Techstrong TV Monday, April 13, 2026

First, as I mentioned, our first guest is Vibhuti Sinha, and he's with Saviynt. Saviynt. Saviynt.

They say Saviynt. " Thank you, Alan. Thank you very much, and very good morning to you.

So I'm going to shut this. We're not going to use it. Vibhuti, let's start with a little bit about you.

Bring us up to how you came to be at Saviynt, a little bit of your career path. Alan, I am a professional working only in identity security for the last 23 plus years now. That's all I know.

That's all I do. For the first decade or so, I was busy implementing identity solutions for large corporates, big enterprises. I learned the ropes of why this market and this domain is so specialized.

And then 2012 is when the CEO of Saviynt, Mr. " So that's how my journey started. And from since then, I have been working with Saviynt and doing more on the product side.

And since then, it has been a great ride with what we have been accomplishing at Saviynt. Very good. What's your present position at Saviynt?

I'm the chief product officer with Saviynt, responsible- So you're running product? Yes. Very good.

Look, so you're doing this, you said, since 2012- Mm-hmm ... at Saviynt. Yes.

Another overnight sensation, right? You guys have been at it a while. Of course, a lot has changed, right?

Identity back then was primarily people identity. And we went through the machine identity. Mm.

Now API identities. Now, of course, we're dealing with AI and agentic identities. But regardless of who sits behind the identity or what sits behind the identity, there's commonalities in here in terms of what we try to do with identity-based security, right?

Yeah. Which is, to me, the aspects are understanding the identity of this entity that is trying to access something, and then managing what control they have. Yeah.

Right? And IAM, if you will. Now, since 2012, Vibhuti, how has Saviynt's mission changed, or has it?

So I'll give you a very snapshot of what Saviynt did and how this industry changed. In 2010, Alan, you won't believe, less than 3% of the identity projects worldwide were successful. Mm-hmm.

Let that number sink in, less than 3%. I just said. The reason was that identity implementations were very cumbersome.

It was unheard of upgrading an identity platform which would take usually three to six months. So when 2012, when Sachin called me and said, "I want to offer IGA as a service," it was never done. It was completely charting an unknown territory.

And I said, "Look, I don't know anything about it. " Right. So that's how we started.

Saviynt became the first company on this planet to take a complex problem like IGA and delivering it on cloud. And at that point of time, you rightly mentioned that identity was all about humans. It was more of a compliance checkbox.

It was more of, like, I have to do something to meet my audit requirements. I had a very nice discussion with a famous financial company CTO, and he said, "Look, there is nothing cool about identity. It's like paying taxes.

" And that's what we are doing. But from there on, what happened in 2016, 2017, when the security breaches started getting up more, what we started seeing was identity became the launch pad of leading the breaches. So from compliance, identity became a strong pillar for securing your organizations.

That became a big shift, and that also resulted in Saviynt coming up with a platform which not only looks at IGA, but other parts of identity. So third party identities, privileged identities. Even though we were still talking about humans, but the convergence became the new norm.

And that was the second thing, big innovation, what Saviynt did at that point of time. And then from there on, as the growth of cloud, non-human identities, and now, of course, AI has come, identity is no longer just a security play, it's a business transformation player. And that is the biggest shift, what we are seeing, and that's what we are here, here at RSA, with our latest launch, what we did on securing AI and securing AI agents.

This is the third wave of innovation, what we did at Saviynt. Excellent. You know what?

Without really knowing the whole story, I sort of had that kind of time, or the progression- Mm-hmm ... of how it is. Before we get into the news from RSA, Saviynt, well, people will see the lower thirds on our screen, so they see how it's spelled.

Yeah. But how can they get more information about Saviynt? Many different ways.

One, of course, going onto the Saviynt web app, like web pages, knowing about the company. Our brand marketing team and product marketing team have done enough information about putting Saviynt on social. There are a lot of marketing events, and there are a lot of events happening here at RSASo if you are here at RSA, come meet us.

We have a booth. And then we can share what we launched today as of this morning, as well as what we have been up to. We are also here to meet with a lot of our customers and partners.

So different avenues, different ways in which you can learn and start partnering and collaborating with Saviynt. I love it. What a great thing.

All right. Let's circle back and talk about news here. Today's a very, very big day, Alan.

I'm really excited. I'm really pumped. This is a culmination of all the hard work we have been doing for the last two years.

See, if you think about, as I mentioned, that AI and the identity being the pillar of business transformation, why is that the case? If you look at AI agents, these are your new types of identities which are now being created. Earlier, any company who wishes to secure their human employees or privileged identities, they were looking at a player like Saviynt.

Today, every company on this planet is implementing AI in some form or fashion, which means that every company now needs securing their identities, the new types of identities. And with today's launch, what Saviynt has done is it is addressing three very simple questions. If you have AI in your organization or AI agents in your organization, can you find them?

Because that will alleviate any kind of shadow AI concerns. Second, can you govern them? Which means that do you have a process to onboard, offboard, register these new types of identities?

Because with employees, you have a very structured process of getting them into your HR systems. What are you doing about AI identities? And third, which is the fundamental shift on how agents or AI agents work as compared to other types of identities, is are they doing what they're supposed to do?

Are they accessing the systems where they're supposed to do? This is the fundamental or the biggest shift on this new type of identities because agents act autonomously. You cannot predict what they're going to do at runtime.

You cannot predict what they're going to exactly touch the systems. And that is why enforcing your policies in real-time becomes extremely imperative. So Saviynt's today's launch addresses all these three questions with our platform.

I love it. Now, RSA is, RSAC, excuse me. RSAC is bigger than ever.

Vibhuti, there's so much news, so much of it around AI and agents. I'm hearing, we put out our newsletter. I got feedback from listeners and watchers, readers.

How do we separate the signal from the noise here? Everyone here is making these announcements around securing AI, using AI to secure things, agents, securing agentics. Succinctly, if you want, and you can look right into this camera, why is this one of the things they need to pay attention to, specifically what Saviynt is doing?

Obviously, rising tide lifts all boats. We're all talking about the same thing. Why is this stand out?

Good point, Alan. And it should be a question which every organization should be asking. I believe.

Absolutely. If you look at any solution in the market, everybody's trying to play in their swim lane. As I mentioned, the three questions, the three pillars, every vendor you talk to, they will be addressing one part of that pillar or two parts of the pillar because that's their strength.

When we started working on this two years ago, we realized that if we are going to build a comprehensive solution, we have to address all three, which means one of the pillars was not Saviynt strength, and we had to realize that this is new for us. This is something we have to build from scratch. We stood up new teams.

We stood up new people who had done this before. And the most important part, we did not want to do this in a silo manner. So we identified enterprises who were willing to do a design partnership with us.

So one, the solution, what we launched today addresses all three parts of the equation, which no other vendor has done it. They're all either addressing one third or two third. We are addressing the entire platform.

And we have done with public large enterprises where the solution has been tested. It is running in production, which tells me that this is battle tested. You have proof.

We are not just talking from a marketing standpoint. And we have referenceable customers who can vouch on what we have done. I love it.

Give them the website one more time. com. Thank you.

You know what? That's our first interview. It's a wrap here at Techstrong on...

We're in Moscone West, but at our outlet here on the Broadcast Alley. We're going to be back at the top of the hour with our Techstrong gang live. Vibhuti is going to be one of our gang members today, so it's his first gang.

