WEBVTT
00:00:19.600 --> 00:00:22.000
Hello and welcome to Full Tech ahead.
00:00:22.079 --> 00:00:26.480
I'm your host, Amanda Razzani, and I'm excited to have Denny LeConte here today.
00:00:26.640 --> 00:00:28.559
He is the CEO of PortNox.
00:00:28.879 --> 00:00:29.920
How are you doing today?
00:00:30.320 --> 00:00:31.280
I'm good, Amanda.
00:00:31.359 --> 00:00:32.240
Thank you for having me.
00:00:32.640 --> 00:00:34.479
I am happy to have you on the show.
00:00:34.719 --> 00:00:37.039
Can you share a little bit about Portnox?
00:00:37.280 --> 00:00:38.719
What services do you offer?
00:00:39.200 --> 00:00:41.679
PortNox is a cybersecurity company.
00:00:42.000 --> 00:00:47.280
We provide access control for your network and your applications.
00:00:47.439 --> 00:00:52.079
We make sure that only the right devices get onto your network.
00:00:52.479 --> 00:00:56.079
We can do that by eliminating the need for passwords.
00:00:56.240 --> 00:01:03.119
And we what we try to do is tie your access to your device so that you can't log in remotely.
00:01:03.200 --> 00:01:07.840
The bad guys, even if they steal your password, they can't log in remotely.
00:01:08.000 --> 00:01:11.680
But if you don't have a password, they can't uh fish it out of you.
00:01:12.159 --> 00:01:12.879
Interesting.
00:01:13.040 --> 00:01:13.439
Wow.
00:01:13.599 --> 00:01:13.840
Okay.
00:01:13.920 --> 00:01:17.439
So I definitely want to hear more about that, which I'm sure we'll get into.
00:01:17.760 --> 00:01:24.159
Our topic of the day is not blaming employees for shadow AI use.
00:01:24.480 --> 00:01:27.680
Um, we hear the term shadow AI quite a bit.
00:01:27.920 --> 00:01:36.159
And I think the first thing to do is just in case our listeners don't know what that is, can you please clarify what is shadow AI?
00:01:36.640 --> 00:01:44.719
What I think most people are referring to when they say shadow AI is AI that is not approved by the company, right?
00:01:44.959 --> 00:01:47.359
IT has not specified something.
00:01:47.519 --> 00:01:58.640
So whenever they say shadow IT or shadow AI, that's just employees trying to solve their problems in a way that has not been kind of blessed by IT or security.
00:01:59.120 --> 00:01:59.760
Dominant.
00:02:00.000 --> 00:02:00.319
Okay.
00:02:00.879 --> 00:02:05.200
So um the next thing is we're always talking about from the employee standpoint.
00:02:05.359 --> 00:02:09.759
Oh, the employees are using the shadow AI, it's all the employees' faults.
00:02:10.000 --> 00:02:19.680
Can you share why um this really needs to be something that business leaders address and maybe it's more of a leadership issue?
00:02:20.240 --> 00:02:26.879
Well, if you've got employees using AI that you have not approved, uh, I mean, there's kind of two situations.
00:02:27.039 --> 00:02:32.000
One is you haven't approved anything, and then people are just doing stuff, right?
00:02:32.479 --> 00:02:35.199
Employees are not gonna use AI for fun.
00:02:35.520 --> 00:02:39.039
You might do that for five minutes, but after a while, like you got to do your job.
00:02:39.280 --> 00:02:43.520
People are using a chat GPT or Claude to accomplish something.
00:02:43.680 --> 00:02:59.439
If you haven't set out a policy that says, hey, we're a Claude shop and Claude is cool, and anything that's not Claude is not cool, then people are gonna do it, they're gonna make choices, they're gonna use what they're comfortable with, and then you are gonna have a certain amount of chaos.
00:02:59.919 --> 00:03:05.199
But if you don't want them to do that, you got to give them a way to accomplish it.
00:03:05.360 --> 00:03:10.560
People are using AI to help with their jobs because it's genuinely useful, right?
00:03:10.719 --> 00:03:14.080
Remember when everybody was talking about crypto and crypto never caught on?
00:03:14.159 --> 00:03:16.319
Because it's very hard to find a use for it.
00:03:16.479 --> 00:03:20.879
You don't have to like you know, bore people for 15 minutes about the blockchain.
00:03:20.960 --> 00:03:26.080
You're just like, hey, let me let me show you what I could do with this uh with this chatbot.
00:03:26.159 --> 00:03:31.680
Uh, and once you've discovered that, you're gonna keep doing it if it helps your job.
00:03:32.240 --> 00:03:33.680
Yeah, absolutely.
00:03:33.919 --> 00:03:50.319
So to that note, you were mentioning if employees don't send Henry, or if leaders don't tell their employees, Henny, we approve Clod or Henny, we approve some other sort of AI tools, then that's then that's kind of where the disconnect lies.
00:03:50.479 --> 00:03:52.000
So better communication.
00:03:52.240 --> 00:03:56.319
How do you recommend that uh leadership address that?
00:03:56.560 --> 00:04:03.120
And how do they pick or how do they decide really what AI tools is best for the company?
00:04:03.759 --> 00:04:20.000
I mean, deciding which one is best is is super challenging because the best one is constantly changing, like faster than, you know, you picked Salesforce.com maybe 10 years ago, and Salesforce is probably still good, uh, and hasn't really changed that much.
00:04:20.319 --> 00:04:25.040
But whatever AI is probably pretty different than it was a year ago.
00:04:25.279 --> 00:04:28.879
I don't know that it's I don't know that it matters that much.
00:04:29.040 --> 00:04:33.199
I mean, certainly at Port Knox, we were using Chat GPT, then we moved to cloud.
