argued for a partner that doesn’t always get invited: “You have to bring IT people into marketing because you need to speak the language of IT to be successful.”

Attribution is a guide, not an answer

The panel treated attribution with healthy skepticism. St. Myer’s reminder was short: “just always remember that it’s imperfect.” Sarkar was more specific about why.

“I think that attribution models are as good as your data is. To be very honest, it’s garbage in, garbage out.”

She said they’re still worth having because they give you a guide, but “it’s ultimately up to you to take that final judgment call.” The risk is what gets funded when a model only rewards what’s easy to measure. Direct conversion is the easiest to count, and she described what happens if that’s all you fund: “You can keep on taking out water from the well, but ultimately the well will dry.” In her telling, the rainwater that refills the well is spending on brand and retention, which is harder to attribute and still has to be funded.

The workshops took the “garbage in” point further. The energy-company leader offered a rule for the human side: “AI can get you 80% of the way there, but you still need the human component to verify the results and make sure they’re right.”

One practical takeaway: when someone shows you an attribution model or an AI tool, ask what data it can see. Then ask how it would hold up in front of your CFO.

Trust counts twice, and AI is checking

Kelly St. Myer’s best-remembered point was about how brands get found. To show up across large language models, “consistency, trust” is the thing. St. Myer named three places that matter: Google, social media and Reddit. AI agents are searching all of them, and if the story doesn’t match, they’ll move on.

“If your messaging isn’t the same exact way from social media to Reddit to Google to your website, they’re going to think, ‘I can’t trust you.'”

A university CMO sharpened the point in a workshop on public confidence: “Your brand’s experience is no longer just a narrative, but structured, objective data. Brand promises must match operational truth.” AI won’t take your word for it. “We can’t say we’re something if we’re not, because AI is going to test those claims against observable performance.” A technology marketing leader noted who the audience now includes: “One of the most blurred lines we’re seeing is that marketing is now being tasked with influencing not just people, but bots and AI agents.”

For CMOs doing AI search visibility work, that suggests a simple audit: read your own brand across Google results, social profiles, Reddit threads and your website, then check whether a stranger would think it was one company.

What two keynotes added

Our Transformational CMO Assembly is a two-day, peer-led gathering for senior marketing leaders. Houston’s program mixed AI Power Hour roundtables of 20-30 peers, and a number of 30-minute workshops, one-hour roundtables and a keynote panel. Two keynotes on Day 1 added the data and creator angles. 

Klaviyo: fix the silos before you add more agents. Mike Lisavich, Senior Director of Product Management at Klaviyo, said the best-in-class tools marketers bought over the last decade now each come with their own agent, and each one “only knows what it knows.” His advice: “The question really isn’t at this point, what is the best tool anymore? In my view, it is whether or not they share what they know because that’s going to make them effective.” He also urged marketers to measure results, not hours saved, and to keep humans on the creative. Fully autonomous agents messaging customers is “a little bit too black box for me at the moment.”

Later: the journey isn’t a funnel. Nicki Seaborn, Head of Creator Product at Later, said “there is no linear journey today between awareness, consideration and purchase,” because many purchases now start with AI research. Seaborn sees the next stage for brands as the point where “your performance and your awareness and your social team budgets will start to sit together,” which is the panel’s brand-and-performance point from the creator side. Seaborn’s advice on creators: don’t over-restrict them. “Just tell them three things they can’t do” and let them do the rest.

Our 2026 Brand Innovator of the Year

Shuchi Sarkar had a full day. After speaking on the panel that morning, she was announced at the Day 2 lunch as winner of The Millennium Alliance 2026 Brand Innovator of the Year Award.

It’s a fitting win. Sarkar has more than 20 years of global marketing leadership across B2C, B2B and B2B2C businesses, from scrappy startups to Fortune 50 companies. She has transformed legacy systems, scaled AI-driven operations and built high-performing teams across the U.S., EMEA, APAC and India. She is both bold and grounded, and her panel comments showed why.

She talked about AAA’s push to be more than the tow company people call when the car breaks down, and she was frank about the risk of standing still: “we’re losing relevance with the younger audience.” She said she made the case with evidence. “I’m a big believer in pilots… give me some money, low risk. I’ll do a pilot and prove it out.”

Congratulations to Shuchi, and to every nominee.

