WEBVTT
1
00:00:00.031 --> 00:00:25.192
Six out of 10 interviews that recruiters are having, they are cheating with AI. They're utilizing this tool called Glass Solution. So you ask me a question, it has access to microphone, and I can connect it to whatever AI engine that I want to utilize. And immediately speaking, in front of me, there are the answers. All I have to do is read it.
2
00:00:35.587 --> 00:01:03.363
I know your friends call you Mr. Paranoid, and there's probably a good reason for that. So I'd just love to understand what's the background of that, and what are you paranoid about now? I think it's just me being everything. That's the easy answer. But overall speaking, I'm a very optimistic person. But behind the scene of optimism, I always see the negativity in everything.
3
00:01:03.751 --> 00:01:32.168
I'm going to take as an example, last week, we are at the oil company. They wanted me to connect my laptop to their screen to show stuff. And I'm looking at it. They're giving me a dongle. That dongle has something on it. And for three minutes, I'm looking around it, reading behind it, and turning around everything while my head of product next to me on R is like, it's okay. Just give it to me. And he told me.
4
00:01:32.557 --> 00:01:59.219
He just puts it on his laptop. I would never have done that thing like on my laptop alone. And when he opens it as just the way that I thought, there is an execution file in that dongle. So I unintentionally have started seeing the operational activities of every technology that I'm utilizing. And that makes me see things very crazily difficult.
5
00:01:59.759 --> 00:02:29.071
Yeah, so when you're hesitant on that, this is not at all on topic, but it's fascinating. You know, when we plug into situations like that, what can they do to our computer? Like what could happen? Everything. Have you seen like QR codes when you're walking in some places saying like, have you seen my llama or have you seen my horse? I really hope that you have never scanned it. I can take over your entirety of your activities with just a single QR code.
6
00:02:29.830 --> 00:02:55.345
As of right now, I can orchestrate a structure for your agentic AI activity by sending literally emojis to you, to your AI chat, and take over your entirety of the agentic activity. So things that are looking normal are not really normal. There is, I keep on always saying, kids, to everyone that
7
00:02:55.784 --> 00:03:23.020
Contextuality has become the most difficult cyber element of the world, where the world is actually ignoring it still. So let's just give an example that you're very, very discreet and very, very private person. You don't give your name to AI tools, you don't give, I don't know, where you live and so on and so forth.
8
00:03:24.387 --> 00:03:42.494
But as you are typing and engaging with these tools more and more, they actually start building context intelligence around you. With that context intelligence, we can just triangulate you or triangulate the whole social activities and start basically
9
00:03:42.899 --> 00:04:08.532
looking for a Caucasian person between the age of 30 to 45. I don't know, in some place that you're gonna be talking, you may be sleeping something that you are married or you have a kid or this and that. You are a podcast host, et cetera, et cetera. The context becomes basically mosaic intelligence that actually tells everything about you. And with it, it's no longer just important about
10
00:04:09.173 --> 00:04:39.059
the traditional HIPAAs or traditional GDPRs and so on, the context breaches all the HIPAA regulations, as an example, in healthcare world. GDPR does not really apply anymore because the context has given everything around you. Is that overwhelming? At some point, do we give them so much information that we're all exposed and it's too hard to get through or?
11
00:04:39.363 --> 00:05:07.139
You know, when I started Polygraph, I started with the context in mind because I saw things really again difficult and different. And I kept on literally telling everyone that you're going to be paying AI twice, first with your data, with your money, second with your data. And two weeks ago, I heard exact same wording for the first time from someone else. That was such a from Microsoft actually saying.
12
00:05:07.510 --> 00:05:36.265
who led the LLM evolution. Now, the way that I'm talking, I may sound as if I'm against AI or whatever, I'm not. We are for AI adoption, we are for AI scaling, but we are for reliable, responsible, ethical way of adoption, development, and scaling of activities. But walk me through, you're a company, you're trying to begin to implement AI. What does that stack look like potentially?
13
00:05:37.227 --> 00:06:01.966
I think the first thing that we need to ask the company is like, what are you actually putting that AI for? What task are we going to be handling? And then we can talk about the stack. Let's give that emoji example. That emoji example was orchestrated by Pakistani attackers and they took down banks and so on and so forth. It was really impactful.
14
00:06:02.860 --> 00:06:32.560
And no one really saw it coming. And it came on, if I'm not mistaken, it came on a customer facing chatbot. A simple thing like that. So if you're talking of that customer facing chatbot, is it going to be connected to the customer data? Is it going to be giving additional approval points similar to Instagram as an example was giving a new two factor authentication links with different email ID? I don't know if you've seen that or not.
