Show: AI AI Podcast
Guest: Caleb Mattingly, Founder & CEO, Secure Cloud Innovations (SCI)
Host: Zanir
Spotify: AI in Cybersecurity & Compliance
Watch the Episode
TL;DR
- Tools don’t “do” SOC 2 or ISO 27001 for you, there’s still ~200–300 hours of real work.
- AI helps with parsing, summarizing, and speeding repetitive tasks.
- Humans stay in the loop for QA, tabletops, and judgment calls.
The Conversation
Zanir: For folks new to SCI, what do you do, and how did this start?
Caleb: Honestly, it started by accident. I was consulting, landed 90 hours of work in two weeks at double my rate, brought someone on, and pretty quickly realized there was a pattern: startups would buy a big-name GRC tool and still struggle to get truly audit-ready. My background is security and DevOps, so we said, “Let’s embed and actually implement the controls.” That became SCI. As my hat says, compliance hell is optional.
Zanir: You mentioned “real work.” How much are we talking, and what is it?
Caleb: Expect 200–300 hours for a solid first pass. Policies that map to controls. Cloud hardening (think encryption at rest for S3/EBS), logging and monitoring, incident tabletops, quarterly access reviews, vendor risk, plus collecting evidence and doing QA so an auditor isn’t chasing you later.
Zanir: Where does AI fit into that picture?
Caleb: We tried generating policies with LLMs when GPT-4 dropped. The issue: hallucinations and messy control mappings. What works better is using AI to extract controls from our policies, list the exact cadences (annual pen test, semiannual tabletops, quarterly access reviews), and turn that into a customer-friendly schedule. We also use AI to draft security questionnaire answers faster by pulling from approved sources and to speed vendor risk assessments. AI is great at grunt work and synthesis; humans own the final quality.
Zanir: So “automated compliance” isn’t really automated?
Caleb: Tools are helpful, but not magic. Some vendors merge or skip controls and still hand you a “you’re compliant” report, then an enterprise buyer points out 30 missing controls and the deal dies. Also, SOC 2 reports in “two weeks”? If it’s not AICPA-aligned and you don’t have an appropriate audit window, that’s a red flag.
Zanir: What absolutely can’t be automated?
Caleb: Tabletop exercises. They’re the fire drills of security. You practice the muscle memory so the CEO and team know what to do if ransomware hits or backups fail. Also, risk acceptance and exceptions need human judgment. And we always run QA on evidence and customer-facing deliverables, AI or human, first drafts can be wrong.
Zanir: With LLMs everywhere, how is the threat landscape shifting?
Caleb: It’s easier than ever to be a “script kiddie.” People can stitch together malware with minimal know-how. That raises the floor: you need strong basics (MFA, backups, logging, monitoring) and faster detection/response. Vendor sprawl also makes third-party risk more important.
Zanir: You were a DevOps engineer. Where do you see AI taking DevOps?
Caleb: Toward chat-driven infrastructure. We already have IaC; add AI and you can imagine: “Give me a cost-optimized stack for 200 concurrent users with managed DB, then monitor it.” We’ll see smarter cross-cloud recommendations, but guardrails still matter, reviews, controls, monitoring.
Zanir: If I’m choosing a compliance partner, what should I ask?
Caleb:
- Accreditation (AICPA-aligned for SOC 2, proper ISO accreditation).
- Control coverage (show me the matrix; what’s merged or out of scope?).
- Who implements the cloud changes and writes/maintains policies?
- Evidence QA (what gets reviewed before auditors see it?).
- Ongoing ops (who runs tabletops, access reviews, DR tests after go-live?).
Favorite Quotes
“Compliance hell is optional.”
“AI accelerates the grunt work, humans own quality.”
“If someone promises SOC 2 in two weeks, ask harder questions.”
If You’re Starting SOC 2 or ISO 27001
- Get clear on controls and cadence early.
- Budget for 200–300 hours of real implementation.
- Use AI for speed, keep humans in the loop for QA and exercises.
Want to talk through your situation? Start a conversation
