Latest / FintechOS Evolv / Cybercrime, AI, and the Future of Fintech

Transcript

Cybercrime, AI, and the Future of Fintech · FintechOS Evolv

0:06
Welcome, Billy Ferguson, to the latest episode of FinTech Evolve podcast.
0:10
Delighted to have you here.
0:11
There's been a lot of news of late around cybercrime and cyber frauds.
0:16
It'll be really good to get your fresh intake on what happened and what went
0:20
wrong, and more importantly, what the impact would be for the banking world.
0:23
But CTO for FinCats now for three and a half years. Tell us about FinCats.
0:30
Yeah, sure. So we're an alternate finance provider, so we lend money to UK businesses.
0:37
Business has been going for a while before I joined, but essentially we kind
0:42
of bring in money, help mid-sized businesses grow, do a lot in mergers and acquisitions.
0:49
And my role has been there to, I guess, land a platform that could scale,
0:54
get us to the kind of position that we want to be, and to create the kind of
0:58
digital efficiencies that you really want from tech.
1:00
And be secure that's the sort of topic we're talking about today yeah absolutely
1:04
and I think I read it's been about 2 billion pounds worth of lent money since
1:07
the inception of ThinkCats and I think a billion pounds worth of assets under
1:12
management so that's an amazing achievement for business that only come about,
1:17
just over 10 years ago really in its first form but I know it's iterated since
1:20
then that's right yeah I mean we're just hovering around the 1 billion mark
1:23
now just it's always that kind of benchmark you kind of kind of break through
1:27
but yeah sort of a billion asset under management,
1:30
is a kind of that next big target, I guess, to kind of break through.
1:34
But, you know, we've been profitable last few years, which again is... Always helps.
1:37
Not always a metric that people sort of talk about, but we, you know, we are.
1:41
It's a business that makes money. It doesn't just evolve and exist.
1:45
It kind of actually makes money, which is kind of what we're all here for, really.
1:48
And you've got that sweet spot of customers in that kind of SME segment or mid-sized
1:51
kind of commercial segment that...
1:54
You could say, has been kind of underserved over a fair period of time.
1:58
So you obviously brought up quite a brand loyalty and a customer base that's doing well for you.
2:02
Yeah, and I mean, it's funny. We kind of go to a lot of these awards and you
2:07
kind of wrap against you. Have you won any?
2:09
In the lending space, we have. I'd love to say we've won in the tech space, but we're still trying.
2:14
But yeah, no, in the lending space, we're sort of winning awards against, you know, the big four.
2:18
Did you lose that nationwide? Is that nationwide you must start to?
2:21
At the last uh tech awards yeah
2:24
i kind of they're a building society but you know we're a
2:27
hundred people and when i'm writing the pitch and i'm like yeah there's 12
2:30
people in tech i kind of find a position it in there you know when you're measuring
2:34
us against them but no so yeah we're in a market where we can serve local regions
2:39
we've got a distributed sales team um and we can work with the businesses a
2:43
lot more closely than some of those kind of more um i guess digitally decision-based
2:49
kind of big banking systems.
2:51
Yeah. And you mentioned digital platforms and digital efficiencies.
2:54
And I mean, I joke on this podcast a lot, I would joke before the cameras went
2:59
live, that you're one of the few CTOs that survived a digital transformation. So congratulations.
3:05
You've obviously seen it through. And it's still going. It's still going.
3:09
It's not what I thought around here.
3:11
And, you know, we joke, we're Jeff and joke, but they're hard work, aren't they?
3:16
More of them fail than they succeed. so actually when you get a
3:19
success story in our world in digital transformation
3:22
especially in the lending space it's something to shout from the hills about and so
3:25
you've been pretty central to that bringing those platforms together and ecosystem
3:28
together and building out partners and knitting it all together and I think
3:32
there was a core a new core from memory I mean that's open heart surgery at
3:37
best anyway so yeah migration decommission of bespoke kind of hand built systems
3:42
and stuff like that no it's been,
3:43
it's been a busy three and a half years but like I said kind of,
3:48
stuck it out for want of a better word but no it's it's been transformational
3:54
as as the name suggests but really enjoyable you know it's loads of loads of
3:58
learnings loads of good stuff you know highs lows difficulties um but you know
4:04
being honest with kind of.
4:06
It being a small business it actually makes so many things a
4:09
lot simpler you know i can literally connect up the dots across the organization
4:12
without having to jump through hoops and
4:15
this that and the other which makes it happen you know you can
4:18
get stuff done you find a problem you can fix it you've got
4:21
support you've got the kind of organization behind you so um
4:24
you know i've been i've been around the block a little bit
4:27
as the kind of lack of hair would suggest so i've been
4:30
at places where you know we've tried and it hasn't always worked
4:33
but it's it's good to be the other side of
4:35
something now and um you know it really works it hangs together end-to-end
4:39
it's a digital platform all the loans are processed through
4:41
one system we've got no legacy all in the cloud it's
4:45
kind of yeah it's a good good place to be all the old book migrated over
4:48
is it 100 yeah have you closed down the old systems
4:51
and cores and closed it down decommission all the hardware nothing's
4:54
left running on it it's all completely gone yeah so um
4:58
which you know being the
5:01
other side of it now makes my life hell of a lot easier because i don't have
5:04
to deal with all those other things that you know distract you take your time
5:07
away um you know we're going to talk about security just uh you know it's just
5:12
more headaches to have to deal with when you've got all those extra bits hanging
5:15
around the edges that you know is points of weakness. It's just, no, all gone.
5:19
And I guess with all that work that's been put in, you're now starting to see the benefits come out.
