Latest / You've Been Heard / 383- Rebuilding executive trust after $1.2M ransomware demand w/Ray Martin

Transcript

383- Rebuilding executive trust after $1.2M ransomware demand w/Ray Martin · You've Been Heard

• 0:10
  Speaker A: All right, we are live. Mr. Martin, welcome to the show. Learner, restorative achiever, competition, belief. Those are your five things on LinkedIn. Maybe we'll just start off with your past. Well, first of all, that is a Bruins rank, so that's. That's near and dear to my heart. I think we talked last time about, you know, I went to Colorado State University. We gave Ray Bork a few titles. That was kind of a fun time, going to college at the time, being a kid from Worcester. Worcester, Mass. So obviously you're hockey fans, so let's start with the most important stuff.
• 0:43
  Speaker B: Yeah, no, big. Big Bruins fan. Born and raised in Rhode Island. The irony of the whole thing is I was a goalie growing up, so my favorite player of all time was Patrick was. So being a Bruins fan and my favorite player playing for the Canadiens for the early part of my childhood was a little tough. But when he got traded to Colorado, it was fun watching them. Especially some dark time for the Bees then, so cheering them on and watched win the cup and Ray Bart going over there and winning one with them. That was fun. And obviously, watching the massacres when they played the Red Wings was time. So that was my prime watching those. But no, it's always great. A huge hockey fan. Still am. I love going to the games. And obviously being a Boston sports fan my senior year and then through my college years and during the 20 years of the title runs. Couldn't be a better time to enjoy that.
• 1:39
  Speaker A: We're already smashing stereotypes. See IT People are cool and do sports and do sports.
• 1:47
  Speaker B: It's interesting how I fell into the IT role for sure, especially with my background. And I graduated.
• 1:55
  Speaker A: Tell me the story. Gotta know.
• 1:56
  Speaker B: Yeah, yeah. So I grew up, obviously, the Internet boom and computers and everything and kind of got my hands into it again. Hockey kind of ruled my world growing up. I played juniors, bounced around. So I was a little older when I graduated. I was 24 when I graduated two 2009. So right after the recession and fell into a job, really tracking small tools and putting barcodes onto tools with a construction company and was just entering into a system, into a small database there. And really, it's a contract job. They gave me a year to do that, and I completed that in about six months or so. And I was still looking at things to do. I was under the contract, and they got me into purchasing materials and working up what they called the yard there. And while I was up there, I just took care of the IT issues up there, fixing printers, helping everyone with Their computers up there. Just basic troubleshooting stuff I learned how to do in college. I had a communication studies degree out of there, but again, just things you do growing up working on a computer. My brother was the tech kid in my family. So learning from him, he actually worked at the company as well. That's kind of how I got my foot in the door. But as those months passed by, the IT director got wind of there was no issues in the yard on the IT side. When he asked my brother down there what was going on, he's like, oh, Ray's taking care of everything up there. I got wind of that and asked, does he want a job on our support desk? And kind of where my career was going, which was really nowhere up there. My boss at the time wanted me to get a CDL license and drive trucks and deliver. Great career, but wasn't for me. I jumped at that opportunity and went down there and started my career in it. And that consisted of sitting in the basement in a cage, key to get in, key to get out, setting up Blackberries and building computers and really learning it 101 from scratch. So learning it on the job is really how I built my career. I wanted to obviously get out of the basement, get out of the cage, and expand my wings. And construction has always been in my family. My grandfather, my father worked in the H vac side. So I was familiar with job sites, and I really wanted to get out into the field. So an opportunity popped up where we didn't have it out in the field. And my previous employer was really spread out at the time throughout New England. So I worked with my director of IT and kind of negotiated something like, hey, how can I get out and support our teams out in the field more and be a presence for IT out in our project sites? And we basically came up with a plan where I would visit our sites and be on site support for them. So I spent a lot of time in the car traveling, and kind of started locally through jobs that were an hour, two hours away a day. I'd get in my car, drive, and spend the day. And that was really cool.
• 5:05
  Speaker A: I'm just thinking of the contractors that I've dealt with over the years. Even just from like a small business perspective. How many contractors still kind of drive around with a big crew of guys and zero technology?
• 5:21
  Speaker B: So I would say our subcontractors that work with us, it's very, very limited. Very few of them haven't helped company. There's a lot of danger there for us. And that's a big concern for us. Right. We can protect our side of the house as much as we can, but that's, we're very vulnerable on their side and that's a challenge. Right. We got to protect them as much as us. We can put as many best in class antivirus and email filters and we can train our users. But on the other side, we're collaborating with our partners all the time and they're out in the wild and they're using Gmail accounts and third party accounts and they're very vulnerable out there in the market and we see them getting hacked all the time. And it's, it's scary on that side of the world. The bigger players, the demios, the consiglies, the shamans of Gilbanes, they all have pretty, pretty solid IT teams and tech stacks that are protecting them. They know the value and the harm can cause if they get attacked. But the smaller sides, the subcontractors, it's very, very scary on that side of the world.
