Cybersecurity Perspectives
Cybersecurity Perspectives is a show for IT and cybersecurity professionals who want real talk, not talking points.
Every episode, a guest draws one of three cards, each one holding a real statistic pulled from an industry report or news outlet. Whatever card they pick becomes the topic. No pre-set questions, no rehearsed answers. Just an honest conversation about what that number actually means for their company, their team, and the industry at large, and what to do about it.
Hosted by Paul Marco and Owahn Bazydlo, co-founders of TALAS Security, the show brings together practitioners, leaders, and builders from across IT and cybersecurity to talk shop, share hard-won lessons, and build a stronger community for the people doing this work every day.
Stats. Insights. Real talk.
https://www.talas.io/podcast
Cybersecurity Perspectives
S1:E7 - 67% of users access AI services via non-corporate accounts on corporate devices
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Shadow IT never went away, it just learned to speak in prompts. Lou Mazzucchelli joins Owahn Bazydlo and Paul Marco for a wide-ranging, historically grounded conversation about AI governance, corporate culture, data as an asset, and why the newest problems in cybersecurity keep rhyming with the oldest.
The episode centers on a striking finding from the 2026 Verizon Data Breach Investigations Report: 67% of users access AI services via non-corporate accounts on corporate devices, and 45% of employees are now considered regular AI users on corporate devices, up from 15% the previous year. Lou, who holds the first undergraduate degree in AI ever granted in the United States and whose career spans everything from IBM 1401 mainframes to venture capital to building a corporate culture with such staying power that 180 former employees held a reunion 10 years after the company was gone, turns that number into practical reality. Owahn and Paul draw the line from personal productivity pressure to enterprise data leakage.
You'll discover why unauthorized AI use is not a novel threat but a repeat of decades of shadow IT behavior, why organizations that fail to provide sanctioned tools drive their people to rogue platforms, and why corporate data assets should appear on the balance sheet as seriously as gold bars. Lou walks through the Maersk incident, where a single server offline in Ghana became the seed of a global recovery, as a reminder of what enterprise data is truly worth when it is gone. The group also examines why standard vendor sourcing practices, if honestly applied, would disqualify most of today's AI providers on financial viability alone, and why corporate FOMO is overriding that discipline at the board level.
Lou, Owahn, and Paul then dig into the deeper shift underneath all of it: the enduring importance of culture, intentional hiring, quiet workspaces, and the small signals of respect, like a $12 mouse, that determine whether employees pick up the phone at one in the morning. The conversation reframes shadow AI as a human and organizational problem rather than a technology problem, and closes with a practical call to use existing telemetry, long-tail web log analysis, and honest risk analysis to surface what employees are actually doing before the data walks out the door.
Essential listening if you care about AI governance, shadow IT, third-party risk, data valuation, or the future of corporate culture in a machine-accelerated world. If you are responsible for protecting people, systems, or data, this conversation gives you both the historical perspective and the operational urgency to think more clearly about what comes next.
https://www.talas.io/podcast
Cybersecurity moves fast. Working in a space measured in minutes and seconds means we can't expect to keep pace by doing the same thing over and over. The sharing of perspective across technologists, defenders, business, and professionals is key to unleashing internal capability. Perspective comes from sharing experiences and ideas.
SPEAKER_02Welcome to Cybersecurity Perspectives. And we're back. I feel like that went really fast. I feel like we just recorded yesterday, and here we are recording again, Owen. It's constant recording. That's all it's all about, though, right? That's it. Well, this is this is what happens when you have a mission, getting perspectives out into the world. Right? When you when you scour the United States for experts from from sea to shining sea, we have to continually get recordings out there and start spreading the word on cybersecurity perspectives. So, listeners, welcome everybody. We have an amazing guest here today. I gotta be honest, I'm uh I'm a little starstruck if I'm if I'm being completely honest with everyone. Because if it's true that having 10,000 hours of experience in any subject makes you an expert, then today's meeting with this gentleman is going to feel like a panel discussion. This person's credentials date back to 1975, and I'm pretty sure that's because he had some sort of LinkedIn work history limit. He's held titles such as venture capitalist, scholar, president and chairman. And today he joined us on cybersecurity perspectives as a CTO. I would like to welcome Lou Mazicelli. Lou, welcome to the show. Thank you, Paul. And uh good to be here. Good to be anywhere these days. Fair enough. Fair enough. Well, look, I I I think I gave like the very high level, but please take a second and let's tell the guests a little bit about yourself.
