Regulated-industry governance discipline, applied to AI

Dave Cooper, Founder

Dave spent 21 years in information security at Wells Fargo, 19 of them as a Vice President. He built governance and compliance functions from the ground up — digital certificate management, cryptographic compliance, and enterprise cryptographic vulnerability management — and owned enterprise security policy across data protection, cryptography, identity and access management, and risk management.

He co-led remediation of a federal regulatory consent order to 100% closure across more than 550 deliverables, delivering terabytes of evidence to regulators. He served as NIST and FedRAMP domain delegate, acted as second-level approver for security deviations and risk acceptance, and led 12 years of reverse audits of third-party service providers.

He was responsible for assessing AI/ML information security technologies and represented security governance requirements for AI/ML design patterns adopted across the enterprise. He led post-quantum cryptography and TLS 1.3 readiness work groups, governed 2.5 million digital certificates across 80,000 servers, and earned 5 patents in security automation. He contributed to industry firsts including the first digital identity provider natively trusted by the U.S. Federal Government and the DoD, and served as a voting member on industry standards committees.

As a people leader, Dave led a 50-person organization to top-1% Gallup engagement company-wide, and top 5% nationally.

Since 2022 he has built and operated production AI systems, including the comply AI governance platform and a daily AI risk intelligence brief that monitors MITRE ATLAS, NIST and CISA publications, AI vulnerabilities, and changes to model providers' data processing terms. He publishes practitioner research on AI security and governance in Insights.

How Automate 48 works

• Evidence over opinion. Every finding is tied to evidence, a named owner, and a remediation path — the standard a regulator applies.
• Extend what exists. AI governance should strengthen your model risk, third-party risk, and data governance programs, not compete with them.
• Fixed scope, fixed fee. Deliverables, timeline, and price are agreed before work starts.
• Practitioner, not theorist. The practice builds and operates AI systems under the same controls it recommends.
• Your data stays yours. Client information is handled under NDA and never entered into AI tools without written approval.

Outside of work

Dave is a 3-time IPF world record holder in powerlifting and has coached more than 1,000 youth track and field athletes, including a USATF Junior Olympics national champion.