Latest / You've Been Heard / 459- Make the Approved Path Fast Enough w/Brandon Muncy

Transcript

459- Make the Approved Path Fast Enough w/Brandon Muncy · You've Been Heard

• 0:00
  Speaker A: I think everyone will be talking about identity and permissions for these non human actors. Right now the conversation is all about what AI can do, right? It's everything is all about, oh, AI can do this, AI can help me do this. But no one is having the conversation about like who is the agent. We just talked about guardrails, what is it allowed to touch? What does the audit trail look like?
• 0:26
  Speaker B: Interesting.
• 0:27
  Speaker A: When it does something wrong, how do we take care of it? If the tool touches for me healthcare, it becomes even bigger problem. If the tool touches patient data, it's a business associate at that point, right. As far as HIPAA and compliance is concerned, teams are adopting it. But then how do we keep it all safe? Right. In 18 months that's going to be an enforcement story, like we're going to have to enforce things versus like a theory. I feel like we're right now on theory base of how we're going to handle it because AI is moving so fast.
• 1:12
  Speaker C: After talking with IT leaders, I've come to discover one thing. And it's the same thing, you know, it's the same thing everyone else knows whether they want to admit it out loud or not. Nothing gets done in any company without it touching it. Nothing. But here's the thing. When everything's on fire, when nothing's working, when the ransomware hits, when the whole business grinds to a halt, it is completely indispensable. You're the most valuable asset in the company. But when everything's running like a well oiled Tesla, you're a line item, a cost center on a spreadsheet. You've done the work, you've built the career, you've earned your seat at the executive roundtable. But having a seat at the table is one thing. How much nicer would it be to actually be heard? This is yous've Been Heard.
• 2:06
  Speaker B: Welcome back to you've Been Heard. Sitting in the guest chair today is Brandon Munsey, an accomplished technology leader. Brandon, mind kicking it off by introducing yourself and sharing what your ride to the leadership chair has really looked like?
• 2:22
  Speaker A: Sure, absolutely. Thank you Mike and I appreciate you all welcoming me to this as well. So I'm Brennan Muncie. I am an IT director for a company called Pepperpoint. We are a dental service organization support based out of Lexington, Kentucky and we're supporting hundreds of practices across a couple states. My path has not been a straight line. I actually started as far as my career, professional career in retail management straight out of college. I was straight nothing but technology. I was an Engineering degree. And my mind was like, I need some business stuff. So this is not something that's normal. I felt like in any IT profession, typically. So I actually did retail management at Verizon and att and then I moved into research computing at the university. I kind of worked my way up. I left the sales sector and went back into the it, where I have now climbed up to where I am today. But really, every one of those jobs has been about the same thing is standing between people who need something to work and then the system that doesn't care whether it works or not. It's there for you to use. Right. Or you never know that that function was even there or existed. Right. But I came into this role about late 2022. The it was fully outsourced. There was no internal team. And so over the past several years, I've built that into what it is today. I've got about seven people on my team. We are moving the whole organization forward. We provide them with strategic planning and helping our practices, just improving their job and reducing friction and making these practices more efficient and everything.
• 4:15
  Speaker B: So, okay, I picked up on the fact that you said supporting hundreds of agencies. What size user base are you talking about then? And are you guys handling the help desk too?
• 4:26
  Speaker A: Yes, we do. There is probably upwards of 1500 or more users in our entire environment. So alone we have like, I think 15, 1600 devices under our care. So.
• 4:42
  Speaker B: And are you guys helping with the features of Microsoft Office and the like, or is it more segmented and you're just on some kind of dental application?
• 4:54
  Speaker A: We manage the Microsoft stack, We manage email, email security, and then we also do help with the practice management systems.
• 5:02
  Speaker B: That is like one IT person for every 200 and 215 people.
• 5:09
  Speaker A: Yes.
• 5:10
  Speaker B: Are your users that technically savvy that you can get away with that much?
