WEBVTT
00:00:03.359 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.039 --> 00:00:17.280
Everyone's rushing to deploy it.
00:00:17.280 --> 00:00:19.679
Nobody's rushing to audit it.
00:00:19.679 --> 00:00:24.399
You've maybe done some tabletops around ransomware or data leakage.
00:00:24.399 --> 00:00:27.359
But who's actually looking at your AI?
00:00:27.359 --> 00:00:30.800
That's the job of internal audit.
00:00:30.800 --> 00:00:36.640
And today's guest has been doing it for real at Norway's largest insurer.
00:00:36.640 --> 00:00:39.679
He reports directly to the board.
00:00:39.679 --> 00:00:42.880
Not the CEO, just the board.
00:00:42.880 --> 00:00:47.759
Which means he can walk into any room in the company and ask uncomfortable questions.
00:00:47.759 --> 00:00:50.320
And nobody can tell him to stop.
00:00:50.320 --> 00:00:53.119
His name is Gaute.
00:00:53.119 --> 00:01:00.159
And he might be the only person I've spoken to who makes auditing sound like the most interesting job in the building.
00:01:00.159 --> 00:01:04.079
Gaute Brynildsen, welcome to the podcast.
00:01:04.400 --> 00:01:04.959
Thank you.
00:01:04.959 --> 00:01:06.400
Glad to be here.
00:01:06.719 --> 00:01:11.040
Today I want to pick your brain about auditing AI.
00:01:11.920 --> 00:01:12.239
Yes.
00:01:12.560 --> 00:01:14.480
What world of audit do you live in?
00:01:14.879 --> 00:01:21.359
What I don't like about the word audit is that most people, when they think about audit, they are thinking about financial audit.
00:01:21.359 --> 00:01:28.640
Financial audit is more about checking controls specific for the accounts and they're looking backwards.
00:01:28.640 --> 00:01:32.640
In the internal auditing, we are looking at all risk dimensions.
00:01:32.640 --> 00:01:36.079
So basically, how will the company improve?
00:01:36.079 --> 00:01:46.959
It's one of the most underestimated, interesting professions to have, where you have all the possibilities to change the company.
00:01:46.959 --> 00:02:02.879
Because we have insight into everything that happens from the board of directors and down into the nitty-gritty details of everything, from how you run claims or how you do investments or how you handle the bank accounts or how you handle IT or AI for that sense.
00:02:02.879 --> 00:02:07.439
So we are a function that reports directly to the board of directors.
00:02:07.439 --> 00:02:11.840
So the board of directors hire two people in the company: it's the CEO and me.
00:02:11.840 --> 00:02:18.240
The CEO can't direct me, he can have opinions about my work, but I can also not care.
00:02:18.240 --> 00:02:20.560
That wouldn't be constructive.
00:02:20.560 --> 00:02:29.439
And the best thing about internal audit is that you get to talk to anyone, you get access to all the information, and you learn something new every day.
00:02:29.439 --> 00:02:32.400
It's never, almost never the same audit.
00:02:32.400 --> 00:02:42.000
Everything about governance, culture, understanding the business as much as it's understanding the models and uh how AI works.
00:02:42.000 --> 00:02:44.960
So I just wanted to say that about internal audit.
00:02:44.960 --> 00:02:48.719
I think it's because most people don't know what internal audit is.
00:02:48.719 --> 00:02:53.039
We're there uh to help improve the company.
00:02:54.800 --> 00:03:02.319
Over time, since you started working with audit, how I'm kind of imagining you sitting in a lot of meetings before, sort of interviewing people.
00:03:02.319 --> 00:03:03.759
That may be like that today.
00:03:03.759 --> 00:03:09.360
I know that you still have to talk to people, but how is that sort of journey been the transformation, or is it still the same?
00:03:09.840 --> 00:03:12.400
Internal audit is a communication field.
00:03:12.400 --> 00:03:15.599
So basically, in how do you actually create change?
00:03:15.599 --> 00:03:23.199
And it's about having good communication, having the same conceptual understanding about things with people.
00:03:23.199 --> 00:03:26.400
It's still a human job.
00:03:26.400 --> 00:03:30.879
But of course, we use a lot of AI to help us do uh audit.
00:03:30.879 --> 00:03:36.879
So we did one strategic choice early when ChatGPT became popular.
00:03:36.879 --> 00:03:39.280
So we made a strategic choice.
00:03:39.280 --> 00:03:41.199
What are we gonna focus on now?
00:03:41.199 --> 00:03:48.879
Are we gonna focus on we will use AI to improve ourselves, or we will teach ourselves how to audit AI?
00:03:48.879 --> 00:03:52.319
So we chose the most difficult thing.
00:03:52.319 --> 00:03:55.280
And that was how to audit AI.
00:03:55.280 --> 00:03:58.479
And we went straight into a machine learning model.
00:03:58.800 --> 00:04:04.639
When you say machine learning model, that's not like something from OpenAI or Anthropic.
00:04:04.639 --> 00:04:07.599
You are auditing your own machine learning model.
00:04:07.599 --> 00:04:08.560
Can you clarify that a little bit?
00:04:08.560 --> 00:04:08.879
Yeah.
00:04:09.039 --> 00:04:18.000
So basically, it's not a pre-trained model, it's a model uh which is a machine learning algorithm, which we only train on our data.
00:04:18.000 --> 00:04:22.879
So it doesn't take any bias in from other data that we don't know.
00:04:22.879 --> 00:04:27.600
We know that the model uh itself, we know what it does.
00:04:27.600 --> 00:04:35.920
Uh, but of course it creates a lot of vectors that we it's immensely complex because we put a lot of data into it.
00:04:35.920 --> 00:04:50.800
And when we did that audit, uh, one of the key things that we looked at was basically what kind of people were involved in deciding that we would choose uh to use AR for this kind of task.
00:04:50.800 --> 00:04:58.720
What kind of competence did we have in who chose the model, uh, if it was fit for purpose for what we want to solve.
00:04:58.720 --> 00:05:10.079
And one what can go wrong still is that they might not have the critical thinking about what kind of risks are involved when we use this kind of data in that model.
00:05:10.079 --> 00:05:14.639
When we did that, we looked at what data did they put in.
00:05:14.639 --> 00:05:22.639
And knowing that we work with a lot of personal data, we have uh immense amounts of data from our claims, for example.
00:05:22.639 --> 00:05:26.319
So we're all looking what kind of data did you put in there?
00:05:26.319 --> 00:05:28.879
Did you analyze the data first?
00:05:28.879 --> 00:05:35.360
Did you look for anything that was a deviation from the normal set that you didn't want to train it on?
00:05:35.360 --> 00:05:37.199
Did you clean the data?
00:05:37.199 --> 00:05:42.959
All these columns that you put in here, are they relevant for what the model is going to do?
00:05:42.959 --> 00:05:52.079
And does any of it contribute to any bias that we don't want or any discrimination that we don't want?
00:05:52.079 --> 00:05:54.639
Are we allowed to use this data for this?
00:05:54.639 --> 00:05:57.839
So these are the things that we are discussing.
00:05:57.839 --> 00:06:04.319
And that that was one of the key issues that we brought into these topics.
00:06:04.319 --> 00:06:12.160
And we have some government agencies who are working especially around discrimination or sustainability.
00:06:12.160 --> 00:06:18.800
They made a guide for what should you look for when you're looking for bias and discrimination.
00:06:18.800 --> 00:06:22.480
And that model from the government was really good.
00:06:22.480 --> 00:06:26.480
So we use that also as a guide to have these discussions.
00:06:26.480 --> 00:06:44.240
And what is really complex about when you build vectors on data is to understand, even though let's say that we can't discriminate on gender, even though if you don't put gender in it, we would still, with our data, have a possibility to separate gender from it.
00:06:44.240 --> 00:07:01.120
So it's basically finding these hidden patterns that the model will understand and will start to produce output, not because the model wants to discriminate, it doesn't have its own opinion, but from the data, it can actually turn out to discriminate on gender.
00:07:01.120 --> 00:07:15.360
So we are in insurance in Norway not allowed to discriminate on gender for car insurance, for example, which is a huge benefit for us men because we are really bad drivers compared to women, although we like to think differently.
00:07:15.360 --> 00:07:24.319
But the data shows that we have much more expensive claims than uh women, if we take the big numbers, and not me, of course.
00:07:24.319 --> 00:07:25.360
Makes sense.
00:07:25.360 --> 00:07:40.480
But then if you look at them, uh we have to take away the color of the cars, we have to take away some dimensions from the cars uh that to basically reduce the chance of uh this kind of discrimination.
00:07:40.480 --> 00:07:43.680
So this audit taught us a lot.
00:07:43.680 --> 00:07:53.920
So by delving deep into some complexity like this, made us much more able to go to the next audit where probably other audit functions would start.
00:07:53.920 --> 00:08:01.839
Other audit functions would probably start at the more easy thing, which would go for how do we live by the AI Act?
00:08:01.839 --> 00:08:08.000
How do we create policies and governing documents and roles and responsibilities around this?
00:08:08.000 --> 00:08:10.319
Which is also important.
00:08:10.319 --> 00:08:21.199
But when we audited this model, we built a company that was quite unique to be more relevant in the next audit that we did, which was the AI governance audit.
00:08:21.199 --> 00:08:29.680
Where we were looking more at the downside risks, where we were seeing: do we have the right security regulations in place?
00:08:29.680 --> 00:08:31.759
Do we have the right policies in place?
00:08:31.759 --> 00:08:44.159
The risk matrix, how we will govern it, the inventory system, uh, the roles and responsibilities, the awareness training that should be in place, all these kind of communication parts of it.
