Editor’s Letter
Security and compliance used to feel like parallel conversations: one about stopping bad actors at the edge, the other about satisfying auditors after the fact. In this issue, it is clear those lines have blurred. The same forces reshaping your workflows – AI, SaaS sprawl, hybrid work, and agentic automation – are also redrawing the threat surface and the compliance playbook at the same time.
Jelani Harper opens with an uncomfortable reality: security teams no longer have the luxury of focusing solely on malware and perimeter defenses. Nation state actors, deepfake-enabled phishing, “laptop farms,” and even looming post-quantum decryption are all converging with an overly permissive AI and SaaS landscape. The early-warning signals of a modern breach now show up in hiring patterns, misconfigured AI features, and encryption decisions – not just in your logs.
From there, Keith Johnson of Obviam makes the case that “inside the city” is where your next incident is most likely to begin. When employees connect AI assistants to contracts, financials, and customer data without clear governance, they are not being reckless – they are trying to get work done. But as he points out, innovation is outpacing defense, and the enemy is already moving laterally through cloud accounts, SaaS tools, and identities we treat as trusted.
Matthew Wood of ABBYY adds another layer: the workflows we built for predictability are colliding with agents that learn, explore, and act across systems. Agentic AI does not eliminate the need for workflow design; it makes it a board-level control surface. If you do not define where agents can learn, how they are constrained, and when humans step in, you are not only risking bad outcomes – you are hard-coding compliance problems into your future state.
Several of our contributors also tackle the human and operational side of this new landscape. Rob Pope of Ricoh shows how fragmented tools and “shadow workflows” quietly erode visibility and turn otherwise well-meaning employees into unintentional risk multipliers. Ron Shoe of SIP Oasis illustrates, in very practical terms, how AI-accelerated phishing, deepfakes, and credential attacks are testing the gap between written policy and real-world practice. Agentic AI comes up again in an article discussing how workflow will be the stabilizing force that keeps learning, control, and accountability in balance. Our contributors show how fragmentation, human workarounds, and AI-powered attackers are testing the gap between policy and practice – and why security and compliance must be designed into the way work actually gets done.
Patricia is president and senior analyst for BPO Media, which publishes The Imaging Channel and Workflow magazines. As a market analyst and industry consultant, Ames has worked for prominent consulting firms including KPMG and has more than 15 years experience in the imaging industry covering technology and business sectors. Ames has lived and worked in the United States, Southeast Asia and Europe and enjoys being a part of a global industry and community.