• 6:31
  Speaker A: I mean, just from an advice perspective as like a. If you were to speak to all of the contractors and small business owners out there that are whatever, framers, building houses, jack of all trades guys and everything, what layer of technology would you suggest that they have or use and would it benefit them and would it make their lives easier and better even though they may be technology adverse as many are?
• 6:59
  Speaker B: Yeah, I mean I would partner up with an MSP at their level and get on your base package of Microsoft 365 and protect your email. That's there in our business. That's their primary source of communication. Protect that level. Everything's coming in there. We're letting them into our systems so you know, we're controlling that aspect of everything. But if they can handle that piece and have somebody that's updating their computer, Windows 10's end of life, everybody on that side is still using it. Somebody's gonna hatch their network and manage that. I would highly recommend, even if it's, I think they're afraid of the cost and what that's going to impact and they're going to spend tens of thousands of dollars on it. I don't, I don't think the cost impact is going to be as high as they think they are. So stop going to your buddy's sons and IT guy at a company, maybe come look at my computers quarterly and update them. There's so much damage that can be done to your reputation, your company, and you could be out of work through a cyber attack.
• 8:01
  Speaker A: I was just even thinking of being just more efficient and just how you pay your guys. Efficiency, time and materials, ordering and receipt orders and receiving and counting parts and different things like that. That probably just goes out the window. I'm just wondering if they're. There's got to be something there. Organizing scheduling. A lot of times people's schedules are all over the place. I can't make it this week because we're. We're getting killed with a foundation over here and blah, blah, blah and forecasting business results in the future. And yeah, I'll get to John Smith, I'll get to your new house In January of 2027, something like that. You get a lot of that stuff.
• 8:40
  Speaker B: Yeah, it's that costing. You can sign up with that are SaaS based that are going to help your company. But you need someone on your team that's going to speak that language and look out for you on that side. You build your vendor relationships there and you trust your partners. Again. We offer any tool that we put on our stack. We invite our vendors into that are going to help them with that exact scenario and bring them in that allow them to schedule. We use things like Voyage Control that help you automate your scheduling to our site and that automates that. Your TNM tickets your scheduling. We use products like Clearstory there that your physical filling out of your. Your TNM slip. That's paper. You can't read that. That's all digital ties now and that's automatically sent via email, tracked up, logged. There's no question on the work that's supposed to be performed if it's approved or not. Like those questions are now eliminated. Everything's logged in. It ties into our master PMIS system with Procore. Everything's logged. We have a master system of record now all those questions. Our scheduling software tracks everything there. They have access into that. They can track that. It's, you know those tools we provide out to our partners. So you can loop in there from my seat as a cto, I'm more concerned about the security of what they may introduce into our environment. So I want them protected on that side. We're going to protect the tools that we give you. We're going to give you everything to streamline that project. We're coming in everything as a partner from the client side, the owner side of the job. Our side is a construction manager, general contractor and then our partners as a subcontractor. We want that to be as seamless as possible all the way through the course of construction.
• 10:21
  Speaker A: So Construction companies, large ones, are notorious for being very cost conscious. Just from the. It's just due to the nature of your job. I mean, you order tons of things. It's like we got to watch bottom line here and there. So I would assume that security in the construction world and in the IT world oftentimes does not get the budget that they need right away until said disaster happens, which, I don't know, you might have a little bit of experience with some of that stuff.
• 10:52
  Speaker B: Yeah, for sure.
• 10:54
  Speaker A: Yeah. It's like, you know, I don't need to wear my face mask until I get a hockey puck in the teeth or something. I don't know.
• 10:59
  Speaker B: Yeah. We've been through two ransomware attacks here at demeo. One under my leadership, then one before I got the job here, which probably why I got the job here in two completely different outcomes.
• 11:13
  Speaker A: Okay.
• 11:14
  Speaker B: The, the first.
• 11:15
  Speaker A: Let's go through, let's go through. Outcome one was obviously a bad one when you weren't there.
• 11:19
  Speaker B: I just have a feeling, yeah, Outcome one systems weren't in place, things got encrypted, things weren't recovered. End of the day, I can't speak too much more on, on top of that, but I know it wasn't, it wasn't good and forced us, or forced the company at the time to really transition quickly into new systems. And it really broke and fractured the trust between operations, leadership and the IT department. So when I stepped in to the role here, really, I was young, 30 year old kid taking over that department and stepping into something, that trust was really fractured. And fortunately enough for me, leadership had that trust in me, which, which really helped. But from the other side.