00:08:44.159 --> 00:08:49.120
So we could have more relevant discussions because we have this experience from before.
00:08:49.120 --> 00:08:52.080
Of course, we have been using Chat GPT, etc.
00:08:52.080 --> 00:08:55.679
So we are we're familiar with this.
00:08:56.080 --> 00:09:02.399
Your context here is insurance and probably making making prices and doing insurance things.
00:09:02.399 --> 00:09:11.039
You were probably one of the few companies in Norway that's actually made your own models, and you've been doing that's the core of your business, I guess.
00:09:11.039 --> 00:09:11.519
Yes.
00:09:11.519 --> 00:09:13.600
So this is nothing new for you in that sense.
00:09:13.600 --> 00:09:14.960
Is that is that correctly understood?
00:09:15.200 --> 00:09:15.759
That's correct.
00:09:15.759 --> 00:09:32.559
And where we came from earlier is that the way we build something called tariffs is a mathematical model where we are trying to calculate the risks based on our data that we have from earlier claims and other extra official data.
00:09:32.559 --> 00:09:40.639
And then we build a risk model called a tariff that will basically put data in and say this will then be the insurance premium.
00:09:40.639 --> 00:09:42.240
It's just statistics.
00:09:42.240 --> 00:09:49.759
It doesn't have the same problems that we have from the model machine learning models that we're using because they're so complex.
00:09:49.759 --> 00:09:54.879
These other models that we were using before, we could totally explain.
00:09:55.440 --> 00:10:02.480
So deterministic, non-deterministic is what you're talking about now, the models that you've been building and auditing.
00:10:02.480 --> 00:10:04.000
Do those hallucinate?
00:10:04.000 --> 00:10:08.159
Or am I because that's different from like one of these frontier models, correct?
00:10:08.399 --> 00:10:17.759
Yeah, so basically what we are did with the machine learning model is that the chance of hallucinating is less because we know what data it was trained on.
00:10:17.759 --> 00:10:20.159
It doesn't contain any other data.
00:10:20.159 --> 00:10:26.559
So basically what it does is basically producing only numerical output for pricing.
00:10:26.559 --> 00:10:36.639
And this is also a thing that a lot of people are missing when they are choosing different AI solutions for different tasks is how do we make them explainable?
00:10:36.639 --> 00:10:41.679
How do you manage to build a model that you can explain?
00:10:41.679 --> 00:10:54.240
So our key concept of the audit of machine learning is that we contributed to making it more explainable and coming closer to what we call the glass box model.
00:10:54.240 --> 00:10:56.480
Can you explain that?
00:10:56.480 --> 00:10:57.360
How do you did that?
00:10:57.360 --> 00:11:20.960
Yeah, so the first phase of it that they did have in place was that they made the model to output to the customer service department or those who were uh going to talk to the customer, giving the I won't say the number of factors, but it's a uh set number of factors that contributed most to the decision.
00:11:20.960 --> 00:11:40.879
So the dangerous thing about implementing AI is that if you are implementing it in anything that affects the customer, and the customer calls back uh or something happened with a decision that they can't explain, you can't have someone sitting there, oh, it's just AI, I don't know what that machine is doing.
00:11:40.879 --> 00:11:43.919
That's gonna be ruining your company.
00:11:43.919 --> 00:11:45.440
So it's gonna be on Vega.
00:11:45.440 --> 00:11:46.159
Yeah, yeah.
00:11:46.159 --> 00:11:49.519
It's uh it's not where you want to end up.
00:11:49.519 --> 00:11:56.480
So we built this uh structure where it basically said that these are the factors that contributed most to that decision.
00:11:56.480 --> 00:12:01.759
Because there could be 1,000 factors, but the most prominent one.
00:12:01.759 --> 00:12:06.000
Once it's uh multiple, uh quite a few actually.
00:12:06.000 --> 00:12:12.480
And I think that's important to enable the customers to get an explanation that is understandable.
00:12:12.480 --> 00:12:14.639
That's one of the factors.
00:12:14.639 --> 00:12:29.840
Now, with the glass box model, we have a more open machine learning model uh that has been developed over time, and we're gonna go back and audit that one and then understand how that is so much more explainable now than it was before.
00:12:29.840 --> 00:12:33.840
So it's been multiple versions going through uh to improve it.
00:12:33.840 --> 00:12:42.320
But I think we were key in contributing to get those discussions in place and start that ball rolling.
00:12:42.320 --> 00:12:53.039
So I think we were recognized by the financial subvisory authorities as the one only one in insurance so far at that time who had audited anything AI, which we were quite proud of.
00:12:53.360 --> 00:12:55.360
Awesome, all the work that you've done.
00:12:55.360 --> 00:12:59.200
Have you tried to audit one of the foundation models?
00:12:59.519 --> 00:13:01.039
I would say yes and no.
00:13:01.039 --> 00:13:12.000
So what you you can't is that uh let's say you take a Lama model or any other model that you find, GPT for all or chat uh RTX or whatever.
00:13:12.000 --> 00:13:19.679
You can't basically know what it's been trained on because it's a model that's been trained on a lot of data.
00:13:19.679 --> 00:13:25.200
And they can maybe tell you what it's been trained on, but it's still gonna be a guess.
00:13:25.200 --> 00:13:41.039
What you can do, of course, is that you can build a model when you train it on your own data and uh you basically start to use the model for your own data, you can build another model or build another system who's gonna uh test and ask questions for from it.
00:13:41.039 --> 00:13:46.320
You can also limit what kind of prompts that you can send to it.
00:13:46.320 --> 00:13:53.679
So you won't get that kind of uh can I make a bomb or what is uh this and this person's salary or something like that.
00:13:53.679 --> 00:14:02.480
So you can do templates for prompts, input, and then you can also do output prompts saying that these are what that model is supposed to do.
00:14:02.480 --> 00:14:04.559
So let's take an example.
00:14:04.559 --> 00:14:17.679
If we have a llama model and I'm training it for the cantina on how to make uh Indian food, then I can basically say that what you're gonna output is only things that have food ingredients in them.
00:14:17.679 --> 00:14:19.200
Nothing else.
00:14:19.200 --> 00:14:22.639
You will only answer it within this and this framework.
00:14:22.639 --> 00:14:28.000
Then you can start to limit hallucination or anything that a bad model can do.
00:14:28.000 --> 00:14:39.440
But you can also start to train it on a very diverse set of questions that you can do structured without AI asking it, to basically test it.
00:14:39.440 --> 00:14:46.159
And then you will uh see if you have a good enough training set, you will be able to try to find something.
00:14:46.159 --> 00:15:01.919
So, for example, if you want to test discrimination, you can test with a set of data that is fit for purpose, where you want to test for does it become a racist or does it do any decisions on gender or things that we don't want.
00:15:01.919 --> 00:15:07.519
And it's easy to create that data and just send it and see do we get different answers?
00:15:07.519 --> 00:15:09.440
Trying diverse sets.
00:15:09.440 --> 00:15:21.919
And the more advanced model is that you start to make an AI challenger model that will challenge the model and start to work with it and then see if it will deviate uh or give a bad output.
00:15:22.480 --> 00:15:25.120
You're at the very mature end of the scale.
00:15:25.120 --> 00:15:34.639
All the other companies that uh I feel like the the vast majority just started, they get started with this, and they're wondering where they should start on their governance journey.
00:15:34.639 --> 00:15:36.320
What would you tell them?
00:15:36.879 --> 00:15:40.720
There are two things that you really need to evaluate.
00:15:40.720 --> 00:15:45.200
One is the employee side of it, shadow AI.
00:15:45.200 --> 00:15:50.399
You don't want to have your data sent out to a public model.
00:15:50.399 --> 00:16:01.120
It's probably not going to happen anything, but it will still be a breach, compliance breach, uh sending data where you're not supposed to send data, especially from a privacy perspective.
00:16:01.120 --> 00:16:12.000
You should as fast as possible try to evaluate uh some models that are generative, give them to your uh employees and make rules.
00:16:12.000 --> 00:16:17.679
Then you mean need to create those boundaries, making awareness, uh, what can we use the different models for?
00:16:17.679 --> 00:16:20.559
Is it okay to use an external model or not, etc.?
00:16:20.559 --> 00:16:23.120
And then you need to monitor it for it.
00:16:23.120 --> 00:16:32.559
So what we did, we did a shadow AI audit, and to make it simple what we did, uh, because we're mostly talking to security people, right?
00:16:32.960 --> 00:16:35.679
I'd be very surprised if anybody else was listening to this.
00:16:35.679 --> 00:16:36.480
But they're welcome.
00:16:36.480 --> 00:16:38.240
I'm listening to your podcast.
00:16:38.559 --> 00:16:43.120
So um what we did was basically ask for the proxy server logs.
00:16:43.120 --> 00:16:52.559
And we got a lot of data out from there, and then we were looking for traces of are they using NODNL and external models that are the most common ones.
00:16:52.559 --> 00:16:55.200
We didn't look for everything, it was like the big ones.
00:16:55.200 --> 00:16:59.440
This this is uh two years ago now, I think.
00:16:59.440 --> 00:17:00.559
Uh I don't remember.
00:17:00.559 --> 00:17:02.639
It's uh a long time ago in my world.
00:17:02.639 --> 00:17:04.400
It's time flies when you're having fun.
00:17:04.400 --> 00:17:14.880
We found out that uh how much data is coming in, which is not that interesting, but we could see usage coming in, then but we were also looking at how much data is going out.