SPEAKER_03Uh okay. Um was lucky enough to discover a computer when I was very young uh and get to play with it before kids played with computers. Uh and when I mean play with it, this was an IBM 1401 at Providence College, where at the end of the one shift that they ran, the guys would throw us the keys and say, Lock up when you're done. And of course, what would we do? We'd take the thing apart. All right, if the IBM CE had been there, they would have been aghast. But the mission was take it apart, see how it works. And oh, by the way, get it back together again so it worked the next day. And that was the best way to learn about how computers work. Uh, and it just sort of went on from there. Um, again, lucky enough to be around in a time where um what I really liked doing was something that also could pay the bills. Um, and uh that that was a great thing. So uh, you know, been there, done that at all scales of computing, from very, very large to very, very small, from embedded systems to very complex corporate support systems. And then, since I couldn't hold a job, you know, I I uh did some other things. I uh went to Wall Street for a while to learn how that worked, and uh that was an interesting time. I was there doing the the first internet bubble, um, which we could talk about in the context of current events. Yeah, and then uh I I uh played venture capitalist for a while and deployed lots and lots of money to uh lots and lots of companies, uh, a few of which made it, but most of which didn't, which is the norm, by the way, in Venture Capital. And uh then I spent uh the last part of my professional career uh corrupting young minds at the college level, uh running entrepreneurship courses and uh programs at a couple of universities. Uh and now I'm um I'm uh messing around with a couple of projects, and one of them is as uh CTO for a small company with uh you know global web presence and uh trying to keep that alive and kicking and dealing with the the modern environment, which is somewhat different from the original computing environments that I started with back in the day.
SPEAKER_02That's amazing. Wow, that's incredible. You know, I'm curious, like as you talk about this journey and all the different things that you've done and all the different hats you've you've you've kind of worn, like was there were there any parts of that that like truly resonated as like, I'm loving this. This is this was my favorite thing to do, or has the whole has the whole journey really been just something you've really got?
SPEAKER_03Well it comes in it comes in various flavors, okay? There's the geek flavor of, oh, this is so geeky and cool. Okay. Um a good example of that was I I uh I bought a mini computer to do uh business data processing for a small company. It was a data general supernova computer. And the application system I bought was written in Fortran. That sort of tells you how old it was, all right? And we spent as much money as this company had spent on anything when I bought this. And and I did some smart things. I did a whole analysis of the business before we bought the computer, bought the hardware based on the requirements of the software, which was typically not the way people did it back in the day. Yeah. Um, I had the system up and running with our inventory within days of the uh acceptance test of the machine, it was all going great. And then I ran the first bill of materials explosion on this computer. And it was like line item, go get a cup of coffee and a sandwich, line item, go write an essay. I mean, it was horrible. It was just unusable. And I'm thinking, oh my god, what have I done? I'm this young kid, I've just spent all this money, I'm gonna die, right? So I ended up getting the source code from the ISD after much argument. And I'm alone in this place, I'm alone in the company, dead of night, reading data general assembly code, which I've never seen before, but it's it's a it's a computer. How are it gonna be? And I found the I said this, I found the one place I said this can't be right. And I changed literally three lines of assembly code and sped their software up by literally 40 times. Now that was so geeky cool. That was, I mean, how cool is that, right? When that happens. Yeah. So there have been a bunch of things like that where you go, ah, nailed it, right? But there's a whole bunch of other things. I, you know, the the most gratifying to me was to have built a corporate culture that had staying power. Um, and again, it was it was completely intentional. Uh my founders and I, when we started Catherine Technologies in the 80s, we had a list of companies who said we like the way these companies behave. And we don't like the way these companies behave, and we want to create a company that's more like these guys than these guys. And the uh the proof point of that was 10 years after we had gone away. We lasted 20 some odd years, but then we went away. 10 years after that, some of my ex-employees said, let's have a reunion. And I went, that's that's that's quaint, that's nice, let's do that, right? Uh at our peak, we had 300 people around the world. Ten years after we were dead, 180 people showed up from uh around the world to celebrate a company that had been for dead for 10 years, and they said it is still the best work experience I ever had. And that to me, that I can take with me for a long time, you know, regardless of what happens on bit 32 of some register somewhere. So there's a you know, there's a variety of ways that you can gain uh, you know, you can you can gain uh feeling good points. Uh those are two.
SPEAKER_02That's a uh like you know I I love this podcast. Obviously, it's why Owen and I did it. We love digging into these cybersecurity statistics, but the thing is like, if I'm being honest, Owen and I spent just as much time talking about culture. Like, what is the culture of the company? Are people happy? I you know, I want to I want to spend a little time on this because it's it's fascinating. So you talk about like spending time developing this culture with staying power. Talk a little bit about that process. I mean, clearly you were successful. I can only imagine that our listeners are going to be interested in like how that worked and what you did that was so successful.