5:24
I know we were talking about, you know, obviously it costs a fair chunk of money
5:27
to do these transfer transformations and now you're starting to see,
5:29
you know, I guess the other side of the hockey stick now and the benefits coming
5:33
through and the efficiency coming through that's impacting.
5:35
Your colleagues in the front line and second line roles and hopefully your customers as well.
5:40
Yeah, I mean, 100%, yeah, we could run at a pretty,
5:44
flat rate now, you know, cost-wise. And, um, it's a cost profile,
5:48
which I think is as good as any, if you look at proportionate to revenue.
5:53
Um, but the other side of it is it gives us the opportunity to invest,
5:56
you know, we can invest in shifting it forward, transformation into innovation and, and, you know,
6:01
AI and capitalizing on everything that's kind of coming through, you know,
6:04
thick and fast because we've, we've sunk a lot of the effort, the hard,
6:09
hard miles into that transformation the focus
6:12
now can be on well let's just keep going you know we can really push
6:15
it well i mean or a business prerogative they
6:18
could decide we're going to run at a really low cost it's scalable it's efficient
6:22
it works you know there's that opportunity there as well that's what i guess
6:25
that's the options it gives you um if you could look back in those three years
6:29
and you know advice to viewers listeners uh and and watchers of the podcast
6:34
that have either started or in the mid-terms of a transformation,
6:38
being that you are one of the very few success stories. So I'll pitch it there.
6:43
What was the kind of, I guess the blind spots you may have had and some of the,
6:49
I guess if you could do it again, here's some of the things that I should have
6:52
done better or this is what we did really well and that's why it became such a success.
6:56
I mean, it's not, I'll be honest, it's not nothing that anybody listening probably
7:01
hasn't heard, you know, break it down into manageable chunks. Absolutely.
7:04
Make it as simple and relatable as physically possible.
7:10
Don't leave any corners unchecked. You know, I've got a bit of an expression
7:17
I use with my team, which is, is it finished, finished, finished?
7:21
Yeah, okay. That's kind of been always a mantra. We move on to the next piece
7:26
of work once it's completely dealt with.
7:29
It's not gone into phase two. No.
7:32
Nothing's rolled there. let's absolutely make sure we get finished and I'll get hammered,
7:37
I'd get hammered on it by something like, let's go, well, it's not really there, is it?
7:40
And like, well, it is, you know, if, if, if there's something that's not there,
7:43
then let's flush it out and let's get it done. Yeah.
7:46
And I guess that, that process of iterative development, but finishing iterations
7:51
has meant, you know, there's never bits sort of coming to catch me or bite me later that I've missed.
7:58
And then it's building up because you get that so quickly, you leave a little
8:01
bit and then you leave a little bit and all those little bits all mount up.
8:04
And then before you know it you're spending more time focusing
8:07
on all that than you are really trying to get to and it's the interdependency
8:10
of the little bits that you you put under the back burner
8:13
or the backlog and actually you don't realize until you get to the next actually
8:16
we needed that piece of the jigsaw to make the picture absolutely
8:20
and i guess it kind of it's a little bit just in my nature i'm a little bit
8:24
of kind of complete a finisher is in my dna i can't help but i hate like i'm
8:29
decorating the house i hate moving on to another job before i like to finish
8:33
a job and then do another job which would bring you can't help you just bring
8:36
it to work don't you and that's kind of the way i am with with the projects
8:38
so you know i've had a really.
8:41
Solid steady strategy i knew what i wanted to do i outlined
8:44
that when we came in and we've stuck to it and we've
8:47
haven't kind of bent and moved around um and
8:51
i guess the other side of it is i've always had the support from the executive
8:55
board yeah to do that have they been consistent throughout the yeah that's that's
8:58
that it really helps i haven't always experienced that you know i often get
9:01
you know a grenade thrown in from the side well let's go and look at this or
9:04
I know we were doing that but I want to do this yeah they've supported the.
9:09
A direction that we've got done and we've stuck to
9:12
you know rightly or wrongly you know
9:14
there are bits of in the mix there that now maybe i might use something else
9:17
but hindsight's a great thing and you know the the decisions that we've made
9:23
i still think stack up now and are plenty good enough um i'd much rather do
9:27
that than be continually chasing that utopian you know excellent piece of tech
9:33
that might be a little bit better yeah i'd rather just get it done and
9:37
deliver against what we've got yeah i think you're quite fortunate to have a such
9:40
a stable ex-com board that have been there throughout
9:43
the whole transformation and you're all stuck with it because more
9:46
often not somebody moves on somebody comes in with a brand new idea don't quite
9:50
understand why that vendor was picked or why what the strategy is and say they
9:54
throw a grenade in and it disrupts the entire program um and that happens so
9:59
often that and the way technology is moving as well is that it's so fast paced,
10:04
you know a three year program actually what you've built after three years is,
10:08
three years old already so it's keeping up with the times and I guess having
10:12
that agility in the program to adopt any new platform or new piece of kit or
10:19
technology AI obviously is going to come up multiple amounts of time because
10:23
that's the next best thing.
10:24
But the key thing for you is having the foundation to enable it because an old
10:30
kit an old technology just wouldn't possibly be able to play that game yeah
10:33
so I'd love to say it was all my brilliance but actually some of it's Some of it is, you know.
10:39
Some of it is that, you know, been fortunate to have had that because that can
10:43
be an absolute destroyer of all your kind of plans is your stuff taken out of your control,
10:48
moves it around and then, you know, you're forever pivoting,
10:52
changing tack and that doesn't allow you to move forward.
10:56
So that's been a part of the story. So talking about things that completely
10:59
throw you off track, right?