15
00:06:33.100 --> 00:06:54.042
So that was the Meta's AI failure around three, four weeks ago, approximately as well. If you look into all these activities, the access points are the most important kind of stack that we need to really think about it. What are we automating? If I'm just automating, what time is my flight?
16
00:06:54.667 --> 00:07:21.143
and I'm just going to be giving a read-only access to my ticket and connect a read-only access to the flight time, I don't really need to care much around it. It's okay. It's very straightforward. Connect A to B to C and it's set. But if you're going to give, let's say, this AI engine ability to change my flight, then we are talking about something different. In here, there is a personal identifier inside.
17
00:07:21.650 --> 00:07:40.685
But not only that, there is no ability to connect to my bank account. There is an ability to change and make changes to my itinerary. And perhaps even send me to some wrong location as well. So access controls are very important and we need to really think around it like
18
00:07:40.853 --> 00:08:03.179
What action are we taking under what circumstances? What is the deliverable that we are looking at? And what is the worst case scenario that thinks that can happen? And where are we sending data? How is the data being communicated back to us? These are the six very important variables that we need to really look into when it comes to data security, AI security, and AI adoption overall.
19
00:08:05.086 --> 00:08:32.761
If you're just building on Claude within the Claude environment or on OpenAI, are these problems that you will face or does this only become a big issue when you begin to layer on different models and different tool sets together? If you are going to be just using as is the way it is, Claude code or whatever, I would not do that. Especially if I'm a company that's producing novel IP.
20
00:08:33.487 --> 00:08:50.935
there is no way that I would actually utilize whether it's cursor or cloud or whatsoever. Because they are transmitting the way it is. There is near no barrier in there. The only barrier they are putting in there is actually to protect themselves.
21
00:08:51.222 --> 00:09:18.880
The cloud right now is not talking about how they're going to be protecting you. They're protecting themselves from legal actions. I'm sure you've seen the mythos to Fable and Blabla, the guardrails that has been there. In none of those guardrailing that there was placed, the customers were never the security aspect. They were trying to secure their own IP. But the same way that they're securing their own IP or they're securing their own operation,
22
00:09:19.184 --> 00:09:46.792
I need to be worried about my or securing my own operation too. And that let's just make it a simple thing. We keep on hearing that AI DLP, AI DLP should not be the target. We should be really looking into adopting everything, but putting an AI firewall. However, when we say about or talk about firewall, the traditional approach is that a lower deny, right?
23
00:09:47.467 --> 00:10:13.268
In AI world, especially in agentic activity that you mentioned about cloud as an example, allow or deny will not really work and deliver much of the development for you or automation or productivity increase that you're looking for. So from that perspective, you need to think around allow, deny, fix, proceed. So if something is denied, you need to be fixing it on the go, on the fly, in line.
24
00:10:13.775 --> 00:10:42.985
So you still proceed forward. There is no workflow change or workflow alteration. So from that perspective, there is a methodology that we ourselves are utilizing. We are building it with Gartner as an example, which we call it AI behavioral control. So the behavioral control is actually warning the engine and also warning the user and changing and fixing everything in the middle on the fly.
25
00:10:43.407 --> 00:11:07.589
So that all the operations are actually real time. You don't. What's a warning it for? Like what's the example that would trigger a warning? So let's say you are, you're putting your social, client social security number somewhere. Right. If it's a chat bot, the user immediately would be seeing it real time. That as you are typing it, it would show that it's in red, but you press submit and you send it.
26
00:11:07.927 --> 00:11:35.568
on the fly, inline, the engine takes it, anonymize it, matches it to the relevant party that has a kind of like similar token approach and then brings it back to you. What is interesting about what you said before is you're the CEO of a $50 million company or you're at home trying to keep up with the times, teaching yourself how to use Claude code.
27
00:11:36.597 --> 00:12:03.327
Inherently by opening up Claude Code on my laptop at home, am I automatically exposing myself to certain secure? I am. Okay, so what am I doing when that happens? As I go tell all my friends, you have to go on Claude Code. You have to go learn about the future. What am I advising them to go into poorly? So it really depends on who your friends are or who the connections are.
28
00:12:04.188 --> 00:12:26.885
If it is a party that just is tinkering and trying to create something and just you are more of a kind of like an idea tinkerer and you're utilizing a prompt to generate some code from the cloud code. In that example, I mean, you are actually getting more from the engine than you're giving it.
29
00:12:27.256 --> 00:12:53.581
Even going back real quickly to that other example, I'm just giving it a prompt, but when Claude comes or any of them come back, they're coming back with deep amounts of code that they're building folders and whatnot in libraries on my computer or at company computers. Should we all be worried that they're just putting bad code or at-risk code onto our computers and onto our servers? Or is that not really something that we need to think about?