What to take back to your team

Nobody on the panel offered a framework. They offered habits for connecting the pieces, and they’re cheap to try:

  • Ask who owns the full funnel. If brand and demand report to different leaders, agree on one shared north star and one scorecard, even if you can’t merge the teams.
  • Cut your scorecard to what the executive committee reads. Then show how brand work moves those numbers.
  • Pilot before you pitch. Small, low-risk tests with a clear before-and-after are easier to fund than a big new strategy.
  • Treat attribution as a guide. Agree on shared definitions and clean the data first, then use judgment on top of it.
  • Check your claims against reality. AI can test what your brand says against what customers experience.

These are the questions we build our Assemblies around. Our Houston panelists were delegates themselves, and that’s the model: practitioners on stage, peers in the room who have the same problem and a different business. We’ll take them up again at our Transformational CMO Assembly in Charlotte on February 3-4, 2027, with workshops on how CMOs build credibility at the executive table, balancing long-term brand building with short-term performance, and keeping your brand discoverable in an AI search world. Come with your own questions. Details are at mill-all.com.

About The Millennium Alliance

Founded in 2014, The Millennium Alliance is a premier technology and business advisory firm dedicated to transforming the digital enterprise. By bridging the gap between enterprise C-Suite leaders and their technology partners, we’ve become a global leader in corporate-level executive education and peer-to-peer engagement. Learn more at mill-all.com.

Leading the AI Transformation: Building an AI-Native Finance Organization with Concourse

In partnership with Concourse

Most finance teams have tried AI. Far fewer have it running in production.

At next week’s Transformational CFO Assembly in Austin, Matthieu Hafemeister, Co-Founder & CEO of Concourse, will lead a roundtable on what separates the two: which workflows to start with, how to build trust and governance in from day one, and how to measure ROI the board will believe.

If you’re attending, save a seat at the table.

Request an invite here

About Concourse

Concourse is AI agent platform for finance.

Concourse accelerates the AI transformation of finance teams at Palo Alto Networks, Front, Carrot, Tecovas, Persona, Coalesce, Curbwaste, Descript, Lightmatter, Curbwaste, Deck, and hundreds more.

Concourse is backed by Standard Capital, a16z, CRV, and YC.

To learn more, visit www.concourse.ai

#MillenniumLive: Jeff Buck: Retail AI Is Only as Good as the Data Underneath It

How can retailers turn the data they already have into smarter decisions, more effective merchandising, and real business value from AI? In this episode of the Millennium Live Podcast, we sit down with Jeff Buck, CEO of Robling, to explore the challenges and opportunities shaping the future of retail analytics, retail data strategy, and AI-powered decision-making. With decades of experience building retail analytics companies, Jeff shares why he returned to the industry to launch Robling in 2018, helping retailers transform retail data into actionable insights that support smarter, faster business decisions. and what he believes retailers need to do differently to unlock the value of their data. Jeff discusses why organizations continue to struggle with disconnected data, overwhelming dashboards, limited customer visibility, and legacy systems that all stand in the way of better decisions. Jeff also explains how AI can empower merchants with actionable insights while keeping human judgment at the center of critical buying, assortment, and merchandising decisions.

Listen on Spotify, Apple, Amazon Music

About Robling

Robling helps retailers unite data across silos and unlock insights that generate millions in new revenue, increased margins and enhanced productivity across the enterprise. Customers like Belk, Hot Topic and Accent Decor use Robling to put data and analytics at the fingertips of everyone who needs it, from data scientists to retail executives, using any BI or analytics front-end tools they prefer. Unlike typical data warehousing approaches, Robling’s Data-as-a-Service (DaaS) is a product, not an endless project. Robling’s fully cloud-based analytics foundation — featuring connectors to common retail systems — rapidly delivers on retailers’ most valuable and pressing analytic use cases, all backed by the company’s software and its unique blend of retail, technical and analytics expertise.

To learn more, visit http://www.robling.io

Concourse Sponsors the Transformational CFO Assembly

In partnership with Concourse

We’re excited to welcome Concourse as a sponsor of our Transformational CFO Assembly in Austin, Nov 4-5.

Concourse is the platform where finance teams build production-ready AI agents: connected to their data, customized to their business, and governed so every output can be traced back to the source. Over 100 finance departments, from high-growth companies to the Fortune 500, are using it to take on the close, flux, forecasting and reporting.

Co-Founder & CEO Matthieu Hafemeister will be on site leading an executive roundtable. See you in Austin.