• 12:08
  Speaker A: Let's just talk about that, let's just talk about that for a second because how did you do that? Because there's a lot of, I mean, 30 year old's a grown adult. I mean, you said kid, but like, yeah, most people think like, oh, if you have a C level, you're, you're a certain age or something like that. But that doesn't mean, I don't know, there's plenty of billionaires that are there. Well, there was a handful, I guess in their 20s. But my point is that there's other. You're not the first CTO that, that I've interviewed that was maybe young. Right. And this was a while back anyway. So what was it that helped deliver that level of confidence? Cause I think that might help a few people listening.
• 12:46
  Speaker B: Yeah. So I just look back of what I know now 10 years ago and what it Took to get there. But I was very ambitious when I took the seat and really saw the potential. And when I stepped in and I saw where it came from and what the tools I was using at my previous company, I saw the path and I said, okay, day one. I know there's a path, and I know I can get us there. I know we can modernize this infrastructure and we can get there. And I was like, this can be easy. We can do this and jump. And when I got in the seat, I realized it wasn't going to be as easy as, okay, why, let's go. Let's jump in and do this. There's a lot of. I don't want to call it politics that went into play, but there was a lot of convincing to go through from just a team that didn't understand and didn't know. There was a lot of teaching that went in into play and how do I know my data's safe up in the cloud? Questions.
• 13:44
  Speaker A: Okay, so let's knock out the common ones. So I'm assuming we had Dana on prem and we wanted to migrate to the cloud. That's what it sounds like. Okay, so that's a typical. All right, how do you. How do you knock that one out? Yeah, the. It's kind of an older one, but there's still people out there that are like, no, I want to keep my Exchange server. No.
• 14:06
  Speaker B: Yeah, the. The easiest. The light bulb that went off the head and how I convinced them at that point was I was like, okay, our systems are down 80% of the time. Do you want the person who's in charge now, and this is before I got the job fixing the system, or do you want a team on Microsoft side of the house assisting you getting those up and running, because that's what you'll get when you move? Or do you want a system with your vendors that you're partnering with? Do you want a full team of professional engineers helping you migrate that and get that up in the cloud? Do you want your data protected and multiple data centers across? Do you want your system down in your data center, but your team's out of the job site? System be up and working, accessible. Do you want to be able to work from home and still have access to your email? Do you want all these benefits?
• 14:54
  Speaker A: Keep going. Keep going, because we're gonna make a nice little. We're gonna make a nice little infographic out of this. Let's keep going.
• 15:00
  Speaker B: Keep going. And just kind of negotiating that.
• 15:03
  Speaker A: Do you want your customers to look at you Cross eyed because you're so old.
• 15:07
  Speaker B: Yeah. So it's just seeing the benefits of, of that and not being exposed to that before and once they, they kind of realized that it was okay, that.
• 15:16
  Speaker A: Makes, there's a cost difference. You have to go from, you have to go from a Capex to an opex.
• 15:22
  Speaker B: Correct.
• 15:22
  Speaker A: So they have to, you got to sell them on the, hey, we're not going to do this. Buy this metal box and depreciate it over five years. From now on we're going to pay a much larger bill every month.
• 15:33
  Speaker B: Correct.
• 15:34
  Speaker A: How'd you do that? Because we have to. There's no other way.
• 15:38
  Speaker B: Yeah, no, it was just, it was the downtime. It was like, I can't have people not working 80%.
• 15:45
  Speaker A: You said 80% of the time. Is that even possible?
• 15:49
  Speaker B: It was bad.
• 15:50
  Speaker A: It was, that's one day out of five. That means, hey, out of the five working days we're working one day.
• 15:56
  Speaker B: It was so bad you couldn't get two, three things to work. Like you would come in and the Internet would be down, but the email servers were up. But you couldn't get your email because the Internet was down in the building. And then you get your, the Internet up and then the exchange server was down in the building. So then nobody had access to your email. And that was an everyday occurrence. And again, not to harsh too bad on the person who was there before, but by the time I was able to get things up and running, say 11 o' clock during the day, we'd be operational through the rest of the day until said network engineer came in at night. For whatever reason, we didn't work nights but would undo what I did in the morning to continue on what he was working on at night, undo what I did. So then I'd have to be back in six o' clock in the morning to undo. It was a terrible working environment.
• 16:49
  Speaker B: And then finally leadership was like, all right, we're going to the cloud and then we push that. And that fixed that issue. And it was like, okay, we're up, we're running now, let's get to the next thing and let's move from there. And then the value was, oh my God, we're working.
