Hacker Valley Studio·Aug 25, 2026·35m·Episode #440

The AI Already Inside Your Company with Russell Spitler & Richard Penshorn

Download audio Show notes Apple Podcasts

Show notes

Ron, Russell, and Richard dig into why shadow AI doesn't behave like shadow IT, how one forgotten grant became the door into a real world breach, and whether AI agents should ever get access to a corporate inbox.

Underneath all of it is the one thing Russell and Richard keep coming back to: ownership. Give an AI agent access with no owner attached and it becomes invisible. Give every employee an approved, low-friction path to use AI and they stop wandering off it. Find out how you can get ahead of the AI already running inside your walls.

Impactful Moments

00:00 - Introduction
02:00 - Busting the "shadow AI is just shadow IT" myth
03:45 - Meet Russell Spitler and Richard Penshorn
05:50 - The surprising long tail of AI tool usage
07:00 - Entertainment vs. finance: build vs. buy culture
08:50 - How 30 OAuth grants became 88 in 2026
10:25 - Why manual OAuth audits became untenable
11:30 - The Canva example: what "click to connect" really grants
15:20 - Benign vs. malicious: how a stolen OAuth grant gets exploited
17:00 - Shadow IT vs. Shadow AI: what's actually different now
21:00 - Hot take: should AI agents ever touch corporate email?
25:10 - The three buckets of AI agent discovery
27:55 - Russell's best practices for locking down agents
31:00 - Fundamentals for the next 18 months: visibility and easy paths

Links

Connect with Russell Spitler on LinkedIn: https://www.linkedin.com/in/russell-spitler/

Connect with Richard Penshorn on LinkedIn: https://www.linkedin.com/in/richardpenshorn/

Learn more about Nudge Security: https://www.nudgesecurity.com/

–

Check out our upcoming events: https://www.hackervalley.com/livestreams

Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com

Become a sponsor of the show: https://hackervalley.com/work-with-us/

← Previous

Humans First: Adobe's Rule for Building AI Security Tools with John Gillis

A year ago, the average employee held about 30 OAuth grants. Today that number has risen to 88, and it isn't slowing down. Ron sits down with Russell Spitler, co-founder and CEO of Nudge Security, and Richard Penshorn, a senior security engineer at a top financial services company, to talk about the AI already living inside your business. Ron, Russell, and Richard dig into why shadow AI doesn't behave like shadow IT, how one forgotten grant became the door into a real world breach, and whether AI agents should ever get access to a corporate inbox. Underneath all of it is the one thing Russell and Richard keep coming back to: ownership. Give an AI agent access with no owner attached and it becomes invisible. Give every employee an approved, low-friction path to use AI and they stop wandering off it. Find out how you can get ahead of the AI already running inside your walls. Impactful Moments 00:00 - Introduction 02:00 - Busting the "shadow AI is just shadow IT" myth 03:45 - Meet Russell Spitler and Richard Penshorn 05:50 - The surprising long tail of AI tool usage 07:00 - Entertainment vs. finance: build vs. buy culture 08:50 - How 30 OAuth grants became 88 in 2026 10:25 - Why manual OAuth audits became untenable 11:30 - The Canva example: what "click to connect" really grants 15:20 - Benign vs. malicious: how a stolen OAuth grant gets exploited 17:00 - Shadow IT vs. Shadow AI: what's actually different now 21:00 - Hot take: should AI agents ever touch corporate email? 25:10 - The three buckets of AI agent discovery 27:55 - Russell's best practices for locking down agents 31:00 - Fundamentals for the next 18 months: visibility and easy paths Links Connect with Russell Spitler on LinkedIn: https://www.linkedin.com/in/russell-spitler/ Connect with Richard Penshorn on LinkedIn: https://www.linkedin.com/in/richardpenshorn/ Learn more about Nudge Security: https://www.nudgesecurity.com/ – Check out our upcoming events: https://www.hackervalley.com/livestreams Love Hacker Valley Studio? Pick up some swag: https://store.hackervalley.com Become a sponsor of the show: https://hackervalley.com/work-with-us/