30
00:12:54.678 --> 00:13:23.416
I'm not worried much about the code quality right now as these engines are not really built to actually intentionally put bad or malicious code into your own environment. It's not the code. It's about the access points. What sorts of access points in the code that you're actually giving it to the engine that you need to be worried about. I'll give you one example in here and I think it's actually a great example.
31
00:13:23.821 --> 00:13:48.965
Google, we all know Google, we all know Gemini. So earlier this year, Google's Gemini somehow decided to connect the Google Maps API and make it the same thing as the company's Gemini API. So your public looking Google Map API was the same thing as your company Gemini API.
32
00:13:49.403 --> 00:14:17.365
So for us, as an example, it came out to be a $17,000 bill for something that we never really used. It was not ever because of our activity. And Google actually tried to blame it on us and still has not returned that money back to us. In our case, we were fortunate that we are a venture-backed company. We can afford the $17,000 loss. But so many other firms did not
33
00:14:17.753 --> 00:14:42.020
you know, small companies, they did not manage to do such kind of payment. And Google actually just deducts the money out of your credit card right away. Right? So how did it happen in that example? Gemini somehow got to give that access control onto that API code, unifying it, kind of like saving them time of storing the API keys.
34
00:14:42.475 --> 00:14:55.790
But that itself, the access control, became the big problem in there. And shout out to Google from here that you need to return our money. I don't need to chase you. You need to give it back.
35
00:14:57.933 --> 00:15:24.815
So you go in for a meeting, you are nervous about plugging the dongle into the computer. But meanwhile, everyone's admitting all of these note takers and people are secretly recording meetings. And I've no idea where that is going. You never know if you're being recorded, you have to always assume you are. And it's unclear where that information is going. How should we all think about
36
00:15:24.983 --> 00:15:50.853
is meeting security digitally now, given that almost everything is being sort of seen by multiple systems? I think I actually around like three months ago, I did an in-depth dive in on meeting not takers. And if you type my name and meeting not takers security, it should pop up. I believe it's in cybersecurity insiders that that has been
37
00:15:51.258 --> 00:16:15.997
If I remember right, at any given, whatever the technology that you're looking at, there, your data is actually being transmitted to seven different providers. Oh, really? Not one, seven different providers. And no matter whomever gives you whatever sort of, of your, the enterprise solution, they don't, they themselves don't have really much, much security.
38
00:16:16.402 --> 00:16:42.760
In that example, what happens is that your voice gets to be transmitted to a transcriber. They can come and say that, oh, we are using a local whisper, whisper flow or something like that in there. And then you wake up that you've actually given everything. It can write an email. It can pull your calendar details. It has the biometrics identifiers on you. It has the IP knowledge about all your meeting context.
39
00:16:43.165 --> 00:16:58.370
And it knows where the email it should be sending it to. And then we are talking about Warren Buffett talking in front of Berkshire Hathaway as a deep fake. And people are saying like, oh, he's actually there until they actually announce that it's not a real Warren Buffett.
40
00:17:01.795 --> 00:17:27.260
So that sounds concerning. I mean, not to... Are you sure that it's concerning? The biometric thing is scary, right? Because how far away are we from you being able, or any system be able to find a few private or public recordings and then turn that into more or less a biometric replica?
41
00:17:28.627 --> 00:17:56.639
I just need right now three to five seconds of your voice or video to be able to act like you talk like you're... It's not really that difficult anymore. I am not really anymore focusing more on how to protect myself being deep faked, meaning my own voice. That's the last battle, yeah.
42
00:17:57.010 --> 00:18:20.534
Because we are already, I mean, anyone that's looking into this, they can already copy my voice and they already have enough data out there, right? What it is on the other side is empowering the CISOs and risk people on how to be able to detect those things in real time. I don't want to be promotional on that side. We actually just announced a product called Meeting Guard.
43
00:18:21.260 --> 00:18:47.045
So on Meeting Guard, what we focus on is not even the deepfakes immediately because deepfakes are themselves connected to an AI agent behind the scene, right? So what happens most of the time, it's not just the audio or the video that gives it away, it's the context of it. Again, going back to my very first part, I'm more worried about the context element.
44
00:18:47.365 --> 00:19:10.315
So when we look into the context, what is being said instead of how it is being said, the meeting guard actually real-time highlights the part that is even you may be a real person reading from AI, it would be able to identify, highlight that for you. And that becomes a huge game changer even for recruiters now.