Request an invite here

About Concourse

Concourse is AI agent platform for finance.

Concourse accelerates the AI transformation of finance teams at Palo Alto Networks, Front, Carrot, Tecovas, Persona, Coalesce, Curbwaste, Descript, Lightmatter, Curbwaste, Deck, and hundreds more.

Concourse is backed by Standard Capital, a16z, CRV, and YC.

To learn more, visit www.concourse.ai

Inside the CFO Healthcare Assembly: Key Insights & Takeaways

One Claim, Two P&Ls: What Healthcare CFOs Said in Austin

Fix the process before you buy the AI

Provider CFOs and payer CFOs shared two days at our Millennium Alliance Enterprise CFO Healthcare Assembly in Austin this August, and they kept describing the same fight from opposite ends. Providers talked about claims that get denied or underpaid, then appealed late. Payers talked about claims that get overpaid, then chased late.

AI came up in every keynote, but nobody treated it as the plan. It’s what makes a better process possible, once the process is worth speeding up. (The keynotes came from Millennium partners, and the views below are the speakers’ own.)

What delegates told us before they arrived

Ahead of every Assembly, we ask registered delegates to describe their department’s objectives. For Austin, those answers came from about 90 decision makers across the provider and payer tracks. About seven in ten held finance titles, and most of the rest held operations, revenue or payment integrity roles.

Cost reduction and margin came up most, named by about four in ten. Efficiency and automation, growth, and revenue cycle performance each came in around three in ten. AI by name came up for about one in four, close to how often automation did.

The tracks differed. Provider delegates leaned toward revenue cycle and automation, each named by about four in ten. Payer delegates leaned toward cost and margin, named by about half, and about three in ten named payment integrity and medical cost. That’s what people said going in, not what was discussed in the room.

The margin is sitting in a department most CFOs rarely visit

Jeff Means, CEO of Long Tail Health Solutions, pointed to utilization management. “Utilization is ground zero for that friction,” he said. It decides whether a stay is paid as inpatient or as observation, “with an absolutely massive contractual adjustment, not a denial.” That’s easy to miss, because a contractual adjustment never shows up on a denial report.

He took on the belief that providers must use the criteria sets their payers use. “It
is a requirement for them. It is not a requirement for you.” His scorecard advice runs against instinct too: “You should have initial denials. If you don’t, you’re not being aggressive enough on your inpatient status.” A low denial rate can mean the money was given away up front.

 

Think small about AI

Ben Schneeman, Chief Financial Officer at Katch, is about two years into his company’s AI work. One of its best wins was “three days of work. Very minimal cost,” yet it “never would have showed up as a priority in our prioritization criteria.” He also warned about “AI value hitchhikers”: other changes made at the same time that get credited to the AI project.

Means came at it from the other side, with a hockey story. “Just adding AI doesn’t give you the answer.” So where does AI earn its place? Sharilyn Campbell, SVP, CFO at Sentara Health Plans, kept it practical: “Taking mundane tasks out of the workflow and letting technology handle them allows you to focus your resources on the more critical work that needs to be done.”

Payers: the expensive way to find an overpayment is after you’ve paid it

David Jackson, VP Integrated Solutions and Partnerships at EXL Health, shared his company’s survey data. About 70 percent of payers believe they’re ahead of competitors on AI. Only 12 percent qualify as leaders by measurable business outcomes. “So there’s a gap between use and impact.”

Rodger Smith, VP, Strategic Accounts at EXL Health, said the fix is to move review earlier. “Stop leakage at the door. Let’s get it before the dollars go out.” The risk is accuracy. “If you’re only finding one out of every 20 claims, that’s a problem,” because providers want their cash flow and regulators can impose prompt pay fines.

Both sides want the fight to end

Means said payer-provider relationships are “harder than they’ve been in the 22 years I’ve been doing this.” So how do two sides that are measured against each other work together? Aron Weisskopf, SVP, Healthcare Economics & Value at UnitedHealthcare, offered a shared test: “Weigh every initiative on financial impact and access risk before it scales.” Either side can run it. Smith named the destination: “Some of these processes are still adversarial, but that’s not, as we heard this morning, probably the future of health care. It needs to get more collaborative.”