11:01
Back to, I guess, one of the things I wanted to scratch your brain on is around
11:06
cybercrime. But we've had really high profile hits in the retail space,
11:12
M&S, Co-op, and Harrods.
11:13
In fact, I think it was only today that M&S turned on back on their online shopping.
11:18
So massive disruption, massive cost, massive reputational damage through effectively a cyber attack.
11:27
And I guess being interested to know your views on kind of what happened and
11:32
what went wrong in the retail world, But bringing it to more perspective of banking,
11:36
because now we were well hit industry in this regard and massive amount of money
11:42
we spend protecting ourselves and new tools we use to protect ourselves,
11:46
but these are the same tools.
11:47
Yeah. A lot of the bad actors have. So I guess, what was your take on,
11:52
on what happened earlier this year and uh, how did you feel about it? Yeah, sure.
11:56
So, I mean, sort of bringing it home from my side, sort of two and a half, three years ago now.
12:03
We had an unsuccessful attack, but it was a pretty concerted one.
12:08
And I think you and I connected quite a bit at the time about it.
12:12
It prompted me to set up UK Finance cybersecurity sort of community because
12:17
I thought I can't be the only one battling away at this and we need a forum
12:22
where we can chat and try and share ideas because we're all in a degree competing, but at the same time,
12:29
this is benefiting nobody with the kind of outcomes.
12:32
I mean, the M&S is the kind of, I guess, the most financially impacting one
12:40
we've seen because they got in, they shut things down, they kind of have completely
12:44
disrupted their kind of e-commerce world.
12:47
The lessons learned from it, from my side, don't let the external world get
12:52
access to your kind of assets. Social engineering, right?
12:54
It was, but it goes beyond that in terms of what they can get onto.
12:59
So it was, you know, it starts out with, you know, they, they,
13:03
they mimic your help desk and they get access to some passwords and they get into accounts.
13:07
But to be able to step through from that, to be able to then get to like your
13:12
IT admin type resources, to be able to get onto your IT directory accounts and
13:17
be able to kind of breach into your kind of directory that,
13:19
that, that's a, there's a lot of pieces in the chain there that have gone wrong to make that work.
13:25
You know there should be you know some clear boundaries between that sort of
13:29
activity and you know I mean we talk about kind of things that we've done but if you look at.
13:37
What they have experienced now.
13:41
I am sure the security budget at M&S has gone up pretty massively as a result, as these things do.
13:49
You know, the co-op one was not quite as significant.
13:53
They didn't manage to disrupt their trade, but they got in and they,
13:55
you know, managed to get all their data, you know, they kind of ripped the data out.
13:59
And they could have ransomware'd it if they kind of got in, but they didn't
14:02
get that far, but they did still manage to get the data out.
14:04
So again, there's kind of a lot of gaps.
14:07
They mentioned the harrods one is also kind of linked together in those stories.
14:11
They didn't get anywhere but they managed to get in they managed to get in before
14:15
they actually did anything you know you're using all the same kind of techniques
14:19
um i mean the bits for it that scares me is one of the things i benefit from
14:26
is you know we're a uk-based company.
14:28
All our employees are in the UK. All our customers are in the UK.
14:32
So one of the controls that I've got in place is any kind of usage of our systems
14:39
from outside the UK is locked.
14:42
You cannot get on us from outside the UK unless there's some exceptional board
14:47
member for a period where we've agreed to access or somebody in the business.
14:52
But that makes my life simpler. The scary thing about, you know,
14:56
you just get spiders and that sort of thing is that looks like it's coming from the UK.
14:59
It sounds like when the people who have been arrested are UK folk.
15:03
I know, and younger than some of my kids, it's a bit frightening.
15:05
But that's coming from the UK. So one of your defaults is, well,
15:09
often this stuff is overseas, so that's a good way of kind of detecting it.
15:13
This was inside the geographic borders.
15:17
And you say, 16, 17 years old, I know there's a lady older than that,
15:20
but these are effectively children,
15:24
right, that have got access to some form of tooling to enable it.
15:28
And okay, I get it, there's some social engineering in place that have been
15:31
able to, I mean, how much information about me and you online,
15:34
the roles we've done, the jobs we've done,
15:37
you know, it wouldn't take a genius to pick up the phone to help desk and pretend
15:40
you're you and do a password reset and you've no doubt got admin,
15:44
you know, keys to the admin castle and there you're in.
15:47
You know, I mean, that's one of the things that we have done.
15:50
I, if you worked for us, I've got no more access than you.
15:54
So one of the things I did about two plus years ago was I reduced my access
15:59
level to be the lowest level because I'm a target.
16:04
You're high profile. I'm a high profile target. It's a CTO, get his profile, go in.
16:09
If somebody did get my profile, which hopefully they won't, I've got no more
16:14
access than a data admin resource because we looked at it and we're like,
16:18
well, if I need access, then I'll request it on a specific need basis.
16:22
And then it'll be revoked because it's too much risk if somebody got in and got my profile.
16:28
But yeah, no, the,
16:30
these are kids in the uk that have not and not very many
16:33
of them you know a handful of kids in uk that have made i mean i read 300 million
16:37
was the cost to mns that's uh that's quite it's quite yeah i mean i've got a
16:43
stat here that says that the you know banks are 300 times more likely to be
16:47
attacked for obvious reasons and that ransomware surged over you know not even 100 but.
16:54
1300 it's it's it's crazy and of course you know you get you get keys to the
16:59
car sort of bank then And you can do some pretty dodgy things on the dark web
17:05
as been seen with some of these high profile ones.
17:08
So, you know, with that being said, you've kind of outlined some of the pressures
17:11
as a CTO, this must keep you up at night.
