Latest / The Adults In The AI Room / Earley AI Podcast - Episode 94: Cybersecurity, AI Risk, and Why Security Is a Sales Motion with Taylor Hersom

Transcript

Earley AI Podcast - Episode 94: Cybersecurity, AI Risk, and Why Security Is a Sales Motion with Taylor Hersom · The Adults In The AI Room

• 0:01
  SPEAKER_01: This is the Early AI Podcast hosted by Seth Early.
• 0:04
  SPEAKER_01: Join us as we delve deep into the passions, expertise, and experiences of thought leaders and practitioners to talk about what's possible with artificial intelligence.
• 0:14
  SPEAKER_01: The Early AI Podcast is sponsored by Early Information Science, your digital transformation journey with design and deployment of innovative technology solutions, as well as Vector.
• 0:26
  SPEAKER_01: Now enjoy the show.
• 0:28
  SPEAKER_03: Good morning, good afternoon, good evening, depending upon your time zone.
• 0:31
  SPEAKER_03: Welcome to the Early AI Podcast.
• 0:33
  SPEAKER_03: I'm your host, Seth Early, and in each episode, we explore how artificial intelligence and data are reshaping business strategy and operations.
• 0:40
  SPEAKER_03: Today, we are talking about cybersecurity in the AI era, a space that's been changing faster than most organizations can track.
• 0:49
  SPEAKER_03: AI is creating more attack surface than ever before.
• 0:53
  SPEAKER_03: The data organizations are collecting to train and fine-tune models has become a target in its own right.
• 0:58
  SPEAKER_03: And the way companies are thinking about security is having to shift from fear-based to value-based and trust-based.
• 1:05
  SPEAKER_03: Today, joining me is Taylor Hursom, founder and CEO at Eden Data, a cybersecurity and compliance firm he built in GrooveMits before its acquisition in 2025.
• 1:15
  SPEAKER_03: Taylor started his career at Deloitte, went on to serve as chief security officer, and has spent the last several years building a practice squarely at the intersection of security, compliance, and AI.
• 1:26
  SPEAKER_03: Taylor, welcome to the show.
• 1:27
  SPEAKER_00: My gosh.
• 1:28
  SPEAKER_00: Seth, thanks so much for having me.
• 1:29
  SPEAKER_00: What an awesome intro.
• 1:31
  SPEAKER_00: Thank you very much.
• 1:32
  SPEAKER_00: I'm honored to be here.
• 1:33
  SPEAKER_03: Well, it's great to have you.
• 1:34
  SPEAKER_03: And you've done quite a bit of uh wonderful work in terms of building your organization from a startup bootstrapping to getting to that$20 million run rate and 100 people.
• 1:45
  SPEAKER_03: So very, very impressed.
• 1:46
  SPEAKER_03: And I'm going to talk about how you attacked that market and thinking about the subscription offerings versus time and materials types of consulting and how AI has really turned all of that upside down.
• 1:59
  SPEAKER_03: But before I get to that, I want to understand what are the common misconceptions that executives and technology leaders uh are most consistently getting wrong about cybersecurity today.
• 2:11
  SPEAKER_00: Oh goodness.
• 2:11
  SPEAKER_00: Yeah, this is this is a loaded question for sure.
• 2:14
  SPEAKER_00: But the the misconceptions I think are a fewfold.
• 2:17
  SPEAKER_00: One, the biggest one by far and above, is that security still gets looked at as a cost center.
• 2:22
  SPEAKER_00: And it is looked at as if I invest in this, I don't see an ROI.
• 2:27
  SPEAKER_00: So therefore, this is just costing me money.
• 2:29
  SPEAKER_00: Therefore, I shouldn't invest.
• 2:30
  SPEAKER_00: I shouldn't, I shouldn't expand budget, that sort of thing, which makes it a really thankless job a lot of times.
• 2:36
  SPEAKER_00: Unfortunately, that mindset is a little bit limited because in reality, you have two main things when you invest in security that you get benefit on.
• 2:44
  SPEAKER_00: One, it is de-risking you.
• 2:46
  SPEAKER_00: So it prevents you from ending up in the news for all the wrong reasons, which is brand reputation, legal reputation, all of all of those things.
• 2:53
  SPEAKER_00: Um, and then secondly, the other thing is if you have two companies that you're comparing to buy services from, and one says, hey, look at all the ways we protect your data, and the other one just says, Oh, we store everything in Google Drive, there's a very different message there.
• 3:07
  SPEAKER_00: There's a very different trust building exercise happening between those two companies, and you're you're more likely to go with the company that makes you feel good about their cybersecurity.
• 3:17
  SPEAKER_00: So those are like the two main things.
• 3:19
  SPEAKER_00: Biggest misconception, though, in security is that it's purely cost, uh cost center.
• 3:24
  SPEAKER_03: Right, right, right.
• 3:25
  SPEAKER_03: And and what about so again, you you you started to talk about this, but you know, security has historically been sold on fear, threat of breach, risk to ending up in the news, as you mentioned.
• 3:36
  SPEAKER_03: And and so you're saying that it's it's more effective to make a a case for security investment as as a a value rather than a cost.
• 3:45
  SPEAKER_03: Say more about that.
• 3:47
  SPEAKER_03: You just mentioned a couple of them, but how else are organizations improving security and and and looking at the value proposition of that?
• 3:55
  SPEAKER_03: So maybe expand on that a little bit more.
• 3:57
  SPEAKER_00: Absolutely.
• 3:57
  SPEAKER_00: Yeah, so you already nailed it on security is largely historically been sold on FUD, so fear uncertainty and doubt.
• 4:03
  SPEAKER_00: And it's just hard to motivate someone to say, if you don't do this, something bad's gonna happen, right?
• 4:08
  SPEAKER_00: That gives people the the inverse uh reaction that you would you would want when trying to sell them a service.
• 4:13
  SPEAKER_00: And so humans do really well when we uh we have some positivity in in uh in anything.
• 4:19
  SPEAKER_00: And so that that applies for security as well.
• 4:22
  SPEAKER_00: And what you can do as a business is rather than go that fear, uncertainty, doubt, or yeah, rather than go the FUD route, you can look at it as, hey, I'm going to use this to build my brand and make it a part of our identity and be proactive in how I use this when educating our customers about how we protect their data, how we protect our employees' data, how we are treating our intellectual property, all of those things.
• 4:46
  SPEAKER_00: And to give a specific example, a lot of what Eden Data did in the early days was focus on instead of selling a customer, hey, VCSO service, we're going to build a bunch of security controls and de-risk your environment.
• 5:00
  SPEAKER_00: We said, hey, let's focus on a compliance standard that you are able to achieve, like SOC2 or ISO 20 7001.
• 5:07
  SPEAKER_00: And then let's build a public security page that showcases all the cool ways that you're investing in security by nature of you going for one of those standards and use that in your sales process.
• 5:18
  SPEAKER_00: So now you've got a lot of cool tools out there that make this a really easy, fluid process where you can upload your pen test report and your cyber insurance policy.
• 5:26
  SPEAKER_00: And here's my security policy, and here's my most recent SOC2 attestation report.
• 5:32
  SPEAKER_00: And you can share that with your customers publicly.
• 5:34
  SPEAKER_00: That's a really cool way and a positive way to be able to build your brand and use in your sales cycle.
• 5:39
  SPEAKER_03: Okay.
• 5:40
  SPEAKER_03: Are there other areas of value and efficiency?
• 5:43
  SPEAKER_03: So you you didn't mention that in your opening, which is great.
• 5:46
  SPEAKER_03: And um, and what I'm trying to see is is beyond that, are there efficiency plays?
• 5:51
  SPEAKER_03: Are there mechanisms?
• 5:52
  SPEAKER_03: So for for example, when we you know help an organization with making their information more findable for a human, it's it will be more findable for AI, right?
• 6:02
  SPEAKER_03: So what we're saying is there's going to be efficiencies on in multiple areas.