• 17:12
  Speaker A: Look at what we can do.
• 17:13
  Speaker B: Up all week in two years.
• 17:16
  Speaker A: That's crazy. It's absolutely insane.
• 17:19
  Speaker B: And it was again this, I'm sorry, this was 10 years ago and we haven't run into those issues and stuff but that was, that was a huge win and a huge build of trust for the department Operations, and you're starting to rebuild that going forward.
• 17:35
  Speaker A: That's absolutely insane. It was, but it happens.
• 17:39
  Speaker B: It does.
• 17:40
  Speaker A: It's still happening. There's someone out there listening right now. Well, after we released this, someone listening to this, I'm like, oh, yeah, I remember that. Lotus Notes is always the one that. I remember Lotus. We're still on Lotus Notes. That was only like six years ago, I think, which is ridiculous.
• 18:00
  Speaker A: We're gonna go to Exchange. It's like, we're on Lotus Notes. We're gonna go to Exchange on site. Oh, you know. Okay, so what was the difference between ransomware Attack A and B?
• 18:12
  Speaker B: Yes. So after Attack one, one of the goals for me to come in was design a system that would be prepared for attack too. Not it's not a matter of if you're gonna. Are you gonna get hit? It's when you're gonna get hit with ransomware. So we still had legacy systems, hardware.
• 18:29
  Speaker A: Systems on ransomware Attack one, did anyone pay any money out?
• 18:34
  Speaker B: No.
• 18:35
  Speaker A: Okay, what. What was the ransom? Just out of curiosity?
• 18:39
  Speaker B: I'm not sure. On one, I can tell you what it was. On two, okay. I was involved on that one. I'm sure it was a million plus dollars for one.
• 18:48
  Speaker A: Okay.
• 18:49
  Speaker B: So on two, we were hit again. And just a little background on the environment we were migrating. We're getting ready to replace our legacy systems at random. Life signed the contract with Nutanix. We have a small environment, wasn't too much, signed the contract, and we're getting ready for a new system to come in. And before it came in, we were hit with ransomware again. Fortunately, 90% of our workload was in the cloud. We had one, say, NAS device that was kind of legacy. That really is what got encrypted. Had a bunch of archive data on it. No personally identifying, really, some old drawings and data wouldn't really need. But what the ransomware really did to us on our IT team was crippled. Our domain controllers crippled. Our backup servers had a lot of rebuilding we had to do there. Fortunately for us, what we did and the way we set up the environment and again, kind of dating myself, is we had a store, simple setup. And then what we did from the store, simple setup is we sent our backups to another Azure tenant completely separate from our accounts and stuff. And we had another set of our backups that were going there as well from the store, simple. So when they went and they deleted our backup jobs and destroyed our veeam situation, it didn't go out to that Azure tenant where we had a clean set of our backups, so those weren't impacted. So when we rebuilt everything and got that spun back up, we're able to do a clean set of backups from that Azure tenant and rebuild our environment back in there. So that saved us. That saved all our data and our servers, and we're able to bring everything back up and really only lost maybe half a day worth of data at that extent. The NAS device that was encrypted, we had a clean set of that backup data, even though we haven't accessed that within years. But we did recover that as well. Going in and talking to. We had the Conti ransomware, if you remember that one. That's what we got hit with. Log into the torrent browser, download that, open up the chat window, upload the ransom note. They send back a file of some decrypted files saying that they can restore it. And they say, okay, send me $1.2 million in Bitcoin. We'll restore your files. I think I sent them back. I was like, I'll send you ten grand so I don't have to go through the trouble. Yeah. They said, no. And I said, all right, well, this conversation's over. And that was the end of the conversation. And we went back, take 10 grand, man.
• 21:27
  Speaker A: Yeah, that would have been a quick hit for them. Ten grand, yeah.
• 21:30
  Speaker B: So that was. That was. That was that. And I brought it back up. Still a lot of time to recover everything. We worked about 100 hours straight straight out to bring it back up. But again, the way we were set up, our job sites, zero impact, everybody was still working. Our teams within the office were up and working. Our critical applications that still ran on prem. We had them up and running less than 24 hours. So they were back up and running. And there's just a little things that we brought back up slowly in the back end. And knock on wood, we were good to go. The. The interesting part of that whole story was probably a couple weeks before the ransomware came in, I met with my boss and we were running through scenarios. If we got hit with ransomware, how would they come in? And I was like, most likely you're going to come in through phishing email. Somebody's going to click on it. These. We had a couple applications that were legacy applications that we had to decommission. They had cached admin credentials in them. And basically I said, it's going to move laterally. It's going to grab the credential here. That's our weak Point of exposure. And really the way I outlined it was exactly the way the ransomware came through and navigated its way across the system. And I told him, I was like, I did not deploy this ransomware across the system. I said, but word for word, the way I told you it came in is how it came in and spread across, through.