17:15
These type of things is because it can be, I say they're outside your control.
17:18
You can put mitigations and controls in place, but, you know,
17:21
it only takes one case of,
17:25
Yeah, I mean, to be honest, no, it doesn't keep me awake at night.
17:29
You're a better man than me.
17:31
If that did, then no, you know, I kind of, I tend to go to bed at night and
17:37
think, yeah, we've done what we can do. I've done a successful transformation. I've done.
17:41
Mark told me I was a star, so I've taken that. I'm done. I'm going to take that.
17:46
But there is, there's a lot of controls in place, as much as we sensibly can.
17:52
Um you know we get we get attacks tens of
17:56
thousands i mean literally tens of thousands attacks like and we're a
17:58
small business yeah reasonably low profile
18:02
you know we're not mainstream yeah um but even us we get attacked but um yeah
18:07
i mean there's only so much you can do uh but some of the stuff we've done now
18:12
it's kind of weird the kind of oil industry's kind of circling back around to
18:15
where it used to be you know we now got physical security keys yeah,
18:20
connected to profiles to get access to the most you know
18:23
the most valuable assets within the company now um and i
18:26
remember having like you know and they now they still exist but
18:29
rsa keys and stuff that's the way you used to look on and use
18:32
that and that was your kind of and we moved away
18:35
from that i you know i think we're going back to physical secure
18:38
keys because it's the only way you can guarantee somebody is
18:42
who they say they are i mean we you know we've got mfa you
18:45
know not just uh sms you know mfa onto
18:48
authenticate and stuff like you know proper controls in place but even with
18:52
all of that you're like that's not even enough because it's interesting because
18:55
as you say like banks or financial institutions have adopted a i guess new ways
19:00
of working around security they
19:02
try to become a bit more digit enabled but possibly maybe too much, right?
19:08
So actually a little kind of reset back to the old ways, which was maybe it's
19:15
a pain because you had to carry around this thing and you'd have to put this
19:17
six digit number in and maybe not a great experience.
19:21
A lot more secure so do you think we're coming almost not
19:25
coming back full circle but having a little research actually does the
19:29
greatest new tools and new experience that is not enough for us to move away
19:33
from yeah some things is you know you can't you the the way that um the way
19:41
that ai is allowing them to come at you at such scale yeah and adapt to what
19:45
what is coming at you you know.
19:50
You can't you can't second guess that people can't work
19:52
ahead of it you cannot deploy things so some things are going
19:55
to have to go i mean i wouldn't be surprised um you know
19:58
we don't at the moment but i wouldn't be surprised some
20:01
of the banks have got locked down to be like physical office
20:04
environments you know we can only do things if you've got a secure key and you're
20:07
in this building you know you're really getting old school yeah you know went
20:11
through covid everybody worked from anywhere do what you like you know the whole
20:13
world's kind of remote yeah we're probably getting to a state now it's like
20:17
you can actually only do this stuff if you're in this building you're and that
20:20
laptop and you're using this key because it's the only way you can be sure,
20:23
it's not some kid with AI in their basement,
20:28
pretending to be who they say are.
20:30
It says that AI, 25% of all taxes are now kind of AI enabled or based.
20:36
Without going too far into detail for obvious reasons, but are you starting to see a lot more AI tax?
20:41
How do you distinguish that they are AI rather than these two guys in their
20:46
bedroom somewhere? Is there a way to distinguish it?
20:49
Um if there is i don't know what it is but i would
20:52
i would be surprised if it's that small really i think
20:55
it's longer bigger than that wow i think if you
20:58
take that that sort of bad actor trying to get in and they
21:01
may be using you know various tools to kind of get access they're
21:04
now using ai to kind of replicate their attacks so they kind of go but i want
21:08
to go in by this profile and use this this approach but ai give me a thousand
21:12
different variants on this one attack vector and start running them and it will
21:17
then you know it can run the automation to kind of drill out so it's just multiplying their,
21:23
bandwidth yeah to give them opportunities so that's why I wouldn't be surprised
21:27
if the numbers are way bigger it's probably I mean it probably distills down
21:30
to a small number of actors but yeah
21:32
you know they can use ai i mean we're all using it now to do more and be more
21:36
productive and kind of work more effectively they're doing exactly the same
21:39
thing going off piece but is there is
21:42
think that's embracing ai and is it in a user's hand or is it kind of bring your own device.
21:48
No so yeah we've got ai um we've
21:51
got a bunch of our prototypes we're running right now actually so
21:54
we're trying to um take away
21:57
i guess the time consuming element
22:00
where people are kind of trying to digest large volumes of data yeah
22:03
so when we go through a deal i'm a
22:06
bit detailed but you can get like a thousand page memorandum or a massive
22:09
piece of documentation you've got to read through to understand what the deal
22:11
is yeah some of the information is always
22:15
the same we've always got to capture the same level of information then you've got
22:18
a retool to find it well that's kind of homegrown
22:21
ai you know use case 101 so how do
22:24
we do that in a in a controlled environment safely securely we're not showing
22:29
the data so that's one of the areas that we're exploring at the moment you know
22:33
document comparison tooling there's a whole bunch of use cases that fit for
22:38
us even as a small business where there's loads of opportunity in it um and that's you know,
22:44
beyond the stuff we're already using it for login profiles we use ai and ml
22:48
for you know login credential checking you know if you start looking like you're
22:52
not doing what you're doing ai is working in the background to kind of go we're
22:55
just going to lock them out that i kind of got in trouble with our CEO a few
22:59
weeks ago because she got locked out because our.