• 6:06
  SPEAKER_03: Are there any efficiency plays that you also see, or is it mostly the uh outward-facing sales motions?
• 6:12
  SPEAKER_00: Absolutely.
• 6:13
  SPEAKER_00: I think people look at compliance and say, this sounds like more work.
• 6:16
  SPEAKER_00: And and if I'm an engineer, I don't want to add more controls in order to do my job or or the controls that make me take longer to do my job.
• 6:26
  SPEAKER_00: But in reality, there is a variety of ways that this creates streamline efficiencies that save you a tremendous amount of time.
• 6:32
  SPEAKER_00: So one big thing that that wasn't uh accidentally great for us early was the compliance automation industry took off.
• 6:39
  SPEAKER_00: So you've got like Drata, Vanta, SecureFrame, where you can automate a lot of your controls.
• 6:45
  SPEAKER_00: So you're just plugging into a system and that system is returning data.
• 6:50
  SPEAKER_00: And if that data doesn't look good from a compliance perspective, then someone can jump in rather than you manually having to go log into AWS and look through logs and address CrowdStrike alerts manually and all sorts of things that took a lot of time from a human.
• 7:05
  SPEAKER_00: That part got really streamlined.
• 7:07
  SPEAKER_00: Um, and and then there's of course the efficiencies of rather than waiting for a customer to send you hundreds of security questions and you have to fill it out in a spreadsheet.
• 7:17
  SPEAKER_00: You say, hey, Mr.
• 7:18
  SPEAKER_00: and Mrs.
• 7:18
  SPEAKER_00: Customer, here's our security program.
• 7:21
  SPEAKER_00: And oftentimes they'll reduce those questions or throw them out entirely.
• 7:25
  SPEAKER_03: I see.
• 7:26
  SPEAKER_03: Okay.
• 7:26
  SPEAKER_03: And so part of what your offering was doing was was applying the automation to the compliance process?
• 7:33
  SPEAKER_00: It was.
• 7:33
  SPEAKER_00: That was like the main thing we leaned in on was being that that let's build your compliance program using technology and then manage it for you.
• 7:41
  SPEAKER_03: Gotcha, gotcha, gotcha.
• 7:43
  SPEAKER_03: So let's talk a little bit about AI and the attack surface.
• 7:47
  SPEAKER_03: So AI is enabling organizations to ship more code, creating more threat surface than ever before.
• 7:52
  SPEAKER_03: What does it mean practically for how security teams need to operate?
• 7:55
  SPEAKER_03: So when you start adding AI and AI capabilities, how is that being addressed proactively and what is what are the implications?
• 8:03
  SPEAKER_00: Yeah, unfortunately, we already had this problem prior to AI in the security industry where it was hard to wrap your arms around your IT environment.
• 8:10
  SPEAKER_00: And you had this thing called shadow IT that was always talked about, where anybody could go adopt a SaaS tool on the internet and download it and sign up for account and upload data into it.
• 8:20
  SPEAKER_00: Now we've exacerbated that problem by adding AI because you're just expanding your your threat, uh, your attack surface exponentially.
• 8:26
  SPEAKER_00: And so you you nailed it, Seth, on on just code, for example.
• 8:30
  SPEAKER_00: If you're if the the average startup that when we started serving them back in when in the early days of Eden, they'd have like early stage startup would have 100 to 200,000 lines of code.
• 8:41
  SPEAKER_00: We've got now pre-revenue new startups coming with a million lines of code.
• 8:46
  SPEAKER_00: And it's it's incredible from on one side, but it's also terrifying on the other side.
• 8:51
  SPEAKER_00: So it's really expanded out the work effort and the need to understand your governance of security fundamentally.
• 9:01
  SPEAKER_00: And it also has created an opportunity to leverage AI to be able to reduce the workload and burden and enhance your ability to address threats.
• 9:10
  SPEAKER_00: So there's a lot of great companies out there, big and small, that are kind of leaning into this like um more automated pen testing, and which you know has has some merits and has some fallacies, but you've got automation like we just talked about with compliance.
• 9:23
  SPEAKER_00: You've got CrowdStrike leveraging AI and ArticWolf using AI to be able to respond to threats faster.
• 9:29
  SPEAKER_00: Those are cool opportunities.
• 9:31
  SPEAKER_03: Great, thank you.
• 9:32
  SPEAKER_03: And uh when you think about the how organizations are building AI on proprietary knowledge, right?
• 9:38
  SPEAKER_03: Training data, fine-tuning uh, you know, knowledge assets, competitive differentiation, uh IP, uh, those types of things, that of course becomes a high-value target in its own right.
• 9:50
  SPEAKER_03: So, how should organizations think about protecting those high-value knowledge assets?
• 9:56
  SPEAKER_00: So let me first start by stating it blows my mind every time I say this out loud, but we we naturally leaned into AI from a technology standpoint, and there is almost no security around it to speak of.
• 10:09
  SPEAKER_00: Security has not really caught up.
• 10:11
  SPEAKER_00: And so, what I mean by that is if you go ask the average company that's using AI across their enterprise, they probably don't, they they may have a general security program, but they likely don't have an AI-specific program where they have controls around their LLM and their processes and their access and such.
• 10:28
  SPEAKER_00: And that is terrifying.
• 10:30
  SPEAKER_00: So I think that one easy thing for people to start with, it was very similar to starting a SaaS company and and adopting something easy like SOC2 or ISO 27,001.
• 10:40
  SPEAKER_00: Let's use a standard that's already established to be kind of your north star right of the gates.
• 10:45
  SPEAKER_00: And in my mind, immediately what comes to mind is one of two standards, ISO 42001 or the NIST AI RMF framework.
• 10:53
  SPEAKER_00: Either of those already have your north star of the things you should be doing to de-risk your company as it relates to the LLMs that you have deployed in your environment, not to mention the governance of all of that.
• 11:02
  SPEAKER_00: And so that's by far, let's not reinvent the wheel.
• 11:05
  SPEAKER_00: By far, that's gonna be the easiest path forward to make a quick impact.
• 11:10
  SPEAKER_03: Do you have any advice for organizations that are going down that path?
• 11:14
  SPEAKER_03: Are there any gotchas?
• 11:15
  SPEAKER_03: Are there any pitfalls that they need to be aware of?
• 11:18
  SPEAKER_03: So, so if an organization is going to be using those standards to uh stand up security for LLMs, what do they need to be aware of?
• 11:25
  SPEAKER_03: Or any anything you can uh point out?
• 11:27
  SPEAKER_00: Honestly, most of it is governance work, which is beautiful.
• 11:30
  SPEAKER_00: That means that it largely just takes a human to sit down and and be strategic and ask, okay, where is my LLM polling data?
• 11:39
  SPEAKER_00: Where is the where where are the references that it's using?
• 11:43
  SPEAKER_00: Uh where did that answer come from initially, right?
• 11:46
  SPEAKER_00: And and that is largely just requires a human to sit down and document it.
• 11:51
  SPEAKER_00: Beyond that, though, there are like for ISO 40 2001, that is a certification standard.
• 11:57
  SPEAKER_00: So you can go buy the standard itself on on the on the ISO website for like 150 bucks.
• 12:03
  SPEAKER_00: But then if you want to go and get audited, then you need to be able to, if you are wanting to be audited against that standard, then you would go and pay a third-party auditor, and there is a cost associated with that.
• 12:15
  SPEAKER_00: NIST AIRMF framework, that is really just an internal document produced by the government that uh gives us some guidance on ways to manage security effectively.
• 12:26
  SPEAKER_00: And it there's no cost other than the cost of implementing.
• 12:29
  SPEAKER_03: Right.
• 12:29
  SPEAKER_03: That's very helpful in terms of how organizations can, you know, leverage what's out there, not reinvent the wheel.
• 12:36
  SPEAKER_03: Uh so you started to talk about the governance as a critical piece of that, and that it is a governance challenge and problem.
• 12:43
  SPEAKER_03: So security requires that we have those governance controls, policies, employee awareness.