• 5:15
  Speaker A: They do good job. Our dental hygienist and our dental team, they are very technical, Right. They can get to point A, to point B in their system. They have to learn it. And we have had help. Ours is structured a little bit different where we actually use our vendors to our support. Like, our vendors provide a lot of training and support that, frankly, my team doesn't have the resources to do. Right. So we rely on the help of our vendors as well. When it comes to those little extra pieces. When you're thinking right there in your mind, like, how do you handle that many people?
• 5:50
  Speaker B: So, yeah, I've got nowhere near the number of people. Well, actually, I guess we're kind of close, but we got like a bunch of truck drivers, but the truck drivers aren't really calling for help with their email and things like that.
• 6:05
  Speaker A: I think they just make do with what they got. And that's the thing that I've found is I think there's a certain level though of users that may just don't want to feel like they're inadequate or that they don't know what they're doing. I feel like there's a lot of times where we're telling people they'll come to us after so much frustration of saying this is not working, like why is this not working? It's like, well what's not working Battle? And it's like, oh, this has been an issue for two years. And it's like, oh, well we didn't know.
• 6:39
  Speaker B: Now you tell me.
• 6:41
  Speaker A: Now you tell me. Exactly. Now you tell me. And so we're like bring this in. I think this is something that I've heard from industry wide is it is not brought up early enough. Right. We're not brought in early enough. So therefore let us know like we may not know from a user perspective everything that's wrong. We're not doing your day to day, right. We're just here to support and then we will help once we know what's not working. And so that's where built the team of like even our technicians are strategists, right? Like asking the question what's not working? Or how can we make this better? Right. So that way we can solve the problems before they become big problems. Right.
• 7:28
  Speaker B: And so when you walked in to this three, four years ago, you were the first one, the only one. Were you handling like the outsourced? Because I believe you said it was outsourced prior to you coming in and now you're bringing more of it in house. And is the focus still primarily just the support and break fix or you guys starting to get deeper in and starting to fight more of the larger, bigger issues?
• 8:03
  Speaker C: Your CFO doesn't want 47 Internet bills. We help IT teams consolidate multi location Internet into parent child billing with coterminous contracts while still buying wholesale from the best providers. It gets control, finance gets clarity. No disruption, no sales pitch. Just go to you've been heard.com and answer the seven questions to simplify, streamline and save.
• 8:26
  Speaker A: So we are becoming more and more that strategic partner of solving bigger issues. Right. When I came in it was one of those things where we were all outsourced it to where we had to bring in. I was having to do all the vendor relationship and just try to build the team and do the cross training. Right. To make sure that the practices are still supported. So it was very heavy on break fixes. So. And that's one of the challenges that I have is steering the direction right of let's get out of just the complete break fix mindset and move towards a more strategic role for us. Because I feel like that is what is seen by us quite often, the break fix part and then moving us to more of a strategic role of the company and bring us in on the conversations about where can we help building power apps to solve problems. Right, Interesting.
• 9:28
  Speaker B: So it wakes the old school IT person in me. I'm going, wait a minute. Okay, hundreds of agencies. Who's handling the networking? Are each of the agencies doing their own networking? Are you guys helping with that networking? Is that completely outsourced? How's that piece of it? Because again, just seven people supporting that many. And then as I start trying to figure out the world that you're dealing with because it sounds like more the application side than infrastructure. And then like you're talking about the fun of being handed applications. Are you standardized across all of the agencies? Do you have multiple different dental systems that you guys are trying to help support?
• 10:11
  Speaker A: It's all valid questions and I get several questions like that all the time from other professionals in the IT space. We are actually completely differentiating systems. We are not reconciled all across the board. As far as networking, I would say most of our locations are pretty bare bone from a networking standpoint. They're pretty simple. I'm very small business oriented most of the locations. So like we manage like the firewall. But as far as that goes, none of my staff is trained or certified in wiring. I do not let them put any holes in the walls. That is one of my rules. They are not allowed to put holes in the walls. That is up for a third party to handle. Like we contract out or we use a facilities person. But it's one of those things that I talked about. Like when it comes to the actual like trying to get out of that mindset and the break fix and trying to do more of that is I figured out is that you don't change the perception by explaining it. Like I spent a while trying and reporting better decks, more visibility of what the team actually does. It doesn't work because you're still asking people to update a belief based off of a slide and nobody does that. So one of the things, things that I've done one of the vehicles I'm using now is onboarding. When new hires come in, we work through that process. Right. We're, we're constantly telling them like, come to us early. But I mentioned a minute ago, like, bring us in early, you want to do a new tool, you think that something's not working, tell us about it. And that gets back to the mindset of we know sooner, so therefore we can maybe fix the problem. Right. And then hopefully that gets us in a better spot to where we can do more reconciliation of the systems and we can find like that doesn't work because if you all were using the system, it would do this X. Right. So it's one visible win at a time until it changes. We do, we just have to get there. Right.