00:04:33.279 --> 00:04:46.639
The only folks are gonna have very strong feelings about it are your um engineers, and they are probably gonna be the biggest consumers, and you probably are best off letting them pick the one that they think makes them the most productive.
00:04:46.800 --> 00:04:49.279
And then everybody else should just use the same one.
00:04:49.439 --> 00:04:54.879
Uh, I think trying to use multiple, you're not gonna get economies of scale on pricing.
00:04:54.959 --> 00:04:59.439
Uh, and then you also just create a bigger problem in trying to control this thing.
00:04:59.600 --> 00:05:08.160
But if you just go ahead and say, okay, we're gonna be a chat GPT shop, engineering's gonna use their codex product, and this is the one, then then that's fine.
00:05:08.240 --> 00:05:10.639
So I don't think the picking is too hard.
00:05:10.720 --> 00:05:19.279
There aren't, you know, some people might pick co-pilot because they're already deep into Microsoft, and that ends up being kind of the most affordable.
00:05:19.439 --> 00:05:23.600
They're all fine for what a normal employee wants to do.
00:05:23.759 --> 00:05:29.680
The most important thing is you need to communicate, but you can't just tell employees, only use this one.
00:05:30.240 --> 00:05:32.160
And other like that's nice.
00:05:32.240 --> 00:05:39.600
That's a that's it's good to have a policy and you can put it in your handbook, but you're gonna have to enforce it if you really mean it.
00:05:39.839 --> 00:05:44.959
Otherwise, it might be slightly less chaotic than saying nothing, but only slightly, right?
00:05:45.120 --> 00:05:49.920
People are gonna go, yeah, yeah, yeah, but I I really like this other one and I'm gonna use it.
00:05:50.079 --> 00:05:56.959
And the problem is people will just do stuff on the the sly if you don't have some sort of enforced policy.
00:05:57.199 --> 00:06:06.319
And the biggest fear most most um CISOs or CEOs have is, well, our customer gate data is going somewhere I don't want it to go.
00:06:06.480 --> 00:06:16.800
But if you buy an enterprise license from one of these firms, they will tell you, hey, we your data, we won't train on it, we won't store it.
00:06:16.959 --> 00:06:19.360
Like they they make a bunch of promises.
00:06:19.759 --> 00:06:31.199
Whereas if you've just got an employee and they're using their personal, you know, chat GPT account and they throw a bunch of data, like they upload a spreadsheet with a chat GPT is pretty clear.
00:06:31.360 --> 00:06:33.360
OpenAI is going to train on that data.
00:06:33.600 --> 00:06:34.800
You don't really know.
00:06:34.959 --> 00:06:41.519
We've seen sometimes that data can can kind of show up at other people's stuff with the right prompt.
00:06:41.839 --> 00:06:46.959
So again, uh here's the approved one, you you pay for it.
00:06:47.199 --> 00:06:54.399
And as a company, the other thing that that lets you do is those those um enterprise accounts come with a lot of controls.
00:06:54.560 --> 00:07:00.399
So you have to put somebody in IT in charge of it, and then you can configure it the way you want.
00:07:00.560 --> 00:07:06.720
So you might say, you can do you can do these things, but it's going to be configured this way.
00:07:06.959 --> 00:07:09.120
Like you're, you know, you can run everything.
00:07:09.199 --> 00:07:21.040
If you have agents doing activities, you can run it in something called sandbox mode, which sort of means it's not doing stuff necessarily directly to machines all over your your company.
00:07:21.199 --> 00:07:28.800
So there's lots of configurations you can set, but only if you're doing kind of here's the approved, the approved AI.
00:07:29.040 --> 00:07:31.920
Uh, and then I think you probably need a tool.
00:07:32.000 --> 00:07:38.959
Obviously, Port Nox is one of the things we do, is we can detect, we can say uh in our product, here's the approved thing.
00:07:39.120 --> 00:07:41.360
If you're going with chat GPT, that one's cool.
00:07:41.519 --> 00:07:47.120
Anything that's not chat GPT, if our product sees it, we can just take it down.
00:07:47.279 --> 00:07:49.680
Uh, we're not the only people who do that.
00:07:49.839 --> 00:08:01.839
Um, there are other products, but I would get a product that can sort of look at what's available and and sort of have a whitelist, black list of what what's gonna run.
00:08:01.920 --> 00:08:06.399
And and if it's if it's not approved, you really do need to just stop it.
00:08:06.560 --> 00:08:17.040
I I don't think wagging fingers at your employees is the right move because it's it's too tempting and people are gonna do what they what the they they think they're being productive.
00:08:17.120 --> 00:08:18.879
And they're like, Yeah, you don't really appreciate it.
00:08:18.959 --> 00:08:20.240
I'm better off with this one.
00:08:20.319 --> 00:08:27.759
And that's that's nice, but like a lot of things that can have security problems, people don't think they're being insecure when they're doing it.
00:08:28.000 --> 00:08:35.679
You know, when they write their password on a post-it note and stick it on the the monitor, they don't realize that they're just they're just trying to do their jobs.
00:08:35.840 --> 00:08:36.559
That's horrible.
00:08:36.720 --> 00:08:37.759
You should not do that.
00:08:37.919 --> 00:08:44.480
But but people will, and it's why you, you know, you want to make it easier for people to follow the rules.
00:08:44.799 --> 00:08:47.919
So I think it so it's it sounds threefold.
00:08:48.159 --> 00:08:54.399
First of all, I think business leaders sh, you know, need to listen to the employees and engineers.
00:08:54.639 --> 00:08:57.120
What is it that they're wanting to use and why?
00:08:57.279 --> 00:09:00.240
And then, you know, make those decisions, stick with them.
00:09:00.320 --> 00:09:08.639
And then it's about enforcement, monitoring, compliance, and then also the security uh from a security standpoint.
00:09:08.720 --> 00:09:10.720
So it seems threefold.
