MCP, Agentic AI Risk, and the Governance Decisions Leaders Must Make Now Webinar
Speakers
Sean D. Goodwin is a Principal in the Cybersecurity (DenSecure) group at Wolf & Company, P.C., where he leads both offensive and defensive security engagements for clients across highly regulated and technology‑driven industries.
Sean leads Wolf’s cybersecurity practice across offensive security, including security reviews, penetration testing, social engineering, threat emulation, and red‑team engagements that stress‑test an organization’s defenses against real‑world threat actors. On the defensive side, he oversees virtual CISO (vCISO) consulting programs, helps design and mature security programs, and leads digital forensic investigations that support incident response and recovery. He also serves as Wolf’s Lead QSA, responsible for overseeing PCI DSS assessments and mentoring teams that support complex compliance environments.
With over a decade of consulting experience, Sean has worked extensively with financial services, healthcare, education, software, and other data‑intensive sectors, helping organizations improve their security posture and resilience against modern cyber threats. His work spans the intersection of compliance and security, frequently advising leaders on PCI DSS scope, the difference between “checking the box” and true risk reduction, and how to build trust‑driven, business‑aligned security programs. Sean regularly speaks and shares insights on topics such as social engineering psychology, AI‑driven threats, cyber deception, tabletop exercises, and why cybersecurity has become a core business survival issue rather than a pure IT function.
Beyond his client work, Sean contributes to the broader cybersecurity community as a board member of the Eastern Massachusetts (ISC)² chapter and a mentor with the Mass Cyber Center. He also serves as an Auxiliary Member in the USCG Auxiliary Cyberspace Flotilla, supporting Coast Guard cyberspace defense and operations through the AUXCYBER program. Sean is a frequent guest on podcasts, webinars, and industry forums, where he translates complex security concepts into practical guidance for executives, boards, and technical leaders.
Sean holds a Bachelor of Science in Information Systems Audit and Control from Bentley University and a Master of Science in Information Security Engineering from the SANS Technology Institute. He has earned an extensive portfolio of industry certifications, including GSE (GSE #271), CISSP, CCSP, CISA, QSA, PCIP, and multiple GIAC credentials such as GSEC, GCIH, GCIA, GCWN, GCCC, GCUX, GCPM, and GDAT, reflecting deep technical and governance expertise across the cybersecurity landscape.
Philip H. Wess is a nationally recognized speaker and technology executive specializing in artificial intelligence, data strategy, analytics, and digital transformation. With more than 20 years of experience building enterprise software, data platforms, and advanced analytics solutions, he helps organizations navigate the intersection of AI innovation, governance, security, and business transformation. Philip works with executive and technology leaders to develop the modern data foundations required to support AI at scale, while addressing emerging challenges around agent governance, cybersecurity, risk management, and regulatory oversight. His experience spans data architecture, software engineering, analytics modernization, AI implementation, and organizational change management.
A frequent speaker to financial institutions and industry groups across the country, Philip focuses on helping organizations move beyond AI experimentation and build secure, governed, and scalable AI capabilities that deliver measurable business value.
SUMMARY
In this Revenue Room™ CXO member exclusive webinar, Philip H. Wess and Sean D. Goodman covered the business case and security risks of MCP-connected AI agents: Philip framed the revenue upside (personalization, rev ops automation), while Sean flagged authentication, auditability, and authorization as the top risks, citing that 97% of AI-related breaches stem from poor authentication and that attackers exfiltrate data in ~90 minutes versus ~187 days to detect it. Q&A focused on accountability, board communication, and penetration testing frequency.
TRANSCRIPT
The webinar opens with a brief setup period before host Heather Holst-Knudsen welcomes attendees and introduces the session on Model Context Protocol (MCP), AI security, and data governance. She explains that AI has evolved beyond chatbots into autonomous operators capable of accessing CRMs, data warehouses, finance systems, and customer records. The discussion focuses on balancing the business value of AI agents with the governance needed to control their access and actions.
02:29 – 04:58: Heather introduces the speakers: Philip Wess, who specializes in AI implementation and data governance, and Sean Goodwin from Wolf & Company, who focuses on cybersecurity. She outlines the format of the webinar, consisting of a 30-minute discussion followed by a live Q&A.
04:58 – 14:03: Philip Wess explains what Model Context Protocol (MCP) is and why organizations are adopting it. He describes MCP as a standardized connection layer that allows AI agents to securely access enterprise systems rather than exposing data directly to large language models. He discusses how MCP enables AI to connect with CRMs, content management systems, data warehouses, analytics platforms, and other business applications while maintaining controlled access. Philip highlights business benefits including personalized customer experiences, operational efficiency, reduced manual work, improved data integration, and increased revenue opportunities. He also notes that while AI modernization creates significant value, it also expands the organization's attack surface and requires stronger governance.
14:03 – 34:35: Sean Goodwin shifts the discussion to cybersecurity considerations for AI agents. He identifies authentication, auditability, and authorization as the three most critical security challenges, explaining that improperly implemented authentication has been a major contributor to AI-related data breaches. Sean emphasizes the importance of least-privilege access, Zero Trust principles, ongoing governance, and updating vendor contracts to explicitly address AI usage. He introduces the AWARE framework as a practical governance model for AI agents and encourages organizations to treat agents like digital employees with clearly defined responsibilities, limited access, continuous monitoring, and accountability. Sean also discusses emerging attack vectors such as prompt injection, data poisoning, and automated exploitation, while stressing that organizations should leverage AI-powered security automation to detect and respond to threats at machine speed. He concludes by outlining a risk-based approach to deploying AI agents, recommending different levels of oversight depending on the sensitivity of the workflow, and emphasizing that organizations should begin with clearly defined business objectives rather than adopting automation for its own sake.
34:35: Philip concludes the presentation by thanking Sean and handing the session back to Heather, who transitions into the live Q&A.