It should be pretty cool. We're going to have John Swartz and a few other people. Stay tuned for that.

We're going to be live all day. I have a feeling this is just the first agentic AI interview we're going to do today, but we'll be talking more about it. You're watching Techstrong TV live at RSAC.

Hey, everybody. We're here in Amsterdam at the KubeCon + CloudNativeCon Europe Conference, and I'm talking to my friend, Josh Bressers, who's from Anchor. Yeah.

Hey, Mike. Hey, welcome to the show. Thanks, man.

I'm excited to be here. " It was a topic that we kind of used to nod to, but now everybody's seeing these npm packages. There's all kinds of attacks coming through, and suddenly it's all very real.

So what are you hearing from folks about what they're doing about all this? I love the question because we're literally in the middle of a supply chain attack right now against an open source scanner. It's not one of mine, thank goodness.

But this is a really hard problem because we don't know what to do in a lot of instances. So I've been doing this open source thing for 20 plus years. I joke with people that I was doing open source supply chain security before we knew it was called a supply chain.

So it's been a long time. But I think how we handle open source security is, I wish I had an answer that was just run this one scanner, buy this one product, do this one thing. But it's not one thing, right?

Because when we talk about npm, the problems we see in that universe are very different from the problems we're seeing when we talk about Go or Rust or Python. And there's a certain amount of cooperation we get between these groups. Like for example, we're here at KubeCon, you've got Linux Foundation has an OpenSSF, and the OpenSSF has groups, for example, that bring some of these people together where you have the package repositories starting to cooperate and communicate on malware in their infrastructure, on vulnerabilities in the packages and how we find them and how we detect them.

And so quite frankly at this point, if this is something you're concerned about, this is a lame answer, but we kind of have to go back to the fundamentals of security is just understand what you have, scan your existing infrastructure and software for just the easy vulnerabilities. Not even the crazy stuff, just the easy stuff. Because we're bad at that too in many instances.

And so start with the fundamentals and then we can kind of work our way up and start having discussions about how are we going to secure the packages we're using from open source? How do we keep track of the packages we're using from open source? Because one of my favorite examples is if I asked you what is an end of life open source package, what would you tell me?

Maybe one that hasn't had an update from a maintainer in five years. I don't know. Five's a pretty good number.

A lot of people say one or two, but there are many legitimate projects that haven't had updates in five years, and they may not have an update for another decade, not because there's anything wrong, just because they say, "It's good enough. " Right? And so it's hard to figure this out.

There are projects that will mark themselves archived or end of life, but we can't really define this. " The episode came out yesterday on Monday where I talked to Brian Fox from Sonatype about their 2026 supply chain security report, and they do this every year. I talk to Brian every year.

I've known Brian for a million years and I love him to death. And we talked about end of life and the fact that just defining that, it feels like it should be really easy to do, and it's almost undefinable in open source, which is, again, one of the super frustrating problems we have when we try to define the whole open source security universe and what's going on. Mm-hmm.

I know, right? That was a mouthful, but like- No worries. Is it your sense that the adversaries are just getting smarter about how to exploit these issues?

Or have these issues just been around forever and they've now found the time and the tools to go and actually do something about them and when they were too busy doing other things before? So I think there's a couple of pieces at hand. None of this is new.

These are the same problems we've always had as long as I've been doing this thing. But I think it's not that the adversaries got smarter. I think they started paying attention because if you look historically, a lot of the adversaries attacking organizations, backdooring components, taking over infrastructure, there was a heavy focus on a lot of the commercial software, but it's the popular commercial software, right?

It's kind of like the old saying, why'd you rob banks? Because it's where the money is. Opportunistic adversaries are going to go where they can get the most bang for their buck, so to speak.

And so historically, the easy answer was often large commercial entities that had, we'll say, horrible security. But now open source is in everything. The numbers vary anywhere between 70% to 90% of all software is open source, and it doesn't matter which number that is because it's a ridiculous amount, right?

And everything is full of open source. It's all over the place. And so this is a very opportunistic place that these attackers can start looking at to understand, what can I do here?

And in some instances, it's pretty low-hanging fruit. And I'm not faulting open source in any way for this, right? This is one of the challenges the open source maintainers have now is they're being essentially attacked from all angles where you have the bad guys attacking them.

You have community people complaining about what's wrong, or there are bugs, or they're not fixing security fast enough. You've got enterprises using their software demanding features. So it's coming from all over the place, right?

But anyway, back to your question. So I think when we look at most attacks, they're opportunistic, and this is where the money is, so to speak, right now. So it's what they're going to focus on.

But also because it's open source, there often aren't resources, right? And if we look at the data of open source projects the vast majority, I'm talking like 90% plus of open source, actually, it's more like 99% of open source, is one person. Mm-hmm.

They don't have a security team. They don't have any team, right? It's literally them doing the work.

And so I think one of the challenges the industry needs to start figuring out, and this is obviously a good place to have a conversation like this, is what do we need to do to start supporting some of this open source, some of these projects, some of these foundations? There's a lot of work to be done, and it is happening. I'm not going to say it isn't.

And especially in Europe, like we have the Sovereign Tech Agency that's been doing an amazing amount of work. The OpenSSF just got, I think it was $12 million for Alpha Omega. You know, Alpha Omega's been doing amazing work.

I actually have an interview with Michael Wisner about that coming out next week. So I'm very excited about that, and that's really fun, too. Some people would say that relative to the mission, though, those efforts, the dollars involved are a drop in the bucket.

So what do we really need to do to secure all this stuff? Because there are tons and tons of these maintainers out there, not all of which are especially passionate about security. Maybe.

I don't know if I would say that. I struggle with this one, right? " And they'll be, "I don't care.

I hate security. " And that does happen, but I don't think it is common, right? It gets the news because it's interesting, and we laugh at them, and we point fingers, and make a big deal about it.

So, I mentioned I had a podcast. I talk to a lot of open source developers. It's one of my goals is to hunt them out and talk to them and understand what they're talking about, because a lot of people aren't, right?

One of my complaints is that when you talk to a lot of organizations and even some of the foundations, I'll pick on them a little bit, is they'll tell you what open source thinks, and then you go talk to a lot of these developers, and that is not what they're talking about. Mm-hmm. Which is an interesting chasm we have to cross sometimes, right?

But now, your question about funding, is it a drop in the bucket? It absolutely is. But that's okay, too, because we have to start somewhere, right?

This is one of those situations, if we would just dump more money than we knew what to do with on top of open source, it would ruin it. It wouldn't fix it, right? This is like where you hear the stories of people winning the lottery, and they're bankrupt a year later.

So I'm not saying we should stop and say, "Oh, $12 million. Good job, everyone. " But I do think it's a good place to start as we try to understand what can we do with this money, right?

Because how we fund some of this stuff, what we fund, is a challenge. And I'll give you a really good example. So in all my discussions with open source developers, there are open source developers that have, let's say, one or two small projects they work on, right?

And they do it on the weekends, maybe one weekend a quarter at most, because they have lives and families and everything else going on. But when you have one or two small packages, basically, no amount of money is going to get them more time, right? Because they have jobs.

They have families. If I say, "Here's $10,000," that doesn't help them, really. Maybe it'll buy them a vacation, so now they're going to miss one of their quarterly updates.

And the challenge being, these people need, if you want them to work on this, they need it to be their job, right? Where they're making enough money to support themselves, to support their families. But now we go from, "Oh, I'll give you $10,000," we're talking about hundreds of thousands of dollars, or I guess euros, being in the current venue.