• 12:15
  Speaker B: Oh, I'm assuming that the agencies are all standalone, since you mentioned, like small business.
• 12:21
  Speaker A: Yeah.
• 12:22
  Speaker B: Okay. And actually one of the things that I was thinking was part of the conversation that you have is like if you get a hold of the office manager and you talk to that office manager and you're talking about onboarding the new employees and you're helping them and you're trying to convince them to call, but if you help convince that office manager, hey, if this person had called three weeks ago, we would have had that problem they were dealing with solved in 15 minutes. They suffered for three weeks. It slowed down your operation during that time. We're not trying to throw them under the bus. We're just trying to show you that we could have helped you be faster, helped them be faster, making you better. Then that way that office manager's on your side and trying to help fix these things too, or at least raise the lag a little sooner.
• 13:14
  Speaker A: Yeah. Well, and that's the thing that services with onboarding. Like for instance, you take that like no sooner. Right. When it comes to like I go back to onboarding because that's a big one. Like a new hire starts on Monday and we find out Monday. Right. And then everybody has a bad week. The person sits there without access. The office manager is frustrated because they, they thought they may have done everything. But then our team is now having to drop everything, is having few hours just to get it done. Done. Right. Everyone is involved, did their job, and it's just something that no one told us. Right. It just didn't get to us. Right. I, I want to be careful here because that's the easy version. Right. We blame that the office did something wrong, but they're running a practice. Right. They're managing the schedule, the teams, patients, insurance, hundreds of things that are actually urgent. Nobody handed them the rule that said it has to like we, we try, like we constantly tell them, but again, millions of things on their plate. Right. And the failure is really the process assumed that it'll travel on its own. We've tried to keep convincing it, but again, it's hard. And that's something that I have learned is dentistry is very hard. You gotta think about this. No one likes going to the dentist, right. It's actually a special little area. People don't go for fun. People don't go because they want to. Right. So they have to sit there, listen to people complain about their pain or how they don't want to go there. They're spending money on things that they really don't want to have to be spending money on. Right. It's healthcare, but at least healthcare, you're at least going to hopefully solve a problem a lot of times. You're usually only going when you're sick a lot of times. So we want to make sure that everyone is taken care of. So we got to make sure that we present, give them as little friction as possible. So we went to them instead of waiting. We actually talking to the office managers about onboarding, we helped them look like from their chair. Like, what does it look like from them? How can they do it? And building out like a way that how they can tell us a little bit sooner. And just saying, hey, if you just do this the moment you learn it, like finding a defining step, right? Once recruiting says that you have a hire and you're selecting someone, here you go. This is where you go it so that the whole shift is miniature, but yet we make a big impact by just helping them get it faster. So everyone is happy, right? No one is having a bad week.
• 15:48
  Speaker B: Yeah. Sue, again, my curiosity is getting the better of me on this and wondering what your world's like. So what's a bad day look like in your world? Say somebody like Comcast. Because I'm assuming that these guys aren't paying for major connections, hardwired connections, they're using the local ISPs. They may be using a business version, but they're using the same stuff that we use for residential. And so a system outage from somebody like Comcast or one of those could take down 15 or 20 of the locations that you guys are dealing with. And I assume that leads towards a bad day.