00:17:14.880 --> 00:17:20.720
And if you look at how much data going out, one prompt on text is very little data.
00:17:20.720 --> 00:17:23.680
Sending documents, you will see the difference.
00:17:23.680 --> 00:17:25.759
And then we use it for awareness.
00:17:25.759 --> 00:17:30.799
We see which kind of uh employees and which departments are using it.
00:17:30.799 --> 00:17:36.799
And we in internal audit are allowed to do these things because internal audit can combine data sources that no one else can.
00:17:36.799 --> 00:17:41.440
And we also have strict confidentiality uh requirements to our department.
00:17:41.440 --> 00:17:46.640
So we were using it to create awareness for management and saying that we know it's gonna be being used.
00:17:46.640 --> 00:17:51.200
We know in those departments, you need to talk about awareness.
00:17:51.200 --> 00:17:53.279
What can we use for what purpose?
00:17:53.279 --> 00:17:57.279
So we didn't go after persons in this audit.
00:17:57.279 --> 00:17:59.279
So that is one aspect.
00:17:59.279 --> 00:18:03.519
I think enable your employees, otherwise, they will use something else.
00:18:03.519 --> 00:18:10.400
And then from a company perspective, is do the evaluation about can we use AI?
00:18:10.400 --> 00:18:12.720
Uh would it be useful for us?
00:18:12.720 --> 00:18:18.880
And then in order to ask us questions, you need to understand what AI is and what AI isn't.
00:18:18.880 --> 00:18:32.480
All these people who are used to saying no, legal, compliance, risk, also internal, some internal audit functions, who are afraid because they don't understand it, build competence there as well.
00:18:32.480 --> 00:18:39.839
And one thing I think is also important when you're building this competence is that you also need to build cloud confidence.
00:18:39.839 --> 00:18:58.079
Because if you don't know what an enterprise boundary is and these normal cloud structures, what is in within a subscription, what is in a personal boundary, and how these cloud structures work, then you're also gonna fail about what is dangerous and not.
00:18:58.079 --> 00:19:02.799
If you build that confidence, then you can start to work with the right choices.
00:19:02.799 --> 00:19:06.640
Where will we have the most effect from AI?
00:19:06.640 --> 00:19:18.160
Because if you just start random, like uh working with AI here and there, it's gonna be a limited set of people who can actually make those AI solutions.
00:19:18.160 --> 00:19:22.400
So, how do you use those to create the most effect for the company?
00:19:22.400 --> 00:19:25.279
That's a strategic decision.
00:19:25.279 --> 00:19:43.680
So, what we built in our company, we built a unit who will attract the best competence and do that strategic enabler work on what which processes are gonna get priority with these resources first, where it's gonna have effect.
00:19:43.680 --> 00:19:44.799
Cool.
00:19:44.799 --> 00:20:00.720
But you also need to enable these small tasks when you're mature enough, then when you are gonna build co-pilot agents with uh co-pilot studio, for example, which is a system you can just buy if you have Azure, for example.
00:20:00.720 --> 00:20:02.559
There are different other solutions.
00:20:02.559 --> 00:20:10.400
Those agents can solve small business problems or big business problems.
00:20:10.400 --> 00:20:20.400
So basically enabling that to also get people to work on this, given that they have competence to ask themselves the right questions.
00:20:20.400 --> 00:20:24.000
Can I use this data for that task?
00:20:24.000 --> 00:20:26.000
Is it kind of fit for purpose?
00:20:26.000 --> 00:20:27.200
Is it legal?
00:20:27.200 --> 00:20:29.599
Which is one important question.
00:20:29.599 --> 00:20:32.160
Uh, can we trust it to make that decision?
00:20:32.160 --> 00:20:52.480
So the way we uh made that is that we made an AI governance system that is built in ServiceNow, where basically when you start to ask yourself these questions, you are getting a guide to what is the typical questions you want to ask yourselves when you are handling personal data.
00:20:52.480 --> 00:21:00.400
What is the simple questions you should ask when you are working on customer closed processes, which are things that you need to build.
00:21:00.400 --> 00:21:19.839
So make governance relevant for your company, for your data, for what is the most dangerous things you could do with AI, which are you say this is not legal, you can't put AI in there unless you talk to these people and we really make uh a group management decision on it, for example.
00:21:19.839 --> 00:21:24.640
So you have to get all this concept in place to make the right decisions.
00:21:25.359 --> 00:21:31.519
If you don't mind me asking, if you're allowed to share, which teams won those early resources in the beginning.
00:21:32.000 --> 00:21:35.920
What we've seen is that they're using it in HR.
00:21:35.920 --> 00:21:39.200
And now you're thinking, oh, that's the dangerous part.
00:21:39.200 --> 00:21:40.960
We're not using it in recruiting.
00:21:40.960 --> 00:21:46.559
Because that's the big no no that if you're using that to automatically hire people, then you're gonna fail.
00:21:46.559 --> 00:21:48.319
That's prohibited.
00:21:48.319 --> 00:21:51.279
But we use it for the personal handbook.
00:21:51.279 --> 00:21:54.240
And it's it's it's really efficient.
00:21:54.240 --> 00:21:59.759
Um we use it for the customer advisors, you're getting a tool to say.
00:21:59.759 --> 00:22:05.279
Say this customer is asking this what are the rules for selling these kind of products?
00:22:05.279 --> 00:22:08.960
So we have a lot of rules for all the insurance products that we're gonna sell.
00:22:08.960 --> 00:22:11.519
You should ask these and these questions.
00:22:11.519 --> 00:22:17.440
So it's much more efficient for the case handlers to just ask in the model.
00:22:17.440 --> 00:22:24.640
And now we are putting it closer to the core processes.
00:22:24.640 --> 00:22:34.720
So I think we were forward-leaning in some cases, and I'm kind of the impatient auditor, so I would uh I want it to go faster.
00:22:34.720 --> 00:22:46.640
So we are not we're starting just now to put it directly into our core processing uh of insurance, especially claims, where it will have an effect.
00:22:46.640 --> 00:22:55.440
Because if you put it right into your production systems where you have the most people working, you can improve the quality.
00:22:55.440 --> 00:23:02.160
So we see that the quality is improving compared to manual handling, and the speed is improving.
00:23:02.160 --> 00:23:07.839
And then you can use your competence and the best people to handle the most complex cases.
00:23:07.839 --> 00:23:11.359
So this is where we are getting traction now.
00:23:11.359 --> 00:23:21.680
And it's uh I go to this insurer tech conference every year, and in the Nordics, we are we have a high degree of automation compared to the rest of Europe.
00:23:21.680 --> 00:23:26.319
So when I went to this uh in earlier years, I was thinking, oh, we are so far ahead.
00:23:26.319 --> 00:23:32.799
They're still doing manual pricing and they still have like branches all over and have manual handling for a lot of things.
00:23:32.799 --> 00:23:40.880
And then I came back a few years ago and then I saw like the big European players are putting AI straight into the core processes.
00:23:40.880 --> 00:23:46.400
And these are big major players who are getting real effects from it.
00:23:46.400 --> 00:23:52.960
And not just production cost saving effects or efficiency effects, but quality effects.
00:23:52.960 --> 00:23:54.880
They can handle so much more data.
00:23:54.880 --> 00:23:57.839
So they put it into data-heavy solutions.
00:23:57.839 --> 00:24:01.359
So in some claims, you have to deliver a lot of documentation.
00:24:01.359 --> 00:24:09.119
Just the evaluation or classification of those things, a machine can do much faster and with much higher quality.
00:24:10.640 --> 00:24:14.480
So far, the use cases have been using generative AI.
00:24:14.480 --> 00:24:16.640
Have you moved to the more agentic?
00:24:16.640 --> 00:24:20.799
You know, they talk about this agency AI where things are actually going and doing things by themselves.
00:24:20.799 --> 00:24:23.119
Have you gotten there yet?
00:24:23.119 --> 00:24:25.680
And if you haven't, why not?
00:24:26.000 --> 00:24:44.000
I think we think we have enough use cases now with machine learning and with the AI solution that are going in advisory to enabling our employees, which are in directly into the profession, and with the automation area of it.
00:24:44.000 --> 00:25:01.039
Agentic, uh, I think uh we are building agents, but we will look at it this year to see what they're doing because I don't know everything the company is doing, because we have a lot of analytics people, because insurance is all about analytics.
00:25:01.039 --> 00:25:05.359
And these people are also the ones who are adept at building solutions.
00:25:05.359 --> 00:25:19.680
So we can probably see maybe there are some agents that talk to each other that we are doing workflow and task handling between agents, but we haven't seen that in the seed yet because we are have this on this year's audit lab to look through this.
00:25:19.680 --> 00:25:22.880
But I see that there are coming Azure tools that can help us.
00:25:22.880 --> 00:25:25.119
So we can look for MCP traffic.
00:25:25.119 --> 00:25:29.440
Uh MCP is the communication protocol between AI agents.
00:25:29.440 --> 00:25:35.680
They have a security agent that can automatically detect MCP traffic in your subscription.
00:25:35.680 --> 00:25:44.079
So these things that we will look for to automate more to find where these things come into our environment.
00:25:44.559 --> 00:25:48.240
Do you think that whole agentec AI thing is just overhyped then?
00:25:48.559 --> 00:25:48.880
No.
00:25:48.880 --> 00:25:50.559
Not at all.
00:25:50.559 --> 00:26:07.039
One of the things that we can do is to build narrow AI solutions who can handle specific tasks and are just good at that, which will also reduce the risk compared to big generic models.