SPEAKER_03Uh wow, it starts, I mean, it it starts at all levels of the design of the organization. Um hiring is important, and again, hiring is is critical. Um, we had a very collaborative hiring process, which was harder to maintain as we got bigger, but but certainly in the early days, our original team was eight people. And uh and eight people with wildly different backgrounds. Uh a typical uh knee-jerk response to hiring team is uh get me get me five of my bros from my fraternity, right? And let's all write code. Uh we were building a system that had to appeal to a wide array of customers doing wildly different things. And there's, I believe it's called Conway's Law or something. It says systems look like the people who developed the system, right? So if we had a bunch of fraternity bros developing this system, it would have been great for fraternity bros, right? But it wouldn't have, it wouldn't have had any DNA or RNA that that resonated with anybody else. So we picked people from like four or five different industries. We picked people, we had a wide array, uh our our team ranged in age from like 27 to 43. Okay. So we did a lot of intentional things just to do the first team. Then we gave that team the best possible development environment we could. We had every one of those guys have an Apollo workstation to develop on, right? And this is and we said it's gonna cost money, but it's the way we're gonna do it. We were doing distributed network computing, we were building a distributed network-based environment for our customers. We said we're gonna eat our own dog food, we're gonna do it the way we believe. So, so the best possible tools we could get for the guys. We built the best possible physical environment we could get for these guys. Uh, there's a classic paper written by IBM about their Almagen Research Labs, which is how you design a physical laboratory for programmers. And guess what? Offices are part of it, okay? Because you need to have you need to be able to think without distractions. Yeah. This partial attention thing is a bunch of baloney. And I cringe every time I walk into a modern uh software shop. It's the rows of tables with keyboards and stuff. How do these people do anything? All right, no wonder they want to work at home. Um, so we couldn't afford offices for everybody, but we tried to build a hybrid space where everybody got at least a quiet cubicle, and then we had phone booths. Now they're they're more common, but we had privacy rooms where you could go make a phone call and do private work if you needed to. Again, intentional. All right. Um the way we dealt with communications, the way we dealt with management decisions, the transparency, all those things were built baked into what we did. Um, scale that across continents and across time zones. All right. So we had to make sure that our communications infrastructure, and again, back in the day, this is before email. All right. I mean, we we remember the advent of voicemail. We thought we died and going to heaven because we had asynchrony down the telephones.
SPEAKER_04Wow.
SPEAKER_03All right. Uh we were one of the first people to buy teleconferencing. We're doing this now, we take it for granted, and it looks free. We paid $50,000 or $60,000 in endpoint for picture town back in the day so that we could tie our West Coast guys with our East Coast guys, with our European guys. Those kinds of intentional decisions. Um, you know, that um our guys came to our engineers came to me and they said, hey, we've got some space in the basement, we have some uh gym equipment down there, we like to build a slot car track. I said, Well, go for it, right? They built from scratch a three-lane slot car track that was unbelievable, you know, and and they own it. And so that they, you know, they you feel like you're part of the the team. Uh those simple things, but but uh and then and then you know uh uh walk the walk. You know, I didn't ask people to do anything I wouldn't do. Um you know, I had demonstrated capabilities and lots of different things, so when I suggested something, I had credibility to make that suggestion. Um I you have to also be ethical in your business dealings and make that visible, yeah, etc. etc. etc. So there are there's there are lots of things. Um there's a great old book called Peopleware by two guys named Tim Lister, who used to be my boss, and Tom DiMarco, which is only a little bit dated now, but focuses on exactly this notion of what it makes what it takes to build good teams. Um I'm I'm quoted in there. I told the story, again, this notion of you this notion of of culture and quality baked into the things that we do. You know, don't don't ship it now, kind of stuff. We had them we are big enough at one point in our in our little history that we had to buy a shredder, okay? And we had the salesman come to us, the American salesman with the American shredder, and he brought us a machine uh that was like the size of a dishwasher and it sort of rumbled, and if it could have belts smoke, it would have belched smoke and it made noise, and my buddy and I were looked at it and we went, Really? Okay. Then the guy comes in with the German product, which was, you know, small, tiny, eight hug caps, silent, right? And we called the other salesman up and we said, Well, yeah, we saw this other thing. And and his response was classic. He said, Yeah, that stuff costs a little more, but all you're paying for is the quality. Is that all? Is that all? Oh, cool. I mean, really. Yeah. So I I you know, I hope that that's a roundabout way of getting to some of the stuff that you you talked about, but you know.
SPEAKER_02No, uh honestly, like it's funny, as you were telling that story, I could pick out pieces and I remember stories of like some of the best places I've worked and been like, they did that.
SPEAKER_03Well, hey, here's a here's a great example. In a former company, okay. In fact, in a former company, we had a Unix system. Again, this was early days. We were the first guys with a Unix system, okay? At the root of the file system, there were two directories called us and them. What do you think that told you about the cult?
SPEAKER_02Yeah, exactly. Exactly. Yeah, it's funny. You you know, you talk about the little things like, you know, having the best possible tools. It reminds me of a story where, you know, I was running a security operation center for one company, and one of the guys, one of my one of my senior tier one analysts, he, you know, ordering on tier two, he basically was complaining that his mouse is well, it was uncomfortable, it didn't work well, he wanted to get a new mouse. So we looked in the company directory, and a new mouse was like 12 bucks. So I was like, Yeah, of course, absolutely. You want to go mouse, get a new mouse, no problem. And this guy goes and he clicks it, and his he comes back, he's like, Paul, he rejected my request. And I said, What do you mean they rejected it? So I had to go to my manager. I'm like, hey, what's up with this guy's mouse? And she's like, Well, his mouth is working, he doesn't need a new mouse. I was like, you gotta be kidding me. I went out to the state, swiped my card, brought the mouse. I was like, mouse, man. And like my man couldn't believe I did that. And and they were like, Why'd you do that? You know, like he didn't need the mouse, the mouse was working fine. I said, You want to know why? Because for $12, I call that guy at one in the morning, he's gonna pick up the phone. Exactly right. Exactly right. Exactly right. These are the little things that people remember, like $12 on a company's balance sheet, like we're talking rounding hours here, but but person to person culturally, huge thing, right? Absolutely. That's a great that's a great story and a great example of that.
SPEAKER_03Absolutely.
