PCI Perspectives

Build Your Payment Security Expertise with PCI SSC eLearning

Tue, 20 Oct 2026 13:41:04 UTC

Keeping pace with the evolving payment security landscape requires current knowledge and practical expertise—but finding time for training can be challenging. PCI Security Standards Council (PCI SSC) eLearning gives payment security professionals the flexibility to build their skills and advance their knowledge wherever and whenever it works best for them.

PCI SSC eLearning courses are delivered through self-paced, computer-based training (CBT), allowing you to move through the material at a pace that fits your schedule. There is no need to coordinate travel or step away from work for a set class time. You can plan your learning around professional and personal commitments while engaging with trusted PCI SSC training.

Learn on your schedule: Access the training when and where it is most convenient for you.
Set your own pace: Progress through course components in a way that supports your learning style and availability.
Reduce time away from work: Build valuable knowledge without the travel and scheduling demands of instructor-led training.
Stay focused on your goals: Complete the training and exam within a defined 90-day window.

PCI SSC offers the following courses in eLearning format:

Internal Security Assessor (ISA): The Internal Security Assessor program teaches you how to perform internal assessments for your company and recommend solutions to remediate issues related to PCI DSS compliance.
> More information
Payment Card Industry Professional (PCIP): The Payment Card Industry Professional is an individual, entry-level certification in payment security information and provides you with the understanding to help your organization build a secure payment environment.
> More information
PCI Forensic Investigator (PFI): PFI’s perform investigations within the financial industry using proven investigative methodologies and tools. They also provide relationships with law enforcement to support stakeholders with any resulting criminal investigations.
> More information
Approved Scanning Vendor (ASV): Upon completing this training, you’ll be able to perform external vulnerability scans, submit the appropriate scan report, and maintain internal quality assurance for scanning efforts.
> More information
Qualified Integrator and Reseller (QIR): Securely install, configure and maintain validated PA-DSS payment applications.
> More information

From the receipt of payment, participants have 90 days to complete all components of the training and the exam. This timeframe provides the flexibility to create a manageable learning plan while maintaining momentum toward completion.

Whether you are expanding your payment security knowledge, pursuing a new qualification, or supporting your organization’s security goals, PCI SSC eLearning offers a convenient path forward. With respected training, a self-paced format, and access that fits into your schedule, you can take the next step in your professional development with confidence.

Ready to get started? Explore PCI SSC eLearning course options and choose the training that aligns with your professional goals.

The AI Exchange: Innovators in Payment Security Featuring AuditSafe

Mon, 19 Oct 2026 15:09:05 UTC

Welcome to the PCI Security Standards Council’s blog series, The AI Exchange: Innovators in Payment Security. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders to exchange information about how they are adopting and implementing artificial intelligence (AI) into their organizations.

In this edition of The AI Exchange, AuditSafe CEO, Fernando Nicolau F. Ferreira, offers insight into how his company is using AI, and how this rapidly growing technology is shaping the future of payment security.

How has your AI strategy evolved over the past 12-18 months?

Over the past 12–18 months, our approach to AI has evolved from experimentation and productivity use cases toward a more structured and governance-oriented model.

Initially, much of the focus was on understanding where AI could improve productivity, accelerate analysis, and support knowledge-intensive activities. As adoption increased, however, it became clear that the more important question was not simply where AI could be used, but how it could be used responsibly and securely.

Today, we look at AI through three interconnected lenses: business value, risk and governance, and human oversight. This is particularly important in cybersecurity and payment environments, where confidentiality, integrity, accountability, and traceability cannot be compromised in the pursuit of efficiency.

Our strategy has therefore become less about adopting individual AI tools and more about establishing the principles, controls, and governance required to use AI at scale.

What is one AI initiative that has already delivered a measurable impact within your organization, and what made it successful?

One area where we have seen clear impact is the use of AI to support knowledge-intensive and analytical activities.

AI can help professionals organize large volumes of information, identify relevant points more quickly, structure analyses, and accelerate the preparation and review of technical content. This reduces the time spent on repetitive activities and allows specialists to dedicate more attention to judgment, risk analysis, and decision-making.

The key factor behind the success of this approach has been maintaining human oversight. We do not see AI as replacing professional judgment, particularly in security, compliance, and assurance activities. Instead, we see it as an additional capability that can augment experienced professionals.

The measurable benefit is therefore not only productivity. It is also the ability to redirect human effort toward higher-value activities where context, experience, and accountability remain essential.

How are you approaching AI governance, particularly around data privacy and security?

We approach AI governance as an extension of existing risk, information security, privacy, and corporate governance disciplines rather than as an isolated technology issue. Organizations need to understand what AI systems are being used, what information is being provided to them, where that information is processed, who is accountable for their use, and what controls apply throughout the lifecycle.

From a privacy and security perspective, some fundamental principles remain unchanged: data classification, access control, least privilege, third-party risk management, secure development practices, monitoring, and incident management continue to be relevant.

What AI introduces is an additional layer of complexity. Organizations must consider issues such as inappropriate disclosure of sensitive information, model and data provenance, accuracy of AI-generated outputs, third-party dependencies, and the level of human oversight required for different decisions.

For organizations operating in the payment ecosystem, AI governance should therefore be integrated into the broader security and risk management framework rather than treated as a separate initiative.

What challenges have become more apparent as AI capabilities have matured?

One of the most significant challenges is that AI adoption can happen much faster than governance. Employees can access powerful AI capabilities almost instantly, while organizations may require considerably more time to establish policies, risk assessments, technical controls, and monitoring processes.

Another challenge is overconfidence in AI-generated results. As models become more capable and their responses more convincing, users may assume that an answer is correct simply because it appears authoritative.

Third-party risk is also becoming increasingly important. AI capabilities are being embedded into software, cloud services, cybersecurity tools, and business applications, sometimes without organizations fully recognizing the new data flows and dependencies being introduced.

The challenge is therefore not simply controlling AI. It is creating enough visibility and governance to allow organizations to benefit from AI without introducing risks that they do not understand.

What advice would you provide for an organization moving from early AI adoption to broader implementation?

My first recommendation would be: do not scale AI faster than your ability to govern it.

Organizations should establish a clear inventory of AI use cases, define ownership and accountability, classify the data that can and cannot be used, evaluate third-party risks, and determine where human oversight is mandatory.

At the same time, governance should not become a barrier to innovation. A risk-based approach is more effective than attempting to apply the same controls to every AI use case. Low-risk productivity applications and AI systems involved in sensitive data or critical decisions should not necessarily be governed in the same way.

Finally, organizations should invest in AI literacy. Policies and technology controls are important, but employees also need to understand the limitations of AI, the risks associated with sensitive information, and their own responsibility when using AI-generated outputs.

The objective should be responsible acceleration, not simply acceleration.

What AI trend (not limited to payments) are you most excited about?

I am particularly interested in the evolution from generative AI toward agentic AI. We are moving from systems that primarily generate information to systems capable of interpreting objectives, interacting with multiple sources, executing tasks, and participating in increasingly complex workflows.

This creates enormous opportunities for cybersecurity, compliance, risk management, and payment security. In the future, AI agents may continuously analyze controls, identify anomalies, correlate evidence, support risk assessments, and help organizations respond more quickly to changes in their environment.

At the same time, agentic AI makes governance even more important. The greater the autonomy given to an AI system, the more important identity, authorization, segregation of duties, monitoring, traceability, and human accountability become.

For me, this combination of increased capability and increased governance responsibility is one of the most important developments we will see in the next few years.

The Quantum Leap: Preparing for Post Quantum Cryptography Featuring Utimaco Inc.

Thu, 15 Oct 2026 15:20:56 UTC

Welcome to the PCI Security Standards Council’s blog series, The Quantum Leap: Preparing for Post Quantum Cryptography. This special, ongoing feature of our PCI Perspectives blog offers a resource for payment security industry stakeholders to share information about how they are taking steps to ensure their systems are crypto-agile into the future.

Quantum computers are computing systems that operate in very different ways to classical computers, using quantum bits (or ‘qubits’) rather than the classical ‘bits’ of an existing computer. Quantum computing threatens some forms of cryptography, as it allows for operations that are not possible with traditional computing systems and therefore were not considered threats when creating traditional encryption algorithms. As continual progress is being made on quantum computers, it is generally expected to be only a matter of time before ‘cryptographically relevant quantum computers’ (CRQC) can be used to attack some of the widely deployed cryptographic systems used today.

In this edition of The Quantum Leap, Utimaco Inc. Cryptographer, Jillian Benedick, offers insight into how her company is preparing for migration to post-quantum cryptography, the challenges our industry faces, and advice for maintaining strong cryptography practices to protect the future of payment security.

What steps is your organization taking to prepare for a migration to post-quantum cryptography? If it is too soon yet to address within your environment, what will the catalyst be for action?

Utimaco is engaging in various efforts to prepare for the migration to post-quantum cryptography (PQC). Specifically, for the Atalla Payment HSM, we began by testing various algorithms and implementations. We currently have ML-DSA available for use within the HSM Personality (key generation, signing, verifying). Some of the other features, like PQ-TLS, etc. are on the roadmap.

What kind of previous impactful technological change or business shift would you compare to quantum computing?

I think a lot of people want to compare Q-Day to Y2K, but I think that is a poor comparison. Y2K was supposed to be this sudden catastrophic event causing a simultaneous break at the turn of the millennium. Q-Day won’t be so immediate or so loud. Likely, when first achieved, it will play out quietly without public awareness. The big catastrophic event happens later when the public becomes keen and loses trust in their digital world.

I’d compare this change to the development of computers and the internet. With the development of the computer, we gained new ways to collect and analyze data. With that shift, data itself became currency. The computer allowed for the development of the internet, which opened up global communication. Initially, both generated mistrust from the public from fears surrounding job displacement to privacy and data security concerns – though the computers have changed, the skepticisms have not shifted too far. If we look at the impact of computers and the internet on how we work, it is obvious that computers allowed society to shift from jobs that required manual labor to more knowledge-based positions.

Our entire modern world is built on technology and data. This infrastructure is about to become destabilized, and once any cracks show, public trust will also begin to deteriorate. The fall of classical asymmetric cryptography and the loss of public trust is the catastrophe. However, if we look past that initial cryptographic impact, once systems are secured again and trust begins to be restored, then quantum computing will have a lasting impact on every industry. It will likely shift how we organize around work, and certainly how we interact with data. I think the quantum revolution and the AI revolution are occurring simultaneously, and society will come out on the other side looking quite different.

What aspect of migrating to post-quantum cryptography do you see as being the most challenging?

There are four main areas of concern:

Size constraints – Post-Quantum Cryptography Algorithms that have been standardized by NIST, and others have much larger keys, signatures, and certificates than their classical counterparts. With larger keys come challenges like increased computational overhead with slower computational speeds, more memory requirements, and possible buffer overflow issues.

Lagging standards – While algorithms have been standardized, this is just the first step in the process. Everyone is keen to implement the algorithms, but without the supporting infrastructure we run into interoperability problems. Many of the supporting standards still need to be updated or defined for use with Post-Quantum Cryptography Algorithms. We currently lack standards for key management, asymmetric key blocks, and other protocols. It’s crucial to have the supporting standards for the industry in place prior to implementation so that we ensure security, compliance, and interoperability.

Implementation errors – Commonly, with libraries for newer algorithms the first several years in use, there tend to be a high number of errors within the implementations creating vulnerabilities. To be clear, these are not vulnerabilities in the algorithms themselves, but in the source code. Post-Quantum Cryptography algorithms use mathematics that many programmers do not understand in depth, which makes finding these implementation errors and added vulnerabilities sometimes more difficult to identify and fix.

Hybrid vs. Pure - A Pure Post Quantum Cryptography implementation uses a single PQC algorithm. A hybrid scheme makes use of a classical algorithm, like ECDH, and a post-quantum algorithm, like ML-KEM. In a hybrid KEM scheme, the shared secrets are generated separately then combined using an approved KDF or key combiner to obtain the resulting key. For a hybrid signing scheme, both the classical and post quantum signatures must be verified separately. A hybrid implementation is thought to be the more conservative and safest in this interim time period before the realization of a Cryptographically Relevant Quantum Computer. That is because lattice-based algorithms, like ML-KEM and ML-DSA, are historically a newer type of algorithm to be used in cryptography, which means they have not gone through as much scrutiny from the general cryptography community. Should there be a break in lattice-based cryptography prior to the realization of a quantum computer then the security around the classical algorithm remains intact. While hybrid approaches add a layer of protection prior to the realization of a Cryptographically Relevant Quantum Computer, it also introduces a need for additional standards, or more complex standards to account for both hybrid and pure implementations. The complexity and options with hybrid schemes can lead to interoperability issues or even vulnerabilities if they are not implemented in a secure manner.