00:26:07.039 --> 00:26:27.920
So I think it's a possibility for us to have more control if you compare it to microservices kind of uh architectures, that we can build more structured, narrow solutions that have more explainability, more narrow solutions that function as agents that are going to talk to each other based on tasks that they're gonna do.
00:26:27.920 --> 00:26:36.480
So I think it's gonna be more of the future in how we should design things from an architectural perspective and risk perspective.
00:26:36.880 --> 00:26:40.480
So a mature AI governance program.
00:26:40.480 --> 00:26:50.000
Do you have any tips for like where to start and how do you like operationalize it in practice just based on your two years of doing it?
00:26:50.400 --> 00:26:53.599
So don't build an AI governance just on the side.
00:26:53.599 --> 00:26:55.839
Integrate it with what you've always been doing.
00:26:55.839 --> 00:27:10.079
So most of us have an STLC process, we have a procurement process, we have a risk management process, we have a governing structure for how we handle privacy, integrated into those structures.
00:27:11.279 --> 00:27:11.920
Hmm.
00:27:11.920 --> 00:27:22.799
I was thinking it makes sense that you own this process in your organization because the audit function is holy, like the board hired you and the CEO, which is that's crazy.
00:27:22.799 --> 00:27:23.680
It makes sense though.
00:27:23.680 --> 00:27:28.000
What about for companies that don't have a really strong compliance or audit function?
00:27:28.000 --> 00:27:34.640
Because you're an insurance, like you they'll take away your license or whatever if you don't adhere to these things, but most companies don't have that.
00:27:35.039 --> 00:27:38.559
No, so basically uh they don't need that either.
00:27:38.559 --> 00:27:42.720
It's it's gonna be helpful on the journey if you have the right people in those functions.
00:27:42.720 --> 00:27:48.400
Uh so we hired a person to be the AI risk officer.
00:27:48.400 --> 00:27:55.680
He's in first line, he's not in second line or third line, he's helping guide those decisions.
00:27:55.680 --> 00:28:04.240
So if you build that competence in one per one or more persons, who's gonna help ask the right questions when people are starting to work with this?
00:28:04.240 --> 00:28:08.000
I think that is one of the key enablers that you need to have in place.
00:28:08.000 --> 00:28:14.240
He's organized in one of our most sensitive areas where we're using most data.
00:28:14.240 --> 00:28:22.079
But he's also going across division or department, so he can go anywhere because he has a company role.
00:28:22.079 --> 00:28:36.240
So if you don't have a compliance function or anything, hire one who's gonna be lead on AI risk things, security things, or competence in what AI is and what it isn't.
00:28:36.240 --> 00:28:45.200
And that person can help you build the training program, the awareness program, help building how we ask the right questions in our governing documents.
00:28:45.200 --> 00:28:56.960
Because what I hate about governing documents, if you don't make them pragmatic about context sense relevant for your business, it's just generic theoretical stuff, then it's not gonna work.
00:28:56.960 --> 00:29:02.880
You have to make how do we ask the right AI questions for the business that we are in.
00:29:02.880 --> 00:29:10.640
So get someone to work with it because this is gonna take time if you're gonna really enable AI in your company.
00:29:11.279 --> 00:29:13.039
Last question could be a fun one.
00:29:13.039 --> 00:29:15.119
You still do cyber insurance, correct?
00:29:15.119 --> 00:29:17.200
We do cyber insurance, yeah.
00:29:17.200 --> 00:29:22.480
I've read that certain providers are excluding AI systems from their coverage.
00:29:22.480 --> 00:29:24.319
What's your take on that?
00:29:25.200 --> 00:29:27.440
I think that's gonna mature over time.
00:29:27.440 --> 00:29:38.640
What they are really afraid of now is that companies are putting big language models into customer-facing services without knowing what they do.
00:29:38.640 --> 00:29:51.039
So I think in order for this to mature, then they need to also, from an insurer's perspective, they need to set more strict requirements about what kind of governance can you need to have in place.
00:29:51.039 --> 00:29:52.000
So I don't know.
00:29:52.000 --> 00:29:57.440
I like to say that cyber insurance makes the world better if you try to buy it.
00:29:57.440 --> 00:30:06.720
Because if you try to buy it, then you will look, uh then you will understand more about what uh you're expected to do as a company.
00:30:06.720 --> 00:30:09.359
Because there's a lot of requirements in it.
00:30:09.359 --> 00:30:15.359
So if you start to think about this, this will automatically start to improve if you actually do something about it.
00:30:15.359 --> 00:30:20.079
Because you will have to do a lot before you buy uh cyber insurance.
00:30:20.079 --> 00:30:24.319
The same will apply to AI insurance when it's matures.
00:30:24.319 --> 00:30:39.039
The best way you can prepare the things we talked about earlier about getting the right governance in place, asking the right questions, uh starting maturingness, working structured with it, will help you when you want to buy insurance.
00:30:39.759 --> 00:30:41.039
It's kind of crazy, right?
00:30:41.039 --> 00:30:47.759
That there hasn't been any big newsworthy attacks coming from AI systems lately.
00:30:47.759 --> 00:30:49.279
I thought there'd be more by now.
00:30:49.519 --> 00:30:53.440
Yeah, it's the recent attack that was before the weekend, where they get all the prompts.
00:30:53.440 --> 00:31:02.400
It's a small narrow uh AI solution built for uh anime manga things where you want to create comics or uh figures.
00:31:02.400 --> 00:31:05.039
And who knows what they've used that for.
00:31:05.039 --> 00:31:06.799
Oh no.
00:31:06.799 --> 00:31:14.720
It's uh so basically if you combine the prompts with the person, you can basically do extortion.
00:31:14.720 --> 00:31:16.319
Yeah, that's horrible.
00:31:16.319 --> 00:31:18.559
No, but you have horrible incidents.
00:31:18.559 --> 00:31:20.079
So you have the Dutch case.
00:31:20.079 --> 00:31:36.400
Whenever I talk about it, I get tears in my eyes, where they put AI solutions direct on uh some of the most vulnerable people in society on welfare and support, basically for people who need welfare tickets or payments.
00:31:36.400 --> 00:31:43.119
And they automated decisions where they were looking for fraud and they stopped welfare payments.
00:31:43.119 --> 00:31:49.839
People lost uh right to be with their children, people lost their house.
00:31:49.839 --> 00:31:55.359
The people who worked in the welfare department could not answer why the payments were stopped.
00:31:55.359 --> 00:31:57.039
So what everything went wrong?
00:31:57.039 --> 00:31:58.559
It's a terrible case.
00:31:58.559 --> 00:32:01.519
And this is about terrible wrong competence.
00:32:01.519 --> 00:32:04.720
And if you think about security, what it really means.
00:32:04.720 --> 00:32:13.119
Security is not only about attacks, it's about how you create systems that have integrity availability as well.
00:32:13.119 --> 00:32:21.200
And I think these things, integrity, is key to AI, that you can actually do the right thing with the right data.
00:32:21.200 --> 00:32:27.440
This is where this is kind of an employee error where someone put AI on the wrong solution.
00:32:27.440 --> 00:32:32.160
So a lot of things are happening where you put AI on the wrong tasks.
00:32:32.160 --> 00:32:42.240
And that's so you had the Trump administration doing it on veterans, uh, also trying to find fraud, and that model was not built for finding that.
00:32:42.240 --> 00:32:44.160
It's it's just horrible.
00:32:44.160 --> 00:32:51.839
Imagine uh how many companies are rolling out things because they're stressed about if we're not in the AI game, we're not relevant.
00:32:51.839 --> 00:32:54.319
And I'll leave one end note.
00:32:54.319 --> 00:32:55.680
I'm talking a lot now.
00:32:55.680 --> 00:33:03.039
But if you look at all the SaaS solutions that you're buying, all the solutions that you have, the cloud solutions, AI is coming from the side.
00:33:03.039 --> 00:33:12.240
So you need to know that suddenly AI is doing something to your data because in the last update that just happened, suddenly an AI solution was in there.
00:33:12.240 --> 00:33:18.319
Because now, if you work in tech and Linux software, you're not relevant if you don't have something AI.
00:33:18.319 --> 00:33:20.319
So that's a it's a huge pressure.
00:33:20.319 --> 00:33:23.119
So there's gonna be a lot of mistakes.
00:33:23.759 --> 00:33:29.519
Well, Gaute, thank you so much for your time today and for showing your expertise and for making audit sexy again.
00:33:29.519 --> 00:33:31.279
I never knew that you had so much fun at work.
00:33:31.279 --> 00:33:33.200
No, it's it's a lot of fun.
00:33:34.079 --> 00:33:37.279
So, thank you for so much for uh inviting me.
00:33:37.279 --> 00:33:41.359
It's a learning experience to just uh communicate this to others.
00:33:41.359 --> 00:33:43.359
The honor and pleasure is all mine.
00:33:43.440 --> 00:33:44.319
Thank you so much, Gaute.
00:33:44.319 --> 00:33:44.559
Take care.
00:33:44.559 --> 00:33:45.039
See you.
00:33:45.039 --> 00:33:45.839
Take care.
00:33:45.839 --> 00:33:48.720
Well, that's all for today, folks.
00:33:48.720 --> 00:33:51.519
Thank you for tuning in to the mnemonic security oodcast.
00:33:51.519 --> 00:34:00.960
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcast at mnemonic.no.
00:34:00.960 --> 00:34:04.400
Thank you for listening, and we'll see you next time.
00:00:03.359 --> 00:00:13.359
From our headquarters in Oslo, Norway, and on behalf of our host, Robby Peralta, welcome to the mnemonic security podcast.