00:09:11.039 --> 00:09:13.200
Yes, there's the security piece of it.
00:09:13.279 --> 00:09:28.000
Uh, I was at a conference with a bunch of other CEOs, and everybody was using, they were not cybersecurity CEOs, and they were all talking about the stuff that their companies were doing, and they all had AI agents all over the place, and none of them were talking about the security.
00:09:28.159 --> 00:09:42.320
And I'm like, yeah, the problem is these things, what's powerful about them is also what's scary about them, that they can sometimes, in fact, almost always, if you use them a lot, they will do what you ask them to do, but they will do other stuff too.
00:09:42.399 --> 00:09:56.480
And then, you know, if you read the news at all, it does seem like now every day or two, one of the um the big AI labs is coming out with a report of their agents doing stuff hacking other people's websites, government websites.
00:09:56.720 --> 00:09:59.600
They can get out of containment if you're not careful.
00:09:59.759 --> 00:10:05.840
So you do really need to treat them as this is an entity inside of my organization.
00:10:06.080 --> 00:10:14.159
Probably I would think about them as an insider threat, just like most employees almost all of the time are trying to do the right thing.
00:10:14.320 --> 00:10:25.039
But occasionally you get an employee who goes rogue and actually is trying to maybe hurt the company or use the company's data for for bad purposes.
00:10:25.200 --> 00:10:25.759
Same thing.
00:10:25.919 --> 00:10:28.879
You have to, and you have everybody has lots of controls.
00:10:29.120 --> 00:10:34.320
Cybersecurity teams are like trying to make sure that it's easy for people to stay within the rules.
00:10:34.399 --> 00:10:36.320
But if somebody tries, you you can catch them.
00:10:36.480 --> 00:10:37.679
Same with the agent.
00:10:37.840 --> 00:10:46.879
You now have to treat the agent as a potential insider threat that can actually hurt the company, and it'll apologize after if you've used an AI at all, right?
00:10:46.960 --> 00:10:54.080
Like you're absolutely right, is their most, you know, favorite phrase, right after they did something that was really wrong.
00:10:54.320 --> 00:10:54.639
Right.
00:10:54.799 --> 00:10:58.080
So you have to treat them as a potential threat.
00:10:58.159 --> 00:11:03.759
They're helping you, but they might inadvertently, you know, go uh go rogue.
00:11:03.919 --> 00:11:18.480
And so you want something that's forcing them to stay in the box that you put them in, so that at least if they do go rogue, it sort of the blast radius, as you might say, is as small as possible.
00:11:18.639 --> 00:11:29.039
So you probably want to make sure that they are uh well contained in terms of network access, in terms of application access, that they can't do do too much.
00:11:29.200 --> 00:11:37.279
Because if they're super powerful, then if they do something wrong, it it could have, you know, you don't want them deleting a whole database or eliminating backups.
00:11:37.360 --> 00:11:40.720
And those are like real incidents that have that have happened to people.
00:11:41.039 --> 00:11:42.159
Yeah, absolutely.
00:11:42.320 --> 00:11:47.039
Um, so having those safeguards and always the human in the loop.
00:11:47.519 --> 00:11:48.960
Always the human in the loop.
00:11:49.120 --> 00:11:57.039
There is uh, I think at least one of them has what they call YOLO mode, you only live once, which is where you stop asking the for the human and you just go.
00:11:57.679 --> 00:12:02.159
You might want to say as a configuration policy that we don't allow YOLO mode.
00:12:02.399 --> 00:12:14.559
Like you you do need a human to say, even if they're just sitting there going, okay, okay, okay, uh, it still kind of slows the process down and forces people to to think about it, especially if they're again, they're taking actions.
00:12:14.639 --> 00:12:27.200
It's it's one thing to just answering a question, but the minute you have an agent and it starts working with files or with email, the risk goes up, which means that your vigilance also needs to go up.
00:12:27.519 --> 00:12:35.600
I think there's still a big problem with people in general not realizing all the risk involved in the AI tools that they're using.
00:12:35.919 --> 00:12:43.600
Do you think companies need to put a little more effort into educating their employees and really providing them with that knowledge?
00:12:44.799 --> 00:12:52.240
They can, but I will tell you, my perspective is shaped by um all the years we've all done security training.
00:12:52.480 --> 00:12:58.480
And if you look at the research on security training, there is no evidence that it works, right?
00:12:58.559 --> 00:13:08.320
Like you can train people they've for eight, nine months, and they're just as likely to give their uh click on a phishing email as somebody who never took training.
00:13:08.480 --> 00:13:12.639
And it's because people are busy, like you might be good most of the time.
00:13:12.799 --> 00:13:23.200
So I'm not a big fan of just trying to convince everybody to be good because people are people and they're very busy and they get distracted, and so they'll just do risky things.
00:13:23.519 --> 00:13:30.559
The answer is build a system that doesn't allow people to shoot themselves or the company in the foot, right?
00:13:30.720 --> 00:13:38.320
Like again, constraints, put things in a box so that even if somebody slips up, it's not a disaster.
00:13:38.799 --> 00:13:40.559
You got thousands of employees.
00:13:40.720 --> 00:13:48.879
At some point, somebody's having a bad day and they're distracted and they're gonna do something that that uh harms your security.
00:13:49.039 --> 00:13:57.440
So, you know, you just you set up a I'm much more a believer in building a system and the tools exist for you to do that.
00:13:57.600 --> 00:14:02.000
Um, you know, wagging your finger at employees is just never the right answer.
00:14:02.320 --> 00:14:02.720
Yeah.
00:14:02.960 --> 00:14:14.559
Well, this may seem really futuristic, but we're seeing AI advance so rapidly and we're hearing about it make its own choices, choosing to shut down certain things on its own.
00:14:14.720 --> 00:14:21.519
So uh that's a little concerning because we talk about guard riddles and you know, monitoring and and keeping things secure.
