Compliance Unfiltered is TCT’s tell-it-like-it is podcast, dedicated to making compliance suck less. It’s a fresh, raw, uncut alternative for anyone who needs honest, reliable, compliance expertise with a sprinkling of personality.
Show Notes: Join TCT at the PCI-NACM in Vancouver
Quick Take
PCI has evolved from checkbox audits toward continuous assurance, but are organizations truly keeping pace? Todd Coshow and Adam Goslin explore how AI, cloud-native payments, software supply chain risk, and operational compliance are reshaping payment security.
They explain why continuous evidence beats annual screenshots, what the PCI Community Meeting in Vancouver can offer, and how teams can turn compliance into practical, measurable risk reduction. Ideal for security leaders and compliance professionals worldwide.
Read The Transcript
So let’s face it, managing compliance sucks. It’s complicated, it’s so hard to keep organized, and it requires a ton of expertise in order to survive the entire process.
Welcome to Compliance Unfiltered, a podcast dedicated to making compliance suck less. Now, here’s your host, Todd Coshow with Adam Goslin.
Todd Coshow:
Well, welcome in to another edition of Compliance Unfiltered. I’m Todd Coshow, alongside the floor sear compliance cookout, Mr. Adam Goslin. How the heck are you, sir?
Adam Goslin:
I’m doing pretty good. How about you, Todd?
Todd Coshow:
Pretty, pretty, pretty good. I got you. I’m not bad, sir. I’m not bad at all.
As always, we do like to thank the folks for their time and for sharing it with us, listening to Compliance Unfiltered. If you have anything that you’d like to share directly with Adam or myself, please feel free to reach out to us at [email protected].
Like, share, tell your friends, and of course, come and say hi if you see us at this year’s upcoming event.
Adam, join us at the PCI North American Community Meeting in Vancouver, British Columbia, Canada. 20 years later, I have to ask you, Adam, has PCI actually made payments more secure?
Adam Goslin:
Oh, I mean, there’s no doubt it had a dramatic impact. You got to remember back in the day, it was the absolute Wild West. The card brands were just getting their asses handed to them, and something needed to be done.
The level of change from when this whole adventure first started to now is pretty startling. I think in many ways it was necessary.
I think that the card industry as a whole forced a lot of organizations to start leveling up, start taking this stuff seriously. I believe it was astronomically helpful as we’ve headed into this arena.
Certainly, we’re seeing a lot of shifts in the marketplace where we’re moving away from a checkbox approach, etc.
It’s hard to remember. I was looking up, when did PCI V1 officially get released? It was middle of December in 2004.
Todd Coshow:
Oh, wow.
Adam Goslin:
It was like the first version of it, type of a deal. It was 2006 that the PCI SSC was officially formed.
Then they started to make enhancements. But there have been a whole myriad of different changes and modifications to the standards over that time.
The payments arena really has made a fairly startling shift from just checking the box, annual validations, into more of a continuous security or, as we here at TCT like to call, operational mode, type of a deal.
The acceleration of AI, both for the white hats and black hats, has enabled attackers to move as quickly as defenders.
So it remains a very, very vibrant and exciting arena.
Todd Coshow:
No doubt. Well, what do you think the biggest conversations at this year’s community meeting will be?
Adam Goslin:
Yeah, I think there’s a lot.
New and exciting things happening in the payment space will certainly be one.
Bar none, a big participant will be a lot of topics surrounding AI. AI, its use and benefits and all that fun stuff. Honestly, I’m kind of hoping that somebody whips a little bit of realism in there about the dangers of AI as well.
I think I’ve mentioned once or 80 times about AI zombie walk.
I think there’s a lot of signs in the marketplace right now that the AI zombie walk mentality isn’t necessarily the best idea in the grand scheme of things. I think there’s a lot more reasonability starting to enter into the mix. That’s what I’m hoping at least.
Certainly, a lot of discussions around operational compliance, automation of evidence collection, various ways to streamline your engagements, looking at threat intelligence and attack trends as they’re going.
Certainly, one of the cool parts about being at the conference is getting updates direct from the council, what’s happening, what’s coming soon to a theater near us, all of that fun stuff.
We’ve got all that coming our way as well.
Todd Coshow:
Indeed. What’s one thing every first-time attendee should do in Vancouver?
Adam Goslin:
Well, number one, I’m just gonna underscore this big time.
We’ve been doing the community meeting now for a week or three, and it’s interesting watching the people at the conference, right?
One recommendation that I have is a lot of the participants will tend to, it’s almost like they’re walking between two lines of hot lava or something. They’ll take this center walk down kind of like a vendor aisle or whatever.
Come to the vendor showcase. Certainly encourage all your friends, etc., to come by and pop by and see us at the TCT booth. We’re gonna be located over near the PCI Cafe on that floor.
