# Lucas Hathaway

Lucas Hathaway shares practical guidance on AI governance and cybersecurity for financial institutions, including credit unions. His posts focus on assessing AI vendors, finding AI tools already embedded in products, and putting controls such as data-loss prevention and human review into practice.

- Profile: https://b2binfluencer.marketing/creators/lucas-hathaway/
- LinkedIn: https://www.linkedin.com/in/lucas-hathaway
- LinkedIn followers: 3,098
- Topics: artificial-intelligence, cybersecurity, ai-governance
- Based on 10 dated posts, latest 2026-10-01

## Summary

They are most useful for AI governance and cybersecurity guidance for financial institutions and credit unions.

- Best for: A fintech compliance software brand doing AI governance content for credit unions is a fit.
- Not for: Consumer budgeting, crypto basics, saving money, affiliate links, and paid placements do not fit.
- Check first: Confirm audience demographics, comparable campaign results, and partnership terms before contacting them.

### Takeaways

- Add AI checks to vendor reviews and keep a dated record of decisions.
- Shadow AI hides inside products the institution already owns.
- Block sensitive data from reaching chatbots rather than relying on warnings.

## Main ideas

- **Add AI to the program you already run instead of building a new one**: Lucas Hathaway's answer to "where do we start" is a benchmark first, then four foundations built inside existing processes. The benchmark is an honest assessment against a named framework, either the NIST AI Risk Management Framework or CRI's Financial Services AI Risk Management Framework, on the reasoning that institutions need to know where they stand and regulators already point at these frameworks. The four foundations are AI policies written for how a team actually uses the tools rather than copied from a template, a repeatable AI risk assessment that runs inside the existing risk process, vendor security reviews extended with AI items alongside SOC 2, and incident-response playbooks updated for AI failures. Lucas Hathaway argues the work is additive and the evidence should be kept as it happens, not rebuilt the week before an exam.
- **A SOC 2 does not cover AI, so vendor review has to detect change**: Weak AI vendor assessment is a change-detection problem, not a discipline problem. A vendor is reviewed and its SOC 2 filed, then a point release switches on a summarizer or scoring model without notice. Lucas Hathaway argues that SOC 2 was never going to catch this: training data, bias testing, and human oversight are not trust services criteria. They recommend starting with two scoping questions for each vendor: Does the product touch customer data, and does it make or influence a decision about a person? The answers determine the depth of the review. Next, send critical and high vendors a one-paragraph discovery email asking what AI is in the product today, and use the replies to build the review queue. Add a renewal clause requiring notice before a new AI feature is enabled on the institution's tenant.
- **Shadow AI rides in inside products the institution already owns**: Lucas Hathaway argues shadow AI is harder to find than shadow IT: no purchase order or new domain in the logs marks its arrival. AI features appear through releases in vendor tools the institution already bought. They recommend running three discovery sources together over about two weeks, because any one source alone misses most of it: technical discovery of AI domain traffic, browser extensions on managed endpoints, and OAuth grants in the Microsoft 365 or Google tenant; vendor management, with one question per critical vendor about whether the product has an AI component; and short, explicitly non-punitive department surveys sent through department heads. The survey is the only source that catches personal-account use. Add an AI component field to the vendor inventory so the exercise does not have to be repeated.
- **The highest-value control is often already configured, so make it decisive**: Lucas Hathaway argues that a control an institution may already own can do the most work in an AI program: the prebuilt GLBA data loss prevention models in Microsoft 365, which look for Social Security numbers, card numbers, and driver's license numbers. They recommend setting the models to block rather than warn: people click through warnings but cannot click through a block, stopping a spreadsheet of member data from ever reaching a chatbot. Pair the control with a documented human review procedure specifying what a person must review versus what AI decides alone, particularly near lending, fraud, and member communications, and with training on sanctioned tools.
- **Name the tools and keep the dated record before someone asks**: Across Lucas Hathaway's posts, approvals and evidence need to be specific and written down. They argue that approving a category such as "AI assistants" is not enforceable, while a named list of three product names is. The same approach runs through the vendor posts: the examiner-facing artifact is a dated record of the questions asked, the vendor's answers, and the institution's decisions, kept as the work happens. Their rule of thumb is to have the policy, risk assessment, and vendor review on paper before anyone asks for them.