• 16:35
  Speaker A: Well, it can be a bad day for sure. I mean, we have a lot of calls. Our call volume will spike, obviously. Right. But because of the way we're provisioned. Usually a mass outage, except for like a Microsoft outage or something like that, then that affects everybody in the world, right? Or a grand majority of people. It usually isn't a day when something breaks. Breaking aspire is what we do. We point in the right direction and it's. I think that's where it helps for us, is where we do have the third party, like right. The ISPs or we rely on them. You mentioned about the Internet going all down. We reach out to them and then it's a matter of us just reassuring and providing them workarounds. Right? Like we're being the saviors, we're being the heroes of saying here's how we can keep you running for the day. Right? They're stressful, but they're overall, it's a pretty clean day, right? Because we know our processes, we can take care of it. Bad days when we're spending nine hours reacting and never touching a thing that would have prevented the other time, right. Where every conversation is having a decision beforehand. Like we're working on something where we're constantly reacting and we can't build out to where we can prevent any of those things from actually happening. Right. We're not pre planning because you feel like the next version of it being created is just slipping through your hands. Right. The other it's whenever I'm in constraint. Right.
• 18:08
  Speaker B: Basically defined examples because you had to have experienced it one way or another. And yet when I go through one of those break fixes or one of those break periods and it's typically something that my leaders will ask me too, is okay, what are you guys doing to work on it now and what are your plans to keep it from happening again?
• 18:32
  Speaker A: Right.
• 18:32
  Speaker B: And that to me that's what it sounds like you're describing is one of those situations, but that you're so busy in it that you can't figure out how you're going to keep it from happening again. Right?
• 18:45
  Speaker A: Well, so for me, here's a real bad day. It's boring on purpose because I get in early to work on something that matters. Like we're working on trying to automate a process that everyone is complaining about. Right. Everyone says that this process is awful and I want to build out a solution and fix that or that we are really digging down into fixing that. But a plan, a review or something that has been really been working on for six months to pay off, right. But a few minutes in, someone needs an answer, they're like, what's going on, then a vendor call like come moves up or some issue with a vendor, right? But then a question comes in that only I can answer because I'm the only one who had the original conversation. And by 4 o' clock, I've been useful maybe 11 times, but I've not moved a single thing forward, right? My team is still waiting on me for three, four decisions. I can't strategic think. I think that's where the hardest part is, right? Strategic thinking time. That's the bad day for me, really.
• 19:51
  Speaker B: And in all honesty, I think it's one of the core struggles that we in technology deal with. It's that balance between the firefighting mode and the strategic partner and trying to make sure to get out of the firefighting mode to get into and stay in strategic partner. Or some of us have a hard time delegating that and allowing ourselves to be that strategic partner and delegating and allowing somebody else to be the firefighter. I was talking to somebody, another interview yesterday and he was talking about working with guys in Linux and they loved being the cowboy, the hero that shows up, riding in on the right, the white stallion to fix the day. And then they jump on their horse and take off out into the sunset. And just their need to fix things versus being able to slow down, sit back and go, okay, how do we do this so that we don't have to go through that again?
• 20:56
  Speaker A: I will say that is one big growth thing for me from this role because I've always been in infrastructure, I've always been in engineering, right? So doing that I still catch myself doing it, is trying to fix the stuff I have no busy business fixing, right? That should be things that I let my team. Something comes across my desk, I know the answer. It take me four minutes and I could do it. And every time I can do that. But I've also told my team two things I didn't mean to say, or maybe I'll just say I'll take care of it real quick, wait long enough, but handing it off. I've done much better in that I feel like now. But the pool is real though, right? Us as IT people, we are the firefighters. We're like, ooh, let's fix that. And I do that even to this day. I think about, like, what we've just been talking about. I can think of a few projects where I'm like, it's in my mind, like something I would love to, I guess, tinker with, right? I want to tinker with it. But then I Know I should be focusing on other things. So sometimes I've held on to a few of them and I do it in my free time or my in between times whenever I have a moment to breathe or I want something to do that is not policy driven or escalation driven and just tinker on like building a solution for something. Right.
• 22:21
  Speaker B: Okay, I want to step back in your history a little bit because you mentioned research computing as part of your experience. Define that for me. What did you mean by research computing?