00:14:21.840 --> 00:14:27.360
But what happens if the AI gets to this point where it can just override this?
00:14:27.679 --> 00:14:32.879
Well, then you've made that that's honestly at that point, IT has made a mistake, right?
00:14:33.039 --> 00:14:36.399
Like you're a company, you're an employee in the company.
00:14:36.559 --> 00:14:39.200
I, as IT, grant you certain permissions.
00:14:39.360 --> 00:14:46.559
I do not, if I'm smart, make you an administrator on your own device and let you install any darn thing you want.
00:14:46.799 --> 00:14:49.200
Because again, you might make a bad choice.
00:14:49.360 --> 00:14:53.679
So most responsible companies don't allow you to be an administrator.
00:14:53.840 --> 00:14:57.039
They also don't just give you rights to anything in the company.
00:14:57.120 --> 00:15:03.600
There's places you go where you suddenly smack against your limitations, you box people in.
00:15:03.840 --> 00:15:06.399
You need to do that with the AI as well.
00:15:06.559 --> 00:15:13.679
If you make an AI powerful, then it can, you know, do a lot of stuff.
00:15:13.840 --> 00:15:14.879
So that's the whole point.
00:15:15.039 --> 00:15:20.000
When I say guardrails, what I mean is like you really need to restrict it.
00:15:20.080 --> 00:15:31.279
You put it somewhere and it can only see certain things so that it it doesn't it doesn't have the same access as a human who can do kind of anything.
00:15:31.440 --> 00:15:44.879
You certainly wouldn't want somebody with like an IT with large rights over all sorts of stuff to then have an agent that has their rights because that agent can go do really, really impactful things.
00:15:45.039 --> 00:15:53.039
So I think you do need to worry about it trying to do like again, it's just trying to, it's just trying to achieve whatever goal you gave it.
00:15:53.200 --> 00:15:55.039
It doesn't have its own motivations.
00:15:55.200 --> 00:16:06.399
You told it to do something, and as a result of doing that, you will find it's like, oh, in order to do that, I'm gonna go do this other thing you didn't ask for, but I'm sure you will find it helpful.
00:16:06.559 --> 00:16:10.879
That's where when we say guardrails, what we really mean is very restricted rights.
00:16:10.960 --> 00:16:15.840
And cybersecurity, we talked about that lease privileges, the principle of least privileges.
00:16:16.000 --> 00:16:21.440
You don't need more rights than you need to do the job that you've been assigned, right?
00:16:21.919 --> 00:16:37.519
You go back in time, most people in most companies could do a lot of stuff, and then that's bad things happen, and then more and more cybersecurity is like, no, no, no, you really can't just let people, you know, be on their best behavior because sometimes they're not.
00:16:38.000 --> 00:16:38.559
Right.
00:16:38.799 --> 00:16:41.039
Well, um, what do you see down the road?
00:16:41.200 --> 00:16:49.279
What's the next thing that business leaders and companies need to focus on to stay ahead of AI and harness it to their best of their ability?
00:16:49.679 --> 00:16:52.159
I think the the there's kind of two things happening.
00:16:52.320 --> 00:16:58.480
There's what we've been talking about is kind of inside the company using AI, but also trying to constrain it.
00:16:58.720 --> 00:17:12.079
The other thing is outside your company, there's a lot of available AI in the hands of very bad people who are going to use that AI to attack your company, right?
00:17:12.480 --> 00:17:20.240
They were attacking your company beforehand, and AI just makes them better at it and sort of just faster, right?
00:17:20.559 --> 00:17:31.519
So the number of attacks that everybody's going to see just is going to multiply because for a while the attackers might have an advantage over the defenders.
00:17:31.759 --> 00:17:43.119
And so this is a good time for everybody to just improve their cybersecurity, you know, your posture, as we say in the in the industry, like you got to make that better.
00:17:43.279 --> 00:17:58.480
Like if you think you're good enough, that good enough is not gonna stand the next couple of years as the AIs get better and the bad guys, they're gonna be better at fishing, they're gonna be better at hacking vulnerabilities.
00:17:58.640 --> 00:18:06.720
So you you're just gonna have to, we're all gonna have to spend some money kind of improving, improving our defenses because it's coming.
00:18:06.880 --> 00:18:18.960
And so those are the things I think everybody should be thinking about, both that how do I handle it when it's inside the house and how to handle the stuff that's outside of my house that might might want to get in.
00:18:19.519 --> 00:18:20.559
Good advice.
00:18:20.799 --> 00:18:27.039
Okay, well, if there was one way to sum it all up, what's the key takeaway for today that you would leave our audience with?
00:18:28.640 --> 00:18:44.799
You probably need to have someone in the company who is sort of an AI operations person who's thinking about the whole thing and coordinating, just like this is going to be so important to most companies that you want somebody who's coordinating.
00:18:44.880 --> 00:19:05.279
They don't do it all, but they're thinking about the security, or they're thinking about productivity, but they are pulling it all together and then they can report to senior leadership about what's working, what's not working, but like letting it just rip and let everybody do what they want, like you're that chaos is gonna come back to bite you.
00:19:05.359 --> 00:19:07.119
So I don't think that's a good idea.
00:19:07.359 --> 00:19:07.759
All right.
00:19:07.920 --> 00:19:11.200
Well, thank you so much for coming on the show and sharing your insights today.
00:19:11.440 --> 00:19:12.319
Thank you, Amanda.
00:19:12.480 --> 00:19:13.039
I appreciate it.
00:19:13.440 --> 00:19:14.480
Thank you to our audience.
00:19:14.640 --> 00:19:18.079
If you have any questions or comments, leave them below and I'll respond back as soon as possible.
00:19:18.240 --> 00:19:20.559
And meanwhile, have a wonderful week.