## Work to read

- [Where to start with AI governance: benchmark first, then build the foundation](https://www.linkedin.com/posts/lucas-hathaway_the-most-common-ai-question-we-get-is-not-activity-7493367956135960576-PMlH)
- [AI vendor risk: why a SOC 2 is not enough and what to ask instead](https://www.linkedin.com/posts/lucas-hathaway_i-dont-think-were-adequately-assessing-activity-7511572944435851265-UAF-)
- [Shadow AI hides inside the products a credit union already owns](https://www.linkedin.com/posts/lucas-hathaway_aigovernance-cybersecurity-activity-7508587994434420736-2udk)
- [The highest-value AI governance control may already be in Microsoft 365](https://www.linkedin.com/posts/lucas-hathaway_cybersecurity-activity-7506458713029828608-RFTt)

## Partnerships

Lucas Hathaway’s posts promote a service of their own: a free NIST AI Risk Management Framework assessment delivered in one working session, with a written benchmark and roadmap, and an AI vendor review checklist offered in the comments of a post. These point to a potential brand partnership around AI governance readiness for financial institutions, but the posts and linked LinkedIn profile list no media kit, sponsor policy, rate card, paid collaboration, or partnership inquiry route. A buyer would need to ask about format, deliverables, pricing, timing, placement, and attribution; a co-branded proposal, such as a webinar on AI vendor risk assessment, would need to be negotiated from scratch.

## Alternatives

- Nir Sofer, CISSP: Choose Nir Sofer when the webinar should center on discovery findings rather than vendor paperwork. The posts give attendees a concrete visibility exercise: pull the application list from the identity provider, pull the OAuth grants sorted by scope, and pull twelve months of card spend filtered for SaaS, then treat the gap between the three lists as the shadow estate. One post supplies a survey figure to lead with — 718 IT professionals, with only 9.9% reporting full visibility into their software ecosystem — and reframes the problem as an AI assistant holding a delegated OAuth grant with read access to mail and files, sitting inside the identity provider where a firewall never sees it. For a compliance software company whose product covers software inventory, SaaS discovery, or identity-adjacent risk, this puts the product at the discovery step before any vendor review.
- Jeff Willinger: Choose Jeff Willinger when the campaign shifts from reviewing outside AI vendors to governing AI the institution has already bought. The case study walks through a 90-day AI Center of Excellence rollout at a $1.2B health and life sciences organization with 400+ Microsoft 365 Copilot licenses: executive charter and steering committee, SharePoint and OneDrive permission cleanup, Purview sensitivity labels, role-based Copilot workshops and a prompt library, a monthly cadence between the CIO, chief revenue officer, HR, compliance, and data leaders, and usage analytics reporting proposal creation time down 28%, executive prep time down 35%, and 14 internal workflows automated. A compliance software company whose product supports AI policy, enablement, or adoption measurement on a Microsoft 365 estate would get a ready-made session spine with named outcomes. The posts also show sustained teaching across the Microsoft ecosystem — Modern Work, Copilot, Power Platform, and security — and a career spanning Microsoft MVP, consulting, and partner work.
- Robert Cain: Choose Robert Cain when the goal is a low-friction first step for institutions with no dedicated security or GRC function. The posts target organizations under 500 people where someone in IT, the COO, or the founder carries security on top of their actual job. They describe a 15-question, 1-to-5 snapshot across five domains — breach preparedness, breach deflection, incident response, breach recovery, and breach optimization — with a gap analysis tied back to the core business. The framing is deliberately modest: a summary read, not an audit, that gives an honest starting point without a consultant's calendar. For a credit union audience where the vendor-risk contact may not hold a security title, that is an approachable registration asset. The argument that the weakest domain, not the strongest, decides the next bad day gives a session a clear teaching point.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/