AI Security and Governance – with Ryan Jones from Microsoft and Fernando Montenegro

Hey everyone, it's Alan Shimel, founder, CEO here at Techron Group. Really happy to introduce this next session here for you. In, in this, uh, session, we are gonna have a fu terms fu Fernando Montenegro, who is the analyst in the security cyberspace, speaking with Ryan Jones.

Ryan is the partner di uh, partner director of product for Power platform manage platform over at Microsoft. Great conversation with Ryan and Fernando. Uh, Fernando is going to talk to Ryan as we explore how organizations can securely scale agent apps, including power platforms, governance capabilities.

This is gonna include managed environments, adaptive risk models, and lifecycle controls. Hopefully you'll get out of this video practical guidance for balancing innovation with compliance in an age of AI first development. Let's listen in on Fernando and Ryan.

Alan, thank you very much. So, I'm Fernando Montenegro. I am VP of Security research o over at, uh, at Futurum, and I'm thrilled to be here with, uh, Ryan Jones to, to talk about the broader part, the broader topic of, uh, AI governance.

Ryan, wanna say a few words before we get started? Yeah, Thanks so much, Fernando. Uh, my name is Ryan.

I work on a number of the security governance and operational capabilities that we provide, not only to like our AI agents, but also that we provide to our low-code apps and automations that run on the, the power platform as well. Has you come across something more specific to AI risks or AI governance concerns that surface above and beyond the, the, the, the, this data sharing, the, the, the for data flow and, and, and sharing and others? You know, as we look at the maturity of agents, we see that they kind of go from being assistants that are completely directed by humans to still interactive agents where humans are dispatching tasks, but you know, the agent is completing them on behalf of the human.

And then we see kind of those fully autonomous agents. And I would say that that 10 to 20% is really more over on the end of the spectrum with those fully autonomous agents than it is with, you know, like my little assistant agent or something like that. And the types of things that we see at that end of the spectrum are things like, Hey, if I am collaborating with a set of agents, how do I understand what they are doing or what they are doing on my behalf?

The second scenario that we see is we're in the very early innings of, of ai. And so there are lots of cases where agents need help, where they sometimes get stuck. And so some of the things that we've been trying to add into our products and our offerings are things like within power apps, we have the agent feed where a human can see what all the agents are doing for them, and then within copilot studio, the request information action, which actually allows us to define an agent such that it can engage with humans as needed.

So What has been your, uh, your exposure experience? What kind of of considerations do you have in this topic of, of model drift and model security and and so on? Yeah, I think that, I mean, it's funny, we've talked about how like what old, what's old is new again earlier, right?

Like Yep. We've had static tests that we perform against software for, for a long time. And what's interesting is seeing how that is evolving because models are less deterministic than, than, you know, traditional software.

We call it, you know, stochastic life, right? Um, and, and so as a part of that, you know, one of the capabilities that we've added to copilot studio is the ability to add tests and evaluations so that as our technology improves, as makers and builders go through and they modify what tools their agents can use, or what knowledge sources are used to ground those agents, those test cases, those evals can run and can return a result so that folks, as they are evolving, they know whether or not they're actually improving the quality of, of their agents. Because what we find is that the first day that an agent is shipped in an organization, this may sound negative, but that's gonna be the worst that that agent ever is.

Okay. It's only going to get better over time as folks refine the knowledge sources, as folks refine the tools as folks look at and improve the success rate across those evals over time. And so I think that those quality gates that we've had in software for a long time, we have those with AI as well.

Mm-hmm. I think also, you know, a lot of times an individual maker, they're gonna be the folks that are really interested in whether or not that agent really works well or not, while, you know, it is gonna take a bigger picture, look at things, right? They're gonna wanna understand in aggregate how are things looking, are they healthy or not?

And it could be that if they see an agent that's not performing well, but, you know, maybe just you and I use it, it probably doesn't care. But if I have an agent that 20,000 people use this month, it is gonna care. And so those same views that we provide to our makers to understand whether or not their agents are healthy, we provide those aggregated views for the admins as well.

