“AI was never built to replace us. It was built to enhance us. Let it do the heavy lifting and free yourself to do other things.”
Who They Brought In
Chris Nurse is a Principal Consultant at ISOutsource with close to three decades in technology. He started when computers still took up entire rooms and has spent the last 15 to 20 years working on large-scale projects from both the consulting and delivery side. His previous clients were enterprise-level organizations running 20,000 to 100,000 servers, and his work has spanned banking, insurance, legal, medical, and manufacturing across the US and globally. He is currently deep in the AI automation space, helping organizations figure out how to eliminate repetitive work, right-size their technology spending, and build the governance structures that make both possible. He is also the person who saved a 25,000-user corporation $2.5 million in Microsoft licensing in a single assessment and grew a consulting department from 3 people and $3,000 in monthly revenue to 47 people and over $20 million.
What Got Loud
- A task that used to take Chris 45 minutes to an hour now takes five minutes because he built an AI automation tool for it. That is the whole AI argument in one sentence
- Most organizations are paying for the same AI tool four times simultaneously because nobody did the groundwork before employees started adopting on their own
- Chris’s licensing assessment for a 25,000-user Microsoft environment saved them $2.5 million. The culprit: hundreds of unused licenses and duplicate tools nobody had audited in years
- Why data is now the competitive differentiator, not the product or the service. Everyone can build the building. The question is what data you bring to the table about how you will build it
- The data seepage problem: personal devices connecting to corporate environments are moving data in ways nobody is tracking, and most of it is completely unintentional
The Rundown
Chris’s framing on AI resistance is the most practical in the series. His position is not that AI is inevitable and people need to get over it. His position is that AI was designed as a tool for humans, not a replacement for them, and the fear goes away the moment you experience what it actually does to your workload. He built an automation tool for his own client reporting process. What used to take 45 minutes to an hour now takes five minutes. He did not build it to reduce headcount. He built it so he could spend that recovered time on things he actually wants to do. That reframe, from threat to multiplier, is the one that lands with people who are stuck in fear.
The AI licensing conversation is where Chris gets direct about something most organizations are quietly ignoring. Companies are not managing their AI tool adoption. Employees see something that works and start using it without any governance in place. The result is organizations running Microsoft Copilot, ChatGPT, Claude, and one or two other platforms simultaneously, paying full licensing costs across all of them, for work that one properly configured tool could handle. Chris’s audit framework makes it visible. He builds into a client’s licensing stack and asks the question nobody has asked: when was the last time this user touched this product? The answer is almost always damning. A 25,000-user Microsoft environment turned out to be carrying hundreds of untouched licenses and duplicate tool subscriptions that had been running for years. One assessment. $2.5 million saved.
The data protection framework Chris uses is structured but accessible. He describes it as a castle. The moat, the turrets, the drawbridge, the guards inside. What he is actually describing is a layered approach that starts with understanding where data lives and who touches it, adds data loss prevention to monitor what moves and where, and wraps it in a business continuity plan so that when something goes wrong, the organization does not stop operating. His pointed observation: most companies do not care about disaster recovery because it sits on the balance sheet as a liability, not an asset. It costs money with no visible return. Until it is the only thing standing between continued operations and a catastrophic shutdown. By then it is too late to care.
The change management piece is what Chris circles back to throughout the episode. He has walked into manufacturing facilities where employees have been running the same processes for 50 years and have zero appetite for anything new. He describes wearing them down through persistence, patience, and repetition. He frames security not as an IT issue but as a business survival issue. If CMMC compliance is required to keep government contracts and you refuse to implement MFA because it feels like too much, you are making a business decision that ends the company. Chris puts it plainly: pick your poison.
Real Talk
Every organization has back work that never gets done because the people who would do it are buried in repetitive tasks. AI does not take the job. It clears the queue so the job gets better. That is the conversation worth having.
Catch It
Listen to the full episode on Apple Podcasts, Spotify, or wherever you get your podcasts. If this conversation made you think twice about your own security posture, let’s talk. Visit socsoter.com