00:00:15.039 --> 00:00:17.280
Everyone's rushing to deploy it.
00:00:17.280 --> 00:00:19.679
Nobody's rushing to audit it.
00:00:19.679 --> 00:00:24.399
You've maybe done some tabletops around ransomware or data leakage.
00:00:24.399 --> 00:00:27.359
But who's actually looking at your AI?
00:00:27.359 --> 00:00:30.800
That's the job of internal audit.
00:00:30.800 --> 00:00:36.640
And today's guest has been doing it for real at Norway's largest insurer.
00:00:36.640 --> 00:00:39.679
He reports directly to the board.
00:00:39.679 --> 00:00:42.880
Not the CEO, just the board.
00:00:42.880 --> 00:00:47.759
Which means he can walk into any room in the company and ask uncomfortable questions.
00:00:47.759 --> 00:00:50.320
And nobody can tell him to stop.
00:00:50.320 --> 00:00:53.119
His name is Gaute.
00:00:53.119 --> 00:01:00.159
And he might be the only person I've spoken to who makes auditing sound like the most interesting job in the building.
00:01:00.159 --> 00:01:04.079
Gaute Brynildsen, welcome to the podcast.
00:01:04.400 --> 00:01:04.959
Thank you.
00:01:04.959 --> 00:01:06.400
Glad to be here.
00:01:06.719 --> 00:01:11.040
Today I want to pick your brain about auditing AI.
00:01:11.920 --> 00:01:12.239
Yes.
00:01:12.560 --> 00:01:14.480
What world of audit do you live in?
00:01:14.879 --> 00:01:21.359
What I don't like about the word audit is that most people, when they think about audit, they are thinking about financial audit.
00:01:21.359 --> 00:01:28.640
Financial audit is more about checking controls specific for the accounts and they're looking backwards.
00:01:28.640 --> 00:01:32.640
In the internal auditing, we are looking at all risk dimensions.
00:01:32.640 --> 00:01:36.079
So basically, how will the company improve?
00:01:36.079 --> 00:01:46.959
It's one of the most underestimated, interesting professions to have, where you have all the possibilities to change the company.
00:01:46.959 --> 00:02:02.879
Because we have insight into everything that happens from the board of directors and down into the nitty-gritty details of everything, from how you run claims or how you do investments or how you handle the bank accounts or how you handle IT or AI for that sense.
00:02:02.879 --> 00:02:07.439
So we are a function that reports directly to the board of directors.
00:02:07.439 --> 00:02:11.840
So the board of directors hire two people in the company: it's the CEO and me.
00:02:11.840 --> 00:02:18.240
The CEO can't direct me, he can have opinions about my work, but I can also not care.
00:02:18.240 --> 00:02:20.560
That wouldn't be constructive.
00:02:20.560 --> 00:02:29.439
And the best thing about internal audit is that you get to talk to anyone, you get access to all the information, and you learn something new every day.
00:02:29.439 --> 00:02:32.400
It's never, almost never the same audit.
00:02:32.400 --> 00:02:42.000
Everything about governance, culture, understanding the business as much as it's understanding the models and uh how AI works.
00:02:42.000 --> 00:02:44.960
So I just wanted to say that about internal audit.
00:02:44.960 --> 00:02:48.719
I think it's because most people don't know what internal audit is.
00:02:48.719 --> 00:02:53.039
We're there uh to help improve the company.
00:02:54.800 --> 00:03:02.319
Over time, since you started working with audit, how I'm kind of imagining you sitting in a lot of meetings before, sort of interviewing people.
00:03:02.319 --> 00:03:03.759
That may be like that today.
00:03:03.759 --> 00:03:09.360
I know that you still have to talk to people, but how is that sort of journey been the transformation, or is it still the same?
00:03:09.840 --> 00:03:12.400
Internal audit is a communication field.
00:03:12.400 --> 00:03:15.599
So basically, in how do you actually create change?
00:03:15.599 --> 00:03:23.199
And it's about having good communication, having the same conceptual understanding about things with people.
00:03:23.199 --> 00:03:26.400
It's still a human job.
00:03:26.400 --> 00:03:30.879
But of course, we use a lot of AI to help us do uh audit.
00:03:30.879 --> 00:03:36.879
So we did one strategic choice early when ChatGPT became popular.
00:03:36.879 --> 00:03:39.280
So we made a strategic choice.
00:03:39.280 --> 00:03:41.199
What are we gonna focus on now?
00:03:41.199 --> 00:03:48.879
Are we gonna focus on we will use AI to improve ourselves, or we will teach ourselves how to audit AI?
00:03:48.879 --> 00:03:52.319
So we chose the most difficult thing.
00:03:52.319 --> 00:03:55.280
And that was how to audit AI.
00:03:55.280 --> 00:03:58.479
And we went straight into a machine learning model.
00:03:58.800 --> 00:04:04.639
When you say machine learning model, that's not like something from OpenAI or Anthropic.
00:04:04.639 --> 00:04:07.599
You are auditing your own machine learning model.
00:04:07.599 --> 00:04:08.560
Can you clarify that a little bit?
00:04:08.560 --> 00:04:08.879
Yeah.
00:04:09.039 --> 00:04:18.000
So basically, it's not a pre-trained model, it's a model uh which is a machine learning algorithm, which we only train on our data.
00:04:18.000 --> 00:04:22.879
So it doesn't take any bias in from other data that we don't know.
00:04:22.879 --> 00:04:27.600
We know that the model uh itself, we know what it does.
00:04:27.600 --> 00:04:35.920
Uh, but of course it creates a lot of vectors that we it's immensely complex because we put a lot of data into it.
00:04:35.920 --> 00:04:50.800
And when we did that audit, uh, one of the key things that we looked at was basically what kind of people were involved in deciding that we would choose uh to use AR for this kind of task.
00:04:50.800 --> 00:04:58.720
What kind of competence did we have in who chose the model, uh, if it was fit for purpose for what we want to solve.
00:04:58.720 --> 00:05:10.079
And one what can go wrong still is that they might not have the critical thinking about what kind of risks are involved when we use this kind of data in that model.
00:05:10.079 --> 00:05:14.639
When we did that, we looked at what data did they put in.
00:05:14.639 --> 00:05:22.639
And knowing that we work with a lot of personal data, we have uh immense amounts of data from our claims, for example.
00:05:22.639 --> 00:05:26.319
So we're all looking what kind of data did you put in there?
00:05:26.319 --> 00:05:28.879
Did you analyze the data first?
00:05:28.879 --> 00:05:35.360
Did you look for anything that was a deviation from the normal set that you didn't want to train it on?
00:05:35.360 --> 00:05:37.199
Did you clean the data?
00:05:37.199 --> 00:05:42.959
All these columns that you put in here, are they relevant for what the model is going to do?
00:05:42.959 --> 00:05:52.079
And does any of it contribute to any bias that we don't want or any discrimination that we don't want?
00:05:52.079 --> 00:05:54.639
Are we allowed to use this data for this?
00:05:54.639 --> 00:05:57.839
So these are the things that we are discussing.
00:05:57.839 --> 00:06:04.319
And that that was one of the key issues that we brought into these topics.
00:06:04.319 --> 00:06:12.160
And we have some government agencies who are working especially around discrimination or sustainability.
00:06:12.160 --> 00:06:18.800
They made a guide for what should you look for when you're looking for bias and discrimination.
00:06:18.800 --> 00:06:22.480
And that model from the government was really good.
00:06:22.480 --> 00:06:26.480
So we use that also as a guide to have these discussions.
00:06:26.480 --> 00:06:44.240
And what is really complex about when you build vectors on data is to understand, even though let's say that we can't discriminate on gender, even though if you don't put gender in it, we would still, with our data, have a possibility to separate gender from it.
00:06:44.240 --> 00:07:01.120
So it's basically finding these hidden patterns that the model will understand and will start to produce output, not because the model wants to discriminate, it doesn't have its own opinion, but from the data, it can actually turn out to discriminate on gender.
00:07:01.120 --> 00:07:15.360
So we are in insurance in Norway not allowed to discriminate on gender for car insurance, for example, which is a huge benefit for us men because we are really bad drivers compared to women, although we like to think differently.
00:07:15.360 --> 00:07:24.319
But the data shows that we have much more expensive claims than uh women, if we take the big numbers, and not me, of course.
00:07:24.319 --> 00:07:25.360
Makes sense.
00:07:25.360 --> 00:07:40.480
But then if you look at them, uh we have to take away the color of the cars, we have to take away some dimensions from the cars uh that to basically reduce the chance of uh this kind of discrimination.
00:07:40.480 --> 00:07:43.680
So this audit taught us a lot.
00:07:43.680 --> 00:07:53.920
So by delving deep into some complexity like this, made us much more able to go to the next audit where probably other audit functions would start.
00:07:53.920 --> 00:08:01.839
Other audit functions would probably start at the more easy thing, which would go for how do we live by the AI Act?
00:08:01.839 --> 00:08:08.000
How do we create policies and governing documents and roles and responsibilities around this?
00:08:08.000 --> 00:08:10.319
Which is also important.
00:08:10.319 --> 00:08:21.199
But when we audited this model, we built a company that was quite unique to be more relevant in the next audit that we did, which was the AI governance audit.
00:08:21.199 --> 00:08:29.680
Where we were looking more at the downside risks, where we were seeing: do we have the right security regulations in place?
00:08:29.680 --> 00:08:31.759
Do we have the right policies in place?