In fact, uh, you know, had a large customer in the energy industry where someone built, um, built an agent and it was for them and they shared it, and it kind of grew and grew and grew. Next thing they knew they had 10,000 people using it, they moved on to work on other things, right? It was able to see and observe, oh my gosh, this agent is critical to our business.

And so they took it over, they added it to their portfolio of applications that they managed. And the thing was, they saw it not as a burden, but rather as an opportunity because there's an application that's out there that delivers value to tens of thousands of people in the business every month. And their dev cost up to that point had been zero.

So it was a win-win for, for everybody. Once the technology security teams build the guardrails, right? Then it then the, the, the, the business users are free to, to go work on those use cases.

So what kind of advice, uh, do you think would, uh, would be applicable to those technology and security teams in terms of getting them ready to build or to, uh, to build those, those guardrails or, or to leverage what they have to, to implement those guardrails? I think enumerating the categories or the dimensions of risk is one of the first steps. There are huge categories of risk that these teams can eliminate through how they define policies.

And to be clear, I don't mean policies like a Word document. I mean policies that are codified in the power platform and copilot studio and these sorts of things. Organizations don't want a random person in their company to build a workflow that takes information from their core ERP system and pushes it to Twitter, right?

We have the controls that allow you to preclude that. What would you consider to be from a governance angle, uh, you mentioned, okay, let's not focus on use cases. What would the advice, uh, for, okay, let, let's move this forward, right?

Where, where are typical things that you'll see people hate? Let's do this. I think the first thing that we see people do is they define like a, a zoned governance framework or a zoned governance approach, right?

They decide within their company or their organization, what does green, what does yellow, what does red look like? Mm-hmm. And then they go through and they define that using the tools that we, that we provide through the power platform and through called Pilot Studio.

I think the second thing that we see folks do is that helps with kind of the supply side, right? That sees to it that the technology is available and accessible for folks mm-hmm. Across the organization.

But then there's this strong demand element. Um, 'cause gosh, I was talking to another, uh, big company in the, the credit processing space a couple weeks ago, and they had this amazing, you know, governance framework set up, but they didn't do anything to stimulate demand, right? And so the next thing that we see is, you know, reaching out to the businesses not to harvest their use cases, but to help them implement their use cases.

You know, things like hackathons, things like training, things where for the people that are interested and excited about transformation through technology, where they can roll up their sleeves and, and get into it, I mean, the number of apps and agents and automations that came out of those couple day training session and hackathons, it blows my mind ev every, every time I have the opportunity to, to participate in, in one of 'em. Um, and it's fascinating because you see the passion of the people in the business. You see their ideas come to life.

And then in many cases, that's the first step of a broader personal transformation and career journey where you have someone that's been in accounts receivable for the last two decades, and all of a sudden they realize, oh my gosh, like I can actually harness AI to completely change how this part of the business works. And what you highlight here is super interesting because one of the things we talk about in the context of platforms is how, uh, you can have that network effect of you've already configured something in your environment for a particular use case, like I said, enterra groups for, for identity and how that can accelerate the, the, the time to value, if you will, within, uh, uh, AI development because hey, you're, you're, you're building on a foundation that, that you already built for your organization. So I think that's a really powerful message, right?

And, and, and it, uh, it, it's something i I tie back to how do we help technology and security teams, uh, build that scaffolding so that those business users can go play with the, the, the, the on on those environments? A thousand percent. And I think that in a lot of, you know, circumstances, it means, you know, standing on the shoulders of giants that came be ahead of us, right?

Like, what, what organization today doesn't have entra deployed in one form or another for user and group management? And so why wouldn't we use those grouping constructs as a foundational capability around which we build our security and governance frameworks, right? Like, it's already there, it already works.

And I think that is one of the things that's a little bit differentiating around the, the offerings that, that we provide in the space because mm-hmm. You know, I build an app, an agent, an automation from day zero, it's on authenticated and authorized, right? Um, you know, another thing that we're seeing that's super common right now is as, as companies are trying to figure out how do they get these AI tools into the hands of people across the organization, and how does that center of excellence or that center of an enablement help people in the various business units upskill and, and drive transformation?

