The C-Suite Signal – Perspectives from the people leading the AI transformtion
You Can’t Govern What You Don’t Know You Have
By Christopher Hippensteel, Director of Information Technology, New Resources Consulting
I’ve spent most of my career on the “no” side of the table. As an ethical hacker and cybersecurity specialist, it’s my job to think like an attacker before an attacker does, and for the last couple of years that’s meant being the guy in the room who slams the brakes on AI. Every new tool, every “just try this GPT plugin” request from a well-meaning employee, every unsanctioned account signing up with a corporate email, I was against it, loudly and often. If I couldn’t see it, test it, and control it, I didn’t trust it near my network.
So, it says something that I’m writing a guest post for Portal26, on Portal26’s own blog, telling you why I think it’s one of the best decisions I’ve made in my security program this year.
The problem wasn’t fully AI. It was the blind spot
I write a monthly security blog for New Resources Consulting, and back in the Spring I published a piece on shadow AI: the idea that employees are adopting AI tools faster than any of us can write policy for them, and most security teams are flying blind. You can lock down sanctioned SaaS all day long, but if someone’s pasting client data into a personal ChatGPT account or a browser extension nobody vetted, none of your controls matter, because you don’t even know it’s happening.
That’s shadow AI. And here’s the uncomfortable truth I had to sit with as an ethical hacker: I can’t hack, audit, or defend what I can’t see. Visibility isn’t step one of governance, it is governance’s foundation. You cannot govern what you don’t know you have.
I first met Neil Cohen and his team from Portal26 in person at RSAC. I’d been the anti-AI guy at every security dinner and CIO roundtable for so long that it had become my whole personality, so I wasn’t exactly the easiest audience. I walked away with some familiarity with what Portal26 did, but not a full picture of the product.
That fuller picture came later, when Neil reached back out after he’d read my shadow AI article. That conversation actually got my attention instead of getting filed away like the other vendor follow-ups in my inbox that week. I told him honestly that my org wasn’t going to invest in another security tool that budget year, but I wanted to understand it well enough to talk about it with NRS’s clients. The more his team walked me through what Portal26 actually did, and the more he showed me in a full demo, the clearer it became that this wasn’t another blocklist. It’s a real-time, self-updating catalog of every AI tool actually in use across your environment, not the ones you assume are in use. That conversation kept going anyway, because the problem he was describing was the exact one keeping me up at night.
After that conversation with Neil and the demo, I brought the product straight to Jeff Thompson, at CinchIT, one of NRC vendor partners. Jeff is also, another amazing security professional, and the two of us had been going back and forth for a while about my frustrations trying to get a real handle on AI security. When I showed him Portal26, he saw the same thing I did. With his help, we launched a proof of concept between CinchIT and Portal26 in my own environment, and that’s where I actually got to see the value firsthand: what AI was really running in my organization, how to start controlling it, how to govern it, and how to move forward with it instead of just fighting it.
From 10% visibility to 90%, and why that number matters more than it sounds
The results from that CinchIT and Portal26 proof of concept are documented in Portal26’s case study on New Resources Consulting. The short version: data started flowing within about 30 minutes of deployment, with zero disruption to end users. Our visibility into shadow AI tools jumped from roughly 10 percent to 90 to 95 percent, and we cut the time my team spends manually chasing down AI risk by about 75 percent.
Those numbers are nice. What they represent is better. For the first time, I wasn’t guessing. I had an actual inventory of what AI was touching our environment, who was using it, and what it had access to, the same question I’ve dug into in my own writing about what tools like ChatGPT, Copilot, and Gemini actually do with the data you hand them. Portal26 turned that question from a research project into a dashboard.
Detection was never the finish line
Here’s where I’ll push back a little on how a lot of the market talks about this space, because it matters for anyone evaluating tools like this. A lot of “AI visibility” products stop at detection: here’s a list of AI tools your employees are using, good luck. That’s a start, but it’s not governance, and it’s not what got me to stand behind Portal26 publicly.
What changed things for me is that Portal26 gives me the operating intelligence to answer more than “is this risky?” It helps me answer who’s using a tool, for what purpose, under what controls, and whether it’s actually worth what we’re paying for it. That’s the difference between security telemetry and AI program management.
Governance, in practice, is an evidence problem. When something goes wrong, or when a board asks me to prove our AI program is under control, I need to show what happened, which policy applied, whether it was enforced, what data was involved, and what remediation followed. That’s the layer above detection. It converts discovered AI activity into policy, training, a risk posture, a real roadmap, and accountability for whether the investment is paying off. If you’re only buying for security, you’ll eventually get stuck answering a different set of questions anyway: is this AI worth the license fee, are teams actually adopting the tools we approved, are we over-licensed or under-licensed, where should we invest next. Portal26 is the first tool I’ve used that treats AI governance as an adoption and investment-management function, not just a security feed.
Putting it in front of my peers
I don’t recommend products I haven’t stress-tested, and I don’t put my name on things I don’t believe in. Ask anyone who’s heard me talk about the vendors I do trust at industry conferences over the years. So, when I got the chance to bring this conversation to my own peer network, I took it.
Earlier this month I hosted a session with our local CIO group here in Milwaukee, affiliated with the MMAC, with 15 Directors of IT and CIOs in the room. The topic was AI security and governance, and I brought Portal26 and CinchIT into that conversation because it’s exactly the kind of thing that community needs to hear about from someone who’s actually run it, not just read the datasheet. I’ve since pointed other security leaders in my network toward Portal26 for the same reason. Plenty of tools can tell you an AI tool exists. Fewer can tell you what to do about it, prove you did it, and show whether it was worth doing.
Why I’m putting my name on this
I don’t do brand endorsements. NRC’s blog exists to help our clients and community get smarter about security, not to sell specific vendors, and I hold myself to that line. But every so often a product comes along that solves a problem I genuinely lose sleep over, and shadow AI is that problem for me right now.
I want to be clear about where I stand on AI itself. I’m not against it. I want to see it advance, and I think it’s going to keep changing how we all work. But I still believe, to this day, that we are running a beta product in production. AI adoption inside organizations isn’t slowing down, and most security programs, including the ones I’ve run, have been treating it that way, as a beta feature quietly running in the background with no guardrails around it. We are finally starting to realize we need guardrails, security, governance, and visibility into what is actually out there. You can’t secure or govern what you can’t see and don’t know you have.
Portal26 gave me the visibility I’d been missing, and more importantly, it gave me a path from visibility to actual governance: policy, evidence, and a way to show leadership that AI risk in our organization is managed, not just monitored. It lets me bring actual evidence to my C-suite instead of a gut feeling, see clearly into my own environment, and work hand in hand with my users to find solutions instead of just telling them no. That’s why I went to bat for it with my MSP, why I put New Resources Consulting’s name on a public case study, and why I’m writing this post under my own name.
If you’re the person in your organization who’s supposed to have an answer when someone asks, “what AI are we actually running and is it under control?” start by finding out what you don’t already know you have. That’s where governance actually begins.