00:08:31.759 --> 00:08:44.159
The risk matrix, how we will govern it, the inventory system, uh, the roles and responsibilities, the awareness training that should be in place, all these kind of communication parts of it.
00:08:44.159 --> 00:08:49.120
So we could have more relevant discussions because we have this experience from before.
00:08:49.120 --> 00:08:52.080
Of course, we have been using Chat GPT, etc.
00:08:52.080 --> 00:08:55.679
So we are we're familiar with this.
00:08:56.080 --> 00:09:02.399
Your context here is insurance and probably making making prices and doing insurance things.
00:09:02.399 --> 00:09:11.039
You were probably one of the few companies in Norway that's actually made your own models, and you've been doing that's the core of your business, I guess.
00:09:11.039 --> 00:09:11.519
Yes.
00:09:11.519 --> 00:09:13.600
So this is nothing new for you in that sense.
00:09:13.600 --> 00:09:14.960
Is that is that correctly understood?
00:09:15.200 --> 00:09:15.759
That's correct.
00:09:15.759 --> 00:09:32.559
And where we came from earlier is that the way we build something called tariffs is a mathematical model where we are trying to calculate the risks based on our data that we have from earlier claims and other extra official data.
00:09:32.559 --> 00:09:40.639
And then we build a risk model called a tariff that will basically put data in and say this will then be the insurance premium.
00:09:40.639 --> 00:09:42.240
It's just statistics.
00:09:42.240 --> 00:09:49.759
It doesn't have the same problems that we have from the model machine learning models that we're using because they're so complex.
00:09:49.759 --> 00:09:54.879
These other models that we were using before, we could totally explain.
00:09:55.440 --> 00:10:02.480
So deterministic, non-deterministic is what you're talking about now, the models that you've been building and auditing.
00:10:02.480 --> 00:10:04.000
Do those hallucinate?
00:10:04.000 --> 00:10:08.159
Or am I because that's different from like one of these frontier models, correct?
00:10:08.399 --> 00:10:17.759
Yeah, so basically what we are did with the machine learning model is that the chance of hallucinating is less because we know what data it was trained on.
00:10:17.759 --> 00:10:20.159
It doesn't contain any other data.
00:10:20.159 --> 00:10:26.559
So basically what it does is basically producing only numerical output for pricing.
00:10:26.559 --> 00:10:36.639
And this is also a thing that a lot of people are missing when they are choosing different AI solutions for different tasks is how do we make them explainable?
00:10:36.639 --> 00:10:41.679
How do you manage to build a model that you can explain?
00:10:41.679 --> 00:10:54.240
So our key concept of the audit of machine learning is that we contributed to making it more explainable and coming closer to what we call the glass box model.
00:10:54.240 --> 00:10:56.480
Can you explain that?
00:10:56.480 --> 00:10:57.360
How do you did that?
00:10:57.360 --> 00:11:20.960
Yeah, so the first phase of it that they did have in place was that they made the model to output to the customer service department or those who were uh going to talk to the customer, giving the I won't say the number of factors, but it's a uh set number of factors that contributed most to the decision.
00:11:20.960 --> 00:11:40.879
So the dangerous thing about implementing AI is that if you are implementing it in anything that affects the customer, and the customer calls back uh or something happened with a decision that they can't explain, you can't have someone sitting there, oh, it's just AI, I don't know what that machine is doing.
00:11:40.879 --> 00:11:43.919
That's gonna be ruining your company.
00:11:43.919 --> 00:11:45.440
So it's gonna be on Vega.
00:11:45.440 --> 00:11:46.159
Yeah, yeah.
00:11:46.159 --> 00:11:49.519
It's uh it's not where you want to end up.
00:11:49.519 --> 00:11:56.480
So we built this uh structure where it basically said that these are the factors that contributed most to that decision.
00:11:56.480 --> 00:12:01.759
Because there could be 1,000 factors, but the most prominent one.
00:12:01.759 --> 00:12:06.000
Once it's uh multiple, uh quite a few actually.
00:12:06.000 --> 00:12:12.480
And I think that's important to enable the customers to get an explanation that is understandable.
00:12:12.480 --> 00:12:14.639
That's one of the factors.
00:12:14.639 --> 00:12:29.840
Now, with the glass box model, we have a more open machine learning model uh that has been developed over time, and we're gonna go back and audit that one and then understand how that is so much more explainable now than it was before.
00:12:29.840 --> 00:12:33.840
So it's been multiple versions going through uh to improve it.
00:12:33.840 --> 00:12:42.320
But I think we were key in contributing to get those discussions in place and start that ball rolling.
00:12:42.320 --> 00:12:53.039
So I think we were recognized by the financial subvisory authorities as the one only one in insurance so far at that time who had audited anything AI, which we were quite proud of.
00:12:53.360 --> 00:12:55.360
Awesome, all the work that you've done.
00:12:55.360 --> 00:12:59.200
Have you tried to audit one of the foundation models?
00:12:59.519 --> 00:13:01.039
I would say yes and no.
00:13:01.039 --> 00:13:12.000
So what you you can't is that uh let's say you take a Lama model or any other model that you find, GPT for all or chat uh RTX or whatever.
00:13:12.000 --> 00:13:19.679
You can't basically know what it's been trained on because it's a model that's been trained on a lot of data.
00:13:19.679 --> 00:13:25.200
And they can maybe tell you what it's been trained on, but it's still gonna be a guess.
00:13:25.200 --> 00:13:41.039
What you can do, of course, is that you can build a model when you train it on your own data and uh you basically start to use the model for your own data, you can build another model or build another system who's gonna uh test and ask questions for from it.
00:13:41.039 --> 00:13:46.320
You can also limit what kind of prompts that you can send to it.
00:13:46.320 --> 00:13:53.679
So you won't get that kind of uh can I make a bomb or what is uh this and this person's salary or something like that.
00:13:53.679 --> 00:14:02.480
So you can do templates for prompts, input, and then you can also do output prompts saying that these are what that model is supposed to do.
00:14:02.480 --> 00:14:04.559
So let's take an example.
00:14:04.559 --> 00:14:17.679
If we have a llama model and I'm training it for the cantina on how to make uh Indian food, then I can basically say that what you're gonna output is only things that have food ingredients in them.
00:14:17.679 --> 00:14:19.200
Nothing else.
00:14:19.200 --> 00:14:22.639
You will only answer it within this and this framework.
00:14:22.639 --> 00:14:28.000
Then you can start to limit hallucination or anything that a bad model can do.
00:14:28.000 --> 00:14:39.440
But you can also start to train it on a very diverse set of questions that you can do structured without AI asking it, to basically test it.
00:14:39.440 --> 00:14:46.159
And then you will uh see if you have a good enough training set, you will be able to try to find something.
00:14:46.159 --> 00:15:01.919
So, for example, if you want to test discrimination, you can test with a set of data that is fit for purpose, where you want to test for does it become a racist or does it do any decisions on gender or things that we don't want.
00:15:01.919 --> 00:15:07.519
And it's easy to create that data and just send it and see do we get different answers?
00:15:07.519 --> 00:15:09.440
Trying diverse sets.
00:15:09.440 --> 00:15:21.919
And the more advanced model is that you start to make an AI challenger model that will challenge the model and start to work with it and then see if it will deviate uh or give a bad output.
00:15:22.480 --> 00:15:25.120
You're at the very mature end of the scale.
00:15:25.120 --> 00:15:34.639
All the other companies that uh I feel like the the vast majority just started, they get started with this, and they're wondering where they should start on their governance journey.
00:15:34.639 --> 00:15:36.320
What would you tell them?
00:15:36.879 --> 00:15:40.720
There are two things that you really need to evaluate.
00:15:40.720 --> 00:15:45.200
One is the employee side of it, shadow AI.
00:15:45.200 --> 00:15:50.399
You don't want to have your data sent out to a public model.
00:15:50.399 --> 00:16:01.120
It's probably not going to happen anything, but it will still be a breach, compliance breach, uh sending data where you're not supposed to send data, especially from a privacy perspective.
00:16:01.120 --> 00:16:12.000
You should as fast as possible try to evaluate uh some models that are generative, give them to your uh employees and make rules.
00:16:12.000 --> 00:16:17.679
Then you mean need to create those boundaries, making awareness, uh, what can we use the different models for?
00:16:17.679 --> 00:16:20.559
Is it okay to use an external model or not, etc.?
00:16:20.559 --> 00:16:23.120
And then you need to monitor it for it.
00:16:23.120 --> 00:16:32.559
So what we did, we did a shadow AI audit, and to make it simple what we did, uh, because we're mostly talking to security people, right?
00:16:32.960 --> 00:16:35.679
I'd be very surprised if anybody else was listening to this.
00:16:35.679 --> 00:16:36.480
But they're welcome.
00:16:36.480 --> 00:16:38.240
I'm listening to your podcast.
00:16:38.559 --> 00:16:43.120
So um what we did was basically ask for the proxy server logs.
00:16:43.120 --> 00:16:52.559
And we got a lot of data out from there, and then we were looking for traces of are they using NODNL and external models that are the most common ones.
00:16:52.559 --> 00:16:55.200
We didn't look for everything, it was like the big ones.
00:16:55.200 --> 00:16:59.440
This this is uh two years ago now, I think.
00:16:59.440 --> 00:17:00.559
Uh I don't remember.
00:17:00.559 --> 00:17:02.639
It's uh a long time ago in my world.
00:17:02.639 --> 00:17:04.400
It's time flies when you're having fun.
00:17:04.400 --> 00:17:14.880
We found out that uh how much data is coming in, which is not that interesting, but we could see usage coming in, then but we were also looking at how much data is going out.