SPEAKER_01I think that was under the threshold anyways. Like you didn't even have to register that. They wouldn't even know if you used the corporate card.
SPEAKER_02Yeah, right. Exactly. Exactly right. So listen, also, this is this is a great, this is an entire episode, right? We could probably end here and we'd be fine. But Owen, do you want you want to take us into what's happening to the happening today?
SPEAKER_01Uh yeah, I mean, nothing's really popping out for me, and we just dove into a lot of the topics. I think why don't why don't we get into card selection?
SPEAKER_03Sure, sounds like fun. Let's go, let's go to Vegas.
SPEAKER_02Yeah, exactly. That's what we're gonna do. This is this is the the thing. So we've explained this before, but what you're gonna do is you're gonna pick card A, B, or C. These have statistics from a bunch of different industry publications, and whatever we pick, that's gonna be the discussion. All right, Lou, so you gotta pick four card A, card B, or card C. And you're gonna just call it out. Let's try B.
SPEAKER_01B. B's been the popular one. All right. Um, so the title of this one is AI Defense, Governance and Shadow AI. According to the 2026 Verizon Data Breach Investigations report, 67% of users accessed AI services via non-corporate accounts on corporate devices. And 45% of employees are now considered regular AI users on corporate devices. Up from 15% the previous year. So, really quickly, right, one more time 60% of users access AI services via non-corporate accounts on corporate devices. 45% of employees are now considered regular AI users on corporate devices, up from 15% the previous year.
SPEAKER_04Yeah. Wow.
SPEAKER_03Yeah. So I gotta I got a couple of like knee-jerk reactions to that. Uh one is what the hell are they all doing? We can come back to that one. Sure. Two is um using non-corporate accounts from corporate machines is almost a guarantee that all of my corporate data assets are leaking somewhere. Um That's right. I'm just aghast that that is even possible. All right. I I'm not surprised. I, you know, I mean, come on. You know, that the the morons who said, let's take a power plant with a you know with a nicely closed uh control system and put it on the public internet so we can you know manage it remotely. What could go wrong? It's the same kind of stuff, right? You know, and now the Chinese can control our air and water. I mean, come on, guys. Um so I I we you know what I you know what I see here in all this AI stuff, and this is a good example, where repeat we repeat history so many times, right? This statistic could have been people using not approved departmental computing resources 40 years ago. It would have been the same thing. Okay? People do the and why? Because they feel that the environment is too restrictive, right? Or management doesn't realize that a potential threat exists because they haven't caught up with the technology. Those are those are the two uh you know uh areas of tension I see. And and those those are independent of technology. They happen forever. That's cycles and cycles and cycles. Um so yeah, huge, huge potential threat problem for corporate assets. And again, what are these people doing with this stuff?
SPEAKER_02You know, you're spot on. I I had the same thought, right? Like I maintain that especially in cybersecurity, the things that we experience are cyclical, right? So like you know, SQL injection became prompt injection, right? Model poison SEO poisoning became model poisoning. Like these things just become repackaged over and over and over again. And the, you know, what what's interesting here is this is the same problem we're discussing, which is basically shadow IT, right? You know, in this particular case, someone went to and signed up for a SaaS platform that they weren't supposed to use, or brought in, you know, software from home and installed it and they went to the internet.
SPEAKER_03In the old days, right, I snuck in a PC into my office, right? And I, you know, I ran my department inventory on D-base or something. Well, you know, uh it's the same problem. Uh it's just different technology.
SPEAKER_02You know, uh it's it's what I think is like what we need to talk about here is is I think you're asking the right questions. And it's not necessarily outrage that this is happening. But yeah, there's there's definitely outrage that would be aggravated, right? Like for if my data was being used on random like AIs that we didn't approve. But the reality is, like, the question is why?
SPEAKER_03Why do you have you seen the ads just just in the last couple of days? I've seen a couple of ads in my in my fees saying take your entire work history and sell it to us to train AI systems. Yeah.
unknownWhat?
SPEAKER_03And I'm looking at that and going, Get out of here. Uh are you out of your mind? I'll send I'll send one to you if I can find it. Are you out of your mind? Okay. And and I know people are gonna do it because it looks like a quick buck. You know, and one of the problems is that that the way we treat corporate data assets is still kind of brain dead. Um they should appear on the balance sheet as a as a a serious asset if your company runs on data. And in general, they they don't. Okay? They're they're treated as something, but they're not the accounting is way behind the the the ball on uh on lots of aspects of technology. I think that's a that's just gonna be a more rolling problem. It has been for decades, but it you know, AI might exacerbate it even more.
SPEAKER_04Yeah, interesting.
SPEAKER_02I've never thought, I've never thought of that, to be honest. Like, you know, for for years and decades, I've been saying we live and die by our data, but I've never thought to quantify data as well.
SPEAKER_03Do a little thought experiment. Imagine your data was gold bars. Okay? Yeah. What would you want those gold bars to do? You would want to protect, physically protect and manage and track those gold bars and know exactly what they were worth at any point in time, right? Your data is gold bars, and we treat it very differently.