• 22:59
  Speaker A: But did, did your executive management even understand anyways, even if you told them like, hey, this was the way, would you know what I mean? It's kind of like, how do you gain that? Obviously you gained that trust and you're able to say, hey, this is how it happened, we're prepared and this is what's going to happen over the next. Would you say 100 hours? It took you 100 hours? How, what was it, two weeks or something? How long did it take to fix everything?
• 23:22
  Speaker B: We work non stop through that week. We were there probably a few hours a night and we just grinded through it and got through it from, I think it hit on a Thursday night and we went through the weekend and we were done by that following Friday. We walked out of the office around noon time or so unscathed. Yeah, just ran through a biggest glass of scotch I think I've ever had in my life. It was awesome. But he, my boss, since he's been through it so recently, he was very in tune and very involved on what we were buying, why we were buying it, how it worked. He probably wasn't in the weeds as much as how it worked, but he did want to understand and he wasn't afraid to make the investment into what we were purchasing, which is why it held up, why we continue to make the investment. And we learned from it. And we put in more security features throughout the years as well. Multi factor authentication, EDR tools, the SIM environment, you name it. We're constantly improving and looking for upgrades. Using, you know, AI is a huge topic now. How to use that in your cyber security posture. We're looking at tools there, how AI is tied into our antivirus tools and detecting ransomware across the board. It's very.
• 24:42
  Speaker A: And well, this brings us to the conspiracy section of the show. So there's gotta be some conspiracy theories that you buy into that are tied into either security drones flying over the state of New Jersey or AI.
• 24:57
  Speaker B: So I had two of those drones fly over my house. It took a picture of them too.
• 25:01
  Speaker A: So I turned on like, I, like I made the mistake of like opening up like X, I guess I'm still calling it Twitter one day and I was like, what is going on. Like, there was just like this endless stream of like drones over New Jersey. I was like, why is it always New Jersey? It's always, always New Jersey. It's like all the patents, like 98 of all the patents come out of New Jersey. All the weird alien drones are flying over New Jersey. I guess what is going on? But any conspiracy theories that are real? No two people, some people either get really offended at this point. Like, no.
• 25:38
  Speaker B: My favorite, my favorite conspiracy theory is, and I don't buy into it, but is the Flat Earth conspiracy theory and the documentary that's out there bending the curve. I think it's on Prime.
• 25:52
  Speaker B: It's probably my favorite. So every, every experiment they perform proves that the Earth is round, but they perform the scientific method, but they do it backwards. And that's my favorite part of those conspiracies.
• 26:06
  Speaker A: So if you had to buy into one part of the flat Earth theory, then what would be the most realistic? Because the Flat Earth Dave or whatever his name is the guy, Flat Earth Dave, he's like actually not far from. I believe he lives in Connecticut. And then, I don't know, I mean, like, don't have Eddie Bravo be your spokesperson. I'm sorry, Eddie, I love you, But I mean, 10th planet, Jiu Jitsu, all of it. I love you, man, but you can't have like a bunch of stoner MMA dudes talking about flat Earth. It's just making you look really bad. You got to get some like physicists and scientists and some no name guys that have actual credentials and stuff. Maybe a couple Einstein Right Hand guys. You got to get some people on there other than Eddie Bravo. Eddie Bravo. You're not, I mean, you're just, I mean, I get it, but you're just. You can't be this Flat Earth spokesperson.
• 26:52
  Speaker B: Yeah, I don't know. I, I don't know if there's anything I can buy into it. I, I just go outside and look up and see everything's a globe and around and looking. The telescope and yeah.
• 27:06
  Speaker B: Like, I don't know. If it was flat, we would. Gravity works. And you'd be climbing up Mount Everest with every step you take. It's. I don't know, it's just static electricity.
• 27:16
  Speaker A: Or something to them. Remember, they went over the ground. They hit, they hit on the gravity in. Yeah, that one's. Let's. We'd have to pick a. We'd have to pick a simpler one.
• 27:23
  Speaker B: Like, I don't know, the ice wall.
• 27:26
  Speaker A: The ice part of the flat Earth. We can't go past like whatever the line is. You ever try to go past the whatever. Whatever degree like ladder line or whatever they like to talk about? Yeah.
• 27:38
  Speaker B: You can see Chicago on the other from Ohio or across.