• 22:33
  Speaker A: So beforehand we had a data warehouse. I think it was like 10 node cluster virtualization VM system where we housed tons of research data for all these different research scientists. We had state data, we had federal data. Like we had all this data and we offered it. It was a computing platform because we even had a deep learning machine, bunch of video card machines. Had like I don't know at the time I think it was like 10 Nvidia GT TI's. I don't know. It was one of the high end ones at the time. Now it probably seems like it's a joke, but they did AI learning there looking at deep models at that time and so on and so forth. So that is where a lot of my big infrastructure work came from. Was working on that. We had our own NAS set up like it was a full on giant tech stack and we had hundreds of VMs that we ran and then we had a VDI instance to roll up all these devices for these researchers to use as a secure area where they could do it and not worry about compliance piece. Right. So that's more about it. I'm curious, where's your mind going? What other little details?
• 23:54
  Speaker B: Well, I'm wondering what the time period was that you were doing this.
• 23:58
  Speaker A: Like the timeframe is in the years.
• 24:01
  Speaker B: Yeah. What year was it that you started doing that or working in that and doing it? Because it, I'm guessing it was like the 2019 somewhere there earlier or was it a little later?
• 24:13
  Speaker A: It would have been 2018 to about 2021. Right before I came to where I am now.
• 24:19
  Speaker B: Yeah. So before OpenAI really kind of became public.
• 24:23
  Speaker A: Oh yeah. AI wasn't a thing. That was just a buzz. If anything, I say a buzzword, it's now a buzzword today. But it was just a thought, it didn't really exist. And yeah, yeah, people were doing it,
• 24:35
  Speaker B: but you were sitting on top of something that it would just love to consume and probably is and consuming and spitting stuff out today now. But some of the deep learning and things that you were involved in?
• 24:48
  Speaker A: Yes. And that machine was a bane of my existence because people, the researchers would fill it up or cause it to lock up because they were doing some kind of script on it that would break it.
• 24:57
  Speaker B: Oh, man. Okay, so you were doing the infrastructure and helping support. Support all of that there in that environment?
• 25:05
  Speaker A: Yes. My role at that time was a lot more building. Like, I was the Lennox guy, too. I was our Lennox person when I left. I had to write so many SOPs for our people as I was leaving, because they're like, we need you to lay out the lay of the land of how in the world this works. I had quite a bit of it done. All the little pieces, little nuances that I just knew I just had to run across some and then real quick, document it down.
• 25:35
  Speaker B: I need to document that now. You're going to document this? You're going to document this, the stuff that we're always so, so proficient at?
• 25:44
  Speaker A: Absolutely. We're always so great. So great. I mean, that's the favorite thing of all IT people. Right?
• 25:51
  Speaker B: Right. Actually, now it's not so bad. Hey, ChatGPT, document this.
• 25:56
  Speaker A: AI has made things so much easier when it comes to writing SOPs, but it also has the same challenges of removing the thought sometimes. Sometimes you take a step back and you let it do its thing and it misses a crucial piece. Right. It's the most boring thing. But that is one thing that you probably ask my team. They would all say, that's all I talk about is, did you document it? Everything's documented. We got a CYA and everything else. Also, I'm all about the proverbial bus, because you never know. Someone's got to cover in the event something happens. Right. And it's so hard. And it's not something no one wants to talk about. Right. No one wants to talk about anyone just disappearing one day. Right. It's the first thing to slip always when you're busy. Documentation work is the longest gap between effort and payoff. Right. It loses the prioritization fight every time. So you have to treat it as just. It's just part of it. Like, it is part of the process. It's something that you have to do to make it work.