• 12:49
  SPEAKER_03: How how does AI change both of those?
• 12:52
  SPEAKER_03: And where are organizations falling short?
• 12:54
  SPEAKER_03: Because we find there's uh governance on paper, but not in practice, right?
• 12:59
  SPEAKER_03: And it's better and it's better to not have a policy than to have a policy that goes unenforced, you know, because that's where you really have some some liability.
• 13:08
  SPEAKER_03: I mean, maybe that's a little bit an extreme statement.
• 13:10
  SPEAKER_03: But tell me more about what you're seeing.
• 13:12
  SPEAKER_03: And does your have your efforts been a catalyst uh to install governance or to operationalize governance?
• 13:18
  SPEAKER_00: Yeah, I'll I'll answer those backwards because the the second one is is fairly simple of yes, so thankfully we were able to jump into AI pretty early and focus on AI security specifically.
• 13:29
  SPEAKER_00: And a large part of that is simply the governance uh aspect.
• 13:33
  SPEAKER_00: And then to answer the first question, really, a lot of what has happened is that it's just an expansion of existing controls.
• 13:41
  SPEAKER_00: So it really still comes down to the fundamentals.
• 13:43
  SPEAKER_00: We were prior to AI, people are getting breached because of the wrong access, the wrong uh types of monitoring, the wrong um oversight, that sort of thing.
• 13:53
  SPEAKER_00: Still the same.
• 13:54
  SPEAKER_02: Yeah.
• 13:54
  SPEAKER_00: Yeah.
• 13:54
  SPEAKER_00: And to your point, like I have a security policy that says I do all these things, but I don't have a control that's actually doing those things, right?
• 14:02
  SPEAKER_00: It's still happening with with uh AI.
• 14:05
  SPEAKER_00: But I I think for the most part, that's the the things that are largely, I guess, quote unquote nefarious, is is things like like access to the LLMs, access to what the LLMs are able to do, um, and then governance over the citations, uh, governance over uh the the basically the the legal ramifications of hey, I I'm a healthcare company that plugged in an LLM to my customer's PHI.
• 14:33
  SPEAKER_00: Like, are am I allowed to do that?
• 14:35
  SPEAKER_00: Do I have legal coverage for that?
• 14:37
  SPEAKER_00: Those sorts of things.
• 14:38
  SPEAKER_00: Yeah.
• 14:39
  SPEAKER_03: Yeah.
• 14:39
  SPEAKER_03: And uh one of the things that we've done with governance is to stand up uh a mechanism to it's called governance or as it's something that helps organizations kind of take those policies and procedures and and really operationalize them.
• 14:53
  SPEAKER_03: And part of that is also, you know, looking at the performance of the LLM itself, right?
• 14:58
  SPEAKER_03: And and making sure that's being monitored, making sure that you're looking at ongoing testing, testing that the outcomes and the outputs, you know, accuracy, precision, recall, faithfulness, all those sorts of things.
• 15:10
  SPEAKER_03: Was that part of the work that you were doing, monitoring the LLMs themselves and monitoring their outputs, or is that a separate piece of work?
• 15:19
  SPEAKER_00: Transparently, it's something we really want to get into, but we haven't done historically.
• 15:23
  SPEAKER_00: It's still, yeah, it's it's still very much focused on the on the basics, to put it simply.
• 15:29
  SPEAKER_00: But I I think that there's a ton of value and a ton of opportunity in where you just stated.
• 15:33
  SPEAKER_03: Well, then let's set up another call.
• 15:35
  SPEAKER_03: I won't I won't pitch you here, but we'll talk about what we're doing in that space.
• 15:39
  SPEAKER_00: I'd love to.
• 15:40
  SPEAKER_00: I'd love to.
• 15:40
  SPEAKER_03: Yeah, so it's it's a really important area.
• 15:43
  SPEAKER_03: So when we start looking at, you know, how AI is being used, there's this tendency to assume that AI tools are going to handle this security monitoring threat detection automatically.
• 15:57
  SPEAKER_03: Where does it break down and what requires human judgment?
• 16:01
  SPEAKER_03: Obviously, you're flagging a lot of stuff, but that's been around for a while, right?
• 16:04
  SPEAKER_03: Surfacing some of these anomalous behaviors and the human needs to investigate.
• 16:08
  SPEAKER_03: What is what is different about how AI is handling that?
• 16:12
  SPEAKER_03: And then what are the boundaries and how have those boundaries changed over the last couple of years?
• 16:16
  SPEAKER_03: Is that a fair question?
• 16:18
  SPEAKER_00: Yeah.
• 16:18
  SPEAKER_00: So yeah, it's a great question.
• 16:19
  SPEAKER_00: It's to really historically we've been focused on humans are the complete factor.
• 16:25
  SPEAKER_00: They're the ones deciding on on is this a should this alert be uh valid?
• 16:30
  SPEAKER_00: Is this something I should investigate?
• 16:31
  SPEAKER_00: And then they come to an acclude conclusion on the alert.
• 16:34
  SPEAKER_00: So is this a threat?
• 16:35
  SPEAKER_00: Is this not a threat?
• 16:36
  SPEAKER_00: Did they look at the right source uh to make sure that the their their validation was appropriate?
• 16:43
  SPEAKER_00: Now we have AI doing a lot of that.
• 16:45
  SPEAKER_00: So what is shifted is it's it's we went from like doing the work to supervising the work, right?
• 16:52
  SPEAKER_00: And so now AI is going and making a lot of the preemptive decisions, it's evaluating a lot of logs, it is telling you, hey, this is a threat and this is not a threat.
• 17:02
  SPEAKER_00: It's coming to a lot of those conclusions before you even see it.
• 17:06
  SPEAKER_00: And so one is, hey, how is it coming to those conclusions?
• 17:10
  SPEAKER_00: Is that accurate?
• 17:11
  SPEAKER_00: And then two, when it comes to that conclusion, there still needs to be human intervention to say, okay, this is legitimate and I need to do something about it.
• 17:19
  SPEAKER_00: It's not like AI is, even though companies claim this, it's largely not going out and and actually addressing the threat.
• 17:26
  SPEAKER_00: It's largely still at the stage of just alerting in in many cases within security.
• 17:32
  SPEAKER_00: So those are some areas that it's it's certainly shifted.
• 17:37
  SPEAKER_00: They also like the way that the the way that we rely on LLMs can sometimes get a little out of hand because it is the way that it's designed, is that it can largely be right, but when it is wrong, it's really wrong.
• 17:52
  SPEAKER_00: And so how do you catch those wrongs?
• 17:55
  SPEAKER_00: How do you make sure that it's not bleeding in and expanding, I guess, the the percentage of fail rate because of the data sets or because of the the prompts or whatever the case may be.
• 18:06
  SPEAKER_03: And are you using LLMs to judge the output of LLMs?
• 18:09
  SPEAKER_03: You're using that there you go.
• 18:11
  SPEAKER_00: You start getting into that third party, fourth party, fifth party risk, right?
• 18:15
  SPEAKER_00: Uh and and that's the that's the other big problem is you can take a data set that was produced by an LLM and then you're uploading it to another LLM and saying, what do you think of this data set?
• 18:25
  SPEAKER_00: Like that's not good.
• 18:26
  SPEAKER_00: Uh in and I'm sorry, data set, I mean data output.
• 18:29
  SPEAKER_00: So you're taking a decision or or a document from one and putting it in another, that doesn't solve your problem either.
• 18:36
  SPEAKER_03: Yeah, yeah.
• 18:37
  SPEAKER_03: In some cases, we've used LLMs to judge the outputs as being equivalent.
• 18:43
  SPEAKER_03: So in other words, you'll get variations in what the answers are.
• 18:46
  SPEAKER_03: And for humans to look through that and say, oh, these are equivalent answers, it's a lot of work.
• 18:51
  SPEAKER_03: So an LLM can make be judge whether those answers are equivalent, for example.