One of the things that we're seeing is that our customers who already had a center of enablement or a center of excellence built out for low-code applications and automations, they're moving much, much faster when it comes to agentic transformation because a lot of the foundational governance concepts that you need to have in place their modality or client agnostic. Um, and, and so that's, you know, I was talking with a financial services customer just yesterday, a big one, one of the G CFIs, and they were like, yeah, we have deployed, you know, this many thousands of agents over the course of the last, you know, month. And we would not have been able to do that if it wasn't for the fact that we already had this governance framework in place from what we've done over the course of the last five years with low code.

I think that one of the areas that, uh, that we want people to be aware of, like, and we, we talk about in our research is that this evolution in models, right? We shouldn't be, just like you said about the use cases, just like the use case conversation. You shouldn't be waiting for the use cases before you get started kind of thing.

We shouldn't be waiting for a perfect model to solve, okay, once we have this model, this is how we're going to do this. No, because these models are evolving, uh, constantly, right? And, uh, if you've, if you architect your AI governance framework, right?

You build in or you leverage the build in the, the monitoring capabilities to observe how a particular model is evolving, how a particular model is behaving. So yes, it, it is a, a critical component like observing how these things are evolving. Well, And and it's interesting because I know that at times we've had discussions with some customers that are like, Hey, how do I control which version of the model is being used by this agent?

And, you know, there are some places where we give customer those controls, but I will say like, I'm kind of hesitant about it because I can't tell you the last time I talked to a customer that was worried about what version of the T net framework or what version of Python I was using to deliver services to them. And so I think it's a little bit interesting that folks are, are looking for that level of control with some of these models. And I think that if we zoom out and ask ourselves, you know, apply the good old five why's to why folks are looking for that, they wanna make sure that as new models are available, it doesn't cause functional regressions in their agents.

And the thing is, like we were talking about earlier, that's quite literally why we have tests and evals, right? And, and that's where, by the way, if for some reason, even though I don't think I've seen it practically speaking in the last year or so, if folks did see a regression as a result of a new model, awesome. At that point, yes, you want the control to, to go back to an older version, but we're not really seeing that in practice that much.

So, Yeah, no, and, and it's, uh, this speaks very, this, this, this talk track of, of multiple tools for your SaaS apps within, within the, the, the business environments is something that, uh, it's a shared pain for security teams as well. Because when we speak with security executives and, and, and, and their teams, they are swiveling between, uh, uh, multiple tools on the environment as well. As a matter of fact, we're we, we, we are working now on a, on a report on security platforms precisely on, uh, on that note.

And, uh, one of the areas that, that, that we are tracking is, uh, uh, AI for security, right? In the context of how do the, the, the, the, the agents that are now being deployed within Sentinel, for example, right? Uh, are, are, are helping with, okay, let's, let's, let's do exactly what you're describing from a local no-code perspective.

I know it's on the power platform, but we're seeing a similar thing on the security platforms as well. And there, and there is tremendous interest in doing that, provided that yes, we've, we've handled the, the, the governance and, and risk constraints around those. So absolutely, this is a, this is a phenomenal time.

The, the, the joke I make is that, uh, like, listen, you can wake up at six o'clock in the morning, go to bed at midnight, and, and this stuff that keeps coming at you with, uh, with opportunities, right? It's a, it's information to collect, it's, it's, uh, information to, to, to parse and opportunities to make improvements. Perhaps you can use agents to help you with that too, as you're thinking about how you're evolving the, the, the power platform.

And what has you been looking to improve in terms of security and governance capabilities on the platform? Where do you see the platform going in terms of one of the things that, uh, and this is more of a higher end use case, but we do see requests for regulatory compliance. Like remember when the internet was new and people started creating, like those blogs that talked about like what they ate for lunch or what their dog did that afternoon because they didn't know what else to do with it.

I kind of, I kind of feel like we're in the same place right now with, with ai, and so I would definitely want to preface anything I say with these are early innings, and so I kind of don't know. Okay. Okay.