45
00:19:10.720 --> 00:19:35.527
as people are reading from AI tools when they are answering like complicated recruitment questions. Oh, wait, walk me through that for a second. Yeah, that's good. Yeah, what's going on there? So as we speak right now, six out of 10 interviews that recruiters are having, they are cheating with AI.
46
00:19:36.505 --> 00:20:02.965
And they are not cheating with neither deepfakes nor teaching or wishing anyone. They're utilizing this tool called Glass solution. Glass solution cannot be captured even with screen sharing. So if I'm looking at it right now and I would screen share my entirety of the screen, you would not be able to see if I'm reading from AI. So you ask me a question.
47
00:20:03.387 --> 00:20:29.594
It has an access to microphone and I can connect it to whatever AI engine that I want to utilize. I can connect it to cloud or open AI solutions or even Kimi or whatever it is. And you ask a question and immediately speaking in front of me there are the answers. All I have to do is read it. So it's like a teleprompter on my monitor that basically is telling me?
48
00:20:30.202 --> 00:20:54.822
And it has happened to us as an example, you know, for us, when we recruit one person, we generally go through around 1200 candidates. For every one person for us to hire, we go through 1200 people. And three times we hired a candidate and I'm saying a candidate, three different parties. They were like, I've never really seen such an amazing candidate.
49
00:20:55.497 --> 00:21:12.743
I was excited for the day to come to work with those guys. And these guys lasted less than 10 days. Within 10 days, we were like, okay, who are you? Why are you here even? Like, how did you get here?
50
00:21:13.148 --> 00:21:32.487
We basically looked into the recordings and so on and built the technology to detect it for ourselves. And now finance people, recruiters, talent acquisition leaders, et cetera, utilized in this solution. But this is my favorite question to ask guys like you, which is, you know, everyone...
51
00:21:33.702 --> 00:22:01.613
everyone is encouraged to use AI in most companies right now. There's CEO mandates to use AI. And as we sit now, I'm sitting at an event where we're all talking about how to get our companies to build more with AI. And yet all of this stuff are existential risks that are happening. So how do we need to think about putting together the guardrails
52
00:22:02.356 --> 00:22:23.112
to push, push, push, expose the data to the models that we want to expose, but also control it when the average, you know, we're all remote. We've got people in different countries. You've got people at different skill sets. It's just so overwhelming for most of us to think about where to start. So like if you're in our shoes, how do you think you would approach this or what advice would you give us?
53
00:22:23.602 --> 00:22:49.859
I'm gonna be a little promotional in here. The problem that I see Keith with everybody is that it's not the technology problem, it's the people problem or the user problem. So what we do for those people is we give every end user a desktop application. You've used a Grammarly before, right? You know what's Grammarly. So similar to Grammarly, this engine is a contextual privacy engine.
54
00:22:50.078 --> 00:23:16.285
that's tied to your company, what do you call policy, that's assigned to you. So as you are engaging with any tool and it requires zero integration to anything, you get to see what you should not be really doing. Even if you don't even stop it, we get to see that within two days, three days, your average DLP violations, quote, DLP is data leak prevention,
55
00:23:16.893 --> 00:23:43.893
the DLP violation goes down by 72 to 78%. So what it shows us is that people are too much under pressure and they make mistakes in general. So when we fix that part, what is left for us is now the 22%, 22 to 28% of the problems. Is that where everything is going to end up, that we all have these sort of...
56
00:23:44.551 --> 00:24:10.724
desktop based controls because more and more, I mean, I'm just looking at my own little stack here, right? I've got cowork, I've got granola, I've got this, I've got that. Like, and when they're all like, who's going to, who controls what in that environment, right? Like who's ultimately the decision maker as to what's safe and secure and what's not. If you don't own your data, someone else owns you.
57
00:24:11.973 --> 00:24:32.510
Tell me this yourself. If you had the ability to disable everywhere, on every application, unless it's an email input and password input, anyone to ever see your email and your password, would you not anonymize that, eliminate that? Yeah, probably. I mean, it seems to be a good idea.
58
00:24:32.847 --> 00:25:02.328
Why not? Right. If I'm not putting into an email input and or password input, why should I ever share that with anyone or put it anywhere? What's your personal tech stack? Like, what do you use? Like, just out of curiosity, like, what do you feel comfortable installing on your computer? And we have some sort of a coder. Let's just call it. It's not cloud. Uh, it's not from cloud, but it has a cloud word on it. The old school, uh,
59
00:25:03.138 --> 00:25:25.210
We have put a guardrails on it. So for coding related stuff, we are utilizing that. Awesome, well thank you so much. This was great. I mean, less scary than I would have thought. So I don't know why you're appropriately paranoid, but you're not afraid of the future, which is great. So thank you. The future is in our control, right? I like that.