• 18:56
  SPEAKER_03: So I think your point or my point, my counterpoint might be that maybe it's not appropriate in certain situations and can compound errors or or propagate errors in some way, shape, or form.
• 19:07
  SPEAKER_03: But in in the right uh use case, using the LLM to judge the output of an LLM can be part of that safeguard.
• 19:14
  SPEAKER_03: So that's kind of how what our experience has been.
• 19:16
  SPEAKER_03: But yeah, yeah.
• 19:18
  SPEAKER_00: Absolutely.
• 19:18
  SPEAKER_00: It also you you bring up a good point too, where I mean, in the in the security world, we're always identifying risks, right?
• 19:25
  SPEAKER_00: And so risks expand all the time.
• 19:26
  SPEAKER_00: One of the things that AI has created is a risk that we're talking about.
• 19:30
  SPEAKER_00: It's like a consequence risk.
• 19:31
  SPEAKER_00: It's uh basically what am I having the LLM do?
• 19:35
  SPEAKER_00: What decisions is it allowed to make?
• 19:36
  SPEAKER_00: And what are the consequences if it if it makes the wrong decision?
• 19:40
  SPEAKER_00: And that's where you need to weigh how much oversight needs to be involved, right?
• 19:44
  SPEAKER_00: And so that's something that that is a risk in and of itself.
• 19:49
  SPEAKER_03: So now I want to shift gears a little bit to talk about how consulting and services firms are being disrupted.
• 19:57
  SPEAKER_03: Uh the time and materials mechanisms are not appropriate anymore.
• 20:02
  SPEAKER_03: It is uh, well, it's funny because we see customers saying, give us a time and materials estimate, but then we're accelerating certain pieces of that so we give fixed price in parts of it, right?
• 20:12
  SPEAKER_03: Because there's stuff that we can do now that you know with our tools, with with our IP uh combined with the LLM, can can do much, much more rapidly than uh than before, right?
• 20:25
  SPEAKER_03: We've been able to accelerate.
• 20:26
  SPEAKER_03: And I think that translates into just more cost-effective, lower price efforts that accomplish more than than you could in the past.
• 20:34
  SPEAKER_03: So you're still uh you're still pricing it uh in a in a in a in a way that makes sense for organizations, but you're able to do so much more than than than before.
• 20:43
  SPEAKER_03: And you went into looking at this uh outsourcing, security, and compliance as a subscription from the start, as opposed to time just contracts started you know as short as three months, moved to to month to month, still average just under two years of tenure.
• 20:58
  SPEAKER_03: So, how did how did that subscription model kind of evolve and and and and what did that get right that hourly consulting got wrong?
• 21:07
  SPEAKER_03: So talk a little bit about how you how you did that.
• 21:10
  SPEAKER_03: And did you anticipate the efficiencies at the start?
• 21:14
  SPEAKER_03: Did you gain more efficiencies as you went?
• 21:16
  SPEAKER_03: How how did that kind of evolve?
• 21:18
  SPEAKER_00: Yeah, I so originally I got started even prior, I started Eden in in 2021, but in in 2020, I I spent when COVID hit the world, I spent uh a lot of that time on Upwork.com.
• 21:29
  SPEAKER_00: And that was where I really started playing with the subscription model.
• 21:32
  SPEAKER_00: So for anyone that's not familiar with Upwork, when you go on, you you post a job, say, or you can post, hey, I can do these things, or a company says, Hey, I need these things, and you can apply for that post.
• 21:42
  SPEAKER_00: And then in Upwork, it was configured to only be able to put in an hourly rate or a project rate.
• 21:48
  SPEAKER_00: And so I started gamifying that system of saying, look, how do I apply the consumer model where the consumer market already is to the professional world?
• 21:57
  SPEAKER_00: And what I mean by that is by that time, you had.
• 22:00
  SPEAKER_00: SaaS, you had subscription products.
• 22:02
  SPEAKER_00: Like we as humans are pretty, we're pretty ingrained in saying, okay, I I value this product at$50 a month or at$50 and it adds enough value to me every month that I'll pay$50 every single month.
• 22:15
  SPEAKER_00: The same principle.
• 22:16
  SPEAKER_00: So how do you come to a scenario where a company is valuing your services to pay$5,000 a month, let's say every single month, and they see the value and you are getting the margin, that's what I toyed with.
• 22:28
  SPEAKER_00: So to go back to your original question of did I adjust?
• 22:33
  SPEAKER_00: Absolutely.
• 22:34
  SPEAKER_00: There was a lot of guinea pig moments on Upwork where I was asking uh questions to my clients.
• 22:40
  SPEAKER_00: I was giving discounts in exchange for feedback.
• 22:43
  SPEAKER_00: All of that was happening so that I could really refine.
• 22:46
  SPEAKER_00: But what I didn't see coming is that how relevant it would be for years to come.
• 22:51
  SPEAKER_00: Like the same subscription model that I started at back in 2021 is is still being used largely in many ways at Riveron.
• 23:00
  SPEAKER_00: Um and now you're starting to see this global shift of nobody wants time and materials anymore.
• 23:06
  SPEAKER_00: They want to be able to pay for an output and they set a dollar value on and and on upwork.
• 23:12
  SPEAKER_03: So I I were you were you getting meaningfully sized engagements on Upwork?
• 23:17
  SPEAKER_00: I was.
• 23:18
  SPEAKER_00: Yeah.
• 23:18
  SPEAKER_00: And largely when I shifted, you you would have people post on there and say, I only have a$500 budget.
• 23:24
  SPEAKER_00: But when you go on and you educate them on kind of the the implications of of security and ongoing versus ad hoc, and then say, look, let's let's uh let's shift your kind of value proposition and then let me hit you with uh I'm gonna charge you a couple grand a month.
• 23:39
  SPEAKER_00: It actually works quite well.
• 23:41
  SPEAKER_00: And so on Upwork, uh really I Eden became successful because Upwork became so successful, and I was able to Google how to start an LLC and just said I I can't do all this by myself.
• 23:52
  SPEAKER_00: And that's naturally how I started the company.
• 23:55
  SPEAKER_03: Interesting.
• 23:55
  SPEAKER_03: So so services firms at this point, you know, they you know, they're getting are getting hit up with with uh you know, these models are shifting.
• 24:04
  SPEAKER_03: So I I I guess the question is really, you know, how you make that transition and how you need to think about certain types of projects.
• 24:12
  SPEAKER_03: So what what else should services firms be doing now?
• 24:16
  SPEAKER_03: Again, if they have a traditional time materials model.
• 24:19
  SPEAKER_03: And many times it's not that easy to translate that into a clear value proposition or a clear subscription rate or a clear fixed price.
• 24:29
  SPEAKER_03: I mean and just talk a little bit more about some of that experimentation and how you had to kind of deconstruct that and make that work.
• 24:36
  SPEAKER_00: Yeah, this part was really it's gonna sound stupid simple, but it was getting customer feedback constantly.
• 24:43
  SPEAKER_00: It's so hard to ask for feedback.
• 24:45
  SPEAKER_00: We just are not great at that as humans, and you're afraid that people are gonna say something critical.
• 24:51
  SPEAKER_00: And so I kind of lowered the expectation for myself on saying this is my entire purpose on Upwork is to be able to gather data, not so much to make money.
• 24:59
  SPEAKER_00: And so that's how I would encourage folks to look at this now is have conversations with your customers, ensure that what you are offering actually adds value, right?
• 25:09
  SPEAKER_00: That's I know that sounds simple as well, but getting candid feedback from your customers on do you see this being a value add for your organization?
• 25:18
  SPEAKER_00: I I would especially be getting that feedback from your champion at the customer.
• 25:22
  SPEAKER_00: That's really just an easy way to kind of start to ideate how would you start to shift this to at least a project, right?
• 25:28
  SPEAKER_00: Like how how can I how can I do project with with insight into the next project and the next project and the next project?
• 25:35
  SPEAKER_00: But I I think that it's all like uh one thing that I obsessed over was marketing.