What to bring to December

Our Millennium Alliance Enterprise CFO Healthcare Assembly returns December 1-2 at the JW Marriott Arts District in Dallas. It opens with “The Modern Healthcare P&L: Bridging Provider Pressures and Payer Economics.” On Day 2, Tom Lindquist, Chief Growth & Strategy Officer at Medica; Kenneth Hogue, Chief Revenue Cycle Officer at UHS; and Jim Beiermann, CFO at CHRISTUS Health, will take on the question Smith left hanging: how do payers and providers stop fighting over the same claim? Their keynote panel, “Payer-Provider Alignment: Shared Data, Reduced Administrative Friction, and Joint Value,” will center on sharing data to cut prior authorization friction and denials, building risk contracts around total cost of care, and using joint analytics to manage medical loss ratio and capital allocation. Workshops pick up Austin’s threads, including “Show Me the ROI.”

Three questions to bring:

  • Where does your loss actually show up? If it’s a contractual adjustment or a clawback, a denial dashboard won’t catch it.
  • What’s your smallest AI win, and what was the baseline? Hitchhikers can’t hide in a number you measured first.
  • Who on the other side of the claim could you share data with?

Details of our CFO Healthcare Assembly can be found here for Providers and Payers.

Inside the CISO & AI Assembly: Key Insights & Takeaways

CISO AI Governance: Lessons from Millennium’s CISO Assembly

The AI Governance Problem Is Mostly a Basics Problem

At our Transformational CISO Assembly in Atlanta on October 7, a keynote speaker asked the room a simple question. Who here is fully confident they know every AI and SaaS tool running in their environment?

One hand went up.

That moment set up the next two days. Under every session was the same pressure. AI is moving faster than anyone’s plan for it, and security leaders are being asked to steer through change they can’t fully size up yet. CISOs don’t like being in that spot.

On Day 2, the keynote panel “Velocity vs. Vulnerability,” moderated by Dr. Dave Chatterjee, Adjunct Associate Professor at Duke University, brought together security leaders from financial services, government, federal research and national security policy. A Day 1 fireside chat with ADT’s Deputy CISO added the operator’s view. The panel’s answer wasn’t to start over. It was to update the playbook, beginning with the basics AI is putting under stress.

The short list

  • Set your risk appetite first. The business moves faster when it knows where the guardrails are.
  • Fix the basics. AI speeds up whatever’s already weak in asset inventory, data governance and identity.
  • Go find the shadow AI. Unapproved MCP servers can be running before a governance committee ever hears about them.
  • Write down who owns what. That means who owns the risk, who’s accountable and who can take systems offline.
  • Widen your tabletops. Bring in legal, communications, executives and third-party scenarios.

What delegates told us before they arrived

Before each Assembly, we collect a short needs assessment from registered delegates, including the objectives their department is working on. We reviewed the responses for Atlanta. About 90 security decision makers took part, and here’s what they said.

AI topped the list, and most of those mentions were about governance, risk or security. Only about three in ten framed it purely as adoption or automation. Here’s how the rest stacked up.

What Delegates Named as an Objective How Often
AI About 7 in 10
Compliance and Program Maturity About 3 in 10
Identity and Access About 3 in 10
Consolidation and Modernization, Led by Cloud and Infrastructure Migration About 1 in 5
Detection and Response, Data Security, Network and OT, Exposure Management, Application Security Each about 1 in 10 to 1 in 7

This is what delegates said going in, not what was discussed in the room. Still, the pairing is worth noticing. They arrived focused on AI governance, with identity and compliance close behind. On stage, the answers kept coming back to inventory, ownership and identity.

1. Security done well makes the business faster

Eric Boateng, Chief Information Security Officer and Head of Enterprise Cyber Security at MassMutual, opened the panel by flipping the usual question.

“The question is how much security risk are we prepared to take while we try to innovate with AI.”

Set that appetite, he said, build the guardrails, and teams can move inside them. “We speed in our cars because we have brakes. That is risk management.” Quinton Jones, Information System Security Officer at the National Institutes of Health, took the analogy further. Without brakes, “our maximum speed we would ever safely be able to go is maybe five, possibly 10 miles an hour.”

Exceptions work the same way. When the business needs to go outside the guardrails, Eric said, it “has to be well documented. It has to be time bound with compensating controls.” Senior management decides who owns it, somebody monitors it and a mitigation plan follows. The answer to a product team is never a flat no. It’s yes, within these limits, and here’s the paper trail.

