Guardrails matter as much as the prompt. Princess Okoro tells the agent what it must not do, anchors it to named standards such as ISO and PCI DSS, and instructs it to come back with questions when it is unsure instead of hallucinating. The same thinking shows up in Ask Infosec, an internal custom GPT that answers policy questions for the business, and in a growing map from policy to control to risk that feeds a unified control framework at Trainline.

Tooling comes with trade-offs. Trainline is implementing a GRC platform chosen because it handles risk better than the alternatives, and Princess Okoro expects her team's future to blend that platform with AI tools rather than wait for one product to solve everything. She also notes that many GRC platforms lean toward compliance and SOC 2, while the conversation in the UK centers on risk.

Next on her list is AI governance. With ISO 42001, the EU AI Act, and the NIST AI framework offering nothing she can lift and shift, Princess Okoro is working out the minimum controls required, because no organization can do everything, and how GRC can serve a business that is pushing hard on AI adoption.

For security and risk leaders, the takeaway is plain: GRC earns its seat when it serves the business, and AI helps only after the process underneath it works.

Sean Martin, Co-Founder at ITSPmagazine, Studio C60, and Host of Redefining CyberSecurity Podcast & Music Evolves Podcast | Website: https://www.seanmartin.com/

Princess Okoro, Manager, Security Governance, Risk and Compliance of Trainline | On LinkedIn: https://www.linkedin.com/in/princessdavidokoro/

Trainline | https://www.thetrainline.com/
The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
More Redefining CyberSecurity Podcast episodes | https://www.seanmartin.com/redefining-cybersecurity-podcast
Redefining CyberSecurity Podcast on YouTube | https://www.youtube.com/playlist?list=PLnYu0psdcllS9aVGdiakVss9u7xgYDKYq
Advertise on ITSPmagazine: If you want your own story told in a promotional conversation, ITSPmagazine offers that across its programs. Visit https://www.itspmagazine.com/advertise to explore all of the programs.

princess okoro, trainline, sean martin, grc, ai in grc, ai governance, policy management, ai agents, human in the loop, control mapping, pci dss, iso 42001, risk management, redefining cybersecurity, cybersecurity podcast, redefining cybersecurity podcast