Steven R. Combs is Co-Founder and Principal of Cocha Technology Inc., a Houston-based AI governance and data security firm he co-founded in 2021. Cocha helps law firms and other regulated organizations in the US, Canada and the EU get ready for Microsoft Copilot and Claude without exposing client data. The firm’s work centers on oversharing cleanup, identity, data loss prevention and the policies that let a firm adopt AI with confidence. Cocha implements AI TRiSM controls using Gartner’s framework, and it also provides managed IT for some clients. Steve built Cocha’s free AI Readiness Snapshot, a bounded first step that shows a firm what an AI assistant could reach in its files today. He brings 30 years of experience in security programs, cloud transformations and AI governance, and he has served as Fractional or Interim CIO and CISO for more than 25 organizations across legal, financial services, oil and gas, and insurance. He has directed enterprise Microsoft Copilot deployments across 1,700 users and led incident command on seven major breach containment and remediation engagements. He has founded multiple service firms and previously worked at BDO. He holds a master’s in chemistry from Rice University and a BS in chemistry and biology from Occidental College.
Company: Cocha Technology Inc.
We are thrilled to have you join us today, welcome to ValiantCEO Magazine’s exclusive interview! Let’s start off with a little introduction. Tell our readers a bit about yourself and your company.
Steven Combs: Thanks for having me. I’m Steven Combs, co-founder and principal of Cocha Technology. We started the company in 2021. We’re a five-person AI governance and data security firm based in Houston, and our clients are in the US, Canada and the EU.
Most of them are law firms that are turning on Microsoft Copilot or Claude and want to know what those tools can see before they flip the switch. That’s where we live. We look at who can open what in Microsoft 365, clean up oversharing, tighten identity and data loss controls, and write the policies that let a firm say yes to AI and mean it. We implement AI TRiSM controls using Gartner’s framework, so the governance ends up as real settings in the tenant and not only a document in a shared drive.
We still run managed IT for some clients. But the AI security work is the reason most firms call us now.
I’ve spent 30 years in technology and security. Along the way I’ve served as a Fractional or Interim CIO and CISO for more than 25 organizations across legal, financial services, oil and gas, and insurance. What I’ve always focused on is translating technical complexity into something a board can act on. Cocha is built around that.
What was the moment you realized that complexity was holding your company back, and how did that shift your approach to product, operations, or strategy?
Steven Combs: It goes back to before Cocha. While I was at BDO, I worked on a 1,700-person Copilot rollout at a client. They couldn’t make decisions on data protection. That alone slowed the rollout by six months.
That stuck with me. And after we started Cocha, I kept hearing a version of it. A firm wants to turn on AI. The managing partner asks a fair question: is this safe? The standard answer in our field is a long, open-ended security assessment that nobody can scope or budget. So the rollout stalls.
That changed how we package everything. We stopped opening with the big engagement. We open with the one question the partner cares about: what could an AI assistant reach in our files today? If we can answer that quickly and in plain English, everything after it has a reason to exist. If we can’t, nobody buys the rest anyway.
For a five-person firm, that also keeps us honest. We don’t have the headcount to run sprawling projects that never finish, so we build work that ends.
Can you share one specific example of something you simplified (a product feature, process, pricing model, or customer experience) that delivered outsized results?
Steven Combs: The first step of an AI rollout. We shrank it to something with edges.
We call it the AI Readiness Snapshot. It’s one 60-minute working session, a read-only permissions scan the client runs themselves, and written findings within five business days, ranked by risk. It’s free.
A few choices made it work. The scan is read-only and the client runs it, so their IT team never has to hand us admin keys. The findings are ranked, so a partner can read the top of the list and know what to fix first. And because the whole thing is bounded, nobody has to fight for a budget line before they’ve seen a single result.
One large Canadian law firm used those findings to launch Claude with 20 pilot attorneys. Once the pilot results are in, they plan to expand to more than 100 attorneys in January.
How do you systematically identify and eliminate complexity across the organization without oversimplifying in ways that hurt quality or value?
Steven Combs: Solve the data problems before you even try to roll out AI.
That’s the rule, and it does most of the cutting for us. The data decisions come first. Everything else waits until the firm has decided what the tool should be allowed to see. If that isn’t settled, the rest is just activity.
The guardrail against oversimplifying is the framework underneath. We implement AI TRiSM controls using Gartner’s framework, so when we make the client-facing side simpler, the controls behind it don’t get thinner. The checklist stays complete. The client just doesn’t have to read all of it to know what matters.
We also tie every finding to something concrete. “Improve data governance” won’t help anyone. “This folder of client files is shared with everyone in the firm, and Copilot can read it” will. A partner can act on that in an afternoon.
What’s the biggest resistance you’ve faced when pushing for radical simplicity, and how did you overcome it?
Steven Combs: Indecision about data protection.
Simplifying a rollout forces a decision early. Once you strip it down, the first step is a data question: what should AI be allowed to see? A lot of organizations would rather keep studying that than answer it. I understand why. It feels safer.
But I’ve seen what it costs. On that 1,700-person Copilot rollout I mentioned, the data protection decisions didn’t get made, and the rollout slipped six months.
The way through, for us, is to make the decision smaller. The Snapshot puts a firm’s own permissions data in front of them, ranked by risk. So the first decision is about a short list of specific exposures, and not a policy debate in the abstract. Smaller decisions get made.
There’s also resistance on our side. It’s tempting for any services firm to lead with the biggest engagement it can sell. We decided the first step should be the one that helps the client decide, even if it’s smaller for us.
For other CEOs who struggle with feature bloat, process overload, or confusing customer journeys, what’s the most important principle or first step you would recommend they take?
Steven Combs: Find the one question your customer is losing sleep over, and build the smallest thing that answers it.
For our clients, that question is “what could AI see if we turned it on today?” Not “what’s our maturity score.” Once you know the real question, a lot of the extra steps start to look like padding.
If you’re a CEO about to roll out Copilot or Claude yourself, start there too. Before you buy more licenses, find out what the tool can reach. Look at what’s shared with the whole company, what’s shared by anonymous link, and which old team sites nobody owns anymore. That one exercise will tell you more than a long questionnaire.
Then keep the first step small enough that people can say yes to it this week.