• 25:40
  SPEAKER_00: It's it does not matter how much I know about security.
• 25:43
  SPEAKER_00: If my customer doesn't give a damn, then it it just truly doesn't matter.
• 25:46
  SPEAKER_00: And so rather than trying to change their mind, I try to meet them where they're at.
• 25:51
  SPEAKER_03: And and what would be what were some of the experiments or what did you find worked well?
• 25:55
  SPEAKER_03: What did you what kind of iterations did you go through there?
• 25:58
  SPEAKER_00: Yeah, I I would say that so to start, I mentioned briefly Upwork would say set your hourly rate, right?
• 26:05
  SPEAKER_00: And it would only have a field to set your hourly rate.
• 26:08
  SPEAKER_00: Well, there was a comment section, and I would email or I would message in that comment section when submitting my hourly rate.
• 26:15
  SPEAKER_00: I would say, hey, my hourly rate, and I would go ahead.
• 26:18
  SPEAKER_03: What would you put it in at?
• 26:19
  SPEAKER_03: I'm just out of curiosity.
• 26:20
  SPEAKER_00: The the hourly rate.
• 26:21
  SPEAKER_00: Yeah.
• 26:22
  SPEAKER_00: Yeah, I would usually pick a really high number.
• 26:24
  SPEAKER_00: So I would do something like 250 or 300 or$350 an hour.
• 26:28
  SPEAKER_00: And then I would message in the comment section and say, Hey, I actually do ongoing retainer services and it's much more affordable in the in the long run.
• 26:37
  SPEAKER_00: Message me for more details, basically.
• 26:40
  SPEAKER_00: And that was in itself a test.
• 26:42
  SPEAKER_00: And I got a lot of responses on that.
• 26:44
  SPEAKER_00: And with if you're not familiar with Upwork, you actually you're you're bidding on these jobs, right?
• 26:49
  SPEAKER_00: And and they get to pick from whoever bids on it.
• 26:52
  SPEAKER_00: And so I was going up against competition, but I was winning because they were they were so open to this, like uh this shift.
• 26:58
  SPEAKER_00: And and so that was one thing.
• 26:59
  SPEAKER_00: And then secondly, it was going and testing project versus subscription and educating customers on hey, you're you're hiring me to fill out the security questionnaire, but in the security questionnaire, you're failing about half of it.
• 27:13
  SPEAKER_00: So I could help you, you know, pass the security questionnaire and any subsequent ones that come through.
• 27:20
  SPEAKER_00: That was one way that I was I was kind of uh toying with.
• 27:24
  SPEAKER_00: They they really only wanted to hire me for this one little project.
• 27:27
  SPEAKER_00: How do I see help them see the value beyond that?
• 27:29
  SPEAKER_03: Yep, yep, interesting.
• 27:30
  SPEAKER_00: And that works out really well.
• 27:32
  SPEAKER_03: Any other marketing efforts that you found to be more effective or less effective?
• 27:36
  SPEAKER_00: Go look at your competitors and then try to be the opposite of them.
• 27:40
  SPEAKER_00: And what I mean by that is not in the service you're offering, because there's plenty of Eden data's out there, like a lot of a lot of security companies that that can consult on on SOC2 and ISO and VC so and all that.
• 27:52
  SPEAKER_00: But all I could see was like blues and grays and like really subpar JPEGs that they were using.
• 27:58
  SPEAKER_00: And it was really confusing to go on their website, and only I understood the terminology because I'm in the industry.
• 28:03
  SPEAKER_00: So I went the opposite direction of that.
• 28:05
  SPEAKER_00: And if you go, I unfortunately the Eden site is no more, but go to the Wayback Machine and a lot of neon, a lot of positive language in the website, a lot of, hey, we're gonna grow your business.
• 28:17
  SPEAKER_00: And then we talked about topics that would be relevant to them and not relevant to us, like those types of things really worked out.
• 28:24
  SPEAKER_03: Interesting.
• 28:25
  SPEAKER_03: And did you ever do LinkedIn promotions?
• 28:27
  SPEAKER_00: We did, yeah.
• 28:28
  SPEAKER_00: Yeah.
• 28:28
  SPEAKER_00: LinkedIn largely um I I focus just on building my brand organically.
• 28:34
  SPEAKER_00: And so just consistent posting when nobody was interacting, that's the hardest thing is to motivate yourself to keep posting when no one's interacting.
• 28:41
  SPEAKER_00: Uh, but that's the that's the way to uh that's the way to do it.
• 28:45
  SPEAKER_00: And so I I I not only did that, but I also would like promote posts when I could.
• 28:50
  SPEAKER_00: And we would do I I tried the blog, I don't think LinkedIn blog really took off, but like webinars and such, going and doing things with partners and promoting that on LinkedIn.
• 28:58
  SPEAKER_00: That was all part of the all part of the game.
• 29:00
  SPEAKER_03: Yeah, great.
• 29:01
  SPEAKER_03: That's interesting.
• 29:02
  SPEAKER_03: So when you look at at there's a note here uh that talks about getting thrust into AI for two reasons.
• 29:09
  SPEAKER_03: I don't have those reasons here.
• 29:11
  SPEAKER_03: Do you recall what those reasons were?
• 29:13
  SPEAKER_00: Thrust into AI, yes.
• 29:15
  SPEAKER_00: You know, I actually don't I I bet I could come up with more than two, but the two that immediately come to mind is is one, the market forces us into it.
• 29:25
  SPEAKER_00: Like it's no different than the steam engine and the industrial printer and the internet and everything else.
• 29:31
  SPEAKER_00: It's been largely, hey, you need to you need to evolve or you die.
• 29:35
  SPEAKER_00: And so that was one part of it.
• 29:37
  SPEAKER_00: And then secondly, inadvertently, the first adopters of AI were the startups and the scale-ups and the technology forward companies, and that was our entire customer base.
• 29:47
  SPEAKER_00: And so that forced us to be able to have those conversations because they were immediately bringing it up and were educated on on AI and how to use it from a technology standpoint.
• 29:57
  SPEAKER_00: So I needed to be able to meet them where they were at.
• 29:59
  SPEAKER_00: And so that's that's definitely a a second reason that we were thrust in.
• 30:03
  SPEAKER_03: I see the notes here now.
• 30:04
  SPEAKER_03: It does it it said had it on the other page, but uh it did talk it.
• 30:08
  SPEAKER_03: We did talk about uh that you were being you were you were at the forefront of the space and you were attracting companies that were also at the forefront.
• 30:16
  SPEAKER_03: So they were leveraging AI, so you kind of had to, as as you said before, meet them where they were.
• 30:22
  SPEAKER_03: Let's see.
• 30:22
  SPEAKER_03: So when you started signing up these AI startups, what did securing an LLM require that securing traditional SaaS app did not?
• 30:33
  SPEAKER_00: It yeah, that very good question.
• 30:35
  SPEAKER_00: It was uh it was really it was back to the basics, but a basic that I didn't mention, which is historically a lot of companies struggle with asset inventory.
• 30:46
  SPEAKER_00: So just understanding what your assets are, understanding where your hardware's at, your software, all of that good stuff, and just having a list of that.
• 30:52
  SPEAKER_00: We had to focus on asset inventory for LLMs and understanding how is AI being used, what were agents involved?
• 31:00
  SPEAKER_00: I mean, at that point, like the agentic AI was still pretty early stage, but from a cursory standpoint, it's like, are we developing an LLM?
• 31:09
  SPEAKER_00: Are we leveraging a third party?
• 31:11
  SPEAKER_00: What does that entail?
• 31:12
  SPEAKER_00: What technologies do we need to be able to develop it?
• 31:14
  SPEAKER_00: So you've got these ancillary services that you're using, these SAS services that are helping you develop net news technology.
• 31:21
  SPEAKER_00: You have your LLMs that you're leveraging that are leveraging software comp or you know, leveraging third parties or fourth parties.