• 27:43
  Speaker A: I do find the. Being an ex. Line of sight wireless, fixed wireless guy. I do find the line of sight argument to be the strongest because there is a salt flat somewhere down in like South America or something that when it rains and creates like an inch of water that's like a glass reflection. I'm pretty. I'm almost positive you can see past the whatever, even if it's past six miles. What's the curvature of the Earth? I think it's like every six or seven miles is the curvature. You shouldn't be able to see past like that. But it doesn't mean the earth is flat. It just means it. It could be bigger than we think it is. Like that. I'll buy. It could be that or it could be like. Or I guess there's on a wobble some. Like that's. Yeah, that was too. So there's anyways flat earth, but. So you did watch it, though.
• 28:33
  Speaker A: Somehow someone got you with that, with the helium balloons and stuff. I do think it's possible. I do wonder how Elon is getting less than 25 milliseconds of latency into the upper atmosphere for satellites. That's. That's very impressive. That should not be doable.
• 28:50
  Speaker B: We do use them. We do use some of our job.
• 28:53
  Speaker A: Sites, but according to these guys. What was the movie again?
• 28:57
  Speaker B: I already forgot bending the curve.
• 29:00
  Speaker A: Bending the curve. Yes. Of course we're using helium balloons. That's how it's being done. You're not going up to a satellite. You're going up to a helium balloon, which is much closer in the upper atmosphere. So that would explain the latency.
• 29:13
  Speaker B: Yes.
• 29:14
  Speaker A: Okay, so this is the transition to AI. So the transition to AI is everyone wants to hear about security layering techniques. We kind of already banged that one out. I mean, at least we banged out the. Unfortunately, you were one of the ones that's like, we don't get the budget until there's a ransomware attack.
• 29:30
  Speaker B: Yep.
• 29:32
  Speaker A: So, okay, I would. I would love to see someone get the budget for security without a ransomware attack. And there's someone out there that can answer that question. But the other one that's. That everyone wants to hear about is real AI use cases that actually do something versus kind of this hype scale level of AI where we have to have AI everyone's pushing us to have AI. If we don't have AI, we're not. There's this like frenzy right now. Do you guys have any AI implemented that is doing something that's moving the needle on KPIs?
• 30:03
  Speaker B: Yeah. So we're, we're in the crawl stage of our, our AI and actually just sent out a pretty interesting survey to our team to, to kind of get everybody's temperature and really helping define our culture. Where we are today with AI. Are people scared of it? Are they willing to use it? And it's, it kind of aligned with our company culture. We're builders first.
• 30:28
  Speaker A: Yep.
• 30:28
  Speaker B: And there's a, it's not a hesitation to use it, but our team wants to use AI if it's, if it's practical, if it's going to help with mundane repetitive tasks. And a lot of the interesting responses I got is they don't want to lose the knowledge transfer from our older generation to our younger generation and they don't want to see our younger generation just rely on AI to teach them how to build. Which I thought was pretty interesting and the other things I've seen there and what we're starting to build in is we're taking a vendor approach kind of based on the company we are and the tools we have. And I just came back from Houston at a groundbreak conference and they released a gentic AI within their platform and it was very interesting on kind of their 18 month journey with AI. And the way they were going to release it first was they're like, okay, we're going to build 75 to 80% of these AI agents for the companies to use and then we'll let the companies build 20% of them from there. And the product kind of never got released, but they released this year and we are lucky we got into the beta a little bit beforehand is they flipped the script because when they released their agents they realized the first group of beta weren't using them. And when they went back and they asked why, they said, well, your agent doesn't really fit my business need or how we would use them. So they opened up, they flipped it around, they said, okay, well we're going to open up the agent builder first and we're going to give you some guidelines how to build them, but we're going to let you build the agents and we're going to help you along the way. So now the agent builder is open and it's just kind of got released to our team and we put our first community on them. We're starting to use them. So now we can build these custom AI agents in our biggest investment into software, really, to fit the way we want to use them, which I thought was pretty impressive. They're not.
• 32:42
  Speaker A: Were you the one that I was talking to with adoption, where we were talking. It may have been someone else, but we were talking about AI adoption, and someone was saying that more of the. You're kind of talking about a hybrid, actually, which is interesting, but there's kind of like, build your AI agent from scratch yourself and build your AI tools yourself. Then there's the find a vendor that's selling something that's in alignment with what you're trying to do, which is probably difficult to do because there's 8 billion people out there doing that, and you're getting swamped with a bunch of people trying to sell you AI something that's not even. They think you need it, but, you know, you don't need it. And then there's this kind of hybrid thing, which is what you just mentioned, which I like.