00:17:14.880 --> 00:17:20.720
And if you look at how much data going out, one prompt on text is very little data.
00:17:20.720 --> 00:17:23.680
Sending documents, you will see the difference.
00:17:23.680 --> 00:17:25.759
And then we use it for awareness.
00:17:25.759 --> 00:17:30.799
We see which kind of uh employees and which departments are using it.
00:17:30.799 --> 00:17:36.799
And we in internal audit are allowed to do these things because internal audit can combine data sources that no one else can.
00:17:36.799 --> 00:17:41.440
And we also have strict confidentiality uh requirements to our department.
00:17:41.440 --> 00:17:46.640
So we were using it to create awareness for management and saying that we know it's gonna be being used.
00:17:46.640 --> 00:17:51.200
We know in those departments, you need to talk about awareness.
00:17:51.200 --> 00:17:53.279
What can we use for what purpose?
00:17:53.279 --> 00:17:57.279
So we didn't go after persons in this audit.
00:17:57.279 --> 00:17:59.279
So that is one aspect.
00:17:59.279 --> 00:18:03.519
I think enable your employees, otherwise, they will use something else.
00:18:03.519 --> 00:18:10.400
And then from a company perspective, is do the evaluation about can we use AI?
00:18:10.400 --> 00:18:12.720
Uh would it be useful for us?
00:18:12.720 --> 00:18:18.880
And then in order to ask us questions, you need to understand what AI is and what AI isn't.
00:18:18.880 --> 00:18:32.480
All these people who are used to saying no, legal, compliance, risk, also internal, some internal audit functions, who are afraid because they don't understand it, build competence there as well.
00:18:32.480 --> 00:18:39.839
And one thing I think is also important when you're building this competence is that you also need to build cloud confidence.
00:18:39.839 --> 00:18:58.079
Because if you don't know what an enterprise boundary is and these normal cloud structures, what is in within a subscription, what is in a personal boundary, and how these cloud structures work, then you're also gonna fail about what is dangerous and not.
00:18:58.079 --> 00:19:02.799
If you build that confidence, then you can start to work with the right choices.
00:19:02.799 --> 00:19:06.640
Where will we have the most effect from AI?
00:19:06.640 --> 00:19:18.160
Because if you just start random, like uh working with AI here and there, it's gonna be a limited set of people who can actually make those AI solutions.
00:19:18.160 --> 00:19:22.400
So, how do you use those to create the most effect for the company?
00:19:22.400 --> 00:19:25.279
That's a strategic decision.
00:19:25.279 --> 00:19:43.680
So, what we built in our company, we built a unit who will attract the best competence and do that strategic enabler work on what which processes are gonna get priority with these resources first, where it's gonna have effect.
00:19:43.680 --> 00:19:44.799
Cool.
00:19:44.799 --> 00:20:00.720
But you also need to enable these small tasks when you're mature enough, then when you are gonna build co-pilot agents with uh co-pilot studio, for example, which is a system you can just buy if you have Azure, for example.
00:20:00.720 --> 00:20:02.559
There are different other solutions.
00:20:02.559 --> 00:20:10.400
Those agents can solve small business problems or big business problems.
00:20:10.400 --> 00:20:20.400
So basically enabling that to also get people to work on this, given that they have competence to ask themselves the right questions.
00:20:20.400 --> 00:20:24.000
Can I use this data for that task?
00:20:24.000 --> 00:20:26.000
Is it kind of fit for purpose?
00:20:26.000 --> 00:20:27.200
Is it legal?
00:20:27.200 --> 00:20:29.599
Which is one important question.
00:20:29.599 --> 00:20:32.160
Uh, can we trust it to make that decision?
00:20:32.160 --> 00:20:52.480
So the way we uh made that is that we made an AI governance system that is built in ServiceNow, where basically when you start to ask yourself these questions, you are getting a guide to what is the typical questions you want to ask yourselves when you are handling personal data.
00:20:52.480 --> 00:21:00.400
What is the simple questions you should ask when you are working on customer closed processes, which are things that you need to build.
00:21:00.400 --> 00:21:19.839
So make governance relevant for your company, for your data, for what is the most dangerous things you could do with AI, which are you say this is not legal, you can't put AI in there unless you talk to these people and we really make uh a group management decision on it, for example.
00:21:19.839 --> 00:21:24.640
So you have to get all this concept in place to make the right decisions.
00:21:25.359 --> 00:21:31.519
If you don't mind me asking, if you're allowed to share, which teams won those early resources in the beginning.
00:21:32.000 --> 00:21:35.920
What we've seen is that they're using it in HR.
00:21:35.920 --> 00:21:39.200
And now you're thinking, oh, that's the dangerous part.
00:21:39.200 --> 00:21:40.960
We're not using it in recruiting.
00:21:40.960 --> 00:21:46.559
Because that's the big no no that if you're using that to automatically hire people, then you're gonna fail.
00:21:46.559 --> 00:21:48.319
That's prohibited.
00:21:48.319 --> 00:21:51.279
But we use it for the personal handbook.
00:21:51.279 --> 00:21:54.240
And it's it's it's really efficient.
00:21:54.240 --> 00:21:59.759
Um we use it for the customer advisors, you're getting a tool to say.
00:21:59.759 --> 00:22:05.279
Say this customer is asking this what are the rules for selling these kind of products?
00:22:05.279 --> 00:22:08.960
So we have a lot of rules for all the insurance products that we're gonna sell.
00:22:08.960 --> 00:22:11.519
You should ask these and these questions.
00:22:11.519 --> 00:22:17.440
So it's much more efficient for the case handlers to just ask in the model.
00:22:17.440 --> 00:22:24.640
And now we are putting it closer to the core processes.
00:22:24.640 --> 00:22:34.720
So I think we were forward-leaning in some cases, and I'm kind of the impatient auditor, so I would uh I want it to go faster.
00:22:34.720 --> 00:22:46.640
So we are not we're starting just now to put it directly into our core processing uh of insurance, especially claims, where it will have an effect.
00:22:46.640 --> 00:22:55.440
Because if you put it right into your production systems where you have the most people working, you can improve the quality.
00:22:55.440 --> 00:23:02.160
So we see that the quality is improving compared to manual handling, and the speed is improving.
00:23:02.160 --> 00:23:07.839
And then you can use your competence and the best people to handle the most complex cases.
00:23:07.839 --> 00:23:11.359
So this is where we are getting traction now.
00:23:11.359 --> 00:23:21.680
And it's uh I go to this insurer tech conference every year, and in the Nordics, we are we have a high degree of automation compared to the rest of Europe.
00:23:21.680 --> 00:23:26.319
So when I went to this uh in earlier years, I was thinking, oh, we are so far ahead.
00:23:26.319 --> 00:23:32.799
They're still doing manual pricing and they still have like branches all over and have manual handling for a lot of things.
00:23:32.799 --> 00:23:40.880
And then I came back a few years ago and then I saw like the big European players are putting AI straight into the core processes.
00:23:40.880 --> 00:23:46.400
And these are big major players who are getting real effects from it.
00:23:46.400 --> 00:23:52.960
And not just production cost saving effects or efficiency effects, but quality effects.
00:23:52.960 --> 00:23:54.880
They can handle so much more data.
00:23:54.880 --> 00:23:57.839
So they put it into data-heavy solutions.
00:23:57.839 --> 00:24:01.359
So in some claims, you have to deliver a lot of documentation.
00:24:01.359 --> 00:24:09.119
Just the evaluation or classification of those things, a machine can do much faster and with much higher quality.
00:24:10.640 --> 00:24:14.480
So far, the use cases have been using generative AI.
00:24:14.480 --> 00:24:16.640
Have you moved to the more agentic?
00:24:16.640 --> 00:24:20.799
You know, they talk about this agency AI where things are actually going and doing things by themselves.
00:24:20.799 --> 00:24:23.119
Have you gotten there yet?
00:24:23.119 --> 00:24:25.680
And if you haven't, why not?
00:24:26.000 --> 00:24:44.000
I think we think we have enough use cases now with machine learning and with the AI solution that are going in advisory to enabling our employees, which are in directly into the profession, and with the automation area of it.
00:24:44.000 --> 00:25:01.039
Agentic, uh, I think uh we are building agents, but we will look at it this year to see what they're doing because I don't know everything the company is doing, because we have a lot of analytics people, because insurance is all about analytics.
00:25:01.039 --> 00:25:05.359
And these people are also the ones who are adept at building solutions.
00:25:05.359 --> 00:25:19.680
So we can probably see maybe there are some agents that talk to each other that we are doing workflow and task handling between agents, but we haven't seen that in the seed yet because we are have this on this year's audit lab to look through this.
00:25:19.680 --> 00:25:22.880
But I see that there are coming Azure tools that can help us.
00:25:22.880 --> 00:25:25.119
So we can look for MCP traffic.
00:25:25.119 --> 00:25:29.440
Uh MCP is the communication protocol between AI agents.
00:25:29.440 --> 00:25:35.680
They have a security agent that can automatically detect MCP traffic in your subscription.
00:25:35.680 --> 00:25:44.079
So these things that we will look for to automate more to find where these things come into our environment.
00:25:44.559 --> 00:25:48.240
Do you think that whole agentec AI thing is just overhyped then?
00:25:48.559 --> 00:25:48.880
No.
00:25:48.880 --> 00:25:50.559
Not at all.
00:25:50.559 --> 00:26:07.039
One of the things that we can do is to build narrow AI solutions who can handle specific tasks and are just good at that, which will also reduce the risk compared to big generic models.