00:00:19.600 --> 00:00:22.000
Hello and welcome to Full Tech ahead.
00:00:22.079 --> 00:00:26.480
I'm your host, Amanda Razzani, and I'm excited to have Denny LeConte here today.
00:00:26.640 --> 00:00:28.559
He is the CEO of PortNox.
00:00:28.879 --> 00:00:29.920
How are you doing today?
00:00:30.320 --> 00:00:31.280
I'm good, Amanda.
00:00:31.359 --> 00:00:32.240
Thank you for having me.
00:00:32.640 --> 00:00:34.479
I am happy to have you on the show.
00:00:34.719 --> 00:00:37.039
Can you share a little bit about Portnox?
00:00:37.280 --> 00:00:38.719
What services do you offer?
00:00:39.200 --> 00:00:41.679
PortNox is a cybersecurity company.
00:00:42.000 --> 00:00:47.280
We provide access control for your network and your applications.
00:00:47.439 --> 00:00:52.079
We make sure that only the right devices get onto your network.
00:00:52.479 --> 00:00:56.079
We can do that by eliminating the need for passwords.
00:00:56.240 --> 00:01:03.119
And we what we try to do is tie your access to your device so that you can't log in remotely.
00:01:03.200 --> 00:01:07.840
The bad guys, even if they steal your password, they can't log in remotely.
00:01:08.000 --> 00:01:11.680
But if you don't have a password, they can't uh fish it out of you.
00:01:12.159 --> 00:01:12.879
Interesting.
00:01:13.040 --> 00:01:13.439
Wow.
00:01:13.599 --> 00:01:13.840
Okay.
00:01:13.920 --> 00:01:17.439
So I definitely want to hear more about that, which I'm sure we'll get into.
00:01:17.760 --> 00:01:24.159
Our topic of the day is not blaming employees for shadow AI use.
00:01:24.480 --> 00:01:27.680
Um, we hear the term shadow AI quite a bit.
00:01:27.920 --> 00:01:36.159
And I think the first thing to do is just in case our listeners don't know what that is, can you please clarify what is shadow AI?
00:01:36.640 --> 00:01:44.719
What I think most people are referring to when they say shadow AI is AI that is not approved by the company, right?
00:01:44.959 --> 00:01:47.359
IT has not specified something.
00:01:47.519 --> 00:01:58.640
So whenever they say shadow IT or shadow AI, that's just employees trying to solve their problems in a way that has not been kind of blessed by IT or security.
00:01:59.120 --> 00:01:59.760
Dominant.
00:02:00.000 --> 00:02:00.319
Okay.
00:02:00.879 --> 00:02:05.200
So um the next thing is we're always talking about from the employee standpoint.
00:02:05.359 --> 00:02:09.759
Oh, the employees are using the shadow AI, it's all the employees' faults.
00:02:10.000 --> 00:02:19.680
Can you share why um this really needs to be something that business leaders address and maybe it's more of a leadership issue?
00:02:20.240 --> 00:02:26.879
Well, if you've got employees using AI that you have not approved, uh, I mean, there's kind of two situations.
00:02:27.039 --> 00:02:32.000
One is you haven't approved anything, and then people are just doing stuff, right?
00:02:32.479 --> 00:02:35.199
Employees are not gonna use AI for fun.
00:02:35.520 --> 00:02:39.039
You might do that for five minutes, but after a while, like you got to do your job.
00:02:39.280 --> 00:02:43.520
People are using a chat GPT or Claude to accomplish something.
00:02:43.680 --> 00:02:59.439
If you haven't set out a policy that says, hey, we're a Claude shop and Claude is cool, and anything that's not Claude is not cool, then people are gonna do it, they're gonna make choices, they're gonna use what they're comfortable with, and then you are gonna have a certain amount of chaos.
00:02:59.919 --> 00:03:05.199
But if you don't want them to do that, you got to give them a way to accomplish it.
00:03:05.360 --> 00:03:10.560
People are using AI to help with their jobs because it's genuinely useful, right?
00:03:10.719 --> 00:03:14.080
Remember when everybody was talking about crypto and crypto never caught on?
00:03:14.159 --> 00:03:16.319
Because it's very hard to find a use for it.
00:03:16.479 --> 00:03:20.879
You don't have to like you know, bore people for 15 minutes about the blockchain.
00:03:20.960 --> 00:03:26.080
You're just like, hey, let me let me show you what I could do with this uh with this chatbot.
00:03:26.159 --> 00:03:31.680
Uh, and once you've discovered that, you're gonna keep doing it if it helps your job.
00:03:32.240 --> 00:03:33.680
Yeah, absolutely.
00:03:33.919 --> 00:03:50.319
So to that note, you were mentioning if employees don't send Henry, or if leaders don't tell their employees, Henny, we approve Clod or Henny, we approve some other sort of AI tools, then that's then that's kind of where the disconnect lies.
00:03:50.479 --> 00:03:52.000
So better communication.
00:03:52.240 --> 00:03:56.319
How do you recommend that uh leadership address that?
00:03:56.560 --> 00:04:03.120
And how do they pick or how do they decide really what AI tools is best for the company?
00:04:03.759 --> 00:04:20.000
I mean, deciding which one is best is is super challenging because the best one is constantly changing, like faster than, you know, you picked Salesforce.com maybe 10 years ago, and Salesforce is probably still good, uh, and hasn't really changed that much.
00:04:20.319 --> 00:04:25.040
But whatever AI is probably pretty different than it was a year ago.
00:04:25.279 --> 00:04:28.879
I don't know that it's I don't know that it matters that much.
00:04:29.040 --> 00:04:33.199
I mean, certainly at Port Knox, we were using Chat GPT, then we moved to cloud.