• 31:28
  SPEAKER_00: And so all of those things were the things that we had to focus on first.
• 31:32
  SPEAKER_00: And then the other big part that popped up pretty early was a lot of our companies that we serve sell into enterprise.
• 31:39
  SPEAKER_00: And so you had these enterprise companies that were suddenly overnight sending across AI security assessments and saying, fill out these 20 questions on how you manage AI.
• 31:48
  SPEAKER_00: And so we had to we had to start by just saying like a lot of it was come up with a document that explains how the heck you, as an organization, our customer, was using AI.
• 31:58
  SPEAKER_00: And this is what we do, these are the tools we use, this is how we protect your data, just a one-pager.
• 32:04
  SPEAKER_00: And so that was a big part that didn't exist before.
• 32:06
  SPEAKER_00: We didn't have to have a one-pager on security so much.
• 32:08
  SPEAKER_00: Yeah.
• 32:08
  SPEAKER_00: So pretty fascinating.
• 32:10
  SPEAKER_03: That's that's great.
• 32:10
  SPEAKER_03: And and we're actually working with a nonprofit that I don't typically work with nonprofits.
• 32:15
  SPEAKER_03: I have in the past, but I'm doing a little pro bono project for this organization.
• 32:19
  SPEAKER_03: And one of the things that we were finding in our discovery was that there was so many, so much embedded AI in the tools and technologies that they were using that their vendors were sneaking in without telling them.
• 32:33
  SPEAKER_03: And that had interesting ramifications because you know, there was one vendor that started auto-coding their expense submissions.
• 32:40
  SPEAKER_03: And it turned out the coding was wrong, that their AI was getting it wrong.
• 32:44
  SPEAKER_03: And it wasn't until someone in the organization started noticing this and then saying, wait a minute, where's this coming from?
• 32:50
  SPEAKER_03: It's coming from our vendor who has used AI without telling us and without testing it, and without our having a mechanism to know about it and to check it.
• 32:59
  SPEAKER_03: So, what do you do in those situations?
• 33:01
  SPEAKER_03: So now what we've said is you need to inventory all of your applications and you need to ask your vendors, what are they doing, right?
• 33:08
  SPEAKER_03: What are they doing with AI and where what is their plan and to make sure that they're informed before they uh end up with this type of a situation?
• 33:17
  SPEAKER_03: So, and and obviously every single vendor is leveraging this increasingly as part of their core offerings or they're bolting it on.
• 33:24
  SPEAKER_03: What what are your what are your approaches for sussing that out and and discovering that?
• 33:29
  SPEAKER_00: I will be transparent.
• 33:30
  SPEAKER_00: Right now, it's it's very hard.
• 33:32
  SPEAKER_00: Like there is we already for data privacy, we had third party, fourth party, fifth party.
• 33:38
  SPEAKER_00: I've said that term a few times now.
• 33:40
  SPEAKER_00: And that just essentially means not only is it the vendor I'm working with, but the vendors that are working with that vendor and the vendors that are working with those vendors.
• 33:47
  SPEAKER_00: Right.
• 33:47
  SPEAKER_00: And so when you apply that to AI, like it's incredibly hard to be able to solve the problem.
• 33:53
  SPEAKER_00: So I think one that you nailed it is asset inventory.
• 33:56
  SPEAKER_00: Like I think that people need to understand that if if I can't address the risk itself, let me at least cover my own bum with legal.
• 34:06
  SPEAKER_00: And what I mean by that is at least having vendors, like having an agreement in place of like you vendor, are going to maintain security posture based on these standards.
• 34:15
  SPEAKER_00: You're going to maintain AI security posture based on these standards, and you need to sign your document saying you did that.
• 34:21
  SPEAKER_00: And if they aren't doing that and something ends up happening, you at least have label legal repercussion that you can apply.
• 34:27
  SPEAKER_00: But then beyond that, it's like, let's evaluate exactly what a vendor is supposed to be doing for my organization and make sure that their access and uh their service is very limited to that.
• 34:39
  SPEAKER_00: And so what I mean by that is this seems preposterous, but customers all the time will give away excessive access to systems that a vendor doesn't even need access to.
• 34:48
  SPEAKER_00: They say, Oh, you're probably gonna need this, you're probably gonna need that.
• 34:51
  SPEAKER_00: Let me just give you access.
• 34:52
  SPEAKER_00: It doesn't expire, it's not monitored.
• 34:54
  SPEAKER_00: Like, don't do that.
• 34:56
  SPEAKER_00: Just start with like, hey, explicitly only giving access to what the vendor asks for, explicitly giving them very, very limited role, explicitly making sure that you have monitoring function into what they're doing.
• 35:08
  SPEAKER_00: Those are like really some of the biggest areas.
• 35:11
  SPEAKER_03: Yeah, yeah.
• 35:11
  SPEAKER_03: And I imagine part of your process is is uh surveying those vendors or having the company survey those vendors.
• 35:18
  SPEAKER_00: Is that exactly?
• 35:19
  SPEAKER_00: Yeah.
• 35:19
  SPEAKER_00: So we we do a lot of like third-party vendor management, and part of that is just documenting this is the vendor, this is the risk to my organization based on the data that they're collecting or the service they're providing and how dependent I am on them.
• 35:32
  SPEAKER_00: And then based on that criteria, then that determines how deep I go on a security review and then documenting that security review.
• 35:39
  SPEAKER_00: So that could be uh, hey, it's just a marketing company, so let me just ask for their SOC too, or or uh like uh there have them fill out a short questionnaire.
• 35:47
  SPEAKER_00: But if it's a critical vendor, I'm gonna need to rely on their certifications.
• 35:50
  SPEAKER_00: I'm gonna need them to fill out a comprehensive security questionnaire.
• 35:53
  SPEAKER_00: I need to have some comfort that they have their act together when it comes to security.
• 35:58
  SPEAKER_03: And and is part of that uh questionnaire what what they're using, what I imagine that that part of it is just asking them very explicit questions about their use of AI and LLMs in their products.
• 36:10
  SPEAKER_03: Yeah.
• 36:11
  SPEAKER_03: Exactly.
• 36:11
  SPEAKER_00: Yep.
• 36:12
  SPEAKER_03: Yep.
• 36:13
  SPEAKER_03: Anything particular that that uh you can share that would maybe be not so obvious to folks about those kinds of questions?
• 36:20
  SPEAKER_03: I mean, you can say, are you using LLMs?
• 36:22
  SPEAKER_03: They say, sure.
• 36:23
  SPEAKER_03: Uh, how are you using them?
• 36:24
  SPEAKER_03: Well, we're using them to provide, you know, this support answers.
• 36:28
  SPEAKER_03: Well, where's the data coming from?
• 36:29
  SPEAKER_03: It's coming from our support database, right?
• 36:31
  SPEAKER_03: Those are kind of the typical things you would ask, right?
• 36:34
  SPEAKER_03: What are you what are you using?
• 36:35
  SPEAKER_03: Are you using it?
• 36:36
  SPEAKER_03: Yes, I'm using it, how are you using it?
• 36:38
  SPEAKER_03: Yes, I'm using it for this purpose in this use case.
• 36:40
  SPEAKER_03: What data are you using?
• 36:42
  SPEAKER_03: Here's that.
• 36:42
  SPEAKER_03: Those are the obvious ones.
• 36:44
  SPEAKER_03: Are there less ones that come to mind?
• 36:46
  SPEAKER_00: Yeah, I there there's certainly there's certainly questions around like basically how do you have your LM contained?
• 36:52
  SPEAKER_00: So how are you able to ensure that it's only pulling from that data set, that it's not replicating in any manner, that it's it's respecting the boundaries, you know.
• 37:02
  SPEAKER_02: Yeah, boundary ignorance, we call that.
• 37:04
  SPEAKER_02: Yep.
• 37:04
  SPEAKER_00: One thing I encourage people to do, like it would actually be a fairly easy exercise to just go download something like the NIST AI RMF framework off the internet, and it'll be in a spreadsheet.