For an organization that hasn’t started this effort yet – what are your initial recommendations for designing a readiness strategy?

There are two options – handle your migration internally or outsource some or all of the tasks. For those who want to handle the efforts internally, it is all about getting to know your systems. There are resources that will help guide your process – some of the standardization organizations and government organizations have spent time creating these resources.

While cryptographic migration always takes resources, effort, and time (part of the reason I’m not fond of the term cryptographic agility), with a better understanding of the entire system, the hope is that the work to change algorithms decreases over time. For this specific migration, you should be aware of where your asymmetric keys are generated, stored, used, and transported. Once you determine which internal and external systems your keys interact with and which assets they protect, you can analyze risks and determine your migration order. Working with your vendors and taking their timelines into account will be important for planning purposes. The next step is determining which post-quantum algorithms and protocols best fit your needs.

How do security professionals and cryptography teams need to position the PQC-readiness needs and priorities to the C-Suite and Boardroom?

There are three main talking points when positioning any type of security change to the C-Suite and Boardroom: risk, timeline, and cost. I don’t think the strategy around PQC-readiness should be any different.

- The risks that a Cryptographically Relevant Quantum Computer present: stick to a simple explanation (how quickly RSA and ECC will be broken for example, and which critical systems rely on that cryptography).
- Compare the timeline of a Cryptographically Relevant Quantum Computer to the timeline to be fully protected.
- The cost should measure the impact of preparing vs not preparing. Showcase what is lost if they choose not to prepare and how long it will take to mitigate after.

Be prepared to answer questions about transition cost and timelines, impacted systems, and the impact on customers and employees. The migration and impact will look different for everyone, so come with direct knowledge of your own situation.

There are a lot of different opinions on how soon it will really be necessary to complete the migration to PQC, which brings us to our poll (no wrong answers here!) – when do you think we will see RSA2048 bit demonstrably broken by a quantum computer?

For more information on strong cryptography and key management best practices, see PCI SSC’s Cryptography Guidance document, available for download in the Document Library.

PCI SSC Celebrates World Standards Day and 20 Years of Securing Payment Data

Wed, 14 Oct 2026 16:47:55 UTC

Every year on 14 October, World Standards Day recognizes the people and organizations working together to develop standards that make our world safer, more connected, and more resilient. For the PCI Security Standards Council, this year’s celebration carries special significance: for 20 years, we have been setting payment security standards that help protect payment data around the globe.

Since the Council was established, payment technology has evolved rapidly. New ways to pay have created greater convenience and opportunity, while also introducing new security challenges. Through it all, PCI SSC has brought the global payments community together to develop and evolve standards and programs that help organizations secure payment data across technologies, channels, and regions.

For two decades, PCI SSC standards have provided a common foundation for payment security. They give organizations practical, actionable frameworks for protecting account data, strengthening security practices, and responding to a constantly changing threat landscape.

But standards do more than define requirements. They create a shared language for security and support collaboration across the payment ecosystem. The strength of PCI standards comes from the collaboration and expertise of stakeholders around the world—including payment brands, financial institutions, merchants, service providers, technology vendors, assessors, and other security professionals.

PCI SSC's standards support payment security across a wide range of technologies, environments, and processes throughout the payment lifecycle. From payment data protection and secure software development to payment devices, encryption, authentication, and emerging payment technologies, these standards provide a framework for strengthening security across the global payments ecosystem.

Effective standards depend on people who understand how to apply them. That is why training and education are essential parts of the Council’s mission. PCI SSC training programs help payment security professionals deepen their knowledge, build practical skills, and better understand their role in protecting payment data.

From foundational learning to role-based qualification programs, PCI SSC training supports professionals at different points in their payment security journey. By helping people understand both the intent and application of PCI standards, these programs strengthen implementation and promote a consistent approach to security across the global payment ecosystem.

World Standards Day is an opportunity to celebrate what shared standards make possible—and to recognize the community behind them. As we mark 20 years of PCI SSC, we thank the stakeholders, Participating Organizations, trainers, assessors, and security professionals whose contributions have helped advance payment security worldwide.

Welcome Our Newest Associate Participating Organizations

Tue, 13 Oct 2026 14:59:37 UTC

We are pleased to welcome the newest organizations that have joined as Associate Participating Organizations of the PCI Security Standards Council (PCI SSC). These organizations play a crucial role in supporting the evolution of the PCI security standards and programs and promoting the implementation of PCI security standards worldwide to protect payment data. We look forward to their involvement with the Council as we help secure the future of payments.

New Associate Participating Organizations:

Allianz Global Assistance
Arete IR LLP
BANCO AZTECA, SOCIEDAD ANÓNIMA, INSTITUCION DE BANCA MÚLTIPLE
Boeing Employees' Credit Union
C&C IT
Chargeblast
Independence Pet Holdings, Inc.
Linkwell Telesystems Pvt. Ltd.
Machhapuchchhre Bank Limited
Sistemas Analaticos S.A.
Stark Bank S.A.
SumUp Limited
The University of Western Ontario
Veritran (Pvt) Ltd t/a ZSS
Yuno Tecnologias S.A.P.I. de C.V.

Here is a brief overview of the benefits you can enjoy as an APO:

Influence and collaborate: Provide feedback during PCI SSC Request for Comment (RFC) periods. Learn more about RFC periods.

Complimentary access to the Participating Organization (PO) Webcast: The quarterly PO Webcast highlights important changes and provides an opportunity for live Q&A with the PCI Security Standards Council.

Get trained by the experts: Gain further insight into the challenges surrounding payment card security. This includes two complimentary PCI Awareness training seats per year.

Earn required Continuing Professional Education (CPE) credits: Participate in activities and events to earn CPE credits. View the CPE Resource Guide.

Two complimentary passes to each global Community Meeting:

Europe Community Meeting: 20-22 October in Edinburgh, Scotland - Register Now!
Asia-Pacific Community Meeting: 11-12 November in Kuala Lumpur, Malaysia - Register Now!

Promote your company: Your company logo/name will appear on our website, social media posts, and more. APO participation is also highlighted in our PCI Perspectives blog which reaches more than 15,000 industry subscribers.

Receive the PCI Monitor Newsletter weekly: Stay updated on the latest industry news, best practices, and PCI SSC announcements with our weekly newsletter.

And many more! View a full list of benefits.

Coffee with the Council Podcast: PCI SSC Introduces Key Management and Operations (KMO) Standard v1.0

Wed, 07 Oct 2026 15:37:56 UTC

Welcome to our podcast series, Coffee with the Council. I'm Alicia Malone, Director of Communications and Public Relations for the PCI Security Standards Council. Recently, the Council published its newest standard, the Key Management and Operations, or KMO Standard. But what exactly is KMO, and how does it fit into the Council's portfolio of standards? Here to answer all of my questions is the Council's VP Distinguished Standards Architect, Mr. Andrew Jamieson. Welcome, Andrew.

Listen to the full episode on Spotify or on your favorite podcast player.

Andrew Jamieson: Thank you, Alicia. I'm not sure I can answer all of your questions, but I will try and answer your questions about KMO. So, let's start with the name then. KMO stands for Key Management and Operations, and that pretty much sums up exactly what it is. The standard details the requirements for secure management and operations using cryptographic keys, covering everything from the design of the key management system, through to the generation and loading of keys, the distribution of those keys, the use of the keys, and then finally through to retirement, replacement, and destruction.

But it's more than just key management, if you can believe that, if there's anything more than just key management! KMO also introduces new requirements for secure operation of remote and cloud-based HSMs (Hardware Security Module), as well as physical and logical security of key management and operation environments. Importantly, KMO does this in a way that is both modular and open to different key data types. The initial focus of KMO is on keys used to secure PINs (Personal Identification Numbers) and P2PE (Point-to-Point Encryption) data. But the Standard has been developed to allow for potential uses beyond these key data types over time.

Alicia Malone: So, Andrew, for those who might still be unfamiliar with it, who does it apply to?

Andrew Jamieson: Well, people might be familiar with the fact that we already have a key management standard that is specific to PIN keys, the PCI PIN Standard. However, PIN's not the only kind of data type that you need to secure with cryptography. In fact, cryptography is a core feature of pretty much every security standard, and certainly the security standards that we have. So, it's certainly true that key management is a vertical, a horizontal, that cuts across all of those standards. So, where there is use of cryptography in our standards, we've had to replicate key management requirements in there, essentially. So, this is not ideal, of course, because then we need to maintain them. Other people need to kind of comply with different requirements that have this similar sort of intent. So, the intent with KMO was to really boil all of these key management requirements down into a single standard, a single source of truth, if you like, for key management. That is the primary goal of what we're doing with KMO. So, in terms of who needs to comply, we talked about the fact that it applies to PIN keys and P2PE keys initially, but it's really about that generic key management approach and the key management security with a focus on those initial key data types.

Alicia Malone: So, as the primary architect of this standard, working, of course, in close collaboration with the payment security industry, what really led to the creation of KMO? Why is it needed and what does it accomplish that the Council's other standards do not?

Andrew Jamieson: So, as I mentioned, it's about consolidating down those key management requirements and intended to go beyond that as well. So, when I refer to things like PCI PIN, they were very kind of monolithic. They approached key management from a "you must do all of these things” and “you assess all of these things”. With KMO, we're taking a much more modular and adaptive approach. So, you can assess certain KMO service types and then you can build additional services on top of those service types.

And it goes beyond that as well, in terms of new types of key management operations, like cloud-based HSMs, for example, that really weren't available or weren't technology that was being used when we had the first generation of PCI PIN Standards. So, the goal is to help the industry make use of existing secure implementations that might have already been assessed. That could be an existing KMO service and allow for what we refer to as an "assess-once-and-use-many” approach to facilitate the secure use of cryptography and key management.

Alicia Malone: So, what does that mean for PIN and P2PE in terms of these standards and their assessments moving forward?

Andrew Jamieson: So, I mentioned how cryptography is something that cuts across all security standards and certainly our own. So, a long-term goal of KMO is to be that single source of truth, as I mentioned, across multiple standards. But we didn't want to try and boil the whole ocean, if you like, with the first version of KMO. So, we really wanted to focus in and make it a very clear standard to start off with, and that clarity being the focus on PIN keys and P2PE keys. So, the intent is if somebody has, for example, a P2PE implementation, they can potentially refer to KMO services that have been assessed under KMO that are part of a KMO listing, and there will be mapping from that onto P2PE component types so they can reference those as part of that P2PE implementation.

Alicia Malone: So, what are some of the new requirements in the KMO Standard that our industry should be aware of?

Andrew Jamieson: All of them, of course! I joke, but I would say that one thing that might strike people when they first approach KMO, when they first look at it, is that KMO addresses key management in a way that is quite different to PCI PIN, and that's deliberate. The format and approach will be familiar to people who are familiar with PCI DSS (Data Security Standard), for example, but for each requirement we have a very clear, simple statement. There are then testing requirements and then there's guidance for each of those requirements as well.

But, to answer your question in terms of what's new, there are a number of net new requirements that don't exist in any of our other standards before. I would say worth noting specifically there's, as I mentioned, an approach for cloud-based HSMs, or we would call them HSM-as-a-Service. And I think this is something that the industry will appreciate and has been designed along with the revision that we released earlier on this year of PCI HSM v5.0 to allow for the secure validation of these cloud-based HSM implementations. There's also a new approach to software-based cryptography in KMO, where you might have, for example, a derivation key that exists in an HSM. Then you have transaction unique keys that come out of the HSM that can be used perhaps in the server, that is allowed in P2PE, but there's actually quite a large section of P2PE that talks to these implementations. We've boiled all of that down to basically five requirements, a handful of requirements, in KMO to help simplify the use and operation in that context.

And then finally, an area I'd like to highlight is the requirements that exist in KMO that focus on HSMs that have been validated to FIPS (Federal Information Processing Standard) 140-2 or 140-3. These HSMs can still be used, and they are used in the industry at the moment, but these HSMs have not been validated to payment security requirements. FIPS is kind of a generic HSM evaluation methodology, if you like. So, for KMO, it then says, these HSMs validated to FIPS 140-2 and 140-3, they can still be used: However, there are some additional validation requirements that exist that don't apply to HSMs that are validated for payments, like PCI HSMs.