00:04:33.279 --> 00:04:46.639
The only folks are gonna have very strong feelings about it are your um engineers, and they are probably gonna be the biggest consumers, and you probably are best off letting them pick the one that they think makes them the most productive.
00:04:46.800 --> 00:04:49.279
And then everybody else should just use the same one.
00:04:49.439 --> 00:04:54.879
Uh, I think trying to use multiple, you're not gonna get economies of scale on pricing.
00:04:54.959 --> 00:04:59.439
Uh, and then you also just create a bigger problem in trying to control this thing.
00:04:59.600 --> 00:05:08.160
But if you just go ahead and say, okay, we're gonna be a chat GPT shop, engineering's gonna use their codex product, and this is the one, then then that's fine.
00:05:08.240 --> 00:05:10.639
So I don't think the picking is too hard.
00:05:10.720 --> 00:05:19.279
There aren't, you know, some people might pick co-pilot because they're already deep into Microsoft, and that ends up being kind of the most affordable.
00:05:19.439 --> 00:05:23.600
They're all fine for what a normal employee wants to do.
00:05:23.759 --> 00:05:29.680
The most important thing is you need to communicate, but you can't just tell employees, only use this one.
00:05:30.240 --> 00:05:32.160
And other like that's nice.
00:05:32.240 --> 00:05:39.600
That's a that's it's good to have a policy and you can put it in your handbook, but you're gonna have to enforce it if you really mean it.
00:05:39.839 --> 00:05:44.959
Otherwise, it might be slightly less chaotic than saying nothing, but only slightly, right?
00:05:45.120 --> 00:05:49.920
People are gonna go, yeah, yeah, yeah, but I I really like this other one and I'm gonna use it.
00:05:50.079 --> 00:05:56.959
And the problem is people will just do stuff on the the sly if you don't have some sort of enforced policy.
00:05:57.199 --> 00:06:06.319
And the biggest fear most most um CISOs or CEOs have is, well, our customer gate data is going somewhere I don't want it to go.
00:06:06.480 --> 00:06:16.800
But if you buy an enterprise license from one of these firms, they will tell you, hey, we your data, we won't train on it, we won't store it.
00:06:16.959 --> 00:06:19.360
Like they they make a bunch of promises.
00:06:19.759 --> 00:06:31.199
Whereas if you've just got an employee and they're using their personal, you know, chat GPT account and they throw a bunch of data, like they upload a spreadsheet with a chat GPT is pretty clear.
00:06:31.360 --> 00:06:33.360
OpenAI is going to train on that data.
00:06:33.600 --> 00:06:34.800
You don't really know.
00:06:34.959 --> 00:06:41.519
We've seen sometimes that data can can kind of show up at other people's stuff with the right prompt.
00:06:41.839 --> 00:06:46.959
So again, uh here's the approved one, you you pay for it.
00:06:47.199 --> 00:06:54.399
And as a company, the other thing that that lets you do is those those um enterprise accounts come with a lot of controls.
00:06:54.560 --> 00:07:00.399
So you have to put somebody in IT in charge of it, and then you can configure it the way you want.
00:07:00.560 --> 00:07:06.720
So you might say, you can do you can do these things, but it's going to be configured this way.
00:07:06.959 --> 00:07:09.120
Like you're, you know, you can run everything.
00:07:09.199 --> 00:07:21.040
If you have agents doing activities, you can run it in something called sandbox mode, which sort of means it's not doing stuff necessarily directly to machines all over your your company.
00:07:21.199 --> 00:07:28.800
So there's lots of configurations you can set, but only if you're doing kind of here's the approved, the approved AI.
00:07:29.040 --> 00:07:31.920
Uh, and then I think you probably need a tool.
00:07:32.000 --> 00:07:38.959
Obviously, Port Nox is one of the things we do, is we can detect, we can say uh in our product, here's the approved thing.
00:07:39.120 --> 00:07:41.360
If you're going with chat GPT, that one's cool.
00:07:41.519 --> 00:07:47.120
Anything that's not chat GPT, if our product sees it, we can just take it down.
00:07:47.279 --> 00:07:49.680
Uh, we're not the only people who do that.
00:07:49.839 --> 00:08:01.839
Um, there are other products, but I would get a product that can sort of look at what's available and and sort of have a whitelist, black list of what what's gonna run.
00:08:01.920 --> 00:08:06.399
And and if it's if it's not approved, you really do need to just stop it.
00:08:06.560 --> 00:08:17.040
I I don't think wagging fingers at your employees is the right move because it's it's too tempting and people are gonna do what they what the they they think they're being productive.
00:08:17.120 --> 00:08:18.879
And they're like, Yeah, you don't really appreciate it.
00:08:18.959 --> 00:08:20.240
I'm better off with this one.
00:08:20.319 --> 00:08:27.759
And that's that's nice, but like a lot of things that can have security problems, people don't think they're being insecure when they're doing it.
00:08:28.000 --> 00:08:35.679
You know, when they write their password on a post-it note and stick it on the the monitor, they don't realize that they're just they're just trying to do their jobs.
00:08:35.840 --> 00:08:36.559
That's horrible.
00:08:36.720 --> 00:08:37.759
You should not do that.
00:08:37.919 --> 00:08:44.480
But but people will, and it's why you, you know, you want to make it easier for people to follow the rules.
00:08:44.799 --> 00:08:47.919
So I think it so it's it sounds threefold.
00:08:48.159 --> 00:08:54.399
First of all, I think business leaders sh, you know, need to listen to the employees and engineers.
00:08:54.639 --> 00:08:57.120
What is it that they're wanting to use and why?
00:08:57.279 --> 00:09:00.240
And then, you know, make those decisions, stick with them.
00:09:00.320 --> 00:09:08.639
And then it's about enforcement, monitoring, compliance, and then also the security uh from a security standpoint.
00:09:08.720 --> 00:09:10.720
So it seems threefold.