1
00:00:00.031 --> 00:00:25.192
Six out of 10 interviews that recruiters are having, they are cheating with AI. They're utilizing this tool called Glass Solution. So you ask me a question, it has access to microphone, and I can connect it to whatever AI engine that I want to utilize. And immediately speaking, in front of me, there are the answers. All I have to do is read it.
2
00:00:35.587 --> 00:01:03.363
I know your friends call you Mr. Paranoid, and there's probably a good reason for that. So I'd just love to understand what's the background of that, and what are you paranoid about now? I think it's just me being everything. That's the easy answer. But overall speaking, I'm a very optimistic person. But behind the scene of optimism, I always see the negativity in everything.
3
00:01:03.751 --> 00:01:32.168
I'm going to take as an example, last week, we are at the oil company. They wanted me to connect my laptop to their screen to show stuff. And I'm looking at it. They're giving me a dongle. That dongle has something on it. And for three minutes, I'm looking around it, reading behind it, and turning around everything while my head of product next to me on R is like, it's okay. Just give it to me. And he told me.
4
00:01:32.557 --> 00:01:59.219
He just puts it on his laptop. I would never have done that thing like on my laptop alone. And when he opens it as just the way that I thought, there is an execution file in that dongle. So I unintentionally have started seeing the operational activities of every technology that I'm utilizing. And that makes me see things very crazily difficult.
5
00:01:59.759 --> 00:02:29.071
Yeah, so when you're hesitant on that, this is not at all on topic, but it's fascinating. You know, when we plug into situations like that, what can they do to our computer? Like what could happen? Everything. Have you seen like QR codes when you're walking in some places saying like, have you seen my llama or have you seen my horse? I really hope that you have never scanned it. I can take over your entirety of your activities with just a single QR code.
6
00:02:29.830 --> 00:02:55.345
As of right now, I can orchestrate a structure for your agentic AI activity by sending literally emojis to you, to your AI chat, and take over your entirety of the agentic activity. So things that are looking normal are not really normal. There is, I keep on always saying, kids, to everyone that
7
00:02:55.784 --> 00:03:23.020
Contextuality has become the most difficult cyber element of the world, where the world is actually ignoring it still. So let's just give an example that you're very, very discreet and very, very private person. You don't give your name to AI tools, you don't give, I don't know, where you live and so on and so forth.
8
00:03:24.387 --> 00:03:42.494
But as you are typing and engaging with these tools more and more, they actually start building context intelligence around you. With that context intelligence, we can just triangulate you or triangulate the whole social activities and start basically
9
00:03:42.899 --> 00:04:08.532
looking for a Caucasian person between the age of 30 to 45. I don't know, in some place that you're gonna be talking, you may be sleeping something that you are married or you have a kid or this and that. You are a podcast host, et cetera, et cetera. The context becomes basically mosaic intelligence that actually tells everything about you. And with it, it's no longer just important about
10
00:04:09.173 --> 00:04:39.059
the traditional HIPAAs or traditional GDPRs and so on, the context breaches all the HIPAA regulations, as an example, in healthcare world. GDPR does not really apply anymore because the context has given everything around you. Is that overwhelming? At some point, do we give them so much information that we're all exposed and it's too hard to get through or?
11
00:04:39.363 --> 00:05:07.139
You know, when I started Polygraph, I started with the context in mind because I saw things really again difficult and different. And I kept on literally telling everyone that you're going to be paying AI twice, first with your data, with your money, second with your data. And two weeks ago, I heard exact same wording for the first time from someone else. That was such a from Microsoft actually saying.
12
00:05:07.510 --> 00:05:36.265
who led the LLM evolution. Now, the way that I'm talking, I may sound as if I'm against AI or whatever, I'm not. We are for AI adoption, we are for AI scaling, but we are for reliable, responsible, ethical way of adoption, development, and scaling of activities. But walk me through, you're a company, you're trying to begin to implement AI. What does that stack look like potentially?
13
00:05:37.227 --> 00:06:01.966
I think the first thing that we need to ask the company is like, what are you actually putting that AI for? What task are we going to be handling? And then we can talk about the stack. Let's give that emoji example. That emoji example was orchestrated by Pakistani attackers and they took down banks and so on and so forth. It was really impactful.
14
00:06:02.860 --> 00:06:32.560
And no one really saw it coming. And it came on, if I'm not mistaken, it came on a customer facing chatbot. A simple thing like that. So if you're talking of that customer facing chatbot, is it going to be connected to the customer data? Is it going to be giving additional approval points similar to Instagram as an example was giving a new two factor authentication links with different email ID? I don't know if you've seen that or not.