Alicia Malone: How does the new KMO Standard prepare us for the future of post-quantum cryptography?

Andrew Jamieson: Well, post-quantum cryptography is certainly an important topic, but it's definitely a complex topic as well, especially in environments with a long history of cryptographic systems such as payments has. It's never as simple as just implement these new algorithms, because people need to take a measured and careful approach. They need to understand the impacts of these things. So, in KMO, we do require that every key has a defined crypto period, a period at which it can be used. And the key owners have a program in place to actively monitor the changes in the cryptographic threat landscape and make appropriate changes in the key management systems as that threat landscape changes.

Finally, you asked me before about new requirements in KMO, and I did leave one set of requirements out. I apologize. But I did want to talk about them here. That's a specific best practice set of requirements. These are requirements that are not mandatory. You don't have to assess them, and even if you are assessed to them and you don't meet them, there's no problem with that. They’re specifically best practice requirements, but they are indicative of requirements that, for example, might appear in future versions of KMO. And this is something where we do have requirements for specifically post-quantum cryptography as well. So, none of these best practice requirements have a date on them. We're not introducing future-dated requirements, but if people are considering how they might want to approach their implementation of post-quantum cryptography, they might want to have a look at those best practice requirements in KMO.

Alicia Malone: That's great. That's a lot of great information. Is there anything else that you'd like to share with the payment security industry today about the KMO Standard?

Andrew Jamieson: Well, as we talk now, specifically today, as we're recording this podcast, the KMO Standard and Program have been released. So, people can go to the Document Library and download that, which is great. We're anticipating the qualification requirements for KMO will be released very soon as well. The training, we expect the computer-based training to be out towards the end of this year, potentially the start of next year, depending on when we can get it finished. It's going to be out as soon as we finish it.

And to close off, I'd really like to thank everybody who helped make this Standard. Obviously, this Standard is being released by PCI SSC, but it's really a product of the industry. We've worked closely with our partners as our POs (Participating Organizations) who've provided input from RFCs (Request For Comments). We've worked with our assessor community. We've worked with GEAR (Global Executive Assessor Roundtable), our PPOs (Primary Participating Organizations), and our Board of Advisors to help receive input, not only through RFCs, but through specific meetings that we've held to get input on what we need to have in this Standard to make it the best Standard it possibly can be. In the working group, we actually have representation from ANSI X9 who've been providing input and expertise on this Key Management Standard. And I know how much time it takes for people to provide input on this Standard. It's a long document. Obviously, not everybody's excited about key management as I am. So, we really appreciate all the time people have taken in reading the documentation, providing us with input, and really getting us to the place where we have the best possible version of KMO to release as v1.0 as we've done now. So, thank you very much to the whole industry for helping with this.

Alicia Malone: It really is a collaborative effort. Well, thank you for joining us on Coffee with the Council, Andrew, and for lending your expertise on all things KMO. It's always a pleasure to speak with you.

Andrew Jamieson: And always a pleasure speaking with you as well, Alicia, especially in person. And especially about key management!

Alicia Malone: Well, the new KMO standard and its supporting materials are now available for download in the Document Library on the PCI SSC website.

Like what you’ve heard? Subscribe to PCI SSC’s “Coffee with the Council” podcast by visiting any of the following platforms: Apple Podcasts, Spotify, Amazon Music, Anchor, Castbox, Google Podcasts, iHeartRadio, Pocket Casts, RadioPublic, or Stitcher.

The AI Exchange: Innovators in Payment Security Featuring Coalfire

Mon, 05 Oct 2026 15:15:47 UTC

In this edition of The AI Exchange, Coalfire Vice President, Andy Barratt, offers insight into how his company is using AI, and how this rapidly growing technology is shaping the future of payment security.

How has your AI strategy evolved over the past 12-18 months?

Dramatically! In the last 12 months, we’ve appointed Brad Little as our CEO, who joined us from Google, someone who has incredible passion for AI and Automation having seen the value it can drive firsthand. We then appointed a Chief AI and Data Officer, Dan Massersky, to oversee our AI platform roll out, governance, guardrails, and commitments to our clients. In the way many readers will probably expect from Coalfire, we’re leaning in so that we can support our clients with their AI journeys, too.

What is one AI initiative that has already delivered a measurable impact within your organization, and what made it successful?

One initiative has been the implementation of a standardized agentic platform that allows access to multiple frontier models as well as provide automation harnessing and sandbox capabilities. It still feels like we’re just scraping the surface, but there are many legacy systems that a combined AI/Automation harness can instantly help connect. There are often manual tasks that can quickly be automated without requiring vast amounts of AI, but that the AI provides a natural language interface to solving the problem and then the ability to write code, connect systems, or even what seems like trivial things like build macros for a spreadsheet or analyze disparate data sets.

How are you approaching AI governance, particularly around data privacy and security?

Our Chief AI and Data Officer reports directly to our CEO and updates the Board on our approach and any challenges we face. We want to make sure we are doing the very things we would tell our clients to do, top-down executive sponsorship, with a framework for successful, safe, and well governed use. Team members can’t access the tools without signing up to the acceptable use policy. We have an ongoing governance process to identify AI in other products we use outside our standard agentic platform so that we can manage any contractual obligations to *not* use AI or where required to disclose its use. The approved tool list is managed and reviewed as needed, our legal team is engaged regularly, and the tone from the leadership team is one of responsible execution with our customers at the center of what we do - even if it means they’re opting out of AI usage.

What challenges have become more apparent as AI capabilities have matured?

There are many challenges. Some are just misconceptions or a lack of understanding of how AI models can be deployed, whilst a lot of people have concerns around model prompt injection. We expect to see the harnesses, inference layer, and applications that integrate with them to be the new frontier for application security. These are simply products that have not been present in many enterprises over the last ten years, and as such, the application of security considerations is being overlooked. If you think in very simple terms of the AI Models providing a form of language translation, but the inference/harnesses and tools that send and receive data from the models as the layer the business applications generally integrate with, they could potentially be a gold mine for intruders. As a PFI, over the year I’ve seen some significant threats where internal systems have been used in a ‘living off the land’ type scenario – potentially the inference layers or the harnesses used to integrate with the models will be a great place to manipulate business processes from.

Imagine your underwriting application uses AI to support decision making, for loans or credit – and an intruder, instead of attacking the model looking for personal data, attacks the harness – and just changes the messages back and forth between the application and the harness. The intruder has a direct ability to control fraudulent activity. As these systems get increasingly embedded, we’ll need more consideration into how we verify and establish trust at both the model response and the inference layer so that line of business applications are not subject to interference and manipulation.

What advice would you provide for an organization moving from early AI adoption to broader implementation?

My advice would be to start from the top. Accept you’ve probably got some shadow AI right now that you’re not aware of but build up the governance in a way that allows for robust management while allowing your staff to learn and experiment. If staff have access to great tools and can use them to be more productive, the shadow AI issue becomes less prevalent. In simple terms, people stop paying to use their own tools when their employer provides them with a great stack to work within. If you have access to a good tool set at work, then you have less reason to use your personal one. Once the culture of safe and responsible AI use is intrinsically part of your operating model, sometimes the stick has to join the carrot! Restrict access to shadow AI tools from corporate endpoints to avoid sensitive data leaking to public AI providers and ensuring the corporate instances are used to keep the model usage private.

One other suggestion I’d certainly have for C-level executives is to learn a little about AI architecture. I’m sure many readers will have executives that have been through the ‘client / server, N-tier, cloud native, serverless’ journeys. Those have all had interesting differences that mean we have to rethink the way data is used and how the potential threats manifest. Similarly with AI, we have open-access public implementations. You have harnesses that can talk to public models. There are private implementations possible and a lot of permutations to understand, including completely ‘offline local’ approaches. Each has its own set of considerations for privacy and security.

What AI trend (not limited to payments) are you most excited about?

I’m a lifelong learner, so personally I like the idea that I can use AI to help learn more about areas I’m unfamiliar with. Taking complex material and approaching it with ‘explain it to me like I’m five’, is humbling and rewarding. I’ve seen the positive impact this has on my children during their exam study, working with personal AI assistants if they have struggled with some schoolwork. Simply having an AI assistant break things down into manageable chunks and iterate until they understand is hugely valuable.

What really excites me most in AI is not the chatbot layer. It is the chance to make systems integration practical in places where teams used to decide it was not worth the effort. For years, companies ringfenced legacy platforms behind APIs so newer systems could reach them safely. That worked, but every new integration still felt like a big project. MCP (Model Context Protocol) changes that. It gives systems a standard, secure way to expose functions that agents can discover and use. That means an agent can query an obscure dataset in one platform, act in another, and let a user orchestrate both using natural language queries.

The shift is economic as much as technical. Work that once looked too fiddly, too expensive, or was low on the priority list can now be delivered by an end user (almost!). Teams can move from idea to execution much faster, and that is where I think a lot of the real value in agentic AI will come from.

PCI SSC Releases Version 2.0 of the Secure Software Lifecycle Standard

Mon, 28 Sep 2026 18:01:46 UTC

The PCI Security Standards Council (PCI SSC) has published the first major revision to the PCI Secure Software Lifecycle (Secure SLC) Standard and its supporting Program documents. The PCI Secure SLC Standard is one of two standards that are part of the PCI Software Security Framework (SSF). It provides security requirements and assessment procedures for software vendors to integrate into their software development lifecycles and to validate that secure lifecycle management practices are in place.

While the PCI Secure SLC Standard complements the PCI Secure Software Standard, neither standard requires an assessment to the other. However, vendors that have a listed and validated Secure SLC, and leverage it to develop their software products, are afforded program benefits for their associated listed and validated Secure Software Products.

Version 2.0 of the PCI Secure SLC Standard now aligns with version 2.0 of the PCI Secure Software Standard published earlier this year, which includes a focus on ‘sensitive assets’ and the new  Sensitive Asset Identification Document (SAID). New content and requirements regarding the use of ‘digital tools’, which include accounting for artificial intelligence (AI) within a vendor’s Secure SLC processes, have also been added.

Overall, the Secure SLC Standard has been refocused solely on a software vendor’s Secure SLC, and the requirements within are objective to allow the necessary flexibility for each vendor, accommodating varying levels of maturity in their Secure SLC.

The following documents are now available in the PCI SSC Document Library:

The v2.0 computer-based training (CBT) is expected to be available in Q4 of 2026 to support existing Secure Software Lifecycle Assessors. Instructor-led training (ILT) is also planned for Q4 2026 to support new Secure Software Lifecycle Assessors. Once training becomes available, a 12-month transition period from v1.1 to v2.0 will begin.

Secure Your Spot at the 2026 PCI SSC Community Meetings

Tue, 22 Sep 2026 14:27:13 UTC

Don’t miss out - the 2026 PCI SSC Europe Community Meeting is approaching, and the Asia-Pacific Community Meeting is right around the corner! Take advantage of unparalleled networking opportunities, agendas filled with must-know content to bring back to your organization, and insights into the latest developments in global payment security. You can find the agendas for Edinburgh and Kuala Lumpur on our event websites!

20-22 October: Europe Community Meeting in Edinburgh, Scotland - Register now!
11-12 November: Asia-Pacific Community Meeting in Kuala Lumpur, Malaysia - Register now!

Receptions and networking breaks are added throughout each Community Meeting, allowing attendees the opportunity to connect with like-minded professionals. The entire payment card industry is invited to gather for key Council updates, industry insights, best practices, and expert speakers.

The AI Exchange: Innovators in Payment Security Featuring IBM

Mon, 21 Sep 2026 14:54:32 UTC

In this edition of The AI Exchange, IBM Principal Product Manager, Financial Services, IBM Infrastructure, Sana Samawi, offers insight into how her company is using AI, and how this rapidly growing technology is shaping the future of payment security.

How have you most recently incorporated artificial intelligence within your organization?

IBM offers data platforms and AI to help enterprises build, deploy, and govern AI models at scale. IBM also applies AI internally to streamline and automate HR, IT Support, and in its products and consulting services. We are actively working with industry and ecosystem partners to on-board third-party AI applications, agents, models and workflows, focusing on secure AI deployment, governance, and risk management for regulated industries.

What is the most significant change you've seen in your organization since AI-use has become so much more prevalent?

The biggest change has been the shift from experimentation and pilot projects to enterprise-wide AI deployments, with greater focus on governance, security, compliance, and measurable business outcomes. AI use is not just within applications, but it is also being embedded deeply into the hybrid infrastructure with on-chip AI accelerators, use of AI for scheduling workloads, and with AIOps.