SPEAKER_02Lou, like if the goal of this podcast is perspective, uh, you just won. I had never I had never thought like, and you know what the thing is, like, this is not even a tough thing to rationalize for me. How much time, effort, energy do we spent protecting data, but we never quantify it as an asset? That's wild to me. Wow. I I may have to rethink my entire perspective on.
SPEAKER_03Well, come on, you know, we know what it costs when the data is held for ransom and you can't run, right? By the way, I the other day I heard the story about Maersk. You know about Maersk going completely downward. Worldwide the shipping company. I do remember that.
SPEAKER_04Yeah. Okay.
SPEAKER_03They their servers in Ukraine were infected by a piece of software targeting other Ukrainian servers. And just by virtue of the fact that they were on the net locally, those servers got the virus and it propagated worldwide and it took their entire system down. Down. Completely down. Wow. All the stuff at the ports, all the stuff on the ships. The only way they were able to recover is that one server in Ghana was off the network for like a 20-minute window when this happened. Oh wow. And they were able to fly a team to Ghana, physically take that machine, take it back, and use that as the seed to recover. Okay? Imagine if that imagine if that server had been online. Right? So now we know what happens, right? That they lost all their data and they went down. What did that cost them? So then what was that data really worth? And why isn't that value showing up on a balance sheet item somewhere as an asset?
SPEAKER_02Question for the readers, right? Yeah. No, you're you're spot on. And I think if we bring this back to the statistic, I'm a little more outraged now that 67% of people are using unauthorized AI on corporate assets with personal accounts. Like that's just a massive data.
SPEAKER_03Unauthorized AI that, by the way, hallucinates, you know, gives you the wrong answer. There's all that too, right? So not only are they using it, but they're probably misusing it.
SPEAKER_01Yeah, I think it brings it back to what we were talking about in the beginning, right? Is this notion of culture. So where does the organization step in? What kind of culture are they creating, right? Are they allowing, are they communicating, articulating what AI tools are available for employees, or you know, is it kind of only for a subset of people where people just want to crank away and use AI because they think it's efficient and effective for their daily job? But yeah, it's it's pretty wild that this particular AI tool set, right, has just so much more exploitability within the usage of than other tools, right? Again, where they go to Pandora or their music or their video games or looking for their grocery list, right? That's a different beast than these AI tools that people are trying to bring in in the environment.
SPEAKER_03Well, uh a couple of a couple of things make me a little optimistic about a little a little about this, okay? Um, this is probably lagging data. And if we look at what this cost when this survey was taken, A, it was a tremendous amount of money, and there's been a lot of pushback because companies are looking at what they're spending and going, what? At the same time, I just saw a graph the other day of the decrease in technology. It starts at time zero when the technology is introduced, and then it tracks the decreasing course, uh cost of that technology. So, you know, computing, which which people call compute these days, which I hate, slap them up the side of that, it's called computing. Um but the steepest line is AI tokens. Okay, it is the fastest declining new technology ever in history. Okay, that's a good thing. Because it's going to it's going to help the the AI exploding cigar explode a little faster, and then we maybe can get back to some sense of normalcy. So yeah, I you know, 67% of people are doing this, but I think that number is going down, and I think econom the the economy of doing it is driving it down. Whether or not people think it's a good thing is a different story.
SPEAKER_02Yeah, it's interesting, right? Because like, you know, I keep coming back to this concept of why. Like, you know, this you're you'd you'd pr you'd presented this this idea of like, all right, well, they're doing it, it's terrible, it sucks. Like, you know, what why are people being shitty? But at the end of the day, if we can answer the question why, like that that gives us some some perspective into what's going on here. Now, look, I've said this before, I'll say it again. AI is amazing, it's transformative, used it used properly with the right people, it can 10 extra output, you know, like it can truly, truly is a force multiplier. I think that part of the reason of why of the why is because of that. People are trying in our society, right, to stand out, to do a good job, right? I think inherently people are good and they want to be able to perform and say, look, look at all the cool things I've done, look at the things that I've invented or or or built or the problems that I've solved. And I think that AI is allowing people to explore those things and in some cases solve problems, in some cases, create new problems, right? But that's a different topic for a different episode. But like I think that that's the thing is we now have this scenario where we have this highly addictive technology that enables people to very quickly skill up and have access to the totality of human, human intelligence in a place where they can interact with it in a very natural sense. They don't have to learn a new coding language, they don't have to learn a query language, they don't have to learn, you know, how to how to interact with a database. They simply ask it questions and I get it to perform these actions that allow them to be better. I'm not surprised that people are seeking out different versions and different things and trying out the stuff that's being presented to them without any real regard for like where that data is going and what the what the fallout of that potential uh the potential use of those platforms would be.