• 26:59
  Speaker B: You called it the bus test. I always think of it as the beer truck test. I don't even remember who brought that saying to my world, but I latched onto it. All right? So we. We started talking about it a little bit. How does AI play into your world of supporting hundreds of agencies as a internal private msp, Are you trying to
• 27:28
  Speaker A: figure that out right now? The problem is nobody wants to talk about the adoption happening through it. So like for instance, I feel like AI right now, there's a lot of shadow it with it, right? And in healthcare AI shows up as a governance question before it shows up as a capability question, right. We all know that AI could probably do it. A matter of where we're careful of the AI. I know a lot of it comes down to most of in dental at least a lot of AI is surrounding I think clinician notes, clinical notes and also imaging. There's a lot of stuff about them being able to help diagnose teeth. And something that I've learned in dentistry, there is a lot of variations in. Like when you look at an X ray, two different dentists may see different things just because of one thing. Whether they're sight, they're tired or it just does it look the same to someone. So it's interesting. That doesn't help in healthcare. You have a broken leg, you have a broken leg. This is what that means, right? But if you have like a something on your tooth or your gum, different dentists could differentiate it as different things that could be resulting, right? But for us with AI, we're looking at any way we can integrate it to make things easier. There's not a whole lot of it fully incorporated yet. For instance, we have some here and there like reminisce of AI. Like for instance of our help desk. It has AI in it to help us with SOPs as you were talking about. Like it helps us do that documentation summarization. But we're doing more evaluation than anything. We need to make sure that it's actually going to work and actually simplify things. Because with the shadow it I feel like there is a lot of AI where I see people have left their reading glasses at home to where they'll look. You know, it's like did you not read what you just sent? Like it is nothing but pure AI. Like prompts like you just copied and pasted your brain is not there anymore. So for us trying to find ways of implementing it to where it's not just a cool tool to help you rewrite things, right? So it's all about leveraging on the work that eats the most time without producing much. Right. The stuff that we are spending 80% of our time on reducing that down the noise so we can take the 20% of our day to day is strategic. Making the big changes where we can spend more time on the 20% right, right.
• 30:10
  Speaker B: So it leads to a couple of questions. I've got a co worker who started up a business and is running a pharmacy. And in that pharmacy, between him and the pharmacist, they implemented AI within the pharmacy to start doing all kinds of things. So they set it up so that when they onboard an employee, they say, hey, onboard this person. And it goes off and it creates the user profile, it gets the access codes, it gives all of the setup of the employee done like that. When the employee's ready to close out the cash register for the night, they bring up the prompt and say, hey, what's the procedure behind closing the cash register? Here you go, here's steps one through 10. And so it was pretty amazing the way that he leveraged that or they leveraged that to do these things. Now, of course, as the pharmacist was building out the AI, he would do things like set it up to offboard an employee. And so the former coworker of mine, he's like, hey, I wonder what happens if you try to tell it to offboard yourself? And so the pharmacist is like, okay, let me try it. And pretty soon he calls back and says, hey, I'm locked out of the system. And he's like, no. Oh, you just yourself. You just fired yourself, dude. So they started adding in some of those guard rattles and making sure that it didn't do things like that it was protected around those kinds of things, which makes me wonder how much it would help you. But it also made me start going, well, wait a minute, hundreds of independent businesses, how do you guys have your, like, active directory set up? And is it like a huge active directory directory that you're setting up for all of these organizations? Is it individual ones? Are you using different things? What kind of infrastructure does that lead to?
• 32:13
  Speaker A: In hindsight, it should probably be multiple tenants, but it is not. It is one giant tenant. Right. So we build everything out, but we've actually looked into ways of trying to, as you mentioned about building out the onboarding system, right. How it can help us. So it's a matter of, again, finding the system that would work to where it's compliant. Right. The biggest problem is that we do work in healthcare, so we have to worry about the compliance piece of things. Right. What's going to be fed into the next model. Right. They say they're not going to feed it in there, but are they really doing it? You won't find out until the next model. Right. Basically, that's the way they work as they're training it up. But I think to answer your question of like, it could help, there's definitely some areas where it could offload. Again, Back to my 80, 20%, right. We spend 80% of our day on things that probably could be automated to help. That doesn't really move the needle. It's just day to day work. And we need to get more on the 20%. Right. So figuring out how we can automate it, but also putting in the guardrails, as you said, like, that's our biggest piece. Because, for instance, like my team, only my administrators have access to copilot. So that way we can actually start working on our DLP policies. And like anybody's going to have access to something they shouldn't. Right? Having that guardrail, that's the important part of the MCP stuff, right? To where it's acting on behalf of that person. So therefore anything beyond their scope, they won't have.