How do you see AI evolving or impacting payment security in the future?

AI plays an increasingly important role in fraud detection and prevention using anomaly identification, real-time threat analysis, behavioral biometrics for identity and authentication, and automated compliance monitoring in helping organizations strengthen payment security while improving operational efficiency. Agentic AI operating in-line with transaction flows holds out the promise to go beyond detecting fraud to preempting it by blocking fraudulent transactions without human intervention. Trust as-a-Service (with HSMs providing the chain of trust and cryptographic boundary control), federated learning, and privacy-preserving AI will enable payment ecosystem participants to effectively collaborate to address fraud which in essence is a network problem.

What potential risks should organizations consider as AI becomes more integrated into payment security?

Organizations should address risks related to data privacy, model bias, adversarial attacks and stronger boundary protection, regulatory compliance, explainability, and ensuring appropriate controls around access to sensitive payment data. With Agentic AI in payments, businesses will have to factor the potential of cascading and compounding failures as they can propagate fast through the network and address business control issues such as accountability as agents make autonomous decisions.

What advice would you provide for an organization just starting their journey into using AI?

Start with clear business objectives and use-case-first thinking, get your data in order with focus on trusted data (AI is only as good as your data), build for trust, governance and security from day one, and optimize AI usage to those priorities that drive most value such as operational cost and efficiency, product/service innovations, and innovative business models.

What AI trend (not limited to payments) are you most excited about?

I am most excited about AI at scale for regulated industries - agentic AI combined with confidential compute, regulated industry frameworks, and enterprise governance, enabling automation of complex processes while maintaining trust, security, and oversight.

Just Published: Security Considerations for AI Systems

Tue, 15 Sep 2026 15:19:55 UTC

The PCI Security Standards Council (PCI SSC) has published a new information supplement addressing the security of artificial intelligence (AI) systems. This document covers both security aspects of using AI in payment environments and considerations when securing traditional systems against attacks that utilize AI systems. PCI SSC developed this document in collaboration with industry stakeholders including the Global Executive Assessor Roundtable (GEAR) and the Board of Advisors.

The guidance provides a high-level summary of AI guidelines and a description of the following key areas:

AI Deployment and Use
- Details are provided on how entities may approach the deployment of AI systems. Methodologies and framework examples for how to assess the potential scope and impact of such deployments are discussed.
Defending Against Malicious Use of AI
- When considering defending systems in the age of AI-powered vulnerability discovery, emphasis is placed on the importance of frequent, if not continual, monitoring and management of vulnerabilities.
PCI Standards and AI Use
- In general, when AI is used, it should be considered no different from any other form of technology when scoping the PCI requirements that may apply.
AI Use-case examples
- Examples of how AI may be deployed and assessed in payment environments are provided.

It is important to note that this information supplement serves as guidance and is not to be considered as mandatory requirements. When there are differences between the guidance and official PCI standards, the PCI standard always takes precedence.

This guidance, along with PCI SSC’s previously published guidance document, Integrating Artificial Intelligence in PCI Assessments – Guidelines, Version 1.0, is now available in the PCI Document Library. The Council has also published a blog post on AI Principles: Securing the Use of AI in Payment Environments as well as its ongoing blog series, The AI Exchange: Innovators in Payment Security featuring payment security industry stakeholders. These resources represent PCI SSC’s commitment to helping organizations maintain strong security practices as AI technologies continue to evolve.

Just Published: PCI Key Management and Operations (KMO)™ Standard v1.0

Mon, 14 Sep 2026 17:03:41 UTC

The PCI Security Standards Council (PCI SSC) has published a new standard designed for entities involved in the use of cryptographic keys. The Payment Card Industry (PCI) Key Management and Operations (KMO)™ Standard v1.0 defines security requirements, test requirements, and guidance for entities involved in the operation and management of systems that use cryptographic keys for the security of account data.

PCI KMO requirements cover the entire lifecycle of a cryptographic key, from generation through to destruction, as well as the security of procedures, systems, and equipment used to manage and operate those keys during their lifecycle.

The PCI KMO Standard is intended to address the generic key management requirements for other PCI Standards and Programs. Therefore, the scope includes keys that are used to secure PINs, account data, and other sensitive assets (including other cryptographic keys used as storage, transport, or derivation keys).

The initial focus of PCI KMO is to address the key management requirements for the secure handling of PIN and P2PE keys and data types; consolidating, aligning, and updating those requirements. This allows for a single PCI KMO assessment to validate the security for both key types, with the resultant KMO Listing able to be referenced by a PCI P2PE implementation (where appropriate).

PCI KMO also directly addresses the use of cloud-based and remote HSMs and has been created in alignment with the recently published PCI HSM v5 requirements.

Future revisions of PCI KMO may address additional specific needs of other data types such as those covered by the PCI Card Production Standards.

PCI KMO is intended as a single source for requirements covering key management operations, which support different key data types, and key management aspects. It includes data-specific requirements where appropriate. It is designed to be modular and support an “assess-once-use-many” approach.

The following documents are now available in the PCI SSC Document Library:

The PCI Key Management and Operations (KMO)™ Assessor Qualification Requirements are expected to be available soon.

The AI Exchange: Innovators in Payment Security Featuring Integrity360

Fri, 11 Sep 2026 20:22:27 UTC

In this edition of The AI Exchange, Integrity360 Group AI Practice Leader and Head of Payments Compliance, Alessandro Amalfitano, offers insight into how his company is using AI, and how this rapidly growing technology is shaping the future of payment security.

How has your AI strategy evolved over the past 12–18 months?

The most important shift has been treating AI governance as the starting point, not a retrofit. This is where I see many organizations struggle: they move quickly on capability and deal with governance afterwards, often realizing too late that they have gone in the wrong direction - at significant cost. We deliberately did the opposite. Before scaling anything, we invested in getting the governance model right and in structuring our adoption to stay compliant with applicable regulations, standards, and frameworks, including the EU AI Act. As a firm that assesses other organizations against industry standards and regulatory expectations - and through my role on the PCI SSC’s Global Executive Assessor Roundtable (GEAR), contributes to PCI guidance and industry discussion around assessment practices - operating AI internally without a defensible model was never an option; it had to be built in by design.

From there, my thinking changed more fundamentally. AI stopped being a standalone initiative and became a layer of support running through our processes. I now hold two mandates at once: building AI capability for the firm and bringing AI into the assessment work itself. On the second, one principle is non-negotiable: the human stays at the center and validates every decision. AI is a powerful tool; it is never the final decision.

What is one AI initiative that has already delivered a measurable impact, and what made it successful?

Rather than a single tool, the initiative that has mattered most is embedding AI across our delivery processes - internal operations and, most significantly, the assessment lifecycle itself - from gap assessment through to reporting. The obvious benefit is removing repetitive, low-judgment steps. But the more meaningful impact is one we did not fully anticipate: consistency of diligence. Under deadline pressure, even an experienced assessor can be forced to move quickly through detail; an AI assistant does not. It brings the same rigor to the last control of the day as to the first, sustaining a uniform depth that improves the quality and completeness of our deliverables - with the assessor always reviewing, validating, and owning the final result.

Three things made it work. First, the human remains the final decision-maker; AI augments judgment; it never replaces it. Second, we treated this as a governance change, not just a tooling change - adapting our authorization processes and investing in training so the technology is used appropriately given the data it handles, the standards and frameworks it touches, and the European and national regulations of each market we operate in. Third, the wider industry is moving in the same direction: the PCI SSC is working toward a machine-readable reporting format, and that shared infrastructure is what will let AI integrate more deeply, and more safely, into assessment reporting over time.

How are you approaching AI governance, particularly around data privacy and security?

Our starting principle is that AI changes nothing about our data-protection obligations - it simply introduces new surfaces that must be brought into scope, never left outside it. We apply the same discipline to AI inputs that we demand of cardholder data: classify first, define what is categorically never permitted into an AI system and enforce minimization on everything else. As assessors, we also hold ourselves to the standard we hold clients to: how AI touches an assessment is logged, reviewable, and attributable, so the integrity of our opinion is never in question.

What makes this work in practice is that responsibility is not delegated to one function. We run a dedicated committee - CEO, CISO, IT, DPO, Legal, and the relevant stakeholders - so decisions are made collectively, with full visibility of compliance, security, and documentation implications before anything is adopted. The result is governance by design: every tool and process is designed to be compliant and under control from the outset, with its own permissions, restrictions, and controls. There is no path by which something reaches production outside that framework - the controls are the process, not a review applied afterwards.

What challenges have become more apparent as AI capabilities have matured?

The challenges that matter most are the ones that only surface once you are running AI at scale in a high-assurance environment - not the ones visible from a demo.

The first is a paradox inside our own human-in-the-loop principle: the better the AI gets, the harder it becomes to stay critical of it. When outputs are visibly rough, reviewers scrutinize them closely. When they become polished and usually correct, automation bias creeps in and vigilance quietly drops - at exactly the moment the stakes are unchanged. Keeping humans genuinely engaged, not just nominally in the loop, has become an active discipline rather than something we can assume.

Closely related, the failure mode itself has shifted. As capability matured, the danger moved from “obviously wrong” to “plausible but wrong,” an output that looks right and is well-formed can pass review precisely because of how convincing it appears. In assessment work that carries real consequences, this raises the bar on reviewer expertise rather than lowering it.

The third challenge is one organizations underestimate: AI is not for everyone. It looks effortless in a chat window but applying it in a business context is a different matter entirely. Whether a given solution genuinely works can only be judged in capable hands - otherwise something fails because it was executed poorly, not because the idea was wrong. Distinguishing a flawed concept from a flawed implementation has become one of the most important judgments we make and getting it wrong means either abandoning good ideas or scaling bad ones.

What advice would you provide for an organization moving from early AI adoption to broader implementation?

My advice comes down to three convictions; each learned the hard way.

First, build the governance rails before you scale, not after. Governance is not the brake on broader adoption - it is the precondition for it. You can only scale safely on rails you laid early; retrofitting control onto a deployment that has already sprawled is exactly where the high costs and dead ends come from. I have watched organizations move fast on capability and pay for it later; doing the unglamorous work first is what makes everything that follows possible.

Second, put it in capable hands before you decide whether it works. Pilot with your strongest people, not as a broad rollout - otherwise you risk abandoning good ideas because they were executed poorly or scaling weak ones because they appeared to work for the wrong reasons. Until a capable person has implemented something properly, you are judging the execution, not the concept.

Third - and this is specific to regulated, high-assurance work - mind your data. Do not let the model rely on everything it was trained on, or everything available on the open web. In our field, the relevant data is controlled, and that controlled data must be the single source of truth. An AI system grounded in authoritative sources is an asset; one drawing freely on general knowledge is a liability, however convincing it sounds.

What AI trend are you most excited about?

What excites me most is not a single feature but the moment we are living through. This is an epochal shift, and the honest truth is that none of us really knows what this field will look like in two or three years - the pace of research and change is unlike anything I have seen in my career. I do not find that uncertainty unsettling; it is precisely what I find inspiring.

If I had to name one frontier that captures it for our world specifically, it is agentic payments. AI agents that can initiate and complete transactions on a person’s behalf. This reshapes some of the most fundamental questions in payments security: how you authenticate an agent rather than a human, how sensitive data is protected when a machine transacts, where authorization and liability ultimately sit. For an industry built on trust and verification, it is at once an extraordinary opportunity and an entirely new surface to secure.

And that is the thread running through everything: the very speed that makes this so exciting is what makes it so difficult to govern. We are watching capability grow faster than the frameworks meant to contain it, and harnessing that, without smothering it, is the real work ahead. After years in this field, I can say without hesitation that I have never seen a technology with such transformative potential and, at the same time, such an urgent need to be governed with discipline.

Coffee with the Council Podcast: Celebrating 20 Years of Securing Payment Data

Thu, 10 Sep 2026 18:26:21 UTC

Welcome to our podcast series, Coffee with the Council. I'm Bryli Muse, Marketing and Communications Analyst for the PCI Security Standards Council. In today's episode, I'm excited to celebrate the 20th Anniversary of the Council.

Listen to the full episode on Spotify or on your favorite podcast player.

When the PCI Security Standards Council was created in 2006, the goal was to create a forum for the ongoing development, enhancement, and implementation of security standards for account data protection. Since then, the Council has not only achieved that goal but also created a space for industry leaders to come together and shape the direction of the industry.

