Keith Hollender on Arcova, AI Cybersecurity, and Enterprise Risk

Keith Hollender is helping enterprises rethink cybersecurity as AI changes both attack and defense. At Arcova, Keith and his team work with large organizations to solve complex security challenges with a practitioner-led approach built around flexibility, execution, and client trust. Arcova recently won a Fortress Cybersecurity Award for its work helping enterprises strengthen their security programs in a fast-changing threat environment.In this episode, Russ and Keith discuss Arcova’s evolution from a cybersecurity practice inside Morgan Franklin Consulting to an independent, private equity-backed company. Keith explains how his experience as a cybersecurity buyer inside large financial institutions shaped Arcova’s approach: make engagements easier, stay flexible, avoid unnecessary bureaucracy, and focus on delivering what clients actually need.The conversation dives into how AI is changing cybersecurity. Keith explains that AI is helping defenders identify and fix vulnerabilities faster, but it is also helping adversaries find new pathways in. That shift is accelerating everything, from threat and vulnerability management to detection engineering, autonomous SOC work, and the need for faster response.Russ and Keith also discuss why identity has become the new front line. As non-human identities, agents, API keys, and automation expand across enterprises, organizations need better control over who or what has access, what those identities can do, how they are monitored, and how quickly access can be revoked.The episode also covers third-party risk, supply chain exposure, the Lynx Technology Partners acquisition, continuous risk monitoring, geopolitical risk, global regulation, quantum readiness, and why security strategies may need to evolve every 18 months as AI and quantum computing continue to change what organizations know and what they need to protect.Topics Covered:[00:01] Welcome and intro, Keith Hollender and Arcova[00:32] Arcova’s origin inside Morgan Franklin Consulting[01:33] Keith’s background inside large financial institutions[01:54] Building a cybersecurity firm from the buyer’s perspective[03:20] Management buyout, acquisition, AI practice launch, and rebrand[04:02] Why the management buyout was the catalyst event[05:14] What enterprises ask Arcova to solve[06:12] How AI is changing enterprise security engagements[06:33] AI, efficiency, and changing operating models[08:09] The difference between digital transformation and AI transformation[09:28] How AI affects vulnerabilities and zero-day discovery[11:16] Old attack methods becoming new again[12:36] Detection engineering and autonomous SOC work[13:25] Faster breakout times and faster response needs[14:20] Why identity is now the front line[15:13] Non-human identities, access controls, and monitoring[16:47] Managing AI agents, credentials, and guardrails[18:46] Third-party and supply chain risk[19:25] Why third-party risk remains difficult to control[21:00] Lessons from the Lynx Technology Partners acquisition[21:17] Continuous monitoring versus annual vendor surveys[22:47] Geopolitical risk and nation-state threat actors[25:13] Global regulation, DORA, GDPR, CCPA, and NYDFS[27:02] Quantum readiness and post-quantum security[28:49] Why quantum will create another major shift[30:31] Hardening for what we know while preparing for uncertainty[31:24] Final thoughts on AI, quantum, and cybersecurity strategy