At the same time as we look at, you know, the types of regulations that are coming into play with the EU AI Act, you know mm-hmm. Some such examples that we're seeing there are like, Hey, these particular types of data need to be handled in a particular way. And one of the things that we've started doing within copilot Studio is surfacing those data labels, those information protection labels in the response so that folks don't enter, um, inadvertently start working with sensitive data in a way that they don't intend to.

Um, and I foresee that in the fullness of time, this will continue to grow. Like one of the things that, that we're seeing is we have a capability in the platform today called Advisor. Um, an advisor constantly scans over the agents and the apps and the automations to make recommendations in kind of like a reactive governance or reactive security perspective, because we believe strongly in the principle of trust but verify.

And one of the things that we're starting to see with advisor, and the way that it can iterate through, you know, like AI generated app and agent descriptions, is we can actually start to flag when some of these apps or agents may be getting too close to that boundary of what, you know, acceptable use policy within a company looks like. And so there's definitely something interesting going there, But one of the areas that when we speak with security practitioners comes up a lot is they are balancing two very distinct problems. On one hand, they are absolutely swamped.

The other is we need to balance two things on one hand. We want to use as much as possible of the broader tooling we already have the security platform conversation that, that, that, that we are observing, right? That being said, there's still, uh, in many cases, particularly the more novel use cases, there is a need to work with third parties.

What's been your experience navigating this, this, uh, platform and ecosystem, um, uh, scenario in, in the conversations you've had as people have been using your platform? Yeah, I think that what we try to do is we try to start from first and foremost providing, you know, those foundational security primitives that people need to, to be able to leverage these capabilities safely. And that, that has to be native within the platform, right?

Like, if I have to go find an authentication provider or find an authorization service or figure out my auditing and, you know, uh, those sorts of scenario, like that's a non-starter, right? And so we have to provide those capabilities from the get go across power platform and copilot studio. I think the next layer above that is, if I think about the tools that someone in the CISOs organization is using on a daily basis, I'd love to think that they come to the power platform admin center every day, but I know that's not true, right?

They're spending their time in, you know, defender experiences. They're spending their time in Sentinel experiences. And so it's critically important that all of the telemetry, all of the audit logs and these sorts of things naturally flow into those systems because we have to meet those security professionals where they are.

And then I think the, the final thing that we're seeing is there are some unique and novel risks in some cases with ai, right? When we look at things like prompt injection and, you know, kind of the emerging product categories of like XDR for ai, does Microsoft have some solutions in that space with Defender? Yes.

Is it also such a quickly evolving product category that we need to plug into the broader ecosystem? Yes. And so, you know, the same extensibility hooks that we use for integrating with Defender are actually the exact same APIs that we allow partners like Zen to connect to so that they can provide additional defense in depth when it comes to particular risks like, like prompt injection.

Ryan, this was a phenomenal conversation. Thank you so much for the time. Hey, thank you so much for your time and for all the, all the awesome discussion.

And you know, my hope is that folks, as they hear what we discuss today, they, they'll feel confident, they'll feel empowered that they have the capabilities needed to manage that security governance, operational availability risk, and that they'll be able to parlay that into, you know, accelerating how AI is able to transform their business and deliver outcomes for their employees as well as their customers can't wait to see what's next. I think that, uh, as a, as a ponder on, on what we discussed a few things. First and foremost, this notion that you have been building a platform to begin with in terms of local no-code before, and then building the AI capabilities on top of that does give people the, the, the benefit of, of building on what they've already done.

It does give the benefit of tying to the rest of their, uh, uh, of their ecosystem. And it's, uh, it's as much about the, the, the culture of let's try and get started and, and work on different types of, of use cases without trying to boil the ocean. We're going to build a capability that accommodates different use cases, uh, different levels of, of governance requirements, right?

And then we're going to help those teams start to work on those, on those particular scenarios. I, I, I look forward to seeing how the platform evolves and, and, and capabilities. This area never stops.

I, I, one of the taglines I use that there is never a dull day in this industry. And that's the case here.