15
00:06:33.100 --> 00:06:54.042
So that was the Meta's AI failure around three, four weeks ago, approximately as well. If you look into all these activities, the access points are the most important kind of stack that we need to really think about it. What are we automating? If I'm just automating, what time is my flight?
16
00:06:54.667 --> 00:07:21.143
and I'm just going to be giving a read-only access to my ticket and connect a read-only access to the flight time, I don't really need to care much around it. It's okay. It's very straightforward. Connect A to B to C and it's set. But if you're going to give, let's say, this AI engine ability to change my flight, then we are talking about something different. In here, there is a personal identifier inside.
17
00:07:21.650 --> 00:07:40.685
But not only that, there is no ability to connect to my bank account. There is an ability to change and make changes to my itinerary. And perhaps even send me to some wrong location as well. So access controls are very important and we need to really think around it like
18
00:07:40.853 --> 00:08:03.179
What action are we taking under what circumstances? What is the deliverable that we are looking at? And what is the worst case scenario that thinks that can happen? And where are we sending data? How is the data being communicated back to us? These are the six very important variables that we need to really look into when it comes to data security, AI security, and AI adoption overall.
19
00:08:05.086 --> 00:08:32.761
If you're just building on Claude within the Claude environment or on OpenAI, are these problems that you will face or does this only become a big issue when you begin to layer on different models and different tool sets together? If you are going to be just using as is the way it is, Claude code or whatever, I would not do that. Especially if I'm a company that's producing novel IP.
20
00:08:33.487 --> 00:08:50.935
there is no way that I would actually utilize whether it's cursor or cloud or whatsoever. Because they are transmitting the way it is. There is near no barrier in there. The only barrier they are putting in there is actually to protect themselves.
21
00:08:51.222 --> 00:09:18.880
The cloud right now is not talking about how they're going to be protecting you. They're protecting themselves from legal actions. I'm sure you've seen the mythos to Fable and Blabla, the guardrails that has been there. In none of those guardrailing that there was placed, the customers were never the security aspect. They were trying to secure their own IP. But the same way that they're securing their own IP or they're securing their own operation,
22
00:09:19.184 --> 00:09:46.792
I need to be worried about my or securing my own operation too. And that let's just make it a simple thing. We keep on hearing that AI DLP, AI DLP should not be the target. We should be really looking into adopting everything, but putting an AI firewall. However, when we say about or talk about firewall, the traditional approach is that a lower deny, right?
23
00:09:47.467 --> 00:10:13.268
In AI world, especially in agentic activity that you mentioned about cloud as an example, allow or deny will not really work and deliver much of the development for you or automation or productivity increase that you're looking for. So from that perspective, you need to think around allow, deny, fix, proceed. So if something is denied, you need to be fixing it on the go, on the fly, in line.
24
00:10:13.775 --> 00:10:42.985
So you still proceed forward. There is no workflow change or workflow alteration. So from that perspective, there is a methodology that we ourselves are utilizing. We are building it with Gartner as an example, which we call it AI behavioral control. So the behavioral control is actually warning the engine and also warning the user and changing and fixing everything in the middle on the fly.
25
00:10:43.407 --> 00:11:07.589
So that all the operations are actually real time. You don't. What's a warning it for? Like what's the example that would trigger a warning? So let's say you are, you're putting your social, client social security number somewhere. Right. If it's a chat bot, the user immediately would be seeing it real time. That as you are typing it, it would show that it's in red, but you press submit and you send it.
26
00:11:07.927 --> 00:11:35.568
on the fly, inline, the engine takes it, anonymize it, matches it to the relevant party that has a kind of like similar token approach and then brings it back to you. What is interesting about what you said before is you're the CEO of a $50 million company or you're at home trying to keep up with the times, teaching yourself how to use Claude code.
27
00:11:36.597 --> 00:12:03.327
Inherently by opening up Claude Code on my laptop at home, am I automatically exposing myself to certain secure? I am. Okay, so what am I doing when that happens? As I go tell all my friends, you have to go on Claude Code. You have to go learn about the future. What am I advising them to go into poorly? So it really depends on who your friends are or who the connections are.
28
00:12:04.188 --> 00:12:26.885
If it is a party that just is tinkering and trying to create something and just you are more of a kind of like an idea tinkerer and you're utilizing a prompt to generate some code from the cloud code. In that example, I mean, you are actually getting more from the engine than you're giving it.
29
00:12:27.256 --> 00:12:53.581
Even going back real quickly to that other example, I'm just giving it a prompt, but when Claude comes or any of them come back, they're coming back with deep amounts of code that they're building folders and whatnot in libraries on my computer or at company computers. Should we all be worried that they're just putting bad code or at-risk code onto our computers and onto our servers? Or is that not really something that we need to think about?