Yeah. But you know what I mean? And so that's one of the challenges is there are developers we can easily say, "Here is a living wage.

" But then there's other developers that might have one project. Who's going to pay them a living wage to work on their one project? Do we need maybe a SWAT team that helps those one person teams, and that's their job to go help them handle this particular security update or fix this patch?

Maybe. So that has been tried in the past more than once, and in fact, that's basically what my job at Red Hat was for a long time is I would help coordinate security fixes amongst open source projects. And there are projects you can do that with where they'll maybe accept the help, they want the help.

But sometimes they won't take it because maybe the project they work on is kind of weird and obscure. But one of my favorite examples is I was reporting something to one of the font-- It was one of the TrueType font libraries one time. And I had all these reproducers that would crash the font library.

And I put together a patch, and I wrote it all up, and I went to them, basically said, "Here's what we found. This is what's going on. " Looked at my patch, and they were like, "This patch is terrible.

" Because I thought it was three bugs. It was actually one bug in some function I didn't even know existed. " Right?

Because now they looked at my patch, decided I was an idiot, and then they went and did it right. Do you think in the age of AI, it might be easier to create the patches going forward? Because now we have AI coding tools, so theoretically, they could tell us what we need to fix.

Maybe. I'm very interested in this topic. This is something I've been looking into.

So I think the AI agents give us a couple of almost dichotomies when we look at them. So they're pretty good at writing code, right? But only if you're a developer that knows how to tell them how to write code, right?

Because if you look at someone who gives a bad prompt, you kind of get crap code out. But if you give it a really good prompt, you can get okay code. Now, there are instances where the LLMs are writing patches, and they vary in quality greatly.

How is the long-term quality on that? We don't really know yet. We don't have numbers, so I'm really interested to pay attention to that.

We also have LLMs that can find security vulnerabilities. Finding security vulnerabilities as a human is really hard to do. Mm-hmm.

I can probably count on one hand the people that I'd say are good at it. And so the bar's not very high. And so I would say LLMs today are probably better than the average human at finding security vulnerabilities.

And then we go back to now we have to patch them, and we have to see how the agents are going to do with their patches. And so that might be one of the answers. I'm not willing to say yes or no yet because prove it, I guess, is where I am.

I like to call myself I'm an AI skeptic, where I want to believe, but I'm also not going to make claims that aren't true, because oftentimes that's worse than anything else. But are we also concerned that the adversaries will be using AI to create exploits faster than ever? Because we've been lucky when you think about how long it takes them to do something.

Well, maybe that's going to be now done in a few days, and they'll be launching all kinds of things that we're going to be- Yeah ... " Hours. Not days, hours.

So if you look, there are various graphs in the security world that show time to exploit. Where how many days does it take from the time a security vulnerability is announced until we have an exploit for that security vulnerability. And a couple of years ago, it was 30, 40, 50 days.

It was hundreds of days a decade ago. Now it's literally hours. And without question, part of that is LLMs.

They're really good at writing exploits. " And it does. Well, usually.

Not every time. It depends. The answer's always it depends with this stuff, but it's pretty good.

I'd say it's better than a human. I've written exploits in the past, again, when I was doing my coordination, and it would take me days sometimes to actually get to the point where because you have to craft a JPEG image and then modify it in just the right way, and you test it and then you tweak it, and then you test it, and you tweak it, and it's just back and forth and back and forth. And these things can do that faster than a human can imagine.

So, and yes, adversaries are 100% using this technology. Adversaries, when we think about the defender versus attacker scenario, the defenders always trail attackers just by definition. That's how it works.

I know we like to pretend we can do it some other way, but it's just how it is. A wise man once told me it's a lot easier to throw grenades than catch them. Yes.

Exactly. 100%. Are the folks who write container applications maybe a little too comfortable?

" And they have to go find that container again, and they may have the same code over again, but they'll never find it because it's just moving too fast. What's reality? So I love when people ask me this because so you've got one camp of people are saying you have to move as fast as possible.

Update every 15 minutes. Update it as absolutely fast as you can. " They're calling it a cool down period.

Because, for example, a malicious actor might have inserted a backdoor and let's give the community and researchers time to do their investigation and understand is there malicious code in this update? And let's say after seven days and no one finds anything, we'll assume it's okay. And these are very different problems because you're moving very quickly, and we're telling people not to update.

But I think the reality is, if you look at the vast majority of organizations, and I talk to a lot of organizations, both big and small, most of them are not moving that fast. There are some, but most aren't. And so this is where you get back to the fundamentals I mentioned way back at the beginning of this conversation, where understanding what you have, being able to run some scans against it, understand what are the potentially dangerous spots I have in my infrastructure, and then I can focus my very limited resources on those areas.

" And that's just not most people. Mm-hmm. The open source community is built on trust.

It's at the foundation of the thing. It was like everybody was pulling for everybody and doing the right thing. Are we in danger of losing that?

Because now you've got bad actors who are joining projects and pretending to be people who are legitimate, and they'll work on a project for six months and then insert something nasty. And do we have to kind of just assume now that not everybody is who they say they are, and their intents are not always benevolent? That is one of the things that I talk to a lot of people about, and we don't have a very good answer.

So there's two sides to this problem. What you're talking about is the XZ incident, where we had a rogue maintainer, Jia Tan, that inserted a backdoor into a project, and it is terrifying because you know what keeps me up at night, Mike? Is that there is no way that's the only project that group went after, and we don't know who else they went after.

We might someday, we might not. It's very hard to say, right? Right.

Now, on the other side, there's people who say, "If you don't want to trust open source, what else are you going to do? It's 70% of your application. You're screwed.

You have no choice. " And I think this is something we see where one of my favorites is you'll talk to security vendors, and they'll tell you, "Oh, you can't trust public package repositories. You need to buy our product where we're selling you trusted open source.

" There's all these things. But the reality is, almost everyone is using all of the open source from all the public repositories, and there are people getting whacked every day because they're using untrusted or typo squatted packages or whatever. But if you look at the numbers, it is almost unquestionable that the benefit we're getting from open source, even knowing some of it is malicious and some of it is dangerous, grossly outweighs the potential problems there, right?

It's like we could sit at home in our hermetically sealed houses and never get sick, or we could come to a conference knowing that there is a possibility we're going to get sick, but that's okay, because the benefits we get from things like this vastly outweigh catching a cold or hopefully not worse. " Listen, I wish I could say you could just do this. I wish that in a million years, right?

Obviously, buy my product, that's the answer. But no, in all seriousness, I think the correct thing to do in this instance is the whole point of open source is that community aspect and understanding what's going on. And I'm not saying you have to be involved in every project that you use, because many of us use hundreds or thousands, so that's not realistic.

But I would say find something you care about and try to make it better. It could be one of the dependencies you use. It could be joining a CNCF group.

It could be working with OpenSSF. There are a ton of organizations. There are a ton of projects.

There's lots of projects looking for help. Go find one that needs help and get involved. So I really think the trick to open source is being part of open source, not buying a product or setting a timeout on your cooldowns for upgrades or running a scanner.

It's really about get involved and understand. Be open source. There you go.

Folks, that's the secret to all things. Stay involved. " Yes, 100%.

All right. Absolutely. Thanks for being on the show, my friend.