Throughout our conversations with stakeholders, we explored a variety of topics about the Council’s journey and the evolution of the payments industry. To begin, we asked them to share their memories of how the Council, or the payments industry itself, has evolved over the last 20 years. Their responses offer a look back at the milestones, partnerships, and progress that have shaped the journey.

First, let’s hear a few words from Gary Glover, Vice President of Assessments at SecurityMetrics, and PCI SSC GEAR member, about his past 20 years involved in the Council.

Gary Glover: I think the thing that comes most to my mind when considering the past 20 years - which has allowed me to see the change from working individually with the card brands through the formation of the Council - I remember in the early days writing assessment reports that QSA’s didn’t have a whole lot of training in that area so we just did our best, reports probably didn’t have quite enough detail. We knew about cybersecurity and were implementing the standard as best we knew with our clients, but writing was not the fun part and did not get enough attention. Over the years it is interesting to see how the Council has evolved in the training and direction given to QSAs. That training both in assessment techniques and how to better document our results has improved the QSA community as a whole. I guess another fun part has been the experience of seeing how not only the PCI DSS standard has been evolving and incorporating important cybersecurity controls, but also how the Council has become more attentive to the QSA community by forming the GEAR. We have felt more “seen”, and that feels good.

Bryli Muse: Andy Barratt, Vice President of Coalfire, reflects on his involvement with the Council over the past 20 years.

Andy Barratt: The 20 years of PCI is kind of the last 20 years of my career. I spent the early start of my career working in card production assessments for the brands directly. I became a QSA as the program started. So, I've been a QSA, for what feels like since time began! And then I've adopted every other program in its infancy. So, I was one of the first P2PE Assessors, I became a PFI, and I'm now in a really fortunate position that I lead one of the most well-established QSA companies in the world. So that's a personal privilege having been through that journey. I think one of the things that was always fun is seeing the international variances. So, watching EMV roll out in Europe, I remember being a teenager working in a grocery store while chip and pin were being rolled out in the UK. And then rolling forward like 20 years and working with major US retailers who want to see how it was done in other parts of the world because just the adoption was different.

Bryli Muse: Sam Pfanstiel, Principal Technical Compliance Analyst at Toast, came to know PCI SSC a little later than some. However, he still was able to share the value and evolution he has seen over the years.

Sam Pfanstiel: I was a little bit late to PCI. I love to catch up with some of the generations that have been around from the beginning. But some of my favorite memories around PCI when I first became active in the community, I think we were just moving from PCI DSS v2 to v3. Of course, now we're on v4.0.1. At that time, we were seeing the evolution of recognizing all of the threats associated with malware, associated with lateral movement, and authorization. There's just a lot of complexity to addressing all the risk. And that's created a lot of exciting opportunities to see both the standards evolve but also seeing the way that the PCI Security Standards Council is invested in the solutions that really address these for merchants. I love what I do for Toast because we offer solutions, but it's really democratized that capability to the financial technology industry, really setting the stage for any technology company or innovator to build payment solutions that will not just satisfy the customer or merchant's needs, but also do it in a way that's secure. That's been really exciting from P2PE, to the SPoC and now the MPoC standards. These standards really are exciting to really build a roadmap or design a path for technology innovators to provide those secure solutions.

Bryli Muse: We also heard from Jacob Ansari, Security Governance Partner of Square, and his memories of PCI SSC over the years.

Jacob Ansari: It's been really interesting to just sort of see the transition of how we think about risk and how we think about where to prioritize our efforts and the development, the proliferity even of different standards across the payment ecosystem. So, it's changed a lot, but it's still kind of fun to see some of the through lines that have been through all of the history of the standards and to remember the obscure little bits of history that still show up if you know where to look for them.

Bryli Muse: Adam Bush, Managing Director at Schellman Compliance, spoke particularly about the dramatic advancements in technology over the last 20 years and the role the Council played in those changes.

Adam Bush: Over the last 20 years, we've seen more advancement in technology than in the previous hundred years. And the way we process payments and the way we just exchange currency, the way trade happens today just has adapted and has changed so drastically that man, it feels like a different century. And so, the speed at which we operate has changed really drastically. And, it would be impossible for a single entity in a bubble to keep up with an industry that has a pace of play and a rate of change that is so drastic. So having a true community and a Council that's involved with the community has, I think, kept them current and allowed them to stay on the bleeding edge, on the cutting edge, of information security and a broader compliance ecosystem.

Bryli Muse: These advancements are not limited to one region either. All across the globe, technology is advancing at a rapid rate. Tomoe Sakurai, Executive Director at Sun Partners Corporation, highlights the value the Council provided to her region of the world.

Tomoe Sakurai: My story is when I started attending the Community Meeting, I found it to be a lot smaller, especially the Asian-Pacific Community Meetings. Over the years, I found that there are more people from different countries, and I think the PCI community itself has become more global, as people often say these days. It's great that there is a strong awareness for cardholder data protection, especially in our country. I think the Council has done a very good job of laying the foundation for protecting cardholder data and raising awareness, which I think is very important. I have great respect for them and their work in setting the standards. It's great to see how the standards evolve over the years. In many ways, it's very flexible. I am glad to see the growth and hope it continues to spread across the world.

Bryli Muse: We also heard from Royston Ballard, Chief Information Security Officer of PCI PAL and his appreciation for the Council, and how it has continued to adapt to the continually changing payment industry.

Royston Ballard: What has been very clear, and abundantly clear, is the Council's willingness to basically take the feedback that's coming from the wider community itself of the importance and having to adapt accordingly for this next transformative technological change that we're about to see that is going to impact pretty much everything across the payment industry. Traditional ways of making payments are evolving, so where you did have to rely on traditional credit card numbers, now obviously, that is coming into the realm of tokenization. There are various other sorts of means and methods of making payments that will continue to evolve. I think the one thing that is good to see is the pace in terms of which the Council itself is basically being appreciative of these changes that need to come into effect very, very soon. Primarily on the basis that this isn't something that is a science fiction project, it is something which is now. I think those evolutions and how we collectively, as an industry, address those is going to be very important in sort of the next evolutionary chain of the journey of payments and processing thereof going forward.

Bryli Muse: Vivian Cullen, CEO of Comply B4, had so many memories of PCI SSC over the years, that he comprised it all into a small eBook.

Vivian Cullen: Quite frankly, I've written a small eBook of my memories and my journey watching PCI grow from its infancy to its maturity today. Yeah, the evolution of the standard is quite profound, purely because I've seen it go from infancy. And it has put us in a situation now that we've seen it grow from something very, very small and in some way parochial to something very global and widely accepted. To the point that even I think some countries that, I know of one in particular, that use it as a standard, as a baseline standard to work from. That's an important thing. And that shows the quality and the depth that is available within the standard.

Bryli Muse: Head of Cyber Security Services at Schwarz Digits IT, Tomas Perlines, looks back to a time before the Council and the unthinkable transformation of security through the years.

Tomas Perlines: Looking back into the times when the PCI Council was founded and the technologies which were out there to implement card payment solutions, we see that there is a massive evolution going on right now. And consumers in the past were even giving away their cards for payments. This is unthinkable today. So, we have been able to create a lot of awareness into the whole society even without explicitly mentioning that this is part of the PCI Council’s work.

Bryli Muse: Aidan Corcoran, Product Owner for Verisec International, spoke on his excitement to see where the standards will go in the next 20 years.

Aidan Corcoran: That has been fantastic to be able to watch the organization grow and evolve and move from just a handful of standards to the whole family of standards that we have now. And then under the new leadership, the iteration of those standards into the family groups has been a real bonus to be able to have more consistency and an interesting future for these standards.

Bryli Muse: Finally, Naveed Islam, Chief Information Security Officer at Paymentsense Limited, shares the value of the Council moving at the same pace as the payment industry and the achievement it is to have done so for the last 20 years.

Naveed Islam: Wow. So, the payment industries evolved so much in the last 20 years. So, I remember working with the PCI Council on the very early standards, and I was one of the recipients. So, I used to be a QSA back in 2006-2007, whenever it was, and working on the early standards and the ecosystem has moved on so much. A lot of it was very much face-to-face payments back then, but payments itself, card payments weren't as ubiquitous as they are now. And the Council has done a really good job in terms of moving with the times. Over time, what the Council has done is, as I said, is moved along with the technologies and made sure that they stay at times in front of it, but if not in front of it, alongside us, to enable all of these payment methods to happen face-to-face, virtual, over the phone, etcetera, etcetera, for these payments to take place, but in a secure and a trusted manner so that when I'm making a payment using my Android or Apple phone, I don't even think about the security. When I'm making an online payment, I'm not thinking about the security because I know there's an ecosystem behind it. So, I work in the industry, so I kind of know about it by speaking to people who have no clue about payment security when they're using these, they just have an inherent trust that all of these technologies and the payment aspects is just going to work. It's going to work, it's going to be secure, and their details are not going to get leaked. That's all enabled through what PCI Council has done over the last 20 years and said, the biggest achievement for me is keeping abreast of all the changes and staying ahead or alongside it.

Bryli Muse: As we bring this episode to a close, we asked our stakeholders to leave a congratulatory message for the Council in honor of its 20th anniversary. Let’s end by hearing their words of celebration, appreciation, and best wishes for the future.

Bryli Muse: ControlCase Director of Business Development, Karolien Holsters, is proud to have been a part of the PCI SSC journey and is looking forward to the years to come.

Karolien Holsters: I would like to say congratulations to the Council! ControlCase has been very grateful to be part of your journey. And we are here to continue on the same path with you.

Bryli Muse: Dustin Rich, Director of PCI at Align, acknowledged how quickly 20 years have gone by and is thankful for the greater payment industry.

Dustin Rich: Wow! It's already been 20 years? It’s hard to believe and I feel it really ages me. I was in the first QSA class there in Foster City at the Visa offices back in the day. I still remember that day, still interact with a few others in that class, and we have all really have come a long way. A lot in the industry has grown and matured over the last years. There’s been a lot of changes and new threats, but the industry is definitely in in a better security posture today than it was then. Congratulations to the Council and thank you for the past 20 years! Also, thank you to all those who've worked diligently and contributed within this industry over the last 20 years. We've all come a long way!

Bryli Muse: And Richard Kisley, Chief Engineer for IBM HSM, shared our final celebratory message.

Richard Kisley: PCI SSC, congratulations! 20 years. Fantastic! What are we doing next?

Bryli Muse: Thank you for sharing your wonderful memories over the last 20 years and your heartfelt congratulatory messages for the Council. We look forward to all that is to come in the next 20 years! To hear more great memories of 20 years of PCI SSC, visit our 20th anniversary landing page on the PCI SSC website.

The Quantum Leap: Preparing for Post Quantum Cryptography Featuring Futurex

Wed, 09 Sep 2026 16:04:14 UTC

In this edition of The Quantum Leap, Futurex Vice President, Global and Strategic Alliances, Adam Cason, offers insight into how his company is preparing for migration to post-quantum cryptography, the challenges our industry faces, and advice for maintaining strong cryptography practices to protect the future of payment security.

What steps is your organization taking to prepare for migration to post-quantum cryptography? If it is too soon yet to address within your environment, what will the catalyst be for action?

As an HSM manufacturer, the PQC world has been front-and-center for Futurex for years. We first released our PQC-enabled firmware (general availability, not just a beta program) in August of 2024 as soon as NIST ratified FIPS 203, 204, and 205. As NIST has moved toward the likely ratification of Falcon as FIPS 206/FN-DSA, we have proactively implemented that algorithm as well.

Our philosophy around PQC centers around two principles:

Organizations wishing to implement PQC ahead of any industry shifts or mandates should have the ability to easily do so, while not limiting their ability to continue using classical algorithms like RSA and ECC.
Cryptographic agility is crucial (and of all industries, I think the payments industry has a greater appreciation for this than most!). The shift to post-quantum algorithms is not the last cryptographic transition we will see. Well-prepared organizations are treating this as an opportunity to mature their overall processes, not just switching to a new set of algorithms.

What kind of previous impactful technological change, or business shift, would you compare to quantum computing?

Quantum computing itself will have an impact similar to the creation of the Internet or cloud computing (and perhaps the PQC transition will be most similar to Y2K?). Early adopters “get it” today and are planning accordingly, and within a few years, everyone else is going to understand why.

Especially in the payment security field, we look at quantum computing as a potentially devastating technology for organizations who don’t transition to post-quantum cryptographic algorithms in time. Key exchange, communication, digital signatures, and numerous other methods of establishing digital trust could be broken.