30
00:12:54.678 --> 00:13:23.416
I'm not worried much about the code quality right now as these engines are not really built to actually intentionally put bad or malicious code into your own environment. It's not the code. It's about the access points. What sorts of access points in the code that you're actually giving it to the engine that you need to be worried about. I'll give you one example in here and I think it's actually a great example.
31
00:13:23.821 --> 00:13:48.965
Google, we all know Google, we all know Gemini. So earlier this year, Google's Gemini somehow decided to connect the Google Maps API and make it the same thing as the company's Gemini API. So your public looking Google Map API was the same thing as your company Gemini API.
32
00:13:49.403 --> 00:14:17.365
So for us, as an example, it came out to be a $17,000 bill for something that we never really used. It was not ever because of our activity. And Google actually tried to blame it on us and still has not returned that money back to us. In our case, we were fortunate that we are a venture-backed company. We can afford the $17,000 loss. But so many other firms did not
33
00:14:17.753 --> 00:14:42.020
you know, small companies, they did not manage to do such kind of payment. And Google actually just deducts the money out of your credit card right away. Right? So how did it happen in that example? Gemini somehow got to give that access control onto that API code, unifying it, kind of like saving them time of storing the API keys.
34
00:14:42.475 --> 00:14:55.790
But that itself, the access control, became the big problem in there. And shout out to Google from here that you need to return our money. I don't need to chase you. You need to give it back.
35
00:14:57.933 --> 00:15:24.815
So you go in for a meeting, you are nervous about plugging the dongle into the computer. But meanwhile, everyone's admitting all of these note takers and people are secretly recording meetings. And I've no idea where that is going. You never know if you're being recorded, you have to always assume you are. And it's unclear where that information is going. How should we all think about
36
00:15:24.983 --> 00:15:50.853
is meeting security digitally now, given that almost everything is being sort of seen by multiple systems? I think I actually around like three months ago, I did an in-depth dive in on meeting not takers. And if you type my name and meeting not takers security, it should pop up. I believe it's in cybersecurity insiders that that has been
37
00:15:51.258 --> 00:16:15.997
If I remember right, at any given, whatever the technology that you're looking at, there, your data is actually being transmitted to seven different providers. Oh, really? Not one, seven different providers. And no matter whomever gives you whatever sort of, of your, the enterprise solution, they don't, they themselves don't have really much, much security.
38
00:16:16.402 --> 00:16:42.760
In that example, what happens is that your voice gets to be transmitted to a transcriber. They can come and say that, oh, we are using a local whisper, whisper flow or something like that in there. And then you wake up that you've actually given everything. It can write an email. It can pull your calendar details. It has the biometrics identifiers on you. It has the IP knowledge about all your meeting context.
39
00:16:43.165 --> 00:16:58.370
And it knows where the email it should be sending it to. And then we are talking about Warren Buffett talking in front of Berkshire Hathaway as a deep fake. And people are saying like, oh, he's actually there until they actually announce that it's not a real Warren Buffett.
40
00:17:01.795 --> 00:17:27.260
So that sounds concerning. I mean, not to... Are you sure that it's concerning? The biometric thing is scary, right? Because how far away are we from you being able, or any system be able to find a few private or public recordings and then turn that into more or less a biometric replica?
41
00:17:28.627 --> 00:17:56.639
I just need right now three to five seconds of your voice or video to be able to act like you talk like you're... It's not really that difficult anymore. I am not really anymore focusing more on how to protect myself being deep faked, meaning my own voice. That's the last battle, yeah.
42
00:17:57.010 --> 00:18:20.534
Because we are already, I mean, anyone that's looking into this, they can already copy my voice and they already have enough data out there, right? What it is on the other side is empowering the CISOs and risk people on how to be able to detect those things in real time. I don't want to be promotional on that side. We actually just announced a product called Meeting Guard.
43
00:18:21.260 --> 00:18:47.045
So on Meeting Guard, what we focus on is not even the deepfakes immediately because deepfakes are themselves connected to an AI agent behind the scene, right? So what happens most of the time, it's not just the audio or the video that gives it away, it's the context of it. Again, going back to my very first part, I'm more worried about the context element.
44
00:18:47.365 --> 00:19:10.315
So when we look into the context, what is being said instead of how it is being said, the meeting guard actually real-time highlights the part that is even you may be a real person reading from AI, it would be able to identify, highlight that for you. And that becomes a huge game changer even for recruiters now.