SPEAKER_03Well, it's interesting. Um I I look at it as uh a couple of different levers that are driving this. Uh you're you're looking at it, I think, from the uh uh personal self-realization, you know, Maslov hierarchy kind of, you know, I can be better doing this, right? I think there's a more sinister way to look at it too. I first of all, there's huge drivers in corporate executives are saying, this is the way to get more profit out of my business. Okay? And so do as much of it as you can, which led to token maxing, which led to all those other kinds of problems, right? Uh and and by the way, if we don't do it, our competitor's gonna do it, so we have to do it, regardless of how good it is. So there's a there's some of and and and we're we're in the mid-to-end part of that phase right now where people are finding out, I spent all this money and I'm not getting a whole lot. Okay? Right, right. You take that down to the individual contributor level. And it depends a lot on what that individual person is doing. Okay. I mean, if they're doing protein folding or they're doing molecule design or they're doing some physics, yeah, all sorts of amazing things can happen. And that can happen because the memory capability, right? You this is like a research assistant with an infinite memory, which is an amazing thing. You as a human, your head's only so wide at any point in time, right? The context you can keep in your head is only so big. The really neat thing about AI as it is today, and it's it's believe me, it's I told you this before, I have the first undergraduate degree in AI ever granted in the US. Okay, so I've been looking at this for a very long time. Um AI today uh is great at uh assembling information from widely varied sources and finding connections between those pieces of information. It's not necessarily good at making the next step that says, okay, what new idea comes from identifying those indications? And it can be awful at applying its imperfect knowledge to a solution. And I've experienced this in coding many, many, many times. And I play with I play with Gemini just because it's free and I'm not gonna pay for this stuff. Um and it's like having a really, really eager, really, it's like it's like a coding assistant rain man. Okay, it knows everything about every part of an API I want to deal with, but it suggests solutions to problems that are completely brain-dead. You know, it it throws much more code in a problem than is necessary, or it doesn't understand the larger context of the particular area of problem that we're trying to solve. Okay, so you know, from the from the and now as an individual practitioner, okay, I look at this and say, if I treat this this rain man assistant the right way, my productivity has improved, right? Because I don't have to spend time spielunking in an API document to figure out the couple of calls I'm on and what the parameter lists look like. Great. Okay. And it can find patterns of code that I can immediately reuse. And that saves tremendous amount of time, but I have to put it in the right context, right? That's right. Um so so there's so again, there's lots of different vectors, pressures driving this stuff, and there are lots of different benefits, some of which I think can be realized, many of which are not. Um and then there are the overriding, you know, uh hallucination problems, ethics problems, uh, all of those things that are just also looming in there. And and and in this crazy environment that we're in, corporations are so afraid of everything right now. Employees are afraid of lots of things, maybe everything right now. Job security is an abstraction for too many people, okay? Um that you know, you grasp at a solution, the old silver bullet, right? I mean, that's that's been a thing forever. AI certainly looks like a silver bullet for a lot of people, and but we know about silver bullets, right?
SPEAKER_02So Yeah, right. Well, it it's interesting. And and this brings it back to the original, the original question, because I agree with you. I think that corporations are highly incentivized from a capitalist perspective to adopt AI. They have the opportunity potentially to reduce headcount, improve output. I don't agree with that. That's the those are the those are the headlines, those are things that people are are saying. I personally don't think that's the right way to go, but I'm not a CEO. Right? So, like in this particular case, like we have these corporations that are highly incentivized to provide these tools to their to their people, right? Here, use the best in class, use these technologies. We're gonna pay for them. We're gonna pay for the API output. Or you talked about a you talked about token maxing or whatever else. Like, that's there. What what I what I'm having trouble reconciling is if that's the case, if that is true in our current state, why are 67% of people going rogue and signing up for other AI solutions? That does that's the part I can't reconcile. If we have an environment where the companies are truly incentivized to give people the best in class tooling, in fact, we talked about that at the beginning of the show relative to culture, and they have that. Why are people, why are 67% of people, according to the statistic, going rogue?
SPEAKER_03Well, I I think I think you've answered your own question, all right? I think that only a very small, the smaller percentage of companies have the mentality of giving their employees the best possible tool environment. The majority of companies don't want to spend $12 for a loss. And it's all of those companies where you have people going wrong because there's no way for them to get access to this stuff other than just going outside the current boundary. So I think, you know, you can hold two things in your head that can be different, right? I think what we're seeing here is that that large percentage comes from companies who have said, we're not going to give you any access to this or very limited access to it, and these people want more. You know, maybe they haven't learned what works or doesn't yet, but they're they still want the opportunity. And I think that number reflects that phenomenon.
SPEAKER_01Yeah, I think it's still going back to the same principle though that we've been seeing from Ever, right? Is you could have Microsoft Word out there, but someone wants to go use particularly Apple product, right? I'm gonna go download this. So I think it's still that human nature of I'm gonna use what's comfortable for me rather than I'm gonna use what the company has authorized to use. So it goes back to that human element again.
SPEAKER_02Well, we definitely have a problem on our hands, gentlemen, right? And uh I think at this point, you know, given kind of the conversation where it's gone, I think it makes sense to start thinking about like, all right, the people that are listening to this are gonna span all kinds of organizations. We're gonna have some folks listening at the enterprise level, we're gonna have some folks listening that are thinking about starting a company in the next couple of months and everything in between. So if we were to think about this, like, how do we rein this in? One, two, is this really a problem, right? Or is this just like an opportunity where organizations can look at what folks are using and potentially find better solutions? Is it somewhere in between? Like, what are y'all thinking about when we think about the statistic? And how do we reel this in so we can protect what I am now considering an asset, which is the organization's data walking out the door to these on-approved platforms?