He also tightens his own scoreboard. “If I am green on metrics, I go back and tighten the thresholds because green metrics is bad, by the way.” The thresholds come from a year of his team’s vulnerability and patching data.

Later in the day, Eric accepted The Millennium Alliance CISO Distinguished Collaborative Leadership Award at lunch. His parting words to the room were the same idea: “if security is done right it’s going to enable speed.”

2. AI is an accelerant, and the fuel is your existing mess

A CISO from the government sector didn’t hedge.

“We don’t truly have to rewrite the book with controls and how policies and governance and how we do things. It’s just adding another layer to it. It’s not a change completely. It’s an add-on.”

What that layer needs underneath it, the CISO said, is to “truly get down to the basics on some aspects, like truly understanding your asset management, understanding what your environment is like, what is out there.”

Rick DeLoach, Deputy CISO and Senior Director at ADT, landed in the same place: “AI is an accelerant.” Dr. Georgianna Shea, Chief Technologist of the Transformative Cyber Innovation Lab at the Foundation for Defense of Democracies (FDD), said organizations are still getting hurt by “the low hanging fruit that we’re getting tripped up on.” Add AI as a force multiplier and those hygiene problems get worse.

Eric tied it to data: “If you have poor data governance, you’re going to have bad AI governance because it feeds with each other.” He expects agentic AI to be the big one. “In the next couple of years, agentic risk will be the number one risk that we have, because you have tons of these agents talking to each other.” His starting point is inventory. How many agents do you have, who owns them and what are they doing? An agent can have a valid identity and still misbehave. “They could be the right identity, but might be behaving the way it was not intended to do.”

Georgianna added two cautions.

  • Risk registers. Likelihood scores often lean on whether something has happened before, and speed changes that. “All of these fundamental assumptions that we’ve been taking for granted and working off of really need to be reexamined.”
  • Compliance. “You can be compliant but not be secure.” In her reading, the NIST controls used in assessments don’t test AI. They look at the confidentiality, integrity and availability of data, not whether you can trust it. On cryptography, the control “just says, do you have a crypto program?” Check the box and move on.

For a CISO, the AI program and the basics program are the same program. An agent inventory is an asset inventory. Agent permissions are an identity problem.

3. You can’t govern what you haven’t found

Rick shared a story from ADT’s weekly AI governance committee. His team raised MCP servers. The committee’s answer: “we don’t have any MCP servers because we haven’t approved any.” So his team pulled data from their own tools and showed them. A fair number were already in the environment.

His point was about the operating model, not the people. Threat actors don’t wait for change control boards, and “governance councils, those are, you know, old operating models and we need to move at speed.” If your review process depends on requests arriving through the front door, it misses everything that came in another way.

The government-sector CISO goes after the same problem from the network side. Any time AI is used, the team gets an alert: “We get the prompt and response, and if they try to upload a document, we actually capture that document at the same time.” It isn’t a gotcha, the CISO made clear. The goal is to see what’s happening so the team can respond at the speed things now move.

Back to the one hand in the Day 1 room. The first job of an AI governance program is finding things. Policy comes after.

4. Decide who owns it before the incident starts

The panel was built around three ideas from Dr. Chatterjee’s framework: commitment, preparedness and discipline. Under commitment, the first question was who owns the risk. The answers were sharper than “the CISO.”

The government-sector CISO split apart two things leaders tend to blur: “there’s a difference between owning and who’s actually accountable.” Everyone who touches a system owns some of its risk, the CISO said, but accountability sits with someone specific. In that organization, it’s typically the CISO or the CIO. Eric described the financial services version. System owners decide within the risk appetite, and anything past tolerance escalates through risk committees, up to the board.

An attendee asked what happens when a data risk owner leaves and nobody wants the job. Eric reframed it: “We don’t have a data risk issue. We have a resiliency issue.” His fix is a named co-owner for every critical inventory item. “There’s always going to be a co-owner, someone who is equally knowledgeable and have the seniority to make some decisions.”

Authority gets the same treatment. Rick said ADT’s incident response plan spells out, with executive sign-off, “that we have the authority to take systems offline if there’s deemed to be a threat in the environment.” The reason is simple.

“So we don’t get into an incident bridge, and we’re trying to figure out who has the authority to do what. Like if you’re trying to do that, it’s already too late.”