Thanks, Mike. All right, and we'll be back. Hey, everyone.

We're back here live on our day three coverage from RSAC on Broadcast Alley, which is just a fancy way of saying Moscone West, right near the keynote room. But anyway, this gentleman here, I've had the pleasure of knowing probably longer than either of us want to admit, but it's probably 25 years or something like this. It's Jody Brazil.

Jody, well, Jody is the longtime CEO of Firemon. Actually, passed, then left, came back. That's right.

They pulled him back in, and present Firemon of CEO of... Excuse me, CEO of Firemon. When I first met Jody, truth be told, though, he was the CTO of FishNet- That's right ...

Security, which was very early MSSP, early like 2001, 2002. They were already well-established. And in that story is the genesis of Firemon actually, right?

That's right. And Jody, I don't want to steal your story, though. But first of all, welcome.

It's great to see you. Thank you. Look, our audience is your audience.

They've heard of Firemon, but they may not know the whole backstory. And let's go from there and this is your life, Firemon, and bring us up to what's Firemon today? Yeah, I appreciate that.

The genesis story of Firemon started where I think most of the engineers live today, which is it's a complex problem and mistakes happen. , I get a phone call from one of our customers at FishNet, actually, that they were down, and it was costing them literally millions of dollars a minute because these firewalls were the gateway between billing records, and it was down. And so I get a phone call and said, "Your firewall's down," right?

Of course, it's my fault. The firewall's broken. So I drive into the data center, and it's fine.

It's healthy. The firewall's passing traffic, it's all good, but I start sniffing traffic on both sides, and they're right. The traffic they're worried about is on one side and not making it through the other side.

So it takes me a long time. There's nothing in the log records, and I dig through, and I eventually find somebody on the team had created a rule that was explicitly dropping that traffic with no logging, right? Super simple fix, delete the rule, push the policy, and it's all fixed.

But vowing to never be in that spot again, I wrote some scripts to say, "Just tell me what's going on. " And I could track those changes, and that became the genesis of Firemon. Those little shell scripts a few years later, we said, "This is a market opportunity.

" We built Firemon. So it started out as a simple problem, and the world has gotten more complex. I was going to say it was a simple world then.

Yeah. Though we didn't realize it- Exactly ... but it was a simple world.

And so things have gotten way more complex. And of course, the capabilities of Firemon have grown and progressed through the years. What's changed, I would say, is the world that we're in, the complexity, where it used to be interesting when a customer had five or 10 firewalls.

Today, it'sHundreds or thousands, right? The number of rules used to be tens or hundreds, and now it's thousands of rules. And so the complexity has grown.

But not just the complexity of an individual firewall, the technology has changed. We used to have access control lists and then proxies and then stateful inspection and now next-generation firewalls and even micro-segmentation technologies. Yeah.

Right? So, the world has changed. Our ability to support the cloud, the on-prem, the micro-segmentation technology like Illumio, which we announced a strong partnership there.

What's interesting that I think is sometimes overlooked, but the world we live in, is that it doesn't matter which technology you use, and it doesn't matter how awesome the technology is, if the policy that's enforced on that technology is weak, your security is weak. And it's just gotten more complex, right? So the more complex the policy is, the more complex your environment, the more difficult it is to effectively implement those policies, the more likely it is that you're going to have mistakes in those policies, and the more you need a solution like Firemon to provide that control plane across the network security policy infrastructure.

So I got a question I've been dying to ask you for three or four years already. All right. I'm weird like this.

So this year it's all about agentic AI. Mm. But three years ago, four years ago, zero trust was all the rage.

Sure. Everything was going zero trust. I was driving, I'm such a freak.

I don't know. I'm driving somewhere thinking about zero trust. Yeah.

" Did that make firewall rules harder or easier? Because with zero trust, right, I could start from this base of everything is shut off. Mm.

And then one by one, I'm going to put in a rule here, a rule there. Yeah. But I almost did a reset.

I took everything down to closed and then turned them on one by one. So I took some of the complexity out and at least I didn't have a lot of garbage in my- Sure ... firewall rules.

It was clean. Mm. Or did zero trust make it harder because now I had to discover what came on and do a...

I don't know what's the matter with me. Yeah. How do you view- The practical implications of zero trust?

Yeah. So we are, at Firemon, huge believers in zero trust. It's the right concept, right?

Obviously, yep. And it's even the concept that the firewall vendors themselves started with, right? If you don't put any rules on a firewall, it should start closed, right?

The last rule should be a drop rule and it's closed. The challenge is embracing and adopting zero trust principles is really complex. So imagine if your existing policies allowed access from internal to external.

From a policy management standpoint, that's simple, right? Yeah. One rule, allow it.

But it's wildly insecure, right? " Right. We're all good.

And we know that that's not true. Yeah. First of all, because there are bad actors internally, but also because a system can get compromised.

And so, as you embrace those zero trust principles, you embrace micro-segmentation from a firewall perspective, and you start making very specific rules, which is great from a security perspective, but really difficult from a management perspective. So now what we have is policies that have thousands of rules. You have hundreds or thousands of firewalls, and then if you look at any individual rule, it might have 10 or 100 source objects, and 10 or 100 destination objects, plus all the specific service objects and applications.

From an administrative standpoint, you're trying to manage billions, if not trillions, of access paths, right? Right. You can't keep that in your brain, right?

That doesn't make sense. You can't hold that in your mind. So instead, you have a general sense of maybe what's allowed, but you don't have any real practical sense of what's happening.

So now you've lost control of the ability to manage the technology. So it's not that the technology's bad, it's not that the zero trust principles are bad, it's that our ability to manage it is really difficult. So it's a complicator, not a simplifier.

That's right. And yet, what I love about Illumio, a great technology partner of ours. Illumio's approach to it, I think, is genius.

Brilliant. Which is to say, "Let's not think in terms of an individual asset. That's hard.

" Tags. Right? So think about this machine is tagged web server, and so are these other 50 things, and I'm going to allow access just to web servers.

Well, that makes sense, right? I can logically put that in my brain and make that work. And so instead of thinking about trillions of access paths, I now break it down to something manageable.

And certainly in a POC or in a small sandbox, Illumio is awesome, and you can see the power of the technology. " Instead, we embrace something like Illumio, and it has to live inside of the broader ecosystem. So you have those 200 Fortinet firewalls as an example.

So you allow access in your awesome tag-based policy in Illumio, and inside this one little zone, it works great, but as soon as you have to transit- Right ... in from one data center to another data center or to a cloud, all of a sudden there's the legacy technology that's in place that isn't aligned to that policy. And so once again, it gets back to where I started, which is security is all about managing the policy.

Yep. Doesn't matter how awesome the technology is. If the policy isn't secure, then your- You're out of luck ...

infrastructure isn't secure. Yeah. And so bridging those two worlds has become a real problem for enterprises trying to embrace micro-segmentation or zero trust.

So bringing zero trust to the enterprise requires that we somehow bridge that gap between the legacy technology and these new principles. Let's talk about legacy technology to new technology. I got to assume AI- Mm ...

must make it easier to manage my policies. Yeah. Write new policies, go through, look at the policies I have, and tell me good, bad, indifferent, ugly.

Yeah. Is that something... So did I make the zero trust mistake again, Jody?

I don't think so. The potential for AI is amazing. The implementation can be challenging.