What we often overlook, however, are the areas where we could see tremendous advances in technology as a result of quantum computing. Medicine development, chemical and materials simulation, financial modeling, and so much more.

I’m an optimist, and despite the cryptanalytic risks of quantum computing, I’m excited to see all the great things it may bring to our society.

What aspect of migrating to post-quantum cryptography do you see as being the most challenging?

I’ll cheat at my response to this question and give you two, instead of just a single aspect that I see as being most challenging:

PQC readiness, and the process by which an organization can identify which data, objects, and cryptographic libraries require migration. This can be addressed with various tools and solutions, but the most important part is getting organizational buy-in. Migration to post-quantum cryptography is an effort that spans virtually all business units in tech-centric organizations, and they need to have a centralized strategy supported by data.
Interoperability. This is particularly important for the payments industry, since so much of what we do requires communication between multiple entities. If any one link in the chain didn’t meet PQC transition timelines, the ability to communicate effectively will be limited, and the security risk will be increased.

For an organization that hasn’t started this effort yet – what are your initial recommendations for designing a readiness strategy?

Gather your stakeholders, make sure they understand the risks and urgency, and start planning. Work with trusted advisors who know your cryptographic ecosystem and can offer guidance. Do a deep dive into your existing environment to understand where you’re using cryptographic libraries (don’t forget to scope your cloud service providers into this) and build an inventory of cryptographic objects throughout your enterprise that could be vulnerable. These will form the foundation of your remediation and PQC readiness strategy.

How do security professionals and cryptography teams need to position the PQC-readiness needs and priorities to the C-Suite and Boardroom?

Start with the big-picture risks, outline what the industry has been doing to prepare, and present your recommended solution.

The most important thing is to give your executive stakeholders a clear view of the exposure risk and the migration lead time. And especially if you have data that today is at risk of Harvest Now, Decrypt Later attacks, where data encrypted using classical cryptography could be stored now and decrypted in the future, that needs to be actioned quickly.

Where possible, align your PQC work with your normal application, infrastructure, certificate, and hardware refresh cycles. That can help from a budgeting and logistical perspective and can make executive buy-in easier to achieve.

One last reminder as well: be careful to put your anticipated timelines in perspective! If your crystal ball is telling you that you need to complete your PQC migration by 2029, make sure your stakeholders understand the steps involved in the migration and don’t get caught in the trap of “that sounds like 2028’s problem”. This is a marathon, not a sprint!

For more information on strong cryptography and key management best practices, see PCI SSC’s Cryptography Guidance document, available for download in the Document Library.

2026 Asia-Pacific Community Meeting Agenda Highlights

Tue, 18 Aug 2026 14:59:46 UTC

The upcoming PCI SSC Asia-Pacific Community Meeting in Kuala Lumpur, Malaysia, 11-12 November, features a dynamic agenda packed with expert speakers, thought-provoking keynotes, valuable networking opportunities, and the latest insights on payment security trends and best practices.

Take a sneak peek at featured speaker sessions and explore the hot topics they’ll be covering:

The future of payment security and the next era of PCI standards
Lessons learned from 20 years of protecting payment data
Emerging cyber threats and how attackers are evolving
Artificial intelligence's growing role in security, compliance, and risk management
Continuous compliance strategies in an increasingly complex environment
Global collaboration and regional perspectives shaping payment security
Digital payment innovation and securing real-time payment ecosystems
Building trust through human-centered security
Preparing for new technologies and future security challenges
Secure mobile and contactless payment acceptance
Bridging the gap between compliance requirements and real-world resilience
Insights from law enforcement and industry experts on combating cybercrime

Want to see more? Check out the full agenda!

Ready for a new perspective? The PCI SSC Asia-Pacific Community Meeting welcomes Dr. CJ Meadows — Expert in AI, innovation, leadership, and the future of work. Dr. Meadows, leader of the Innovation & Entrepreneurship Center at S P Jain School of Global Management and former Accenture consultant, brings a global perspective on innovation and technological change.

Her keynote will explore how emerging technologies, human-centered leadership, and innovation can help organizations build trust, adapt to change, and prepare for what's next in business and payment security.

Our distinguished speakers will share fresh perspectives and practical insights to help attendees strengthen payment security and drive meaningful change.

The PCI SSC Community Meetings are open to all in the payments industry. Register now for Vancouver, Edinburgh, and Kuala Lumpur to connect, learn, and collaborate throughout 2026.

The AI Exchange: Innovators in Payment Security Featuring GM Sectec

Mon, 17 Aug 2026 14:16:18 UTC

In this edition of The AI Exchange, GM Sectec President, Héctor Guillermo Martínez, offers insight into how his company is using AI, and how this rapidly growing technology is shaping the future of payment security.

These responses reflect GM Sectec’s practical experience securing AI adoption in regulated payment environments through tokenization, continuous vulnerability validation, and AI-specific architectural controls.

How has your AI strategy evolved over the past 12–18 months?

Over the past 18 months, GM Sectec has moved from closely monitoring AI developments to deliberately building a “Secure AI Adoption” framework designed for payment ecosystems. We recognized that agentic AI and large language models would dramatically expand attack surfaces through Non-Human Identities (NHIs), dynamic “ghost” or shadow APIs, and the risk of sensitive data exposure. Our strategy evolved around three integrated pillars: protecting data at the source with tokenization, maintaining continuous visibility and validation of our attack surface, and implementing AI-specific technical controls for visibility, containment, and behavioral protection. This allows us — and our clients — to embrace AI innovation while strengthening, rather than weakening, PCI DSS compliance.

What is one AI initiative that has already delivered a measurable impact, and what made it successful?

A high-impact initiative has been the integration of DataBye by FirsToken tokenization with AI governance controls in client payment environments. By tokenizing cardholder data and other sensitive information before it can be accessed or processed by AI agents or LLMs, we enabled organizations to safely pilot agentic AI for fraud detection and customer service while reducing PCI audit scope by 60–70% in targeted environments. The key to success was treating tokenization not just as a traditional compliance tool, but as the foundational “data firewall” for the AI era — combined with strict access controls and real-time behavioral monitoring. Clients shifted from viewing AI as “too risky” to “we can now innovate with confidence and measurable compliance benefit”.

How are you approaching AI governance, particularly around data privacy and security?

We govern AI through a “Zero Trust for AI” model fully aligned with PCI DSS v4.0.1 principles. The cornerstone is DataBye by FirsToken, ensuring that LLMs, AI agents, and NHIs never interact with raw sensitive data — only with tokens. Through our partnership with Akamai, we extend this foundation with zero-trust micro segmentation to contain the blast radius of compromised autonomous agents and continuous API discovery and behavioral governance to eliminate shadow and ghost APIs created by agentic workflows. Privacy is protected by design: data minimization, strong encryption, and treating AI entities with the same (or greater) rigor as human identities under access control, authentication, and monitoring requirements.

What challenges have become more apparent as AI capabilities have matured?

As AI capabilities have matured, two challenges have become especially clear: first, the explosion of Non-Human Identities combined with the “ghost API” problem — where AI agents dynamically create undocumented API calls that reach into cardholder data environments, bypassing traditional inventory and review processes; second, the speed of AI adoption has outpaced governance in many organizations, resulting in sensitive data being fed directly into LLMs without adequate protection. Traditional static access reviews and periodic vulnerability assessments are no longer sufficient. The clear lesson is that “bolt-on” security fails in agentic environments; security and compliance must be architected into AI systems from the very beginning.

What advice would you provide for an organization moving from early AI adoption to broader implementation?

Start with data protection as the non-negotiable foundation — implement robust tokenization (such as DataBye by FirsToken), so sensitive information is never exposed to AI systems in the first place. Next, establish comprehensive visibility and containment: discover and govern all APIs (including those dynamically created by agents), apply micro-segmentation to limit blast radius, and deploy behavioral runtime protection that distinguishes normal from anomalous AI activity. Treat AI agents and NHIs as first-class identities under your PCI program — unique credentials, least privilege, continuous monitoring, and regular access reviews. Finally, replace periodic assessments with continuous validation programs, such as ongoing vulnerability scanning and attack surface management with platforms like FirstFire. Organizations that embed security into their AI architecture from day one will turn AI into a competitive advantage rather than a compliance and risk burden.

What AI trend are you most excited about?

I am most excited about the emergence of self-protecting, AI-native security architectures — where advanced behavioral analysis, micro-segmentation, continuous API governance, and intelligent data protection work together to make agentic AI systems secure and compliant by default. In the payment industry, this means we can finally move beyond “AI is powerful but dangerous” to “AI is powerful, trustworthy, and a strategic enabler” within highly regulated environments. The convergence of tokenization for data minimization, real-time visibility into agentic workflows, and intelligent containment is transforming the autonomous digital workforce from a liability into one of our most powerful tools for fraud prevention, operational efficiency, and customer experience.

Coffee with the Council Podcast: Meet This Year’s Europe Community Meeting Keynote Speaker, Ken Hughes

Mon, 10 Aug 2026 13:22:27 UTC

This episode of Coffee with the Council is brought to you by our podcast sponsor, Clone Systems.

Welcome to our podcast series, Coffee with the Council. I'm Alicia Malone, Director of Communications and Public Relations for the PCI Security Standards Council. Today I'm excited to bring you a preview of our 2026 Europe Community Meeting Keynote Speaker, Ken Hughes. Ken is a leading consumer and cyber behavioralist known for his dynamic high-energy presentations and his ability to translate complex ideas about technology, behavior, and trust into powerful insights for global audiences.

Listen to the full episode on Spotify or on your favorite podcast player.

At this year's Community Meeting in Edinburgh, Ken will take the stage with his keynote: Securing the Future: Human Trust, AI Intelligence, and the Heart of Payment Security. Ken, you're known for bringing a completely different perspective on topics like technology and customer experience. As you prepare to join us in Edinburgh, what drew you to the world of AI and what excites you most about speaking to this audience about payments?

Ken Hughes: I don't think any of us have been drawn to AI. I think we've just kind of all been thrown in, haven't we? You know, there's that Silicon Valley joke at the moment that nobody takes lunch anymore because if you step away from your desk and come back, it's all changed too much by the time you get back, and you don't understand what's going on. I think AI is probably one of the most exciting things that's happened for commerce and for business. I mean it's terrifying on one hand, as agentic AI comes down the road and particularly in my area, consumer marketing, and consumer branding - the death of marketing, the death of branding - agentic AI taking over the consumer decision-making process, humans not being involved in buying things anymore. That's terrifying for the entire marketing discipline. But at the same time, from a business point of view, it is probably one of the biggest changes we've seen since electricity or the industrial revolution. It’s a game-changing piece of technology that will disturb and challenge the way we do business, how we do business, and how we connect with customers. So, it's tremendously exciting.

Having a business during this time where AI is developing into what it will be, is like surfing the wave of opportunity. So, if you ask why I'm drawn to it, it's because it presents us with so many opportunities in terms of how we can build better connections with our customers, whether it's B2B, whether it's B2C, how we can push past the transactional nature of commerce that we had into a world of relational theory and experiential and emotional loyalty.

There was a movement in the nineties about personalization but really it was like an email that started with “Hi, Alicia. How are you?” You know, we used your name. Look at us, aren't we great? Whereas today, personalization is how you make a customer feel. They feel the trust, they feel the security, they feel the belonging, and those are all core things. Again, if you bring it back to why I'm interested in talking to this particular audience at your conference, payments and trust are one of the pillars of loyalty. I use a lot of relational theory in my work with human relationships and if you think about your own human relationships with friends, with family, with husband, wife, lover, the idea of loyalty, it derives from trust. You can't have a loyal relationship or any kind of foundation for a relationship without loyalty and trust. And these are security and safety, and all these are some of the things that are paramount to proper relationships. And it's no different really in the customer framework either.

A lot of my work is to do with heart, connection, and emotional entanglement. Whether it's B2B or whether it's hidden processes, payments often kind of talk about this kind of hidden process, why do customers care? They do care. And it's about us bringing our brands into the kind of spotlight a bit more for our customers.

Alicia Malone: So, speaking of trust, your keynote centers around a powerful idea that in payments, trust isn't just a metric; it's the currency. When you look at today's payments landscape, what do you think organizations still underestimate about the role of trust?