• 33:51
  Speaker B: Interesting. Okay.
• 33:54
  Speaker A: Yeah, I feel like it can help, but again, you got to be careful, right? That's the biggest thing about AI. And it goes back to the security stuff too. Like, AI is becoming harder and harder with phishing. Phishing is the easiest way to compromise any system and it's getting harder and harder to detect because you have AI now to do it. It makes it a lot more likely to trick somebody.
• 34:17
  Speaker B: Oh, man. So what are some of the other interesting challenges or things that you're dealing with in your portion of the industry? I mean, with the other experiences that you had, the sales, the research compute, the infrastructure, and as you find yourself in this realm of the private msp, what's one of the challenges that appeared out of nowhere that you didn't expect? What's one of the things that's been challenging that you've succeeded in solving, but were surprised by over the last couple of years and we thought I was going to catch you flat footed with the prediction.
• 34:59
  Speaker A: I know, right? One of the current ones, because we think about AI and everything it makes me think about this is like technology adoption is outpacing the ability of any organization to evaluate responsibly. Like, it's not a healthcare problem. It's not just me, but I feel like it's a bigger pain point for healthcare because we have to worry about patient data. Right. But somebody finds a tool or somebody, now they're using AI, right? Everyone's using ChatGPT on their own to help work this. It saves them 30 minutes a day, but they're not going to wait six weeks for a Review. Here we are. My team is trying to evaluate and build out and make sure that copilot has its guardrails. Right. And in hindsight, they shouldn't have to. Right. Like they should be able to use these. Solves their problems. But it's. The challenge is making the approved path fast enough that a shortcut isn't tempting. Right. The shadow, it isn't tempting. Right. So that's a bottleneck that I feel like I need to fix. But I feel like there's a fix that many people deal with this. Right. It's.
• 36:04
  Speaker B: Yeah. No, this is a societal issue. It's not an industry issue. Because it's happening on both sides. They're expecting more faster and we're trying to solve it more faster, but it's still that disconnect in continuity.
• 36:19
  Speaker A: Yes. And that's the thing about the strategic. As I've talked about the strategic time, like my bad day. Right. It requires a strategic time. Right. To think about it and figure out the challenges. And it's about building something out to where people can use it, where it can be half baked, but at least it can start somebody so they're not tempted to going shadow it route. Right.
• 36:44
  Speaker B: So sure. I still hate the term guardrails. Like, I'm doing my best not to use that term because it, to me, it's so minimizing. It really minimizes what we're talking about or what we're trying to do. It. It simplifies it beyond simplification. We say guardrails, but we forget that we're in a tank that's just going to go right over those guardrails without even noticing a bump. It's just too simple. The term just like hallucination sounds so nice compared to the fact that it's just wrong.
• 37:23
  Speaker A: Well, it's just like the whole strawberry thing. Right?
• 37:26
  Speaker B: Right.
• 37:26
  Speaker A: It's the whole strawberry thing with AI. I know. That was a hot topic for a little bit.
• 37:31
  Speaker B: No, I missed that one. Tell me that.
• 37:34
  Speaker A: Oh, like there was a time where you could ask it, how many Rs are in Strawberry? But because of the tokenization, it would always say there were only two R's in strawberry, but there's three. I'd have to go back to an article to review exactly the answer. But I know due to the way tokenization was happening, you could argue with it over and over and over. Like you could tell it how many Rs are in straw, how many Rs are in berry, and it would give you the right answers. But when you combine the word together. It did not see it anymore. So there was something about the model that it could not properly give that. So that was one of the very. I remember that as one of the very early big hallucinations that AI had that people just blown out of proportion, like, oh, AI can't even tell me how many Rs are in strawberries. So what makes you think it can actually do anything? And I remember that pretty early on and I thought it was a pretty interesting thing. That's the strawberry thing, but with guardrails on that notice. You have to put something in place, right. Or you never know what people are going to do. It worries me all the time with the shadow IT stuff. People are feeding AI into this. There's no telling what's out there and we won't know until later on.