• 33:21
  Speaker B: Yeah. So we're, again, it's changing so fast, so we're. We're in the middle. Like, my LinkedIn page, I'm sure, you know, people listening to the same thing is loaded. Everybody's in that hype cycle. Like, our AI tool does this, does that, and an AI everything. But it's like, all right, well, let's do what we need it to do. Is it. Is it really going to fit? And I think that's the. The power of what's been released through Procore's AI agent builder, I think is going to be really powerful for us because that's where our data lives. Our team will have access in there, and they can build it within the workflows, within the tools that they're using every day, and it's easy enough for them to start building these things. And then based on the survey results I got, I have an understanding of what our teams are using. They're using ChatGPT. Are they using Gemini? Using the graph, which NAI tools have they used? What's their. How comfortable are they in there? And it's like, okay, well, now where am I going to go to? What type of enterprise agreements do I want? How do I want to protect the data going out there? Like, you know.
• 34:23
  Speaker A: Yeah, how are you protecting that? That the kind of the AI. Shadow AI, yeah.
• 34:28
  Speaker B: So right now, that's what we're trying to get our hands on. We have our AI policy drafted up and ready to go out to the teams we wanted to get those results first back. But what you've shared with me in the past with I believe it's called app dev.
• 34:43
  Speaker A: Yeah, dev's AI. So we have a.
• 34:45
  Speaker B: Something like that is extremely powerful where.
• 34:50
  Speaker B: It'S compliant, you can monitor the chats where your data lives. It's not going out into the public domain like that's where we need to be with it.
• 35:00
  Speaker A: We should have a sound bite for that. We should have a sound bite for that. Greg, where's our, where's our dev's AI sound bite? So yeah, so our partner, so our part one of our partners that helps fund this podcast devs AI which AppDirect purchased is the only enterprise kind of AI aggregator that I know of that's out there. So all the usual suspects. OpenAI Grok Claude, what am I forgetting? The Chinese one, I gotta remember all these. It's like 50 plus. It's like 50 plus that are in secure data centers and will give you SOC 2 compliant will give you in writing that all of your data is not being learned by these systems, but you can control in one platform and write your own agents or have agents written for you as well and kind of pick and choose which LLMs you want it using. There's a, there's another big. There's kind of another big release coming out too just for like come from the coding perspective because it's a whole nother thing is like the vibe coders and the real coders out there and what aspect do I have? But if you want to be able to control all of your end users and give them access to LLMs and be able to see what they're doing, not have the LLMs learning on your company data. Have it secure and give it access to a multiple or single source of truth of your company data and know that it doesn't have access to that is learning it, then this is a real option. So yeah, Greg, my producer, let's throw in a devs AI bullet point there for anyone that's interested that wants, that wants to. You can just. I think it's $30 a user too. So when you think about it, it's $30 a user for like unlimited tokens. Like just shy of unlimited tokens. We can't make it. There has to be a stop gap somewhere because there's always going to be like a someone that's going to take advantage of that. But for, for everyone listening, it's, it's unlimited per user. So $30 per user you're going to get access to OpenAI, Claude, Grok, Gemini, all of that, which would normally be somewhere around like 250, $240 per user anyway. So anyone interested, reach out to the show. We'll have something in there, a sound bite or something in here. But. But yeah, so I thought you guys mentioned last time something about counting like toilet part fixtures and different things like this and other things that are kind of like endless mundane tasks that normally are kind of by hand and take. Take people a long time. This is kind of like the use cases that I think most people are using AI for right now in a realistic standpoint to eliminate labor and yeah. Tasks that normally humans are doing in the past.
• 37:31
  Speaker B: Yeah. So we're looking at products like Total AI on screen takeoff with their boost takeoff built in AI tools. So we're evaluating those same thing looks at the drawing. You set the parameters around there, identify, it'll kind of do the takeoff. Save our estimators, you know, hours out of their day on doing that. So we haven't pulled the trigger on one of those yet, but we're constantly evaluating those tools.
• 37:55
  Speaker A: Are they able to give you a good like POC or anything like that?
• 37:58
  Speaker B: Yeah, the boost with OST hasn't been as good, but Total has been great with their POC back and forth. So there's just. Yeah, I don't know why we haven't pulled the trigger yet, to be perfectly honest with you.
• 38:14
  Speaker B: It's yeah, togo the POC with them, they, they've been great. The boost is they've only kind of given us five sheets and their trial has been kind of weak, to be honest with you.
• 38:27
  Speaker A: I'm giving you the final word, man. What do you have to, I mean to all the other IT leaders out there, I mean we're in kind of a, we're in an interesting space right now. We're in a big change. Not that in technology changes that is the constant, but this is kind of an, this is an interesting and interesting environment right now. What do. Are we climbing out of this IT hiring freeze, lowering wages or do we need to be more prepared for this new age and how do we survive?
• 38:59
  Speaker B: Loaded question.
• 39:02
  Speaker A: I mean are you, are you sleepless at night worrying about it in the future? Are you like, no, screw this, who cares? I mean technology is always going to be true changing.