23:02
Kind of you know our automated detection service was
23:06
looking at her profile i think this is just locked her
23:09
out yeah and so she's on the phone why have we locked out what's going
23:12
on well we're not sure what's going on did she call the help desk or did she
23:14
call you oh me straight away oh dear totally every
23:18
time well every time so yeah no straight
23:21
straight through to me but you know that's um that's
23:25
where we're already using ai and we're benefiting from it yeah um but
23:28
yeah the abuse cases go much broader than that um which
23:31
you know again is exciting stuff for people to
23:34
work on that's what they want to be looking at yeah there's some amazing ai use cases
23:37
out there and i'm i'm i'm glad you've pinpointed you
23:41
know four or five there and become focused on because you know
23:43
over the over the last 18 months people talk
23:47
about ai so holistically that actually we need
23:51
to get to the real nuts and bolts of use cases and how they're.
23:54
Going to impact and what kind of case they're going to deliver and benefits
23:57
they're going to deliver um it's interested that you start to
23:59
use a few which is great because they're the ones i've kind of heard about before um
24:03
i wonder who's going to be who's going to
24:05
be the first if there might be a couple already but who's going
24:08
to fully embed ai into the actual infrastructure of of
24:12
their bank and let it kind of have free reign their
24:15
data does that does a day conversation happen i think that's and
24:18
what's your worries around allowing that because there
24:20
are a lot of worries i think there's a really
24:24
good opportunity in that space you know we call it biai tooling um
24:27
and we i want to expand that because it takes
24:31
away a lot of headaches as a technologist if you
24:34
think about you know extract transform load type thinking ai just removes loads
24:39
of that you know we have to connect databases to to data warehouses to visualization
24:44
tooling you just strip all that away it's like i've got two databases they're
24:48
in different data structures yeah get them to talk to one out of there give
24:52
me some learning from the two of them,
24:54
just instruct AI to figure it out and it you know it's it's proving its value in that space so,
25:00
AI with the ability to kind of crawl all over your data and join it up I think,
25:05
loads of opportunity kind of the the holy grail where I want to get to with that is I want a.
25:11
Genuine sort of natural language kind of interface to
25:14
our data assets so you know
25:17
in February 2023 what was the biggest loan
25:20
we did literally to be able to ask yeah you know
25:22
the system and it just spit out the answers without
25:26
um you know any person coming
25:29
to get involved yeah and i don't think for us that's that far away you know
25:34
we can get there no i mean a lot of i mean even fintech os's platform they've
25:37
got its own ai agent now called dex and it's um you know it's very fintech os
25:42
centric but it's i've seen it in action now it's it's you know it's chat gbt for fintechOS.
25:48
All the policies, all the historical data, all the documentation, it's fantastic.
25:55
It helps you build out products and platforms so much quicker.
25:59
But everybody's going to be doing their own version of DEX.
26:03
So it's about feeding the, giving access to those data.
26:07
And you talk about those two data lakes, two databases you've got.
26:10
I think because you're a bit of a perfectionist,
26:14
Enabling your data in the fact that it's actually quality data,
26:17
which I still see a huge problem in the industry where the data is so dirty
26:22
and actually you're just feeding it a load of rubbish.
26:25
To actually enable the fact that you've got two databases, different structures,
26:30
but being able to communicate between them has put you in a really good pathway.
26:35
We're just closing out a project at the moment actually which is,
26:41
its purpose was to make sure we had a single version of truth for all our financial
26:45
reporting data which we called right numbers right now that's what,
26:51
it's for is to make sure that all of our financial reporting isn't relying on
26:55
somebody adjusting a set of spreadsheets at the back end of the.
27:00
Steps and then spitting out the door the system should
27:03
be putting out the right number without any adjustments any corrections
27:06
um because you know i want
27:09
to be able to interrogate it i want to be able to use it i don't
27:12
want um to second guess the numbers across different things
27:14
so yeah we're we're kind of closing out that
27:17
right now will that tool be available for the frontline users as well so they
27:20
can use it uh i know interrogate their own portfolios and drive out some analytics
27:25
and some insights around customer behavior or products or opportunities that
27:30
sits across their portfolio yeah that's that's that's what we want to get out
27:34
of this and if you build it you know you've built it for a,
27:37
an executive tier audience it works for anyone it doesn't have to be limited
27:43
to a kind of a discrete set of users it could be across the board it's it's
27:48
got value it's got opportunity,
27:50
it's there it should it can be available so it doesn't have to be limited um
27:53
it's partially why we're spending a lot of time at the moment thinking about
27:56
you know evaluating the different models evaluating you know the different frameworks
28:00
that kind of sit behind it the agents you know
28:08
we've always got one eye on the cost profile so making sure this thing will scale means.
28:14
Let's do the hard hard work now yeah
28:17
to kind of evaluate all the different options and kind of cost it um
28:21
because as exciting as it is you know it needs to be cost effective well yeah
28:25
i guess it's no different to the transformation to be under i mean again most
28:29
of the value i pilots or mvps um they'll fail for one reason another um but
28:35
again if you get the the use case the business case,
28:38
the efficiency case, and you drive it for a proper revenue-based view, you're.