00:09:11.039 --> 00:09:13.200
Yes, there's the security piece of it.
00:09:13.279 --> 00:09:28.000
Uh, I was at a conference with a bunch of other CEOs, and everybody was using, they were not cybersecurity CEOs, and they were all talking about the stuff that their companies were doing, and they all had AI agents all over the place, and none of them were talking about the security.
00:09:28.159 --> 00:09:42.320
And I'm like, yeah, the problem is these things, what's powerful about them is also what's scary about them, that they can sometimes, in fact, almost always, if you use them a lot, they will do what you ask them to do, but they will do other stuff too.
00:09:42.399 --> 00:09:56.480
And then, you know, if you read the news at all, it does seem like now every day or two, one of the um the big AI labs is coming out with a report of their agents doing stuff hacking other people's websites, government websites.
00:09:56.720 --> 00:09:59.600
They can get out of containment if you're not careful.
00:09:59.759 --> 00:10:05.840
So you do really need to treat them as this is an entity inside of my organization.
00:10:06.080 --> 00:10:14.159
Probably I would think about them as an insider threat, just like most employees almost all of the time are trying to do the right thing.
00:10:14.320 --> 00:10:25.039
But occasionally you get an employee who goes rogue and actually is trying to maybe hurt the company or use the company's data for for bad purposes.
00:10:25.200 --> 00:10:25.759
Same thing.
00:10:25.919 --> 00:10:28.879
You have to, and you have everybody has lots of controls.
00:10:29.120 --> 00:10:34.320
Cybersecurity teams are like trying to make sure that it's easy for people to stay within the rules.
00:10:34.399 --> 00:10:36.320
But if somebody tries, you you can catch them.
00:10:36.480 --> 00:10:37.679
Same with the agent.
00:10:37.840 --> 00:10:46.879
You now have to treat the agent as a potential insider threat that can actually hurt the company, and it'll apologize after if you've used an AI at all, right?
00:10:46.960 --> 00:10:54.080
Like you're absolutely right, is their most, you know, favorite phrase, right after they did something that was really wrong.
00:10:54.320 --> 00:10:54.639
Right.
00:10:54.799 --> 00:10:58.080
So you have to treat them as a potential threat.
00:10:58.159 --> 00:11:03.759
They're helping you, but they might inadvertently, you know, go uh go rogue.
00:11:03.919 --> 00:11:18.480
And so you want something that's forcing them to stay in the box that you put them in, so that at least if they do go rogue, it sort of the blast radius, as you might say, is as small as possible.
00:11:18.639 --> 00:11:29.039
So you probably want to make sure that they are uh well contained in terms of network access, in terms of application access, that they can't do do too much.
00:11:29.200 --> 00:11:37.279
Because if they're super powerful, then if they do something wrong, it it could have, you know, you don't want them deleting a whole database or eliminating backups.
00:11:37.360 --> 00:11:40.720
And those are like real incidents that have that have happened to people.
00:11:41.039 --> 00:11:42.159
Yeah, absolutely.
00:11:42.320 --> 00:11:47.039
Um, so having those safeguards and always the human in the loop.
00:11:47.519 --> 00:11:48.960
Always the human in the loop.
00:11:49.120 --> 00:11:57.039
There is uh, I think at least one of them has what they call YOLO mode, you only live once, which is where you stop asking the for the human and you just go.
00:11:57.679 --> 00:12:02.159
You might want to say as a configuration policy that we don't allow YOLO mode.
00:12:02.399 --> 00:12:14.559
Like you you do need a human to say, even if they're just sitting there going, okay, okay, okay, uh, it still kind of slows the process down and forces people to to think about it, especially if they're again, they're taking actions.
00:12:14.639 --> 00:12:27.200
It's it's one thing to just answering a question, but the minute you have an agent and it starts working with files or with email, the risk goes up, which means that your vigilance also needs to go up.
00:12:27.519 --> 00:12:35.600
I think there's still a big problem with people in general not realizing all the risk involved in the AI tools that they're using.
00:12:35.919 --> 00:12:43.600
Do you think companies need to put a little more effort into educating their employees and really providing them with that knowledge?
00:12:44.799 --> 00:12:52.240
They can, but I will tell you, my perspective is shaped by um all the years we've all done security training.
00:12:52.480 --> 00:12:58.480
And if you look at the research on security training, there is no evidence that it works, right?
00:12:58.559 --> 00:13:08.320
Like you can train people they've for eight, nine months, and they're just as likely to give their uh click on a phishing email as somebody who never took training.
00:13:08.480 --> 00:13:12.639
And it's because people are busy, like you might be good most of the time.
00:13:12.799 --> 00:13:23.200
So I'm not a big fan of just trying to convince everybody to be good because people are people and they're very busy and they get distracted, and so they'll just do risky things.
00:13:23.519 --> 00:13:30.559
The answer is build a system that doesn't allow people to shoot themselves or the company in the foot, right?
00:13:30.720 --> 00:13:38.320
Like again, constraints, put things in a box so that even if somebody slips up, it's not a disaster.
00:13:38.799 --> 00:13:40.559
You got thousands of employees.
00:13:40.720 --> 00:13:48.879
At some point, somebody's having a bad day and they're distracted and they're gonna do something that that uh harms your security.
00:13:49.039 --> 00:13:57.440
So, you know, you just you set up a I'm much more a believer in building a system and the tools exist for you to do that.
00:13:57.600 --> 00:14:02.000
Um, you know, wagging your finger at employees is just never the right answer.
00:14:02.320 --> 00:14:02.720
Yeah.
00:14:02.960 --> 00:14:14.559
Well, this may seem really futuristic, but we're seeing AI advance so rapidly and we're hearing about it make its own choices, choosing to shut down certain things on its own.
00:14:14.720 --> 00:14:21.519
So uh that's a little concerning because we talk about guard riddles and you know, monitoring and and keeping things secure.