• 37:14
  SPEAKER_00: And you just go through and you yourself, as the founder or the executive or the head of IT or whatever, uh go in and just answer those questions truthfully to yourself so that you know immediately, hey, one, I've got a gap here.
• 37:27
  SPEAKER_00: And two, if this question ever comes up, uh maybe I don't know the answer to it.
• 37:30
  SPEAKER_00: Maybe I need to go figure out the answer now, document it internally, and then be ready.
• 37:34
  SPEAKER_03: Okay.
• 37:34
  SPEAKER_03: Okay.
• 37:34
  SPEAKER_03: So that gives you kind of a comprehensive view of all of that.
• 37:38
  SPEAKER_00: It does.
• 37:39
  SPEAKER_00: It's pretty exhaustive.
• 37:40
  SPEAKER_03: Yeah, yeah.
• 37:41
  SPEAKER_03: And can you I I think we earlier talked about the you know the things that people get wrong in terms of misconceptions.
• 37:49
  SPEAKER_03: What what are the things that they just don't understand, executives in in about security?
• 37:54
  SPEAKER_03: What do they give us the headline of of what those are?
• 37:57
  SPEAKER_03: And if there's if we've covered them, maybe just reiterate them.
• 38:00
  SPEAKER_03: But what is it that people don't understand, especially when it comes to AI and it comes to these third-party risks and so on?
• 38:06
  SPEAKER_03: What are they not getting at this point?
• 38:08
  SPEAKER_03: What are they not understanding?
• 38:09
  SPEAKER_00: One thing that they're not getting who do you really try to educate executives around when they just don't that seems obvious, and it's sad that I still have to say it out loud, is is that recognizing that security is just as important as any other department that you have.
• 38:24
  SPEAKER_00: So you've got at the board level people reporting on marketing and on go-to-market and uh sales and revenue and all of that, they should be reporting on security.
• 38:34
  SPEAKER_00: So just up just a few years ago, less than half of the Fortune 500 had a CISO.
• 38:39
  SPEAKER_00: Like now, if you if you go look at like the commercial and below uh size companies, most of them do not have someone in charge of security, just statistically speaking.
• 38:49
  SPEAKER_00: And that's largely because leadership is not demanding it, right?
• 38:53
  SPEAKER_00: And so I think that part of the issue is just educating on hey, this this really needs to be a topic, I think, at the top, and it needs to be driven top down.
• 39:03
  SPEAKER_00: That would be one huge area I would focus on.
• 39:05
  SPEAKER_00: And then the other is just kind of educating on why things cost what they do.
• 39:10
  SPEAKER_00: Like investing in security is expensive, headcount is very expensive, and tooling is very expensive.
• 39:15
  SPEAKER_00: And unfortunately, the being able to come up with a number around that, it should realistically be one to two percent of your of your total revenue investing in security.
• 39:25
  SPEAKER_00: Companies never do that.
• 39:27
  SPEAKER_00: They they don't.
• 39:27
  SPEAKER_00: And and so realistically, when we educate, we try to say use that 0.5 to 1% at least as as an as an identifier.
• 39:34
  SPEAKER_00: And you can get that down in some ways, but you have to have the right talent to be able to get that down.
• 39:39
  SPEAKER_00: So vendors can help you get that down in in certain regards, but largely that's the that's the kind of the education piece that we give.
• 39:47
  SPEAKER_03: Yeah, that's interesting.
• 39:48
  SPEAKER_03: That is a big number and be curious to see how that compares to other of those types of benchmarks.
• 39:53
  SPEAKER_03: Um but very interesting.
• 39:55
  SPEAKER_03: I have a question about reporting when you said security should be reporting uh to the C-suite just as other departments do.
• 40:03
  SPEAKER_03: And and it's almost like what would the reporting consist of?
• 40:06
  SPEAKER_03: Because you can come and say, We have been hacked again, right?
• 40:09
  SPEAKER_03: Or no security breaches again, or you know, like it's almost like when it's working, it's a non-uh reportable rate because you're reporting that something didn't happen.
• 40:18
  SPEAKER_03: Something could have happened but didn't happen, yeah, which would be a boring report, right?
• 40:22
  SPEAKER_03: And and maybe people would so what are the things that that can be reported upon that would be meaningful to executives in that situation, in that environment where you're trying to increase the visibility?
• 40:34
  SPEAKER_03: Uh, I have some ideas, but I want to hear what your thoughts are.
• 40:37
  SPEAKER_00: Yeah, absolutely.
• 40:38
  SPEAKER_00: So one would be just a cursory understanding of what is actually happening from a security perspective across the environment.
• 40:44
  SPEAKER_00: What are the standards that we align with?
• 40:47
  SPEAKER_00: What are our customers asking for?
• 40:49
  SPEAKER_00: What's the status of if I'm going for SOC to type two and these trust service criteria because all our customers are asking for it?
• 40:58
  SPEAKER_00: How far along am I?
• 40:59
  SPEAKER_00: Uh, were there any findings in the last audit?
• 41:02
  SPEAKER_00: That sort of thing.
• 41:03
  SPEAKER_00: And then drawing particular attention to the areas that are high risk.
• 41:08
  SPEAKER_00: So say, look, we've had this, we we've repeatedly been saying this for the last six months.
• 41:14
  SPEAKER_00: It's a little bit of a CYA exercise, but um that that this particular cloud instance that we have has no security enabled.
• 41:22
  SPEAKER_00: We don't have guard duty, we don't have uh cloud watch, we don't have like anything for a mechanism to know if we were breached, it's certainly great to elevate that at that level.
• 41:32
  SPEAKER_00: Um and then I think that the other one is just educating on um the the kind of the opportunities.
• 41:39
  SPEAKER_00: Hey, we are having more customers ask about ISO 27001.
• 41:43
  SPEAKER_00: If we decide to go for ISO 27,001, that will potentially unlock Europe for us.
• 41:49
  SPEAKER_00: That will unlock the ability to be able to sell our services beyond the US.
• 41:53
  SPEAKER_00: Those types of discussions should also be had.
• 41:56
  SPEAKER_00: Um so those are just a few.
• 41:57
  SPEAKER_03: No, those are great.
• 41:58
  SPEAKER_03: I think that's very helpful.
• 41:59
  SPEAKER_03: And so when you do these audits, so you start this process.
• 42:04
  SPEAKER_03: What does a roadmap look like for remediation?
• 42:07
  SPEAKER_03: So imagine you're put creating a plan of attack and you're saying, here are the things we need to do short term, here's the low hanging fruit.
• 42:13
  SPEAKER_03: Then these are things that are going to take longer to take care of, like auditing all these applications.
• 42:18
  SPEAKER_03: So you're building a roadmap.
• 42:19
  SPEAKER_03: What does a roadmap look like?
• 42:20
  SPEAKER_03: And what is the typical time frame for a uh and what do you call that deliverable?
• 42:25
  SPEAKER_00: And you're talking remediation for a yeah, like a road, yeah, like the road thing.
• 42:29
  SPEAKER_03: So the compliance and uh security roadmap, right?
• 42:32
  SPEAKER_03: Because again, you're you're finding a lot of issues that need to be corrected, and they're not all going to be done in a in a in a in a day or a week or a month, right?
• 42:40
  SPEAKER_03: Something that's a longer time frame.
• 42:42
  SPEAKER_03: So what are some examples of shorter term wins versus longer term?
• 42:45
  SPEAKER_03: And then what is what are the components of a of a security and compliance roadmap?
• 42:49
  SPEAKER_00: Yeah, so really when we set a roadmap, it's setting expectations for a customer on like basically how long something's going to take.
• 42:58
  SPEAKER_00: And usually it we have to factor in budget and priorities.
• 43:02
  SPEAKER_00: And what I mean by that is budget, uh, if someone's hiring Eden Data, for example, we can move pretty fast if you throw enough money at it, right?
• 43:08
  SPEAKER_00: Like as any vendor would.