28:44
A bit like your digital transformation you've been through you're most
28:48
likely going to be set up for success um if you can measure and
28:51
touch it and feel it um and i say there's so
28:53
many use cases out there and uh especially in origination but
28:57
again some of these we're talking about ai tools
29:00
and how they're going to revolutionize the banker's world customer's world
29:02
your world as a as a cto but they're
29:05
also in the hands of you know bad actors to say and
29:08
i i did a little bit of research last night
29:11
and you see um you see
29:14
these people being able to manipulate uh passports driving
29:17
licenses and id and stuff like that and you
29:20
like many other banks probably got a little bit of outsourcing going on
29:23
with a lot of partners that you rely on that are probably
29:26
also going to be attacked this way so even at eid
29:29
and v you've got to stress test your
29:32
partner's resilience as well to make sure they're they're
29:35
passing the test so every time a bank
29:39
comes up with a it's not a new revolution the idmv but
29:41
a new wave journey that is fundamental or a great way it's
29:44
a chink of the armor yeah there's gonna right i'm going for that then uh
29:47
and it's and it's you know with that supply network it's from my perspective
29:52
where we are as a you know maybe more of a smaller business a bigger bank maybe
29:55
slightly differently but you can get caught up in the middle of it as a middleman
29:58
you know they might be going they might the target may actually be that electric
30:02
ID service because they've got loads of different customer bases.
30:06
So it's not just a case of stress testing the service that you're getting from
30:12
them. It's also thinking about the.
30:15
People may be trying to get to them through you because you may be the weak
30:18
point in the connection and they're trying to get across to get a broader access
30:21
point into what they've got.
30:23
And all of that, you know, there's lots of challenge to be kind of worked through
30:28
and understand the kind of the connections and relationships and the, you know,
30:31
the data you're relying on, you're passing to and fro, all that kind of stuff
30:34
because of both sides of it, you know, tax might not be targeted at you,
30:39
but it doesn't mean it's any less impactful on your business yeah give
30:42
us a give us an insight billy as um somebody very
30:45
much front and center this like um give us
30:48
insight of when an attack might happen so you know we're sitting
30:51
here recording this this this podcast you suddenly get a team's note or an email
30:56
through on your on your phone as a it's been an attack or we've just shut down
31:00
what's the process what's the what do you go through to to either shut it down
31:05
or to test your own resilience what is it that your teams have to
31:09
physically have to go to to get to that point where you're safe and secure. Aside from blind panic.
31:14
Yeah, it's time for the fact that you rush out right now and like,
31:17
come back, you're finished recording.
31:18
Screaming in fear. And I guess, you said you get attacked all the time,
31:23
but how often that might happen just for people because I think we all hear
31:27
about these numbers but we don't ever make it real.
31:29
You know, you or maybe your team three o'clock in the morning because it doesn't
31:32
happen at two o'clock in the afternoon.
31:34
It happens when you're going to be the most vulnerable which is usually probably
31:38
when you're asleep. Yeah, I mean, I think, so, I mean, in terms of the cold,
31:41
hard numbers and I try and share them with our board to kind of give them sight.
31:45
So it's somewhere in the region of about 10,000 malicious emails and stuff coming
31:50
at us every month that you kind of filter out.
31:53
Of the things that we see that result in some form of investigation, it's.
31:59
500 to 1000 is that the kind of number where you get to where it's going a little
32:04
bit further there's more going on and it needs a bit more understanding um and
32:08
then you've got to filter out all the false positives of things actually it
32:11
wasn't really bad it was it was this and the other,
32:13
um but the kind i mean the physical steps is
32:16
that you know it's always the um we
32:20
immediately kind of bring up the profile look at the exact kind
32:23
of login details of credentials the access what's going on
32:26
with it um is it have they
32:29
gotten through password is there a password breach if they've gotten through password is
32:32
there an mfa breach yeah if they've gotten through an mfa
32:35
breach where have they gone next what does that look like um you
32:39
know thankfully we haven't gotten past an mfa breach for many
32:42
years now yeah um but it has service purpose then yeah it
32:45
has happened you know they've taken the you know a few years ago they
32:47
piggybacked off an mfa and they managed to breached MFA kind of protocols which
32:51
you know does happen so there's a there's the kind of the immediate event management
32:58
piece of let's understand what we're dealing with and then it goes into containment
33:02
you know if there is something how do we contain what's happened once you contained it.
33:08
Then you kind of look to kind of what's the reporting damage limitation across
33:11
the back of it and then stopping it happening again.
33:15
But the kind of the immediacy piece is, you know, trying to understand the nature
33:20
of what it is because most of the time, and again, touch wood, it's not real.
33:25
And it just looks like there's something going on and it hasn't gone as far as it looks.
33:29
And that's where we've seen it.
33:32
But, you know, the kind of the steps go much like anything,
33:37
things you know just first of all stay calm try and figure out
33:40
what's going on get everybody the right sort of information yeah and
33:43
then deal with the the immediate impact
33:46
and i guess because you know with with the with the platforms that
33:49
you've put in place now and i think probably where i think it was harrods or
33:52
carp i can't remember which one it was now kind of i say get away of it in inverted
33:56
commas is they were able to really isolate that system and effectively shut
34:00
it down before it spread to the rest of the ecosystem that was the harrods one
34:04
is harrods one yeah so the design of the, I guess,
34:08
the infrastructure of a bank to enable the fact that if one particular,
34:13
partner, vendor, system, God forbid, the core, whatever it is,
34:17
did get that, how easy is it to close off the rest of the ecosystem really quickly
34:23
so they can't get hold of it?
34:25
Yeah, I actually gave a bit of thought ahead of us talking because I'd been thinking it through...