• 39:09
  Speaker B: No, I mean I'm sleepless at night every night. I got a five year old and a baby on the way, so I'm preparing. But no, I think there's going to be a whole slew of jobs that aren't created yet through AI. The, the way I look at AI and what's coming, it's going to change the way people work. It's the next revolution with within the space. I'm not sure if you listen to Simon Sinek, but one of the nights I was up, I jumped on and what's his thoughts on AI? And I thought it was interesting. One of the things he said is when the industrial revolution came through, it took away blue collar jobs. This AI revolution is going to take away white collar jobs and those blue collar jobs are going to be safe. But he also expanded on that thought which I thought was really interesting. He goes, you're going to see change. When he used him for the example, he said, in my world right now, the writer is key. The, the writer generates his scripts, his speeches, his narratives and that's really powerful there. And the editor is kind of lower on the title totem pole, lower salary. So now he can have chatgpt or gen AI write what he's going to talk about. So the value of that writer is going to move down, but the value in the editor is going to go up. So you're going to see a shift in, in those jobs. And the value, he goes, so from the owners of these companies, it's going to be a net zero spend, but it's going to be where they're going to focus their money. They're going to focus it on the editor. Now there's going to be more value in that position. So I think you're going to start seeing that across the board.
• 40:45
  Speaker A: So the editor is going to have. How is the editor going to have more value? I would think AI could do that easily.
• 40:52
  Speaker B: Those are, those are his words, not mine.
• 40:54
  Speaker A: But I would say like the one thing AI can't do is create new ideas.
• 40:59
  Speaker B: That was his next point too. He said, you know, AI is constantly always looking in the past, right? It's not going to be able to. He's writing a book on friendship. That's his next book that's coming out. AI is not going to be able to write that book that's in his mind. It's not going to be able to reach through it into his head and produce what he's thinking, what is, what his next book's going to be about. AI can do predict on the future and stuff like that, but it's, it's constantly looking into the past where it's information, at least in his world.
• 41:26
  Speaker A: The other thing that I heard someone say that was mind blowing. And I totally skipped, slipped my mind of who it was. But it was talking about how it's, it's an LLM so that it's in the definition itself. It's a, it's a language learning model. So it learns from language. But how many humans learn from body language or visual or audio? I guess it could learn from audio because it can listen, I guess until I don't know how much. Unless like AI is in my glasses and walking around and learning from everything that I visually see as well. And how, I mean, I guess maybe it is to some standpoint how often. I mean it's going to know from how quick you scroll things on media and stuff. But if you can actually get in your head and see everything that you look at and how you visualize it on a daily basis, that could be pretty wild. Someone's gonna, someone's gotta be doing that. Put them in the lenses and the glasses and stuff like that.
• 42:15
  Speaker B: Yeah, it's gonna be interesting. Like back to the software using Procore within their, their photo feature on the camera. It's going to start tagging.
• 42:25
  Speaker B: Everything it sees within the camera for that into their safety. So we'll recognize that somebody's in there. Their ppe, their protective equipment is in an excavator on site. They'll see a picture and say, okay, the guardrails on up, that's fall hazard. And then the AI is going to go through the tool and create observations and safety hazards and identify that and bring it into the safety engineer and the superintendent identify those right away. Just from somebody snapping a photo on the site. Like, those are really powerful tools for us. It's going to identify. Team installs a window and there's a leak coming through the window and they think it's a. The product's bad. Well, somebody entered the daily log that day and it was pouring rain that day. And silicone that day, silicone when it's pouring rain. But they didn't pick up on that. But the AI went through and found the daily log that day and issued that. Well, it's not a product defect, it's the silicone was that day. So like little things like that that we're not catching now, AI is going to assist and enhance us, you know, moving forward. I think those tools are really powerful.
• 43:26
  Speaker A: Some insurance underwriters like, that's a good point. We ended up catch all these things. Awesome. It's been a pleasure, been a pleasure having you on the show. We could, we could have continued that conversation forever. I was thinking about.
• 43:39
  Speaker B: No. Thank you for having me.
• 43:41
  Speaker A: Interior decoration and how we decorate houses and stuff like this. I mean, just. You could just be like, hey, I like this, this, and this and this, this. And it should be like, all right, go buy this product here. Go get this product here, and go get this here, and we'll whip it all together.
• 43:52
  Speaker B: I mean, I'll be at your door on Tuesday.
• 43:55
  Speaker A: Yeah. Ray, thank you so much. And I guess the. The best for you and no more ransomware attacks and. And only AI adoption in the future.
• 44:06
  Speaker A: Is the way to go in the best for you.
• 44:08
  Speaker B: I appreciate it, Phil. Thank you so much.