Georgianna was blunt about resilience: “if you’re planning on just protecting the system, you’re going to fail.” She starts from the mission, maps the critical functions behind it and the technology that supports them, and works out the minimum service the organization has to keep running through an attack.

5. Rehearse with everyone in the room

The government-sector CISO’s test for a backup plan: “if you say you have a full live backup system, but you’ve never tested it, you have theoretically a backup system.”

Eric described how far MassMutual takes rehearsal. His teams run third-party compromise tabletops and zero-day tabletops, plus a combined scenario where a third-party compromise arrives through a zero-day. There are executive-level sessions with the CEO in the room. The biggest problem in a tabletop, he said, is communication: “who to talk to, at what point, who do we inform.”

An attendee whose company serves the banking sector told the room what happens when you widen the exercise. Their insurer facilitated a tabletop that brought in the CEO and the legal team, and added a scenario the team hadn’t planned for, in which “all of our credentials got exposed to the internet.” One panelist’s reply: “If you have not involved every aspect of it in those planning sessions, you haven’t done it.”

Four checks to run this month

  •  Risk appetite. Is it written down, with a documented, time-bound path for exceptions? If product teams can’t see the guardrails, they’ll build around them.
  •  AI inventory. Does it come from your own tool data or from intake forms? The MCP story suggests the two can differ.
  •  Ownership. Does every critical risk have a named owner and a named co-owner? Does your incident plan say, with sign-off, who can take systems offline?
  •  Next tabletop. Is it built around a third-party compromise, with legal, communications and executives at the table?

The questions above didn’t stay on the stage. Who owns the risk and who’s accountable came up again in the workshops and roundtables, and the room didn’t always agree. Delegates drew the line in different places, and the answers shifted with the size of the organization and the industry. Nobody needed to settle it. Hearing how a peer in another sector or at a different scale handled the same question kept the conversation going, and gave people something to compare against their own setup.

That’s a big part of why delegates came. They wanted to hear how peers were handling it, and to know they weren’t facing it alone. They also wanted to see the new solutions showing up almost daily, so they could tackle a problem or just stay on top of what’s new.

That conversation picks up again at our Transformational CISO Assembly, December 1 and 2 at The InterContinental in New Orleans. The agenda includes sessions on streamlining enterprise AI intake and review, how peers define data-access tiers and real-time circuit breakers for autonomous agents, and modernizing incident response for cloud and AI breaches. Details are at mill-all.com.

 

Risk and Resilience in the Age of AI | Fortinet Thought Leadership Security Summit

In partnership with Fortinet

Date: Thursday, November 12, 2026, 8:30 a.m. to 1:30 p.m. ET
Location: PGA National Resort, Palm Beach Gardens, FL
AI is arming attackers and defenders at the same time. Join CISOs, CIOs and security leaders for a focused morning of plenary sessions and peer panels on how adversaries use AI, how to harden your defenses against AI-driven attacks and how to govern AI adoption without slowing the business. Speakers include Derek Manky, Fortinet‘s Chief Security Strategist, along with IT and security leaders from Hertz, DHL Express, Equinix and TBC Corporation. Stay for lunch and an optional round of golf hosted by Fortinet.
Seating is limited. Reserve your seat: https://events.fortinet.com/thoughtleadershipsecuritysummit2026_fl

About Fortinet

Fortinet makes possible a digital world that we can always trust through its mission to protect people, devices, and data everywhere. This is why the world’s largest enterprises, service providers, and government organizations choose Fortinet to securely accelerate their digital journey.

To learn more, visit www.fortinet.com

Simon Morris, VP International Marketing at Adobe, Recognized as European Marketer of the Year!

The Millennium Alliance is proud to announce that Simon Morris, VP International Marketing at Adobe, received the European Marketer of the Year Award at our European Transformational B2B CMO Assembly, held September 29–30 at the Leonardo Royal Hotel in Amsterdam.

See the full list of winners and learn how you could be our next nominee—visit our Awards Page!

About Simon Morris

A charismatic Marketing Executive used to working in the Enterprise Software market. Specific, deep industry knowledge of Digital Marketing, Mobile Workforce Management, and closely working with partners such as Accenture, IBM, Microsoft and SAP.

A track record of driving significant market demand and establishing ‘market leadership’ in the minds of prospects, partners and analysts. From brand awareness and public relations, to event management and online and offline marketing, extremely successful qualitative and quantitative marketing results have been produced. Experience across B2B and B2C sectors.