34:33
A bit of the evolution of it and where things are going or where they've been
34:36
and you know where we've ended up and we talked
34:39
about earlier the the single platform the unified
34:41
kind of environment yeah so you've done that because that's a
34:44
great experience right yeah but also you've loaded it with a potential
34:48
issue yeah exactly and then you look at it from you know
34:50
a lot of the more traditional legacy banks that are juggling you
34:53
know 5 10 15 cores that
34:56
they've kind of they've never managed to collapse because
34:59
of the cost and the issue i have
35:02
wondered about it like now maybe there's something to be said the argument
35:05
of maybe there's something in isolation and and keeping them
35:08
segregated and rather than consolidate them
35:11
because if you have got lines of business running on very
35:14
discrete platforms you could do exactly that you can keep them
35:17
completely ring fenced keep the security protocols completely
35:20
separate and in the event that you know you lost your mortgage platform
35:23
you're not taking down your savings business yeah um so
35:27
yeah i i did wonder if now maybe there's
35:30
some sense in maybe moving away a bit from the
35:33
unified core which has been you know enterprise utopia for
35:35
yeah yeah everybody wants that one single thing exactly maybe you know
35:39
that you know multi-million and plus
35:42
an investment in consolidation from a
35:45
security perspective there's something to be said for not doing it yeah um because
35:49
you really you know it gives you a completely um hard delineation between your
35:54
systems yeah um you don't have to put any virtual or artificial kind of partitions.
35:59
You can kind of completely segment it so I think.
36:03
There must be a lot of banks looking at that now and thinking,
36:06
let's maybe just keep it the way it is because it's helping us.
36:10
I think in general, I mean, we've probably seen not a lot of people are changing their cause nowadays.
36:17
There may be upgrading, but probably not doing a lot of swap-outs now just because of the cost.
36:22
There's been way too many bad news stories around it.
36:26
But it's interesting because you shut down all your legacy stuff,
36:29
which is fantastic because, again, not a lot of people I've known,
36:33
they end up running it still because contractually they're signing for 5-6 years
36:38
they keep the back work and they are they openly merge over as those products
36:42
run down the new products will be on a new platform but a lot of big big banks,
36:47
multiple cores like 10s 15s but kind of tier 2 alternatives you know 1,
36:54
sometimes 2 mainly because they're stuck with 1.
36:58
Yeah actually maybe there is something to be said about you know running these
37:03
two or having a full bag or being able to have that kind of more secure position.
37:11
And for a FinTech OS that can be quite core agnostic, could actually play quite
37:16
nicely into a USB, actually being able to, as a front end or a middleware,
37:21
it doesn't matter how many cores you have.
37:23
It doesn't matter. Don't have one, I have 10, I have 15, it doesn't really matter.
37:26
Actually, we'll do all that orchestration for it, just,
37:29
concentrate on keep yourself out of jail yeah i mean provided it's
37:33
a you know not it's not a completely legacy yeah you
37:36
know um security gateway into your environment yeah
37:39
if the environments are maintained and up to date
37:41
maybe something said for don't worry about the fact they're on different environments
37:45
you can you know you can unify the data you know for for a data layer and again
37:51
you could abstract that out so it's got its own security kind of wrapped around
37:54
it and it's standard approach that we might see banks adopting yeah so what's
38:03
next for the next three years for
38:05
billy at uh at think at you don't want to do another transformation i'm guessing.
38:11
What's the next thing what's the next big thing ai obviously we've
38:13
touched on if you could roll the dice i don't
38:16
know i mean two three years forward it's yeah so
38:19
i mean ai is a big piece i mean there's there's there's
38:22
some finishing off i want to do you know there are bits of the the digital
38:25
um journey that we haven't completely
38:29
digitized that i want to kind of close out so you know
38:32
from you know point of sale for all the way through to execution and and
38:34
kind of into kind of mainstream servicing is all kind of
38:37
end-to-end digitized now but um we've got
38:40
gaps you know we the the payment gateway isn't isn't completely
38:43
digitized i'd like to go through and make sure we've got that you
38:46
know inbound outbound direct dev and manage all automated all
38:49
kind of integrated so it it's it's
38:53
finishing off the areas of gaps
38:56
we've got that that create um some inefficiencies
38:59
anywhere we rely on a spreadsheet yeah get rid of that yeah and build it into
39:04
an enterprise sort of data repository of which there's a handful not many but
39:08
some yeah um any gaps like that you know create weaknesses for us so um there's
39:13
some areas in that i mean the biggest piece will be really pushing their their
39:17
agenda yeah that that will be,
39:20
that'll be a sexy story that we'll we'll pitch on do you think you'll be a build
39:23
or buy for ai yeah good question um,
39:28
I would have said, if you asked me six months ago, we'd probably,
39:31
we were looking at, and I wrote the AI strategy, we were looking at buying discrete
39:35
AI services for use cases. Yep.
39:39
But having explored and evaluated a few of them, I mean, it comes back to that
39:43
business case type piece.
39:45
If you distill it down to an individual use case, and then you're looking at
39:48
tooling against it, I've kind of come up against it with, right,
39:50
you want me to commit on a three-year license deal, and this is what the cost is.
39:55
And you don't really have a roadmap because you don't know where this is going to go.
39:58
Well for the cost of that i could have two people yeah yeah
40:01
and i know they're not ai but i could literally have two people sat
40:04
on a desk doing this job all the time this doesn't
40:08
stack up yeah so and that's what i always play it back to them it's like i get
40:11
it i understand you've got sunk cost in this thing but i could have people doing
40:16
this and and and you know the job that we're talking about often isn't something
40:20
really really supremely complex so they could cover it um so as a result I kind of,
40:26
I'm now in a position where we are looking at a building,
40:30
not an LLM, you know, but, um.
40:34
You know, AWS has got most of the tools we need to be able to adopt and switch
40:40
between LLMs that we wish building, you know,
40:44
AI tools and agents and services on a, on a unified platform based on individual
40:49
use case needs that, you know, point at different LLMs. Yeah. Great. Yeah.
40:54
I love that, thanks. And then, so it's kind of... It's already in the ecosystem.
40:57
There's already a vendor, I mean, onboarding anybody takes a long time,
41:02
right? I could have said Microsoft.