So we see the power of it and have brought AI to policy management through a number of different capabilities. A chatbot that gives you access to all of your policy data. So if you think about a large enterprise, you don't have one Cisco firewall.

No. You probably have 50 Cisco routers and maybe 20 Fortinets. Plus, you're in AWS and Azure, and so AI struggles to understand the complexity of even a single firewall policy, but certainly across that heterogeneous environment, it's really difficult.

So what we bring is the ability to query your entire policy across the entire enterprise through a very simple-to-use chatbot interface. But then beyond that, think about one of our core capabilities is compliance or analysis, assessment of your policies, just as you were talking about. And we evaluated across a broad spectrum of capabilities and a number of different KPIs that we bring to our users.

So think total number of rules, total number of objects, how many unused rules, how many rules represent high risk or critical risk in the organization. We collect all that data and present it in a really powerful dashboard of insights. It's a pile of metrics, right?

Each metric has real value in itself. And inside of it, we don't just have the raw data. We show you trend data, are you getting better or worse?

And then we even show benchmarks. So comparatively against peers or others that have Palo Alto or others that have Fortinet, are you better or worse than those benchmarks? And while that's all great, making sense of hundreds of data points is hard.

You know what's really good at that? AI. AI.

Right. " That doesn't just take the raw policy data, but takes Firemon's analysis against that raw data and now makes sense of it to say, "You're doing better than the benchmark as far as number of critical risk rules for a Palo Alto environment, but it's trending in the wrong direction over the last three weeks. " But does it suggest improvement?

It does, right? Here are the rules you need to be taking a look at. Here's the action- That's the power ...

to take. Exactly. Right.

We did Techstrong Gang here earlier today. " Right. "I want to see what actions can we take that- Yeah ...

solves the issue. Let's solve problems instead of just reporting- Yeah ... " And I think it's easy for AI to point out problems.

It is. We used to have this at my executive team. We tried putting in a rule, don't bring up a problem unless you have a suggestion to fix it.

Yeah. And we need that from AI, too, right? I think so.

And this is an interesting point. I had this conversation with somebody on the show floor yesterday about agentic AI and the direction of agentic AI, and the question was, how fast are organizations going to embrace autonomous agentic AI and security? And I have a strong opinion.

Surprise. Yeah. Go ahead.

We started a, and I would encourage your members to come check it out, but we started something called Cyber Confessionals, and it's from the ground floor. From those that are actually practitioners in the world doing the hard job of network security management. And it is the stories that they've run into and what we've learned through those stories, and they're great podcasts.

They're quick listens. They're great stories. Is that while it's really hard and complex to do security, you know what causes the most problems within an organization?

It's not the security. It's when they cause an outage, a disruption, right? So they're doing their job to the- That was always it.

I know. They're doing their job to the best of their ability, and they see a threat, they go block the threat, and nobody cares. But if you go do your job really, really well and accidentally take down the email server, you're fired.

And these are the stories, right? Jody, 25 years ago when I first met you and I was selling VAM, the vulnerability assessment tool. Mm-hmm.

This was the same thing I heard. Why's it take you 180 days to patch? Right.

Because if the CEO doesn't get one email he was supposed to get, we're all done. And it hasn't changed. It hasn't changed.

So I believe in the power of agentic AI and the opportunity, particularly what you described, which is, can you analyze and bring back a suggestion of how to fix it? Right. But I believe, at least in the near term, that the human-in-the-loop approach to agentic AI is probably the path forward in security.

There's just too much fear to allow the agents to go off and police themselves. I don't disagree. Look, again, the lesson I learned, not with VAM, but with our IDS, IPS.

Yeah. Who turned on the blocking? No one turned on the blocking.

Yeah. Right? We don't do that.

Yeah. We got to be really, really comfortable before- Yeah ... we go to autonomous or- That's it ...

even automatic. That's right. That's just the nature of security people.

So I see it. There are some niche use cases where I think autonomous agentic AI has a fit. It's just going to be a long road.

We may be talking about decades before it fully is embraced. But along the way, I think we're going to get some tremendous value in the world of network security policy management from AI. Firemon.

com. That's right. Where is the Confessionals?

Security Confessionals? Yes. Cyber Confessionals.

The podcast. Yes. Cyber Confessionals.

Yep. Excuse me. So you can find that on our website, and you'll see a link.

Yeah, the podcast, it's great stories. They really are great stories. Very cool.

Of course, you're here, but if people are watching this, they're probably not here, so that probably wouldn't do them any good. Where else are you going to be soon? What do we have coming up?

Of course, we'll be at Blockade. It feels like- Yes ... if you're here, you got to venture to the Blockade.

Well, it's a couple months only now. That's right. Yep.

We have a series of user conferences coming up later this year, starting in the UK in June, and then- Oh, very cool ... we'll announce some future dates coming up. But yeah.

Hey, man. Another year. It's good to see you.

You as well. I come to RSA to see my friends. I know.

Honestly, I could do this anywhere, but it's good to see you, Jody. You as well. It's been a minute.

We're live here at RSAC. We'll be back in a minute. You're watching Techstrong TV.

Hey, everyone. It's Alan Shimel, founder, CEO here at Techstrong, and welcome to our continuing series on AI, agentic AI, the future here with the Microsoft team and our Futurum Analyst team, as well as Techstrong. In this next episode, though, we're going to be joined by Mitch Ashley of Futurum, who leads the software development life cycle and building segment at Futurum.

And Mitchell is talking with Brian Good, whose official titles is Corporate Vice President at Agents Marketing. But Brian is really here talking about agent apps and chat, and it's obviously a very hot topic as we move to an agentic AI workflow-based basis. So let's join Mitchell and Brian here with me, and it's great to have them both.

My name is Mitch Ashley, and I'm VP and practice lead of the software lifecycle engineering practice at Futurum Research. And Mitch, my name is Brian Good. I lead the business applications and agents team here at Microsoft.

Let's start here. 2025 is described as kind of an inflection point for AI adoption. What do you think are the most significant changes that you've seen in organizations as they're using AI and agents in their businesses this year?

Well, I absolutely agree. 2025 is really an inflection point, and we'll sometimes describe it as the year that the frontier firm was born. And you might have heard us talk about the frontier firm before.

It's this idea of companies that are putting AI really at the heart of their business, and it's enabling them to do things like reinvent the way they engage with customers, or transform their business processes inside their company, and beyond. And it's really the year these frontier firms are sort of rising up in a time when I think we can learn a lot from these early adopters and understanding how they're deploying AI, how they're being successful, and then figure out how we can take those insights and bring them to our own businesses. That's where you can have outsized impact.

As AI transforms those functions, what do you see as the new patterns of work that's enabled by Copilot and agents as customers start leveraging the technology for productivity or innovation? I'll tell you what. I have studied these frontier firms as they come up, and there's really three patterns that I see across these frontier firms.

The first is really enabling employee productivity. So they give every employee an AI assistant, like Microsoft 365 Copilot, and it helps those employees be more productive. The second pattern that I see is really these frontier firms deploying AI to automate existing business processes.

So for example, they already have a way of handling expense reports, but they can use AI to speed that up and reduce costs, and that certainly results in some benefits to the customer. The third pattern is really where a customer starts from the beginning, let's say from first principles, and they reimagine a function altogether. They'll reimagine what it means to engage with a customer who has an issue with their product, and they'll put agents at the heart of that.