SPEAKER_03Well, one thing we haven't talked about, uh let's let's consider this as a prosaic sourcing problem, right? You're a company and you're and you're saying, okay, I want to source this capability. In the old days, it might have been databases or it might have been network switches or it might have been CPUs, right? What would you do? You'd have an RFP out, and one of the things you would do is you would evaluate the financials of the companies if you're looking for a long-term solution to make sure that they'll be around after you're around, right? Right. Uh a corollary of that for people who are starting companies, never base your starter on the success of another startup. All right, because you've just multiplied the degree of difficulty when you do that. All right. Um so let's let's take this back, okay? I have I have implemented a system that uses a very, very small fraction of capability from open AI. And I'm comfortable doing that because no matter what happens to open AI, it's easy for me to unwind this and go, I mean, I'd build layers of abstraction so I can make a switch. Okay. But if I had a purchasing department with people who were, and this was a big procurement, and we exposed, we said, okay, open AI, let's look at your financials. Nobody would buy anything from them. All right? Right. Because they're bleeding, they're bleeding cash. I mean, they're they're they're just they're they're their capex exceeds their operating cash flow. I mean, well, this is nuts. Okay, so you would disqualify them as a vendor. Let's go through all the other potential sources of this. All right. And you'd say, just based on standard buying practices, we are looking at, you know, economic viability. These people would, in the real, you know, in a sense of sensible world, you can go somewhere else. The problem is there's nowhere else to go because they all look that bad. Right? All of these companies are burning billions of dollars of cash. Okay. It can be argued, generally over beer, that many of these companies are going to vaporize in a short period of time. And then the question is what's left and how does the recovery, how do you deal with the cover? And the and the problem that corporate planners should be thinking about is if I'm wedded my future to the products and services of these companies, and there's a high probability that they're going to vaporize, what happens after that? Okay? And I'll bet you I'll bet you a bag of nickels that those discussions are not had not being had in boardrooms and conference rooms when they're planning about this stuff. Okay. So that to me is a real serious problem. Uh which would which would say, hey, we should just, you know, put the brakes on a lot of this stuff. But FOMO at the highest corporate levels, right, just wipes out that kind of sensible thinking. And this is the way bubbles get built. Okay. Uh, you know, we're just we're just seeing the latest, greatest, most inflated version of this that I've experienced in my career. All right. Well, we got a loose solution.
SPEAKER_02Just wait for everything to collapse, and then it won't be a problem.
SPEAKER_01You'll be able to buy it cheap. Turned into an investing show.
SPEAKER_02That's right. Yeah. I mean, I mean, for me, like in the immediate, like the now, this is definitely something that I'd be concerned about, right? I think you did a great job expressing how valuable an organization's data is. And we just have this data walking out the door to these unapproved vendors. And what's even worse is that these unapproved vendors, especially when you don't have your corporate contract in place, are likely using that data to train their models, which means your proprietary information is now becoming part of their public model, right? So I think in this case, like, you know, I I I I always try to stay away from like, you know, kind of these solutions that are focused on technology. But in this, in this particular case, outside of things like of course establishing a proper policy, making sure people know this isn't that this isn't the right way to do it. There may be organizations where people just haven't communicated that, right? Hey, I can get to this thing, it's working, it's helped my one product, maybe it's allowed.
SPEAKER_03Well, there are there are implications. There are implications for things like data architecture, right? For security. I mean, if you have all your data in one monolithic database, whether it's, you know, relational or blaz, if it's in one place, the right data actor has access to all of it if they make the right penetration. Right. Of course. Okay. That sort of says maybe I want to break that up and put different pieces of my data in different places with different access paths, right? Find me five people who are doing that. All right. The the knee-jerk response is do it cheap, do it fast. I gotta be faster than the other guy. This is the easiest way to do it. That's right. That's right. Okay. Uh, and again, every time, I guess so so so in the security world, right? Cheap and fast is the enemy of security. It's just the way it is. 100%. Right? You cannot get security for free, and generally you can't get it quickly. So, okay, what do you want? All right, and um, you know, where's the liability that you're going to incur? So risk analysis is another thing we we haven't talked about, right? Uh if you if you're doing an honest risk analysis of all this stuff and you look at your risk exposure and and you say, eh, I don't care. Well, that's on you, right? And if I were if I were on a board and I saw that going on, I you know, I had a problem.
unknownYeah.
SPEAKER_02No, look, I I think that I definitely agree. Security is not free. But one of the things that no one and I lean into heavily is utilizing the capable you already have, right? So like people pay for security, but they can leverage that security or those toolings to do other things, right? Those capabilities to do other things. So in this case, one of the things I'm thinking about here is not only doing it here, but speaking with our clients, is can we can we pull an old trick from cybersecurity operations called long tail analysis, right? Dump a couple days worth of web bugs and see, do we see anything new that looks like it's going to kind of a new AI source, right? Something where like all of a sudden you're seeing f dot something show up all of a sudden, right? Which is almost always a telltale sign for an online application. And like now, let's check those things out and see are those worth blocking, what data is going there, who's using them, what's the use case is.
SPEAKER_03Okay. Um and this notion of there's a new bad actor around the corner is it's a function of the modern world and not necessarily a good one. I agree with you. I mean, I read web blogs every day.
SPEAKER_04Yeah.