00:14:21.840 --> 00:14:27.360
But what happens if the AI gets to this point where it can just override this?
00:14:27.679 --> 00:14:32.879
Well, then you've made that that's honestly at that point, IT has made a mistake, right?
00:14:33.039 --> 00:14:36.399
Like you're a company, you're an employee in the company.
00:14:36.559 --> 00:14:39.200
I, as IT, grant you certain permissions.
00:14:39.360 --> 00:14:46.559
I do not, if I'm smart, make you an administrator on your own device and let you install any darn thing you want.
00:14:46.799 --> 00:14:49.200
Because again, you might make a bad choice.
00:14:49.360 --> 00:14:53.679
So most responsible companies don't allow you to be an administrator.
00:14:53.840 --> 00:14:57.039
They also don't just give you rights to anything in the company.
00:14:57.120 --> 00:15:03.600
There's places you go where you suddenly smack against your limitations, you box people in.
00:15:03.840 --> 00:15:06.399
You need to do that with the AI as well.
00:15:06.559 --> 00:15:13.679
If you make an AI powerful, then it can, you know, do a lot of stuff.
00:15:13.840 --> 00:15:14.879
So that's the whole point.
00:15:15.039 --> 00:15:20.000
When I say guardrails, what I mean is like you really need to restrict it.
00:15:20.080 --> 00:15:31.279
You put it somewhere and it can only see certain things so that it it doesn't it doesn't have the same access as a human who can do kind of anything.
00:15:31.440 --> 00:15:44.879
You certainly wouldn't want somebody with like an IT with large rights over all sorts of stuff to then have an agent that has their rights because that agent can go do really, really impactful things.
00:15:45.039 --> 00:15:53.039
So I think you do need to worry about it trying to do like again, it's just trying to, it's just trying to achieve whatever goal you gave it.
00:15:53.200 --> 00:15:55.039
It doesn't have its own motivations.
00:15:55.200 --> 00:16:06.399
You told it to do something, and as a result of doing that, you will find it's like, oh, in order to do that, I'm gonna go do this other thing you didn't ask for, but I'm sure you will find it helpful.
00:16:06.559 --> 00:16:10.879
That's where when we say guardrails, what we really mean is very restricted rights.
00:16:10.960 --> 00:16:15.840
And cybersecurity, we talked about that lease privileges, the principle of least privileges.
00:16:16.000 --> 00:16:21.440
You don't need more rights than you need to do the job that you've been assigned, right?
00:16:21.919 --> 00:16:37.519
You go back in time, most people in most companies could do a lot of stuff, and then that's bad things happen, and then more and more cybersecurity is like, no, no, no, you really can't just let people, you know, be on their best behavior because sometimes they're not.
00:16:38.000 --> 00:16:38.559
Right.
00:16:38.799 --> 00:16:41.039
Well, um, what do you see down the road?
00:16:41.200 --> 00:16:49.279
What's the next thing that business leaders and companies need to focus on to stay ahead of AI and harness it to their best of their ability?
00:16:49.679 --> 00:16:52.159
I think the the there's kind of two things happening.
00:16:52.320 --> 00:16:58.480
There's what we've been talking about is kind of inside the company using AI, but also trying to constrain it.
00:16:58.720 --> 00:17:12.079
The other thing is outside your company, there's a lot of available AI in the hands of very bad people who are going to use that AI to attack your company, right?
00:17:12.480 --> 00:17:20.240
They were attacking your company beforehand, and AI just makes them better at it and sort of just faster, right?
00:17:20.559 --> 00:17:31.519
So the number of attacks that everybody's going to see just is going to multiply because for a while the attackers might have an advantage over the defenders.
00:17:31.759 --> 00:17:43.119
And so this is a good time for everybody to just improve their cybersecurity, you know, your posture, as we say in the in the industry, like you got to make that better.
00:17:43.279 --> 00:17:58.480
Like if you think you're good enough, that good enough is not gonna stand the next couple of years as the AIs get better and the bad guys, they're gonna be better at fishing, they're gonna be better at hacking vulnerabilities.
00:17:58.640 --> 00:18:06.720
So you you're just gonna have to, we're all gonna have to spend some money kind of improving, improving our defenses because it's coming.
00:18:06.880 --> 00:18:18.960
And so those are the things I think everybody should be thinking about, both that how do I handle it when it's inside the house and how to handle the stuff that's outside of my house that might might want to get in.
00:18:19.519 --> 00:18:20.559
Good advice.
00:18:20.799 --> 00:18:27.039
Okay, well, if there was one way to sum it all up, what's the key takeaway for today that you would leave our audience with?
00:18:28.640 --> 00:18:44.799
You probably need to have someone in the company who is sort of an AI operations person who's thinking about the whole thing and coordinating, just like this is going to be so important to most companies that you want somebody who's coordinating.
00:18:44.880 --> 00:19:05.279
They don't do it all, but they're thinking about the security, or they're thinking about productivity, but they are pulling it all together and then they can report to senior leadership about what's working, what's not working, but like letting it just rip and let everybody do what they want, like you're that chaos is gonna come back to bite you.
00:19:05.359 --> 00:19:07.119
So I don't think that's a good idea.
00:19:07.359 --> 00:19:07.759
All right.
00:19:07.920 --> 00:19:11.200
Well, thank you so much for coming on the show and sharing your insights today.
00:19:11.440 --> 00:19:12.319
Thank you, Amanda.
00:19:12.480 --> 00:19:13.039
I appreciate it.
00:19:13.440 --> 00:19:14.480
Thank you to our audience.
00:19:14.640 --> 00:19:18.079
If you have any questions or comments, leave them below and I'll respond back as soon as possible.
00:19:18.240 --> 00:19:20.559
And meanwhile, have a wonderful week.