Most companies can only take on one or two of these functional transformation projects at any given time, because it's a big lift. Again, it's reimagining a function from first principles. It's not just taking existing processes and applying AI to them.

How far along do you think most organizations are in their adoption cycle for generative AI? Well, I think we're still in early innings. There's no doubt about that.

Customers are starting to deploy AI in different functions, as we talked about, but certainly they haven't, in most cases, fully realized the transformation that AI can have across their organization. So it's still very early innings, but I'd say we see very promising signs and green shoots of that adoption and success. Again, the key really here is to start function by function.

Think about a particular function. Think about peeling it back to the business processes you need to go focus on. That's where you can have outsized impact.

How do you define agentic business applications, and why are they critical for organizations? Yeah. Well, I do have a vision that the application of old is really transformed with AI, and we call that new type of application the agentic business application.

And the agentic biz app includes the assistant for the human to start to use. It includes pre-built business process agents that basically take the drudgery out of work, and then it's built on a data foundation. And so instead of being limited just to the data that maybe is in the CRM system or the ERP system, it joins that with data from other lines of business systems and even productivity data so that you have a rich set of data that you can build agents on top of, and you can empower your humans to get better decisions from.

And so this idea that brings all those together, the assistant, the agent, the application, I call the agentic biz app, and I think it's a really big idea. Let's talk about why you're optimistic about the future of agentic business applications. I have a lot of optimism here because, number one, I see customers already deploying these applications, and really transforming their business.

So I already see people starting to get great benefit from it. But at a more human level, the thing that gets me excited is if you think about every one of our jobs, there's a lot of stuff that we end up having to do that really isn't adding joy to our lives. Me doing an expense report or filling out a CRM system with an update from a customer call, those aren't the things that make us unique.

Those aren't the things that bring joy. Those aren't really even things that add business value collectively. But if we can delegate those things to AI and agents, I think we'll enable ourselves to actually go do far bigger things and really take our ambition to the next level.

And so I am absolutely excited for what the future holds. Yeah, I'd love to hear about how you see the role of AI agents evolving just over the next few years, especially as organizations start to redesign core business processes, drive outcomes for efficiency. How do you see this taking shape?

Yeah, great question. I would say that we really believe there's a spectrum of agents. There will be very simple agents that someone will use that might just be grounded on a particular knowledge source and help you understand what might happen from that knowledge source.

Then there'll be task-based agents, and then there'll also be more sophisticated, fully autonomous agents as well. And this more autonomous agent is where you can unlock a lot of business value. These are agents that aren't called by a human.

They're just running independently. They're triggered based on different actions, and they can really automate business processes, in some cases from start to finish. So we believe there's this spectrum of agents, and today, I'd say most agentic use cases start with those more simple kind of knowledge agents.

But increasingly, we're seeing customers bring in these task-based agents and autonomous agents, to automate things end to end. How about the C-suite leaders? How should they be thinking about investing in agentic technologies for long-term value?

Well, every C-suite leader I talk to today is already in on AI. Every one of them recognizes that it's a competitive advantage if they can move quickly. And if they don't move quickly, they recognize it could be a disruptive force in their industry.

But let's face it, AI, it's transforming businesses, it's transforming functions. It's going to reshape entire industries. And every C-suite leader I talk to recognizes that and wants on board.

What they're looking for, though, is a partner. They're looking for the tech, of course. They want to make sure they've got the right tech.

But they're also looking for a partner to help them shape this in their business. And that's where Microsoft, I think, comes into play. We're not a large-scale model maker, but we do take the best of the models and bring them into the workplace, so that companies can use them.

We talk about AI being a disruptive technology, probably because it seems that it really can and will affect every part of our work, our lives, et cetera. Certainly, it's affecting how we create software with new concepts like agents and agentic AI. Curious about your thoughts.

Share with us, how does Microsoft view what the transformation is going to be like with AI really having an impact and a big benefit to businesses? Yeah. Many industry pundits will say that this move to AI agents is going to lead to the rise of more consumption-like models or outcome-based pricing.

And I think they're right. That's definitely a direction that I see the world shifting as well. The only thing I would balance that with is that many customers are still most comfortable buying things on a per-user or per-seat basis.

And so, the approach I'm taking is, how do I enable customers to buy offerings that they're comfortable with, and that's typically like a per user or some type of per tenant type of license, while giving them the flexibility to grow and shift into more consumption models as their business changes. And so, we are at an inflection point, just as we said, and I think one of the things that will change is the business model over time. Talk some more about agentic.

We think about agents operating on their own or more autonomously, and why is that an important thing that organizations are looking to move to? Yeah. It really comes down to business priorities.

Every business leader I talk to wants to find ways to grow their top-line revenue, or they're looking for ways to automate things that they're doing so that they can save money or redirect folks to focus on more important activities. And autonomous agents really fit that bill. Imagine in the sales context.

You can have an autonomous agent going through marketing leads and qualifying them before handing them off to a human seller. That's work that wouldn't have gotten done in the past or would've been done by a human seller, and have been relatively low value, not something they really enjoyed about their job. And so an AI agent can do that and add great value to the company, and again, help that company grow on the top line.

Talk about Microsoft, and the offering that you have in the context of an end-to-end toolkit, if you will- Yeah ... for functional transformation. As far as the toolkit goes, we really believe that there's three essential parts to it.

The first is we think every employee should have an AI assistant. In our case, that's Microsoft 365 Copilot. It can be quite transformative.

That next step up is where agents come into the picture, and I describe agents as really being for every business process or workflow in an organization. And we have a toolkit that enables customers to build their own agents. It starts with Copilot Studio, but even extends into our Azure capabilities with our Azure AI Foundry product.

So agents pair very nicely with that Copilot that I described first. And then the final step is where the system of record becomes the system of action. And we'll sometimes call this the agentic business application, where you take a CRM system, and you add agents and an assistant to it to really transform.

Those three are the essential ingredients or building blocks for AI transformation in a frontier firm or any business at this point. That's a great term. Can you share some examples of how Microsoft customers are already seeing measurable impact from adopting agentic business applications?

Yeah. One example I think I can give is Lifetime. They're a great customer of ours, based here in the United States.

They've used us as part of their finance and supply chain operations, and they've deployed agents to basically speed up how they handle and process e-commerce orders. In fact, I think it saved them 95% in terms of their e-commerce order efficiency by deploying AI agents and agentic business applications to solve that problem. So I think that's a great example.

We also have another great example from Europe, a large utility named Eneco, who deployed a multi-language AI agent for their customers to help them scale and address customer questions. It's a pretty cool solution, saves them time, and again, helps them scale up. It's a really exciting time in the world of agents.

You talked about the C-suite and the three phases in this adoption curve as we adopt AI. What kind of recommendations do you have on how to get started, maybe near some of the near-term activities? Well, as I said earlier, I think AI is going to transform every company, every function, every industry, and that opportunity is so vast, sometimes it's hard to know where to get started.

And I've got two bits of advice really there to anybody that is pondering that question. The first thing is, again, start with a function. Pick a function that you want to go after, and then peel it like an onion.

Go look at the next layer, which are the business processes in that function that you can apply a copilot or agents to, to really transform. The other thing, though, is don't get into analysis paralysis. Just pick a business process.

Just go pick a business process to get started with, and as you learn from applying AI to that business process, whatever it is, whatever your thorniest business process is, go apply AI to it. You are going to learn, your organization's going to learn, your culture will adapt, and then it will flow from there. So the opportunity is so vast, don't let that keep you from getting started.