45
00:19:10.720 --> 00:19:35.527
as people are reading from AI tools when they are answering like complicated recruitment questions. Oh, wait, walk me through that for a second. Yeah, that's good. Yeah, what's going on there? So as we speak right now, six out of 10 interviews that recruiters are having, they are cheating with AI.
46
00:19:36.505 --> 00:20:02.965
And they are not cheating with neither deepfakes nor teaching or wishing anyone. They're utilizing this tool called Glass solution. Glass solution cannot be captured even with screen sharing. So if I'm looking at it right now and I would screen share my entirety of the screen, you would not be able to see if I'm reading from AI. So you ask me a question.
47
00:20:03.387 --> 00:20:29.594
It has an access to microphone and I can connect it to whatever AI engine that I want to utilize. I can connect it to cloud or open AI solutions or even Kimi or whatever it is. And you ask a question and immediately speaking in front of me there are the answers. All I have to do is read it. So it's like a teleprompter on my monitor that basically is telling me?
48
00:20:30.202 --> 00:20:54.822
And it has happened to us as an example, you know, for us, when we recruit one person, we generally go through around 1200 candidates. For every one person for us to hire, we go through 1200 people. And three times we hired a candidate and I'm saying a candidate, three different parties. They were like, I've never really seen such an amazing candidate.
49
00:20:55.497 --> 00:21:12.743
I was excited for the day to come to work with those guys. And these guys lasted less than 10 days. Within 10 days, we were like, okay, who are you? Why are you here even? Like, how did you get here?
50
00:21:13.148 --> 00:21:32.487
We basically looked into the recordings and so on and built the technology to detect it for ourselves. And now finance people, recruiters, talent acquisition leaders, et cetera, utilized in this solution. But this is my favorite question to ask guys like you, which is, you know, everyone...
51
00:21:33.702 --> 00:22:01.613
everyone is encouraged to use AI in most companies right now. There's CEO mandates to use AI. And as we sit now, I'm sitting at an event where we're all talking about how to get our companies to build more with AI. And yet all of this stuff are existential risks that are happening. So how do we need to think about putting together the guardrails
52
00:22:02.356 --> 00:22:23.112
to push, push, push, expose the data to the models that we want to expose, but also control it when the average, you know, we're all remote. We've got people in different countries. You've got people at different skill sets. It's just so overwhelming for most of us to think about where to start. So like if you're in our shoes, how do you think you would approach this or what advice would you give us?
53
00:22:23.602 --> 00:22:49.859
I'm gonna be a little promotional in here. The problem that I see Keith with everybody is that it's not the technology problem, it's the people problem or the user problem. So what we do for those people is we give every end user a desktop application. You've used a Grammarly before, right? You know what's Grammarly. So similar to Grammarly, this engine is a contextual privacy engine.
54
00:22:50.078 --> 00:23:16.285
that's tied to your company, what do you call policy, that's assigned to you. So as you are engaging with any tool and it requires zero integration to anything, you get to see what you should not be really doing. Even if you don't even stop it, we get to see that within two days, three days, your average DLP violations, quote, DLP is data leak prevention,
55
00:23:16.893 --> 00:23:43.893
the DLP violation goes down by 72 to 78%. So what it shows us is that people are too much under pressure and they make mistakes in general. So when we fix that part, what is left for us is now the 22%, 22 to 28% of the problems. Is that where everything is going to end up, that we all have these sort of...
56
00:23:44.551 --> 00:24:10.724
desktop based controls because more and more, I mean, I'm just looking at my own little stack here, right? I've got cowork, I've got granola, I've got this, I've got that. Like, and when they're all like, who's going to, who controls what in that environment, right? Like who's ultimately the decision maker as to what's safe and secure and what's not. If you don't own your data, someone else owns you.
57
00:24:11.973 --> 00:24:32.510
Tell me this yourself. If you had the ability to disable everywhere, on every application, unless it's an email input and password input, anyone to ever see your email and your password, would you not anonymize that, eliminate that? Yeah, probably. I mean, it seems to be a good idea.
58
00:24:32.847 --> 00:25:02.328
Why not? Right. If I'm not putting into an email input and or password input, why should I ever share that with anyone or put it anywhere? What's your personal tech stack? Like, what do you use? Like, just out of curiosity, like, what do you feel comfortable installing on your computer? And we have some sort of a coder. Let's just call it. It's not cloud. Uh, it's not from cloud, but it has a cloud word on it. The old school, uh,
59
00:25:03.138 --> 00:25:25.210
We have put a guardrails on it. So for coding related stuff, we are utilizing that. Awesome, well thank you so much. This was great. I mean, less scary than I would have thought. So I don't know why you're appropriately paranoid, but you're not afraid of the future, which is great. So thank you. The future is in our control, right? I like that.