00:26:07.039 --> 00:26:27.920
So I think it's a possibility for us to have more control if you compare it to microservices kind of uh architectures, that we can build more structured, narrow solutions that have more explainability, more narrow solutions that function as agents that are going to talk to each other based on tasks that they're gonna do.
00:26:27.920 --> 00:26:36.480
So I think it's gonna be more of the future in how we should design things from an architectural perspective and risk perspective.
00:26:36.880 --> 00:26:40.480
So a mature AI governance program.
00:26:40.480 --> 00:26:50.000
Do you have any tips for like where to start and how do you like operationalize it in practice just based on your two years of doing it?
00:26:50.400 --> 00:26:53.599
So don't build an AI governance just on the side.
00:26:53.599 --> 00:26:55.839
Integrate it with what you've always been doing.
00:26:55.839 --> 00:27:10.079
So most of us have an STLC process, we have a procurement process, we have a risk management process, we have a governing structure for how we handle privacy, integrated into those structures.
00:27:11.279 --> 00:27:11.920
Hmm.
00:27:11.920 --> 00:27:22.799
I was thinking it makes sense that you own this process in your organization because the audit function is holy, like the board hired you and the CEO, which is that's crazy.
00:27:22.799 --> 00:27:23.680
It makes sense though.
00:27:23.680 --> 00:27:28.000
What about for companies that don't have a really strong compliance or audit function?
00:27:28.000 --> 00:27:34.640
Because you're an insurance, like you they'll take away your license or whatever if you don't adhere to these things, but most companies don't have that.
00:27:35.039 --> 00:27:38.559
No, so basically uh they don't need that either.
00:27:38.559 --> 00:27:42.720
It's it's gonna be helpful on the journey if you have the right people in those functions.
00:27:42.720 --> 00:27:48.400
Uh so we hired a person to be the AI risk officer.
00:27:48.400 --> 00:27:55.680
He's in first line, he's not in second line or third line, he's helping guide those decisions.
00:27:55.680 --> 00:28:04.240
So if you build that competence in one per one or more persons, who's gonna help ask the right questions when people are starting to work with this?
00:28:04.240 --> 00:28:08.000
I think that is one of the key enablers that you need to have in place.
00:28:08.000 --> 00:28:14.240
He's organized in one of our most sensitive areas where we're using most data.
00:28:14.240 --> 00:28:22.079
But he's also going across division or department, so he can go anywhere because he has a company role.
00:28:22.079 --> 00:28:36.240
So if you don't have a compliance function or anything, hire one who's gonna be lead on AI risk things, security things, or competence in what AI is and what it isn't.
00:28:36.240 --> 00:28:45.200
And that person can help you build the training program, the awareness program, help building how we ask the right questions in our governing documents.
00:28:45.200 --> 00:28:56.960
Because what I hate about governing documents, if you don't make them pragmatic about context sense relevant for your business, it's just generic theoretical stuff, then it's not gonna work.
00:28:56.960 --> 00:29:02.880
You have to make how do we ask the right AI questions for the business that we are in.
00:29:02.880 --> 00:29:10.640
So get someone to work with it because this is gonna take time if you're gonna really enable AI in your company.
00:29:11.279 --> 00:29:13.039
Last question could be a fun one.
00:29:13.039 --> 00:29:15.119
You still do cyber insurance, correct?
00:29:15.119 --> 00:29:17.200
We do cyber insurance, yeah.
00:29:17.200 --> 00:29:22.480
I've read that certain providers are excluding AI systems from their coverage.
00:29:22.480 --> 00:29:24.319
What's your take on that?
00:29:25.200 --> 00:29:27.440
I think that's gonna mature over time.
00:29:27.440 --> 00:29:38.640
What they are really afraid of now is that companies are putting big language models into customer-facing services without knowing what they do.
00:29:38.640 --> 00:29:51.039
So I think in order for this to mature, then they need to also, from an insurer's perspective, they need to set more strict requirements about what kind of governance can you need to have in place.
00:29:51.039 --> 00:29:52.000
So I don't know.
00:29:52.000 --> 00:29:57.440
I like to say that cyber insurance makes the world better if you try to buy it.
00:29:57.440 --> 00:30:06.720
Because if you try to buy it, then you will look, uh then you will understand more about what uh you're expected to do as a company.
00:30:06.720 --> 00:30:09.359
Because there's a lot of requirements in it.
00:30:09.359 --> 00:30:15.359
So if you start to think about this, this will automatically start to improve if you actually do something about it.
00:30:15.359 --> 00:30:20.079
Because you will have to do a lot before you buy uh cyber insurance.
00:30:20.079 --> 00:30:24.319
The same will apply to AI insurance when it's matures.
00:30:24.319 --> 00:30:39.039
The best way you can prepare the things we talked about earlier about getting the right governance in place, asking the right questions, uh starting maturingness, working structured with it, will help you when you want to buy insurance.
00:30:39.759 --> 00:30:41.039
It's kind of crazy, right?
00:30:41.039 --> 00:30:47.759
That there hasn't been any big newsworthy attacks coming from AI systems lately.
00:30:47.759 --> 00:30:49.279
I thought there'd be more by now.
00:30:49.519 --> 00:30:53.440
Yeah, it's the recent attack that was before the weekend, where they get all the prompts.
00:30:53.440 --> 00:31:02.400
It's a small narrow uh AI solution built for uh anime manga things where you want to create comics or uh figures.
00:31:02.400 --> 00:31:05.039
And who knows what they've used that for.
00:31:05.039 --> 00:31:06.799
Oh no.
00:31:06.799 --> 00:31:14.720
It's uh so basically if you combine the prompts with the person, you can basically do extortion.
00:31:14.720 --> 00:31:16.319
Yeah, that's horrible.
00:31:16.319 --> 00:31:18.559
No, but you have horrible incidents.
00:31:18.559 --> 00:31:20.079
So you have the Dutch case.
00:31:20.079 --> 00:31:36.400
Whenever I talk about it, I get tears in my eyes, where they put AI solutions direct on uh some of the most vulnerable people in society on welfare and support, basically for people who need welfare tickets or payments.
00:31:36.400 --> 00:31:43.119
And they automated decisions where they were looking for fraud and they stopped welfare payments.
00:31:43.119 --> 00:31:49.839
People lost uh right to be with their children, people lost their house.
00:31:49.839 --> 00:31:55.359
The people who worked in the welfare department could not answer why the payments were stopped.
00:31:55.359 --> 00:31:57.039
So what everything went wrong?
00:31:57.039 --> 00:31:58.559
It's a terrible case.
00:31:58.559 --> 00:32:01.519
And this is about terrible wrong competence.
00:32:01.519 --> 00:32:04.720
And if you think about security, what it really means.
00:32:04.720 --> 00:32:13.119
Security is not only about attacks, it's about how you create systems that have integrity availability as well.
00:32:13.119 --> 00:32:21.200
And I think these things, integrity, is key to AI, that you can actually do the right thing with the right data.
00:32:21.200 --> 00:32:27.440
This is where this is kind of an employee error where someone put AI on the wrong solution.
00:32:27.440 --> 00:32:32.160
So a lot of things are happening where you put AI on the wrong tasks.
00:32:32.160 --> 00:32:42.240
And that's so you had the Trump administration doing it on veterans, uh, also trying to find fraud, and that model was not built for finding that.
00:32:42.240 --> 00:32:44.160
It's it's just horrible.
00:32:44.160 --> 00:32:51.839
Imagine uh how many companies are rolling out things because they're stressed about if we're not in the AI game, we're not relevant.
00:32:51.839 --> 00:32:54.319
And I'll leave one end note.
00:32:54.319 --> 00:32:55.680
I'm talking a lot now.
00:32:55.680 --> 00:33:03.039
But if you look at all the SaaS solutions that you're buying, all the solutions that you have, the cloud solutions, AI is coming from the side.
00:33:03.039 --> 00:33:12.240
So you need to know that suddenly AI is doing something to your data because in the last update that just happened, suddenly an AI solution was in there.
00:33:12.240 --> 00:33:18.319
Because now, if you work in tech and Linux software, you're not relevant if you don't have something AI.
00:33:18.319 --> 00:33:20.319
So that's a it's a huge pressure.
00:33:20.319 --> 00:33:23.119
So there's gonna be a lot of mistakes.
00:33:23.759 --> 00:33:29.519
Well, Gaute, thank you so much for your time today and for showing your expertise and for making audit sexy again.
00:33:29.519 --> 00:33:31.279
I never knew that you had so much fun at work.
00:33:31.279 --> 00:33:33.200
No, it's it's a lot of fun.
00:33:34.079 --> 00:33:37.279
So, thank you for so much for uh inviting me.
00:33:37.279 --> 00:33:41.359
It's a learning experience to just uh communicate this to others.
00:33:41.359 --> 00:33:43.359
The honor and pleasure is all mine.
00:33:43.440 --> 00:33:44.319
Thank you so much, Gaute.
00:33:44.319 --> 00:33:44.559
Take care.
00:33:44.559 --> 00:33:45.039
See you.
00:33:45.039 --> 00:33:45.839
Take care.
00:33:45.839 --> 00:33:48.720
Well, that's all for today, folks.
00:33:48.720 --> 00:33:51.519
Thank you for tuning in to the mnemonic security oodcast.
00:33:51.519 --> 00:34:00.960
If you have any concepts or ideas that you'd like us to discuss on future episodes, please feel free to hit me up on LinkedIn or to send us a mail to podcast at mnemonic.no.
00:34:00.960 --> 00:34:04.400
Thank you for listening, and we'll see you next time.