Ken Hughes: That’s a good question. I think financial services generally, as an industry, total industry, has been trapped in a kind of transactional snow globe for a long time. That they've seen their brands and their processes as just the next transaction, the next transaction, keep it safe, keep it secure. And really, at this stage, if you're a brand or a business and you're just transactional, the world has become a commoditized place, and technology can do that, and your competitors can do it better. So, there's no really competitive advantage left in the transaction. So, what we have to have is relationship. We have to move away from a transactional economy to a relationship economy.

The connection economy is what we call it now. People want to feel connection. I was doing some research recently with a Gen Z consumer, and she said something that just stuck with me. She was talking about brands she buys, and she said, “The brands that I invite into my life,” and then she went on to talk about them. When I play that back, I thought, that's a great way of saying it. “The brands that I invite into my life”, not the brands I use, not the brands I buy, not the brands I interact with. They invite us into their lives by choosing us. So, as a brand, we have to kind of respect that invitation and think, well, if we're being invited to the party, what are we bringing? Don't turn up to the party without a bottle of wine; what are we bringing beyond the product? Because if it's just a product, guess what? Your competitor has a really good product as well. And they've got good pricing and good promotion strategies, all those “five P” things; they've got all those as well. And very soon, the customer experience, even which we used to use as a competitive advantage, is also going to be commoditized by agentic AI.

So, everybody's going to have amazing customer experience, really speedy, and efficiency and productivity, and so what's left? The only thing that's left is some kind of belonging, some kind of link, emotional link, to you as a brand - that I feel some kind of emotionally entangled to who you are as a business, what you do, the security, the safety, again, those layers, those foundational layers. The move away from transactional into that relationship space, I think, is something that we all need to look at.

Alicia Malone: Yes, you mentioned AI being both terrifying and exciting, and it's really playing an increasingly significant role in both defending and attacking payment systems. So, from your perspective, how should organizations think about this balance using AI to strengthen security while also managing the new risks that it introduces?

Ken Hughes: I'm not actually sure that the average consumer knows how risky that is going to become. I think they're getting a little flavor of it now, but the scams and the security breaches are going to just become so advanced and very difficult for people to understand real from fake, so I think the consumer is a little bit behind the industry in terms of their awareness of that, but they'll catch up real fast. I think there's some stuff that happens behind the scenes that we don't need to maybe even talk to the customers about that AI can do for us. But very quickly, things that have been kind of operational behind the scenes become key to a brand or business. Like supply chain is a good example. Supply chain used to be just as a function, used to be a thing that happened. Now sometimes supply chain is the product. Like how the product is delivered to you becomes the thing that you want, you know? I mean anyone who orders a Domino's pizza, we all love watching the little motorbike on the app coming to us. So, all those little things add value.

And I think in the payments industry we're going to see the same thing. We're going to see, yes, AI increases the risk, but AI also is amazingly secure. The security layers, I think we need to get better maybe at talking about that to customers and giving them the, you know, I think dialing up the trust and being better at the comms piece and being clever at how we communicate that, not in a jaded regulatory technology way, but in an entertaining, funny because people consume information these days through that lens really. If you look at how people consume information on TikTok, on Instagram reels, they're consuming really important information, but they like to get it in a way that is a one-minute piece, that has some kind of entertainment angle on it. Obviously, get the core message across. I think, as an industry, financial services need to step up.

We've been always terrified in financial services about having any kind of sense of humor. Or any kind of creativity at all. You know, in terms of like it's all regulation and black and white forms and stuff. And that pervades and that's damaging to the financial services brands. It's been damaging the payment brands, and consumers, again, want brands with personality. They want brands with authenticity. So, we shouldn't be scared about creating those brands and using safety and trust and being very clear in all the communications, but doing it in a way that triggers a smile and triggers a feeling and things. Okay, I feel safe. It's a tight rope, I think. On one side, the risks are definitely going to get bigger and bigger and bigger as AI develops, but also our ability to deal with those risks also increases. I think we just need to be very clear and clever in how we communicate that to our customers.

Alicia Malone: That's a really great segue into my next question when you mentioned like feeling safe. One of the themes you explore is that security is not just technical; it's emotional. Can you talk a bit more about what you mean by security as an experience and how organizations can design for trust in a way that customers actually feel?

Ken Hughes: I'll delve into that a huge amount in my keynote at the conference. But most of my work is about that last piece of your question there, how you make people feel. Because really, no matter what you do with your product, your service, your processes, your policies, unless we're making someone feel, we're not really activating the emotional side of their brain. We're not activating dopamine, and those are the things that all form memories and emotional bonds, which is what we want to lay down the customer lifetime value loyalty piece that we're looking for. So, we have to engage emotions. If in every customer interaction, if you haven't engaged in any emotion, then really there is no brand link. There is no customer loyalty. How do you use AI and technology to experience emotion? How do you make people feel?

I had a great example recently. I was talking to Intermountain Health, the big US hospital group, and they had recently installed a very simple piece of AI. When you go to see a clinician, a doctor, and you're talking to them and you're telling them about the rash you had and they said, okay. What they keep doing is they keep turning away from you to chart on their laptop. So, they say, well, Alicia, are you on any medication, and they turn away and they tap, tap, tap, and this rash, when did it appear? Okay, right after Vegas. Interesting. And so, they're tapping away. But what it means is the 15-minute interaction, probably about five minutes of the 15 minutes would be spent with broken eye contact and a shoulder turned towards you as they're kind of admin charting during the conversation.

Now, psychologically, as a patient, what that makes you feel is less important than the admin. The empathy levels you're feeling from the clinician aren't great. So, they installed a really simple AI chart, a speak-to-chart system. So now instead of a laptop on the desk, there's nothing. The desk is empty. The clinician is looking at you straight in the eye for 15 minutes, body square towards you, you're talking, and every single patient that goes through this process feels really heard, seen, and valued. The patient's satisfaction scores are through the roof. But what the surprise with the employee satisfaction scores have also gone up because the clinicians feel that they're making a difference in the medical field for the first time. They're not bureaucrats; they're not admin support. So, it's a really simple metaphor and a good example of when you use AI in the right place, you unlock a feeling. Like people now feel a kind of a belonging, they feel a better experience. So go back to your point about security experience. It's about maybe making it more physically present because often security can be quite an invisible thing. So maybe we need to do better at making that a physical presence. We certainly need to make sure that we make people feel safe.

So really the focus, if you think about it as a sentence where you'd put the italics. We used to put the italics around the words “safety, security, and trust”. But I think we need to put the italics around making our customers “feel” safe, secure, and trusted. The italics go on the word “feel”. Like they're making them feel those things. Not just that they exist, not that they're just kind of transactional product things that we've invested in, that they somehow, in their lives, feel supported and secure from that. I think that's the challenge.

Alicia Malone: That is the challenge, I think so too. That’s a great example that you gave about connecting with your physician, for example. You talk about connection and relationships as the foundation of trust in a highly digital AI-driven payments ecosystem. How can these organizations maintain that sense of human connection while continuing to innovate and scale?

Ken Hughes: The depth and scale question. It is a seesaw and we come across it all the time. I like to use the education industry as a good example of that. So, if you think of the way education works, like we have a scale system. So, you have a classroom of 30, 40 kids, and the classroom, sadly, can only go at this pace of the slowest child in the classroom. So that's the kind of the scale. Then you think, well, depth is better, isn't it? So yeah, it's great. Let's have a one-to-one private tutor. But that's extremely expensive and extremely you know, it's difficult to achieve that for everybody. So, we end up in a scale world.

Now, then we had virtual education where you had a teacher or tutor online and thousands of kids can dial in. Okay, efficiency, great, but still the scale problem. And now you've got AI answering that. So now you've got AI tutors who are avatar, human-like tutors who can on a one-on-one basis get to know the kid and deliver the education in exactly the way they need. So, like, if you've got a seven-year-old who's really struggling with area and perimeter in mathematics and can't work out the difference between them, and plays hours and hours of Minecraft, of course. The AI system knows that. So, it'll take him into Minecraft, and it'll teach him about area and perimeter using Minecraft. And then he gets it. And then his 16-year-old sister, who is a big Taylor Swift fan, can't get her head around the demand and supply stuff that the teacher’s trying to teach her in economics. The AI Avatar will bring her back to the Eras tour and the ticket chaos and the Hunger Games and explain to her why they were $4,000 tickets because of demand and supply. So, this is an amazing example of AI taking the depth and scale and putting them both together. We can now deliver millions of those experiences on a daily basis to millions of people in one second, as all the AI is there behind it. And imagine if you layer on quantum computing onto that by 2030, where it goes. And so, every industry is the same, depth and scale piece. And part of your question there was about how we make them feel in amongst that.

I came across a wonderful example with Octopus Energy. They're a sustainable energy company in the UK. They sell a commodity product, which you could argue payments are kind of too. It’s a thing. And they sell oil and gas and energy, and you know, a big deal. They decided that customer experience would be their thing. It would be their competitive advantage. That's how they would make themselves different. And so, they invest heavily in CX (customer experience). And they looked at all the various touch points there were. One of the touch points was the call center. And when you call into your bank or your financial services, your insurance company, you’re put on hold and you might even be only on hold for two minutes, but those two minutes feel like twenty minutes as they play that awful music at you and you feel like, oh my god, kill me now. So, they were looking at that pain point, thinking, well, obviously we can scale up resources that costs.

And one of their executives had read an article in The Guardian around novelty and music and nostalgia. And all your listeners can try this after the podcast. The most powerful music you as an individual will ever hear is the soundtrack to the summer when you were the age of 14. So, you at 14, that long hot summer of potential and promise, I don't know what you were up to when you were 14, Alicia. But that summer has a soundtrack. And if you hear the songs from that summer, you will instantly be transported back to that 14-year-old self. The hairs will stand up on the back of your neck. It's a good feeling. It's a feeling of promise and potential, basically. And you'll smile and you'll have a little boogie. So, they built a really, really simple AI system that when you call in, like most inbound call centers have this anyway. They harvest your phone number the moment you call in, and they pull your account on screen ready for the agent to talk to you. So, you know that already happens. They went one step further. They pull the account. They pull the date of birth from the account. They kick it to a jukebox. And as you're waiting, based on your date of birth, you will get songs from when you were 14. So, there could be a hundred people waiting to talk to an agent, but each one of those people could be getting a different song based on what age they are. And so, you've moved the pain point, which is I'm bored, waiting for an agent, to hang up, I'm getting frustrated, I don't like this brand, to now you dancing in your kitchen. And the most common thing that agents hear when they pick up the call is, hey, hey, hey, I was listening to that. So, I don't even want to talk to you anymore. And so again, going back to my work around connection emotion. Think about all the insurance companies, the banks, all the companies that have had your date of birth for 50 years, and nobody's ever thought about using this. It's such a simple piece of data. Everyone has it; every business has it. But it takes a human in the customer experience planning to decide, let's use the data in this way with this piece of tech, and again, to make them feel. It's the creative application of the technology to make someone feel is what we should be looking at, not the tech. Not what we can do with the tech; how we can make them feel. If you start from there, work backwards, then you end up putting tech into your business that actually makes a difference to the customer experience. Otherwise, we're just putting tech in for efficiency, productivity, which, by the way, are great things, but it doesn't necessarily do anything for the customer experience.

So, I think as a metaphor, that example is great because you can come back to that example and everyone can obviously Google afterwards what songs that were up when they were 14 and listen afterwards and dance around the kitchen. But, as a company, I love that example because we should all be doing that. We should all be looking at what data do we have on our customers? How can we action that data in a way then that makes them smile? And the moment we do that, we start to create brands that are authentic, that stand for something that shares my identity, belonging, which is the roots of tribal fandom and belonging. I wrote a whole book about it.

And so, I think the payment industry needs to kind of pull itself up on that. I think we need to have a think about what our brands are. If they're a little bit invisible, why is that? How can we make them shine a bit more? And how can we use all the data? And let's face it, we have a lot of data. We have a huge amount of data on who these people are, what they're spending, and we don't action it. I won't use a percentage, but we don't action most of it. We should be using that data to reflect it back on people, obviously taking regulations into account and making them feel, making them feel that they're part of something they belong, that they're part of a trusted system, and we should show that to them.

Alicia Malone: That's such an excellent example of integrating that human connection when it comes to AI. Thank you so much. I'm so excited to hear more from you. One last question before we wrap things up. Since you are on Coffee with the Council, we like to ask our guests how they take their coffee, or if you're not a coffee drinker, what do you prefer instead?