41:04
I mean, Google, yeah, AWS isn't in their own space there.
41:09
But I think that ability to switch between the language models and,
41:16
you know, it's got monitoring,
41:18
it's got kind of cost tracking, it's got all the things that I'd write in that
41:22
I'd want to have embedded within our AI tooling that I'd go to license,
41:26
well, it's kind of already there.
41:29
So much so that I'm now thinking about it from a perspective of,
41:32
you know, we've got certain resources around the organization whose roles may
41:36
be slightly challenged by AI.
41:39
Rather than thinking of them as, well, let's get rid of those people,
41:42
it's actually do we try to re-architect their role to one that's more an AI
41:48
custodian or in some way... Help build the agents, help manage the agents.
41:52
Yeah. You know, you need people behind these things. So maybe that- You still
41:56
need the intelligence between the artificial.
41:58
Yeah. So maybe let's get those people working over here on this thing rather
42:02
than, oh, well, we've got AI now, so get rid of them.
42:04
Do you see people in the organization seeing it as a threat?
42:09
I do come across it with people on this couch before where, you know, technology-
42:15
has always been, it's an evolution, it's always been a disruptor in the right way.
42:21
But I always hop back to when I started and even the roles you'd have started
42:25
as a banker, I look back at my first role, writing the handwriting envelope,
42:30
sending them out or digging out the checks from the room and comparing them against signatures.
42:35
Now, if ISV, image servicing, if we weren't doing that today,
42:39
crikey, where would we be as an industry?
42:41
But I, as an individual, evolve, you learn new skills, as you start becoming using these tools.
42:47
So I kind of understand the thought process of the threat of I might be unemployed.
42:55
But also in a part of me, I said, I don't really, because that's a part of natural
42:59
evolution is about joining skills and experience and becoming,
43:03
I guess, the custodians of those tools.
43:06
So I can see it both ways, but I'm definitely on the right rather than the left of it.
43:10
I've engaged quite a lot around the business because one of the things I did
43:13
was I went out and I kind of gathered up all the use cases.
43:16
So I went out to all the departments and said, look, this is what you think
43:19
about the AI. What do you think would work in your space?
43:22
And having gathered all the different hundred different use cases or whatever
43:25
it was, and then I basically kind of mashed them together and go,
43:29
look, there's really only 10.
43:30
You're all doing roughly the same thing, but you're calling it something different.
43:35
Nobody in any of those conversations is coming at it from the perspective of,
43:37
I don't want to talk to you because this is a bit scary and I don't know what
43:40
it's going to mean for my job.
43:43
Everybody's looking at it as, oh, it'd be brilliant if it's got rid of that
43:46
because it's crap and I hate doing that.
43:48
People are really, you know... want to embrace it yeah they're
43:52
kind of viewing the the value in which ai can bring um and
43:56
you know the positioning i've kind of always put with it is you know
43:58
we've got really intelligent
44:01
smart people around the business why would we deploy them
44:04
doing some of these jobs when they could actually be doing the work that we
44:08
want them to be doing yeah and that's how people are viewing it as well if i
44:11
gave you a check for one of those 10 business cases i know you you know you
44:15
like to make sure the business case stacks up let's put the business case to
44:18
one side i'm giving you a check for it. It doesn't matter if it doesn't stack up or not.
44:22
One of those 10, what's the best one?
44:25
Or two?
44:30
I think the easiest one that we've got is the one I've described,
44:34
which is extracting kind of fact-based insight from a document.
44:40
So customers send in all documents, PDF, Excel, whatever format,
44:44
doesn't matter, extracts the information you'd need for a lending case.
44:49
I know it compares it to maybe your internal documents,
44:52
your your your customer assessment policies
44:55
your lending policies your metrics and it
44:59
almost starts to pre-write the
45:01
the the actual credit application yeah and that's
45:04
the thing kind of so I think that's the easiest one I think
45:08
if somebody was giving me the money I don't think that's what I do because it's
45:10
a bit dull really now almost which is a bit weird you know AI land yeah I think
45:15
that the one that the one I'd love to do is a natural language kind of AI kind
45:19
of data into extrapolate because I think that's like from a technologist that is really just it's.
45:27
Almost untouchable and when i've talked to people about it around the business they're like,
45:31
oh no that won't work and i don't know i don't know coding
45:34
i don't know no you honestly just ask it
45:37
a question and it will spit it back in the you know like we
45:40
all interact with chat you know you don't think or limit what
45:43
you ask chat gpt or you know or claudering those i'm just
45:46
going to ask it yeah and it will go and find it yeah that
45:50
that of your own data set your.
45:54
Own curated data set with your own business rules and logic
45:56
wrapped around it that it can then understand and be
45:59
able to kind of reflect your your business value and your
46:02
business proposition um i think that's really
46:05
cool and i think that all you know a few years ago
46:08
you would never dreamt of anything like that that would have been tens of
46:12
years of people squirreling away coding stuff yeah
46:15
um i think that's like attainable now
46:18
and i'd love to be able to deliver that well i promise this
46:21
wasn't set up because that's exactly what fintech os are done with
46:24
dex so that's a brilliant way to to to
46:27
finish the pod um you can pay me later but yeah that's true yeah
46:30
yeah it wasn't set up i promise you no billy
46:33
um no thanks for for coming on and appearing and sharing
46:36
insight it's um you know we've known each other for a while now um continued
46:40
um good luck with the thing at thin cats um say
46:43
you are a success story in a world of of failure sometimes so you know honestly
46:50
you've been a you've been a forefront and foundation of that of that for FinCats
46:54
so um congratulations and I'm sure we'll continue uh into the future thank you thanks for time.