• 43:10
  SPEAKER_00: If you are only using internal resources, then I and they already are maxed out at 40 hours a week, you're gonna have a little bit of a different experience, right?
• 43:18
  SPEAKER_00: And in and time frame.
• 43:19
  SPEAKER_00: The other thing is is just priorities.
• 43:21
  SPEAKER_00: If if I need ISO 40 2001 to close that million dollar deal, I'm probably going to put a lot of priority into getting that very quickly.
• 43:30
  SPEAKER_00: Otherwise, this is going to be a maturity exercise that we operate on for the next six to 12 months.
• 43:35
  SPEAKER_00: That's the way we we typically look at it in general.
• 43:39
  SPEAKER_00: And then in terms of what's easy versus what's hard, like there's a few things that you can address right out of the gates.
• 43:44
  SPEAKER_00: Access management, for example.
• 43:47
  SPEAKER_00: If we're doing access management, you have a risk around who has access to your LLMs, pretty easy exercise to go into the various tools and say, Betty Sue no longer has access, right?
• 43:56
  SPEAKER_00: Just remove them.
• 43:56
  SPEAKER_00: Document that somewhere that hey, I did this on this date.
• 43:59
  SPEAKER_00: So you have a Bit of an audit trail.
• 44:01
  SPEAKER_00: But then if you have to do an asset inventory for your entire environment and then be able to incorporate asset inventory for the LLMs and the agents you're using, it's a long exercise.
• 44:13
  SPEAKER_00: That's going to take some time.
• 44:14
  SPEAKER_00: Someone needs to own it.
• 44:16
  SPEAKER_00: Who's going to do it?
• 44:16
  SPEAKER_00: Who has administrative access to be able to get that information?
• 44:20
  SPEAKER_00: That is a long frame kind of a long-term addressment.
• 44:25
  SPEAKER_03: Perfect.
• 44:25
  SPEAKER_03: Great, great examples.
• 44:26
  SPEAKER_03: And I think those are the things that would comprise that executive readout or progress to say, here are the number of applications in our inventory.
• 44:35
  SPEAKER_03: Here's how far we've gone, here's what's left to be done.
• 44:38
  SPEAKER_03: So you're really giving people a snapshot of what you're doing, where you've been and where you're going.
• 44:43
  SPEAKER_03: And that's so that's very helpful.
• 44:45
  SPEAKER_03: Excellent.
• 44:46
  SPEAKER_03: So now it's really, really helpful.
• 44:48
  SPEAKER_03: When we talk about IA, uh, and we only have a couple minutes left, it's information architecture, whereas a lot of people will call will say IA is internal audit, right?
• 44:57
  SPEAKER_03: So uh and I my catchphrase is there's no AI without IA, right?
• 45:02
  SPEAKER_03: You need that information architecture uh as a foundation.
• 45:05
  SPEAKER_03: And of course, security requires information architecture, right?
• 45:07
  SPEAKER_03: Access controls and security on documents and you know, export controls and all of that.
• 45:13
  SPEAKER_03: What do you usually see when you go into an organization?
• 45:16
  SPEAKER_03: Is that something that is problematic?
• 45:18
  SPEAKER_03: Because again, you know, if you're not organizing information in a meaningful way, it's going to be harder to restrict who gets it or make it available to the right models and the right individuals.
• 45:29
  SPEAKER_03: Again, part of you know the ability to control information is to find that information.
• 45:34
  SPEAKER_03: And if you don't have it structured in a way or curated in a way where you can find it, it's going to be more problematic.
• 45:40
  SPEAKER_03: Have you does has that become an issue or have you seen that be a problem or a challenge?
• 45:46
  SPEAKER_03: So the information architecture, the ways repositories are organized, the data standards in those repositories and so on, how has that impacted your work?
• 45:54
  SPEAKER_00: Yeah, I I would say that it actually is what leads to the snowball effect of the risks that we were talking about earlier on the podcast.
• 46:02
  SPEAKER_00: When you have an AI model that is leveraging data that is either not organized or it's incorrect, or you have data that you aren't leveraging, that you should be leveraging, that starts to create systemic problems with the LLM that then leads to systemic risk as it relates to cybersecurity.
• 46:24
  SPEAKER_00: And so that's the main area that we see on our end is you've got this like library of data that's just everything's thrown in one room and you don't know about another room because it's buried behind, you know, this this pile of books.
• 46:41
  SPEAKER_00: It's it makes it really easy to start losing control.
• 46:46
  SPEAKER_00: And when you start losing control of it, you start to create risks that you don't even know about.
• 46:50
  SPEAKER_00: So that's the that's the area that impacts my job on a day-to-day.
• 46:53
  SPEAKER_00: And that that happens a lot.
• 46:55
  SPEAKER_03: Yeah, that makes a lot of sense.
• 46:56
  SPEAKER_03: And you know, the the other question the follow-on question to be to that would be, you know, most leaders are thinking AI is going to solve that problem, right?
• 47:04
  SPEAKER_03: And they just make that assumption, but uh that's far from the case.
• 47:09
  SPEAKER_03: How many understand the nature of the problem so that they can remediate it, would you say?
• 47:13
  SPEAKER_03: Not very many.
• 47:14
  SPEAKER_00: I I think not very many.
• 47:15
  SPEAKER_00: Yeah, yeah.
• 47:16
  SPEAKER_00: People see this as a shiny new object.
• 47:18
  SPEAKER_00: They see it as the output.
• 47:20
  SPEAKER_00: They don't see it as like how it's built and structured and and what it's good at and what it's not.
• 47:25
  SPEAKER_00: So just by like that misconception that you just talked about, yeah, you know, really educates us to say like the person that makes that misconception largely doesn't understand how an LLM works in the first place, right?
• 47:36
  SPEAKER_00: Which is fine.
• 47:37
  SPEAKER_00: That's not supposed to be insulting.
• 47:38
  SPEAKER_00: It's just meant to say like this is a tool that you need to know how to use before you actually start using it.
• 47:42
  SPEAKER_03: Absolutely, absolutely.
• 47:44
  SPEAKER_03: Taylor, thank you so much for joining me today and sharing your perspective on you know how security is changing and evolving in this world and how that threat landscape is being uh rewritten and to our so thank you for for your time.
• 47:59
  SPEAKER_03: Thank you for joining us.
• 48:00
  SPEAKER_00: Man, thank you so much again, Seth, for the opportunity.
• 48:02
  SPEAKER_00: I love nerding out on these topics and your questions are on point.
• 48:06
  SPEAKER_00: This is this is a great time to be alive.
• 48:07
  SPEAKER_03: That's right.
• 48:08
  SPEAKER_03: And to our listeners, thanks for tuning into the Early AI podcast.
• 48:11
  SPEAKER_03: Be sure to subscribe for more conversations on how AI is shaping the business world.
• 48:15
  SPEAKER_03: Where do people find you?
• 48:16
  SPEAKER_00: I I would say LinkedIn is probably the best.
• 48:18
  SPEAKER_00: That's where I'm the most active.
• 48:20
  SPEAKER_00: And yeah, please send me a message.
• 48:23
  SPEAKER_03: Yeah, we'll have that in the show notes and uh so people can reach out to you.
• 48:26
  SPEAKER_03: But and thank you so again so much.
• 48:29
  SPEAKER_03: And we will talk with you soon.
• 48:32
  SPEAKER_01: Awesome.
• 48:32
  SPEAKER_00: Thank you, Seth.
• 48:34
  SPEAKER_01: Thank you for joining us on another deep dive into AI innovation.
• 48:38
  SPEAKER_01: Tune in next time when we introduce another industry expert and discuss how to maximize AI in your world.
• 48:45
  SPEAKER_01: The Early AI Podcast is sponsored by Early Information Science and Vector.
• 48:50
  SPEAKER_01: To learn more, visit early.com.
• 48:52
  SPEAKER_01: That's E A R L E Y dot com.
• 48:55
  SPEAKER_01: Thank you for tuning in.