You got to get started, start simple, pick one thing, and go from there. So as we move to an agentic business environment, let's talk about the people. How do you see the role of human creativity, judgment, leadership?

How is that going to evolve? Yeah, well, that's an excellent question. And one of the things that we'll often talk about is how AI in frontier firms is going to transform the way we work.

It's going to change the org chart into more of a work chart. We sometimes talk about frontier firms taking on the Hollywood model, where individuals will swarm around a problem, focus on a problem, and then disband once they've got a solution. And so it's absolutely going to change the way we work with others inside the workplace.

It also, I think, is going to give rise to a new idea that we call an agent boss. And you can imagine, just as a people manager today might take work and delegate it to different humans on their team, resolve conflicts, and manage performance, every one of us in the future is going to do that, but not just with humans, but also with agents. So imagine taking a business problem, breaking it up into pieces, delegating it to agents or agents on your team, resolving conflicts that might come up, applying human judgment.

It's going to be an absolutely transformational moment, and I'm really excited about it. I really believe that there is still a huge opportunity for humans with human ambition to go do great work amplified by AI. Talk a little bit about how you see the difference in the working together between applications, assistants, agents, the different technologies.

Well, that's an excellent question. And we really have this complete toolkit that spans everything from the assistant to the agent to the application. And I think those three things work together in a symbiotic way.

" Or I might use an agent to update a CRM record after I meet with a customer. But I'm still going to want to go to an application, really, that's a purpose-built experience for me if I want a more specialized or fine-tuned experience. So those three things really work together.

Talk a little bit about the industries or maybe the business functions that you expect to see reshaped first by agentic AI transformation. Yeah. There are three or four, I'd say, functions in particular that are, I'd say, ground zero for functional transformation with AI and agents.

Certainly, customer service and customer experience is one that is absolutely being reshaped and, say, a very early adopter of AI, no doubt about it. Another where I'm seeing a lot of early AI adoption is in sales, and it's just because, just as we talked about, there's a big opportunity to use AI to basically increase capacity for that organization to grow top-line revenue. So the business impact there is undeniable.

But I also see it in places like finance and supply chain, where you can use AI to shorten the time it takes from an order to actually being able to ship that order. We're seeing people use AI to improve accounts payable and accounts receivable, so we're seeing some pretty interesting impacts there. Let's talk a little bit more about the frontier firms.

They're not just adopting technology, they're also changing the way they're doing business around AI agents and copilot capabilities. Can you talk about what they're doing to invest and support the short-term ROI that they're looking to get for long-term innovation? The most successful frontier firms are doing actually is taking a functional approach.

And so certainly they'll think about their entire company, but they'll really take an approach that's function by function. They'll think about their sales function as an example, and then they'll peel back the onion a little bit and understand which processes inside their sales department they can automate using AI agents, as an example. They'll look at which things their salespeople need help with, where you could pair up an assistant like Copilot to help them throughout their workday.

And they'll even look at how they can bring agents in to really augment business capacity, maybe to grow top-line revenue or take out costs. But starting function by function has really been the recipe that these frontier firms are using to see success. As an example, in our sales organization, by deploying Copilot and agents, we've been able to improve revenue per seller, in some cases by almost 10% in some organizations.

And if you think about that, giving a seller 10% more capacity is like giving them an additional month in a year without actually having them spend any extra hours through the work week. And so there's some pretty remarkable results. That's just sales.

We've been able to do the same in customer service, in our finance department, in our IT department. Our legal team has been able to reduce costs by 5% by deploying AI and agents within their functions. How do we ensure trust and transparency as agentic systems become more and more autonomous?

Yeah. Well, there's two things that we want to do to help with trust and transparency. The first is we have a rigorous set of principles on responsible AI.

So for any AI that Microsoft deploys, we adhere to an important set of guidelines, and that's really table stakes. So that's the first piece, responsible AI and our focus there. The second thing that I think is important is we now have an opportunity to start to quantify the value and the impact that many agents will have, and we often will call that, in the industry, we'll call that evals or benchmarks.

And increasingly, I think we have an opportunity to help our customers understand how agents are being effective in their workplace using these evals and benchmarks on real-world problems. So, for example, a typical workflow will be a sales leader doing sales research to try to understand how they might want to organize accounts or territories or reshape planning as they think about the year ahead. We recently released a new benchmark that we call the Sales Research Bench, and it shows how agents can actually help sales leaders in that very specific job, and it's quantified.

And so I think you'll start to see more of that. And between following responsible AI standards and then using quantitative measures like evals and benchmarks to understand efficacy, I think we're really on the cusp of helping customers know how they can deploy AI in a safe way for real business results. Well, thank you, Brian, for sharing with us your insights and kind of look into the future, what's happening with agentic business applications.

Thank you very much. It's really amazing the pace at which AI has been adopted and continues to evolve. I think it's very fascinating how Microsoft has approached the market, both from the standpoint of addressing the individual and their productivity, but also thinking about new workflows, new models of business, but doing that with not a set of tools, but a set of capabilities that provide integration with data, process, workflow, and agentic AI.

No one knows for sure what the future holds and what an agentic business might really, really look like. But in situations like today, when we remove constraints of what we can do with technology, thanks to AI, that's where the possibilities are created. Using tools like Copilot, using applications like Dynamics 365.

And we'll see what end users as well as technologists bring to bear in their ideas and how they reshape businesses for today and tomorrow. I don't about you, but I'm super excited about the future that we're creating together, thanks to working with technology companies and with end users like yourself. Hey everyone, this is Alan Shimel.

And Mitch Ashley. And... Rich Mogull.

Rich Mogull. " No doubt. And I go, "You know what?

" But it's a bit of extraordinary times, so I think it's a good time to rekindle these conversations, and I hope this will lead to more conversations. But what are we talking about? We're obviously, like most people in security, talking about the Anthropic Mythos release.

Well, it's not really released, but the red team report that they released around it, and Project Glasswing and everything that's happened there. So, Rich, if you don't mind, I'm going to ask you to kick this off, right? Because, A, you've been pretty prolific writing about it on LinkedIn and such, but also B, you kind of wrote about something like this happening, what was it, seven or more months ago, six months ago, something like that?

I didn't write a ton six months ago. The big thing I pushed out was actually only in February, but I think- Okay ... I did like LinkedIn posts about it.

Well, in AI time, it was six months. Yeah, yeah. Yeah.

We're all living in bullet time now- Yeah ... and everything's the matrix. Mm-hmm.

" You know what? He was completely right in his timeline was there, and I wrote kind of back in February, like, it's very clear this is going to happen. We just weren't sure exactly when or to what degree, and I think now what happened with Mythos is, that's just the slap in the face.

It's like those shows, you just got to sucker punch somebody to wake them up, and I think that's what this is. Yeah. And to be fair, it wasn't just Gadi did write about it, but it was based on research he did with Heather Atkins, right?

From Google. Yeah, over at Google. Yep.

" It was like, you ever watch in the movies how the avalanche makes the snowballs in sort of slow motion? Well, at first it was in kind of slow motion, right? Because here's how I see it, is first we started just producing, and we have been producing a lot more code than we've ever produced before.

And I think that was one of the breaks built into the system. No matter how many engineers and software developers we had, there was a finite amount of code that we produced. Well, all of a sudden, we saw that X amount of code become 4X, 5X.

