I speak to two rooms that don’t often hear from each other.
The first is the engineers, architects, and security teams who build and run the systems. For them, I talk about access architecture, policy-as-code, and AI governance, and about why their workarounds keep happening even when everyone knows better. The answer is usually a process nobody defined, not a technical gap.
The second is the people who end up paying for those decisions without being in the room: CFOs, general counsel, audit and risk committees, and the investors and underwriters who price a company before it goes public or gets acquired. For them, I translate the same problems into disclosure risk, diligence findings, and valuation.
What I bring to both is the connection between them. Most security failures are process failures, and process failures eventually show up in the price.
Talks are built for security and engineering conferences, finance and governance tracks, and board and committee sessions.
Talks
1. De-Risking the Pre-IPO Surface: Quantifying Privilege and Shadow AI for Board and SEC Defensibility
For: CFOs, General Counsel, CISOs, audit and risk committees
Growth-stage companies collect standing admin access, sprawling OAuth tokens, and AI tools wired into company data, usually because nobody decided who should have what. Those gaps come up in diligence and, once the company lists, in its SEC Item 106 disclosure. This talk walks through how that happens, and how to turn least privilege (NIST SP 800-53 AC-6) into a process the company can actually describe, and defend, in its annual report.
2. The Frictionless Perimeter: Balancing Enterprise Access Architecture with Developer Velocity
For: VPs of Engineering, enterprise architects, technical leadership
When a security control feels like bureaucracy, engineers route around it to hit their sprint dates, and from where they sit, that’s a reasonable choice. This talk covers how to replace approval queues with Just-In-Time access and policy-as-code, so teams keep their pace and the SOC 2 and ISO 27001 evidence gets produced as a side effect of normal work.
3. Governing the Autonomous Agent: Practical Red-Teaming, Permission Boundaries, and Data Lineage
For: Product leaders, security executives, operations directors
Marketing and operations teams are connecting AI agents to Google Drive, Slack, and customer data, not out of malice but because the work needs doing and nobody gave them a sanctioned way to do it. This talk treats shadow AI as an intake failure. It covers scoped permissions, data lineage, and automated red-teaming with human review built in, because a fully automated red team can report hallucinated findings that nobody catches.
Formats
Keynotes and conference talks. 45 to 60 minutes with Q&A, for security and engineering conferences, industry events, and corporate summits. Technical deep dives available for engineering audiences.
Board and committee briefings. Closed-door sessions for audit committees, general counsel, and PE/VC operating partners looking at technical debt and risk ahead of a liquidity event.
Panels and moderation. Especially conversations that put engineering and finance at the same table.
Speaker bio
For event programs. Feel free to use as written.
Elizabeth Lynn Rakphongphairoj Kilrain is a Principal Security Engineer and systems architect with more than two decades in software. She grew up in Krung Thep (Bangkok) around a family business, where she saw early that deals are built on trust and relationships long before anything is signed, and she ran her own web consulting business through university. Today she works on secure software development, access architecture, and AI governance with engineering and support teams across five continents, and writes The Cost of Ambiguity, a publication on how gaps in business process and communication become security risk and, eventually, a lower valuation. She holds an MS in Computer Information Systems from Boston University and an undergraduate degree in Political Science (International Relations).
Get in touch
For keynotes, panels, CFP submissions, or briefings: elizabeth@thecostofambiguity.com