• 38:53
  Speaker B: It has me curious because I haven't done the research and maybe I should have, but I'm still curious what prompts are people using to find out what is freshly going in? Like when they found out that Sony's code, your proprietary code, got put into AI, who was prompting what to find out that went into the model and how did they do that? Because this was also at the time where the models that were coming out were those models that were like 2 years old or had only been fed data up to two years ago. And so I'm like, how did they pull that out?
• 39:33
  Speaker A: That's a much smarter person than I am question for sure. I don't have an answer as well, but it's someone that knows it through and through because I've done my own trying to see about like what people have maybe put in about our, even our stuff, just to see what it will give. But a lot of times until the new model comes out, you actually don't see all those ramifications that early on from my understanding, because whatever you're using on the current model won't show up until the next model. But Anthropic is adding in their own way of watermarking everybody's words. So soon. It will be quite an interesting time as whenever all the AI work out there is actually watermarked or can be check to see if it was a all AI or not. So I'm curious of how that will all pan out in the future.
• 40:26
  Speaker B: It'll be interesting for sure. All right, it's time for the prediction. What are we going to be talking about in 18 months? We're not talking about today.
• 40:34
  Speaker A: I think it goes back to the AI stuff. I know this is the hot topic, but I think everyone will be talking about identity and permissions for these non human actors. Right now the conversation is all about what AI can do, right? It's everything is all about oh, AI can do this, AI can help me do this. But no one is having the conversation about like who is the agent. We just talked about the guardrails, what is allowed to touch, what does the audit trail look like?
• 41:06
  Speaker B: Interesting.
• 41:07
  Speaker A: When it does something wrong, how do we take care of it? Right. If the tool touches for me healthcare, it becomes even bigger problem. If the tool touches patient data, it's a business associate at that point, right. As far as HIPAA and compliance is concerned, teams are adopting it. But then how do we keep it all Safe? Right? In 18 months that's going to be an enforcement story, like we're going to have to enforce things versus like a theory. I feel like we're right now on theory base of how we're going to handle it because AI is moving so fast so well.
• 41:43
  Speaker B: I mean in all honesty, one of the things I'm fighting with is trying to make sure that when a user is using it, that it inherits the user's permissions for access and control. So we get the role based access based off of the user. But when you're talking about, it's more like, okay, I set up an agent today, I instantiate it, it goes out and it does its stuff and then they decide to make it an enterprise agent and then thus they need to get my connectivity to it out. So now it's a standalone agent and now where does its access? What are its boundaries there? And it's kind of like those service accounts because you want your service accounts not to be associated to a person because when somebody fails the beer truck test or somebody self calls as I like to call it, and you need to disable their account. You don't want all of the services that they've created or done breaking. So that's why you put them into a service account. And yeah, so service agents and service agency are, I mean we're all about
• 42:59
  Speaker A: our service accounts in it. Service accounts are a big fundamental way of making things work autonomously. Right. So that's the part of the agents and we, once you build out these agents like these actors, you have to provision them properly. You've got to make sure and you understand how are we going to do those guardrails, how are we going to document it, how are we going to provide the identity, right? Like how we got to identify this thing.
• 43:26
  Speaker B: Yeah. Oh, man. Oh, it's a good one. I haven't heard that in my predictions yet, and I think you're right. So, Brandon, thank you so much for sharing your experience with us today and telling us about what it's been like to be you as you wander through the world today.
• 43:44
  Speaker A: Absolutely. Well, I appreciate it. Again, thank you for your time. I appreciate everything that you all are doing as well because it helps. Sanity checks.
• 43:53
  Speaker B: Yeah, I know. It's definitely appreciated. And you and anybody that's listening, please come join us over at you've been heard dot com. Join the community, talk to us, bring up the questions and let us know what you're thinking and what you need for help. Because a majority of us just are here to try to help because that seems to be one of the fundamental portions or fundamental pieces of technology, people is we love to solve the problems. So thank you for joining us and thank you for your time.