But do yourself a favor. Go and talk to the vendors. Spend a little bit of time with them.
Yes, you’re going to have your atypical kind of salespeople that are there, and yep, no offense to the salespeople of the world, but some of them can be super effing annoying.
TCT aims not to be that, so you’ll be in a safe space. Even if you walk down the middle of the hot lava, pop in and see us at the TCT booth. That’s one recommendation.
Second, attend the sessions. Attend the technical sessions. Don’t just go and pop in for the keynote, but go to the technical sessions.
You’re gonna learn a lot, be exposed to a whole bunch of things, etc.
Keep in mind while you’re there, you’ve got the ability to talk to QSAs, talk to the council staff. You’ve got the ability to go and have face-to-face with the actual people from the card brands. Ask them the questions that you’ve been just dying to ask, etc.
It’s funny how few people will take advantage of that.
Certainly, you’ll be there with a whole bunch of other merchants, service providers, assessors, various people in the payments security space.
I would recommend, as you’re going through and hitting vendor floor, maybe one thing that’ll make it a little bit easier is see who’s talking to you about how they can help you, not how they can ram their sales pitch down your throat.
That’s usually a pretty good barometer for me of, am I gonna bother to spend my time here, or am I just gonna keep walking, type of a deal.
Do yourself a favor. Engage as you go through. You wanna be able to make the most of it while you’re there.
I would certainly recommend taking that participation seriously.
Todd Coshow:
Outstanding. Now, I’m saying this a little tongue in cheek, but is passing the audit still the goal in 2026?
Adam Goslin:
Well, I mean, it depends on who you’re asking.
There’s certainly some organizations that are absolutely fixated on doing as little as humanly possible at their own peril.
The reality is compliance, and protecting an organization more importantly, needs to be a continuous process.
You want real-time evidence collection versus just a once-a-year screenshot. You wanna be able to prove out that your controls are effective versus they exist.
Automation, and leveraging that to cut back on the amount of time you need to spend in audit prep, would be another.
Getting earlier warning signs of an area where you have to make some improvements, etc.
These are all material benefits to walking away from the checkbox approach and moving more toward a continuous assurance model.
Todd Coshow:
What trends will change PCI over the next five years? Got a lot of moving parts right now.
Adam Goslin:
Well, certainly, AI is here to stay. Like it, love it, zombie walk it, whatever you’re doing.
Bottom line is that there’ll be a lot of movement in the AI-assisted compliance management arena.
Machine-generated evidence, where you’ve got moving into kind of cloud-native payment environments, is coming.
Increased software supply chain scrutiny is another.
Identity working to replace the traditional network perimeter, so I think we’ll see a lot of movement in that arena.
Greater harmonization with global security regulations. That is except for the people that decide to be special, if you will, that kind of close the loop their standards and whatnot.
But I think we’re gonna see more and more kind of sharing and caring, if you will, in that arena.
And people moving to an expectation of operational compliance and really that being the expectation instead of it being a competitive advantage.
Todd Coshow:
What should organizations do immediately after returning home from Vancouver?
Adam Goslin:
Certainly, taking a reevaluation of their current kind of PCI implementation maturity.
Start going through how you do what you do as an organization and start integrating automation into there.
Certainly, putting a focus on kind of pressure testing your incident response, your recovery procedures, making sure they’re actually up to date, things along those lines. Really give those a once-over.
Put a closer focus on AI governance and improvements to kind of third-party risk management.
Schedule an effectiveness control review. Don’t just schedule another audit, but really take a look under the covers and see how can we make this better.
Certainly, building out that compliance roadmap before you land up at next year’s community meeting.
Todd Coshow:
Sure. So if you’re headed to Vancouver for the PCI community meeting, stop by and see the TCT team at our booth on the vendor showcase floor.
We are located near the PCI Cafe, and I hear there’s some special things that are, from a coffee standpoint, gonna be featured at that particular event, so we’re excited to see you there.
We’d love to hear what’s keeping you up at night and maybe help make compliance management suck a little less.
Parting shots and thoughts for the folks this week, Adam?
Adam Goslin:
Nah, just get your butts over to Vancouver and come see us. Come over, introduce yourselves.
Existing clients, new clients, new friends, new partners. I mean, we’re pretty open and certainly down to have the discussion and the dialogue.
So we’d love to see you guys there. If you’re able to make it over to Vancouver, we’d love to see you in person.
Todd Coshow:
And that right there, that’s the good stuff.
Well, that’s all the time we have for this episode of Compliance Unfiltered. I’m Todd Coshow.
Adam Goslin:
And I’m Adam Goslin.
Hope we helped to get you fired up to make your compliance suck less.