SPEAKER_03All right. And I look and I say, okay, you know, is there a new bad actor here? Is this just a script kitty doing something and not, you know, and and every time we change a user interface, it seems it's another attack vector. Absolutely. And and it's like it's like cat. This this was the this was never a problem. Now it's a huge problem, and it's a cost, right? It's a you know, detecting and intercepting and mediating and mitigating against those, that costs money. So the the operating expense of uh of your your abstract average program or system now has gone up over time, not down, because more of your effort is going into fending off all this nonsense. Isn't that great?
SPEAKER_02Yeah. And and that feels like a great place to wrap up. Like, look, this has been an amazing conversation. Let's bring this to kind of final thoughts here. Owen, what are you thinking? Like, we've talked about a couple different topics, we've talked about the statistic, we've gone down a bunch of different paths of the impending doom that is coming for AI. What are your last like what are your last things you're gonna take away with on this uh this episode?
SPEAKER_01Uh one for sure, Lou, I think you've got to be a recurring uh guest, man. Talk about perspectives, like you said, Paul. Um, really loved this one. Um, but from the topic perspective, right? With I would say unauthorized use from corporate assets, that's what I really took away from this one. I know it was another AI topic. Uh, we we clearly had to shuffle these cards a little bit better, I think. But um this one truly for me was going back to that organizational culture. How do you articulate your controls? How do you empower your employees to use what authorized resources are there? So we can start to get right those people curiosity to drive through that. But um, I thought we brought up a lot of great points in terms of who's truly using this at the end of the day, who's accessing the AI, for what purpose are they doing it? Is it really having a benefit to the organization at the end of the day? You know, who knows? Um, but it's just interesting how this for me is more of a human cultural organizational problem um than it is a typical.
SPEAKER_03Yeah, you notice we we haven't used the phrase prompt engineering or anything like that. I mean that the technology is almost secondary here. It could be any technology. And again, if you have a historical perspective, right? If you I mean the the the our industry technology works in cycles, generational cycles. Okay. Um people people like to think the technology is magic and rational. Technology is just like fashion. You know, platform shoes come back every 20 years, whether we want them to or not. Why? Because the young designers don't remember, right? And they think they're creating something new. Well, this happens in technology all the time, right? It happened with mini computers, it happened with microcomputers, it happened with uh uh cloud software. We invented all this new stuff, and you look at the research, you look at history, and you go, wait a minute, you know, Boros Corporation did that in 1963. Just a different flavor. Okay, so this the wheel keeps turning and turning and turning. I've got one of my old professors always talked about the wheel's reincarnation, and he's absolutely right about that. And that that is invariant to whatever technology happens to be involved at the time. And I think we've we've exposed some of those issues in in our little talk. Um and I think that's ever going to be the case. In ten years from now, after this carnage has passed, there's gotta be something else.
SPEAKER_04Sure. And we're gonna have the same discussion.
SPEAKER_03Yeah, things we can't even think about. Yeah, 100%.
SPEAKER_02You know what's interesting for me is like just reflecting on this episode, you know, we always talk about these statistics, we talk about technology, we talk about like, you know, inherently cyber is born of IT. This for me truly was a culture episode, right? Starting the episode with culture, finishing the episode with this concept of focusing on people. And like one of the things I want to draw it back to is like, you know, Owen and I'm we're constantly reflecting, and we say this all the time. We say, we have to listen to the market. What is the market saying? What's resonating? What are the services we're providing that are are appropriate, that we want to lean into? What are the things people, it's not resonating with folks. But the thing is, like, I have to shift that a little. What I my advice out of this episode, or at least my realization personally, is you got to listen to your people too, right? You have to listen to your network the same way that that companies listen to the market, because it'll tell you what are the needs, what are the demands, what are your user bases doing in order to try to achieve what they're attempting to achieve, trying to remove blockers, to remove friction, right? And if we just take a second to use the tooling, the telemetry, the logs, the data that we talked about today in a way that just that not necessarily is about this, like, well, what's out there that's adversarial, but let's look at what's good and what are our people doing. That's a huge signal that I think I've been personally missing as a professional. And like that's the perspective I'm taking away with this episode.
SPEAKER_03Cool. Warms warms my heart. That's great. That's really good. You know, I tell people a lot, I you know, business is easy if you take all the people out of the equation. Right, right. Yeah. Exactly.
SPEAKER_02Exactly right.
SPEAKER_03Uh I should I should give a plug for for if there's anybody that's sports-minded out there. Uh the the uh the enterprise that I'm currently supporting, uh, which is a product of my brother's fertile imagination and his great partner, it's called sportsedtv.com. It's a training and education site where uh it's highly curated video and uh text information about lots of different sports. If you want to get better, if you want to get better at pickleball, you want to get better at volleyball or basketball or tennis. Um, this is an interesting place to cruise. And uh for any of you bad actors out there, stay away.
SPEAKER_02That's the plug every guest needs to needs to put out there. Amazing. Well, Lou, thank you so much. It's been a pleasure. Truly appreciated you being here. Our listeners, everyone, thank you out there for tuning in. We appreciate you. Uh be well, stay safe, and we'll talk to everyone soon. This was a blast. Thanks, guys. All right, thanks, take care. Bye. Bye bye.