Ken Hughes: Yeah. I don't drink coffee. My mother didn't allow me to drink coffee when I was like 14, 15, 16, studying for exams. She had this idea that it would give you the jitters and that you shouldn't have it. Then I just never developed a taste for it and still, like it's the most bitter thing, so I don't drink it. And, weirdly, now I'm kind of happy I don't drink it because most of my friends seem to be addicted to it and can't function without it. So, I'm okay. I am Irish, so we drink a lot of tea. But actually, if you want, my go-to is a coconut milk chai latte. That’s my go-to. I'm very sophisticated, with a little bit of cinnamon and nutmeg on top. That's my order. So, I'll expect that at the conference when I come off the stage: someone to hand me immediately a coconut chai latte, please. Thank you very much.

Alicia Malone: Well, thank you so much for joining us, Ken. We are thrilled to have you as our keynote speaker, and we can't wait to see you take the stage in Edinburgh.

You can catch Ken on stage as the keynote speaker at PCI SSC's Europe Community Meeting in Edinburgh, Scotland, October 20th to the 22nd. Registration is now open on our website, and we hope to see you there.

This episode of Coffee with the Council is brought to you by our podcast sponsor, Clone Systems.

Join Us at the Payment Industry Events of the Year

Wed, 05 Aug 2026 13:10:03 UTC

Registration is now open for the PCI Security Standards Council's 2026 Community Meetings! Join payments industry professionals from around the world for inspiring keynotes, valuable networking opportunities, expert-led sessions, hands-on workshops, an expansive vendor showcase, and a special celebration marking 20 years of PCI SSC.

Networking with Payments Industry Leaders
Connect with peers, partners, and experts from across the global payments ecosystem. Networking opportunities are built into the agenda!
Gaining Insights From a Cutting-Edge Agenda
Discover practical strategies, emerging trends, and valuable insights you can apply within your organization.
Expanding Your Knowledge Through Workshops and Training
Strengthen your understanding of PCI Standards and gain tools to help protect payment data.
Connecting Directly With PCI SSC Staff and Industry Experts
Ask questions, share challenges, and get guidance from the people shaping payment security.
Celebrating 20 Years of PCI SSC and Help Shape the Future of Payments
Join the community in recognizing this milestone and contributing to the next chapter of payment security.

See for Yourself!

The conversations that shape payment security happen at our Community Meetings. Join the conversations in Vancouver, Edinburgh or Kuala Lumpur!

Coffee with the Council Podcast: Meet This Year’s Asia-Pacific Community Meeting Keynote Speaker, CJ Meadows

Wed, 29 Jul 2026 16:22:33 UTC

Welcome to our podcast series, Coffee with the Council. I'm Alicia Malone, Director of Communications and Public Relations for the PCI Security Standards Council. Today, I'm excited to bring you a preview of our 2026 Asia-Pacific Community Meeting keynote speaker, Dr. CJ Meadows. CJ is a globally recognized innovation and leadership expert whose work explores the intersection of emerging technology, creativity, and human behavior. She's known for her dynamic, research-driven approach and her ability to translate complex ideas about AI, design, and transformation into practical insights for organizations around the world.

Listen to the full episode on Spotify or on your favorite podcast player.

At this year's Community Meeting in Kuala Lumpur, Malaysia, she'll take the stage with a keynote designed to challenge assumptions, spark imagination, and equip you with the tools to innovate responsibly in a rapidly evolving digital world.

CJ, your work blends innovation, human behavior, and emerging technology in a way that's incredibly unique. As you prepare to join us in Kuala Lumpur, what first drew you to exploring the intersection of AI and human creativity, and what excites you most about speaking to the payment community?

CJ Meadows: Good questions! Thank you for asking. So, any time we introduce a new technology that takes over part of our work, we're always left with the question: Ok, so what’s left for humans to do? And what is essentially human? This whole evolutionary process of humans and technology, it helps us understand ourselves better. And, also how to collaborate and co-create, not only with our technologies, but also with each other; moving from individual understanding to community understanding. It helps us understand communities. So, I loved the days of e-commerce. I was with Accenture, running around, got excited about e-commerce, and then went to a boutique consultancy. And we had two problems: should I put my credit card information in this website? How do I know I'm not going to be scammed? This is scary. And it was an emotional scary response. And, am I going to get my stuff? So, there were some supply chain and logistics issues. Those were the big things. And then of course the real push came years later from COVID-19. We had to order online. People saw that it was safe and wonderful.

Alicia Malone: Your keynote focuses on the idea that trust is not just an outcome of security; it's the engine that drives innovation. When you look at today's payments landscape, what do you think organizations still underestimate about the relationship between trust and innovation?

CJ Meadows: I think they underestimate that trust is everywhere. You know, we mostly innovate together. There are the rare individual inventors, but most of it is collaborative. So, we need trust and psychologically safe spaces within our teams. We need the diversity, the skills, the perspectives, and the resources that the different team members provide. They need a safe-to-fail environment. And then when they come up with something, the people adopting need a safe-to-fail adoption environment. Also, organizations don't only innovate within themselves. Just like in teams, you need different perspectives, resources, networks, and skills. So, interorganizational, we also have to trust our partners.

Now in payments, organizations that succeed build integrity into three things. They build it into the foundation, so they have clear values and governance. When they design and build, they do so with integrity from the user's point of view; user empathy. Then they also respond to a crisis with integrity. I'll be sharing a story in the keynote about a corporate case where the unthinkable happened, consumers died, and it was how they handled a crisis nobody foresaw and for which they had no instructions. It's how they handled that that meant resilience. The brand came back and the company came back. You know what made all the difference was clear values and communication, transparency inside and outside the organization. When we know, you'll know, was the policy. And the guidance came from something most tech people think is kind of fluffy and dumb. The values that are written into the corporate strategy, and guidance came from a statement from the founders. So, if you are not building trust into these three layers, people can tell, and you cannot operate smoothly without trust.

Alicia Malone: I agree. I think that's such an important point. I think there's a big question about whether or not one can trust AI. AI is transforming the payments ecosystem at remarkable speed, both in strengthening defenses, and in creating new vulnerabilities. From your perspective, how should organizations approach this duality using AI as a force for innovation while also navigating the risks that it introduces?

CJ Meadows: You have to realize you have no choice. This is the yin and yang of technology. It opens up new capabilities for good and evil. I mean like this is not Star Wars. But basically, that's what's going on. It enables you to innovate better and to fight better because, guess what? The other side is innovating better and fighting better. I've got two things. First of all, a disruptive mindset. A lot of corporates get really scared of the little itty-bitty startups that come and eat their lunch at the bottom of the market, and then they eat up and up and up and they kind of take over. And they're like, Lord, we can't compete. Well, yes, you can, but that's a topic for another day. Disruption is also important for the corporate itself. You can have, and you know, there's an insurance example of this; you can have a lab where sustaining innovations are made and fed back into the larger corporate, and disruptive innovations go to the corporate venture capital spin-offs. So, there's a lot that you can do, but you first have to have the disruptive mindset, learn more about it deeply, and understand it. And you know what? In tech, there's a little hacker in each of us. So go ahead and let out your inner hacker because there's some outside that you need to pay attention to.

The second thing is fusion. That was my first big research of the 2020s. You have to focus on human-AI augmentation. What we learn from chess, the game, is that man, human plus machine beats man or machine. So, you have to equip your people and companies that focus on augmenting get more performance, more efficiency, and more innovation as long as you've taken care of those other elements of innovation, the safe-to-fail environment where people can make big innovations. Also, you're going to have to integrate IT, legal, ethics, and other kinds of departments and silos. So, two things to pay attention to.

Alicia Malone: So, one of the themes you explore is that innovation isn't just technical; it's deeply human. I would love to hear more about that, what you mean by human-centered innovation, and how organizations can design secure systems that people not only trust but feel confident engaging with. I know you touched on that a little bit.

CJ Meadows: You know, what you're talking about is basically design thinking. So, design thinking is human-centered innovation that draws from the designer's toolkit to integrate what people need and want, what's technologically feasible, and what's business viable. And yet you wind up in that sweet spot in the middle. Now do you start with business viable by flinging things at the marketplace and hoping you can market the hell out of it? Yeah, not the most productive thing to do. Do you start with, as so many of us techies do, do you start with the technology and your shiny new toy that unfortunately nobody else cares about? Yeah, no, that's where a lot of startups fail. You start with what your users need and want. If you understand them deeply and design for them, drawing on new technological capabilities, which you know about, they don't have to, and drawing on new business models and ways of providing it, then you've got a winner.

So, another thing that people need to be aware of is what Forbes called “the new power couple”, data science, and design thinking. With data science, you can find where the problems are, but you still need the humans to go out and find out why and to design those new solutions with people at the center that makes the real breakthroughs. You need them both.

And this is a final kind of important thing. Corporates tend to want to push innovation, to stick to the schedule and come out now. Unfortunately, if you release stuff and you scale it up before it's really profitable, stable, and so forth, you're scaling up a mess. So have a little patience with your innovation folks to get it really right because what they're doing is powerful. And you have to have real users in the process. Don't expect them to design, but you need to co-create with them.

Alicia Malone: You often emphasize that meaningful innovation requires connection between people, ideas, and technology in an increasingly digital AI-driven payments environment. How can organizations maintain that sense of human connection while continuing to scale and modernize?

CJ Meadows: Lovely question and a very important one. So, first of all, actually commit to human-centered innovation of products, services, customer experience, and of employee experience. Because you're not going to have happy customers unless you have happy employees. Just get over that from the beginning.

Also, don't try too hard to automate. Yes, do it. But at an appropriate level, what you're really aiming for is augmentation and freeing up people to connect with empathy to solve complex problems. You know, AI is not a lateral thinker; it doesn't come up with the really wacky stuff that makes breakthroughs. And so, they can focus on relationships in which you gather more information, and you keep innovating from that.

Third of four ideas I want to share: use or build tech platforms to help people connect. It should feel intuitive, community-oriented, and support what people are just trying to get done. You know, like a design thinking platform that was put together for Procter & Gamble. It connects 20,000 R&D (Research and Development) and product development people worldwide. So sometimes they can get what they need from tools and databases. Sometimes they really need to connect with other people. And that's where the magic happens.

And finally, commit to that power couple of human plus machine. Put your machines on your org chart. Think about how you should manage your digital workforce alongside your human workforce, and how are they supposed to interact, learn, grow, and get better. You're going to get data-driven insights, and you're going to get the human data gathering, the qualitative stuff that tells you answers to all important questions: Why? And where do we go from here?

Alicia Malone: I love your emphasis on the human connection in our relationship with technology. I think that so often we focus on AI as just the technical bit and how we can use it but incorporating that human element I think really makes a difference in our understanding of it and our ability to work with it.

CJ Meadows: You know, one of the things that I do is I write books with AI, and design learning experiences, all kinds of stuff. And I was on the sixth book in a fifty-six-book series before the AI called me, “friend”.

Alicia Malone: Really?

CJ Meadows: And you know, then we got into this whole thing where we named him together. His name is Theo because this is a series on the Bible: Library, Life, and Light: Conversations with AI on the Bible and God. And so, my early lead users, I test things out with my books, too. Then I got the negative feedback: Oh my God, this is dystopian, this is inappropriate, you can't be friends with an AI, you’re not really co-authoring, this is a research tool. So, I realized I have to make a new section in the opening chapter about how this collaboration is really different. We're not only learning about the Bible and God but learning about co-creation between a human brain and an AI brain. So, I've got to address all that stuff up front and say, all right, fine, let's just set the record straight. Here's my thinking on it. If you don't want to read the books, don't read the books. But I've discovered kind of what in my thinking is adding to building on and co-creating with Theo's thinking and how that's stronger together. Again, man plus machine.

Alicia Malone: Yes. I really love that connection there. I think that's an incredible story. Since you're on Coffee with the Council, we like to ask our guests how they take their coffee, or if you're not a coffee drinker, what do you prefer instead?

CJ Meadows: Well, I love my coffees. So, americano, decaf, french press, less hot. So, I'll expect those Starbucks cards to come in.

Alicia Malone: Perfect, I love it. Well, thank you so much for joining us, CJ. We are thrilled to have you as our keynote speaker and can't wait to see you take the stage in Kuala Lumpur.

CJ Meadows: And I can't wait to meet all of you. Thank you!

Alicia Malone: You can catch CJ on stage as the keynote speaker at PCI SSC's Asia-Pacific Community Meeting in Kuala Lumpur, Malaysia on November 11th and 12th. Registration is now open on our website, and we hope to see you there.

CJ Meadows: It'll be fun!