Well, the next piece of that puzzle, and this is the one that I think where the dam really broke now, is that security research, AppSec, was basically a scanning job, right? Whether we use DAST or SAST or dynamic or software composition analysis, a lot of AppSec was about scanning to find potential vulnerabilities. Well, the AI stuff, just if we 4X, 5X the amount of code we produced, we've, I don't know, 10X, 50X the amount of scanning we could do up until this Mythos announcement.

So we've already seen the Gadi and Heather projections. It was kind of inevitable. " Well, Alan, we've been, for a while now, talking about a lot of these things.

Rich has been writing about it, too. Of a certain number of things come together to happen to enable something that couldn't have happened before. So we've been talking about scanning is dead.

There's not enough people to review output of scanning. Human in the loop has to be redefined. People can't be the central of this process.

Code is the value of code, or producing code has dropped essentially to near zero. It can just be done. And we're approaching that fast.

We're hitting the bottom of that curve. I don't mean to overstate it, but I really do believe that to be true. And so any kind of a system, when you start pulling out constraints and say, "Let this thing run without those governors in it," you talked about the natural breaks of how many people can actually sit around and write code.

Something not only is going to happen, but something is going to be enabled that could never have happened before. And I think that's what we have. We now have those conditions.

I call it perfect storm. I think it's much more than that. I think it's a resetting of all the parameters of a system that we've built security and software and businesses and everything around, that's changed.

That's how big this is. I really truly believe that. Oh, this is, I think, the most impactful thing that will happen in our security careers.

Mm-hmm. And three of us, I'm the young one at only about 26, 27 years in the industry. Oh, you pup, you.

What do we got? Well, no, but, yeah, we've got you maybe by three years or so, right, Rich? Yeah.

I started doing security with managed checkpoint firewalls in 1997 or so. That's when I started, too, '98. Yeah.

And I was like 2000, 2001. Yeah. But collectively, that's 90 years or so worth of security.

But were they quality years? And we've seen a lot- Quality. Some of those years were quality years.

They're so good quality I don't remember them all. But here's the thing, and I'll ask the two of you for your opinion. I've heard people, and honestly not who I would consider security people, but nevertheless smart people say, "Ah, it's not as bad.

It's not going to be as bad as we say. A, it's going to take years for it to wind its way down. B, it's a lot of hype.

" This takes it down to the core. Our whole premise. It's like all of a sudden you change the fundamental laws of physics on us, and now we don't know how things are going to react.

I think the cane to the core, as you know, because you'd already think, oh, core collapse. It was- Mm-hmm ... about this.

I think whatever we want to say or think, whether it's tomorrow, whether Mythos is it or not, there's no obstacle in front. So let's look at what Mythos is, and where it came from, and why- Sure ... it's doing what it's doing.

It's the next evolution of Anthropic's model. Anthropic's been very good with Claude coding, and they built the next version of the model. They trained it very heavily on writing secure code.

Guess what? They didn't set out to build a magical hacking machine. However, if you train something on all the secure ways we build code, of course, it's going to know the insecure ways, and it's going to find all the flaws, and it's going to be able to infer the different pathways and attack sequences that it takes to get through security.

It's just an emergent property. Anybody who's a great developer can easily become a great vulnerability researcher. There's no obstacle.

It's a mindset difference. It's absolutely not a fundamental skills difference. That's what we're facing.

That's what we have here. So if you read the red team report they issued, they found vulnerabilities in every major operating system. I think I just saw a text message from a friend that Apple released stuff without referring, like, "Patch this now.

" And I don't even know if that's true. I just saw a text message flying across my screen here. So fundamentally, where are we?

Where we are is we have to assume that we now have AI capabilities that are capable. " It's going to be- That's three years out. Yeah.

Within the realm of known bug classes and everything else, but it can scan and search to a degree and chain things together to a way that's beyond most mere mortals, and even the very good people who could find that are usually off doing other things. It's going to then, that's in this isolated, controlled space, because you can't just steal the code for Mythos, for Claude, and make it run anywhere. Has to run on their purpose-built infrastructure, their purpose-built neural network.

However, we've seen these capabilities roll downstream very quickly. Open weight models, you can download it, run it on your own Mac today, can do today what the top-level GPT models and Claude models were doing a year ago. So we know it's coming one way or the other, that there's no gate anymore to slow down vulnerability discovery, exploit development, and chaining of exploits in red team operations.

It's all going to be fully automated with these agents. It's the irony of there is no first-mover advantage anymore, or there's no first mover innovator anywhere. The times is collapsing drastically.

So to your point, someone else would be able to do the same thing and better. Yeah. Look, the AI space, you're seeing OpenAI was first mover.

Anthropic actually has more revenue right now- Yeah ... than OpenAI. So the old way of how we looked at those things areOur history too.

But Rich, I want to go back to something you said here, that we're not going to discover maybe new classes of vulnerability, right? Buffer overflows are buffer overflows, and the kinds of things, we'll just discover them in code that we haven't discovered them before because these AIs are really adept, really good at just looking at things maybe in a different way, from a different angle, and doing it. However, is there a finite amount of vulnerabilities in code, or is it infinite?

Because if it's infinite, we're really hosed. I mean, we're done. If it's finite, well, at least no matter how far out that is, it's something for us to shoot for.

You know what I mean? Yeah, it's finite. But here's the problem, the math associated with the problem.

To give you an example, a positive example. Mythos-per Anthropic was able to find a 27-year-old vulnerability in FreeBSD, which is known as being a hard and secure operating system. Yep.

But they couldn't get remote code execution. They found privilege escalation. Like all the internal security mechanisms worked.

It's not that it's infinite. It is bounded. It's just very bit.

And I think the problem we're facing is that for adversaries, attackers, bug hunters, they have these powerful tools that they can point at a bounded problem. So even the way, if you go more into the details about how they do the testing, they would take a big code base and they'd break it down into functional chunks, and then they would actually have different agents hit different chunks and then coordinate between them. What they're doing is they're taking this massive, too big or bigger than the context window space, narrow it down, but then you deploy a fleet of agents to go at all those different chunks.

And Mitch, we've talked, you and I are both doing code development with a lot of these. We're using different agents, different personas, different pieces all running in parallel. That's what they did, and then they synthesized it all together.

The problem we face is that for the adversaries, it is bound. Find a vulnerability in X, and until every vulnerability in X is found, it's going to find vulnerabilities in X. And we know that there's millions of X's out there, all the open source projects, all the commercial code, all the everything else.

So the attackers just need to kind of focus on those, the ones that they want to start with, and find those vulnerabilities. And then once they find them, they then are back to what's the problem space they're dealing with, a bounded target, and then they can take that exploit and then go after a particular target with a bunch of exploits and chain exploits and go through a whole red team operation and burrow deep into the organization. Or they can take that exploit and just use the one thing at a wide scale across the internet until they can find somebody who's vulnerable and then go in there.

That's the math of what they're dealing with. So basically, it's a search problem. It's a bounded search problem.

Find X vulnerabilities in Y. So- We're screwed as defenders. Yeah.

Yeah. So- Go ahead ... on the defender side, we have to defend all potential code from all potential vulnerabilities from all potential attackers for all time.

And so it's a combinatorial complexity problem for us, and the math is just not in our favor. But was the math ever in our favor? No.

No, it wasn't. Mitch? Maybe it wasn't as stacked as it is now.

And I know I'm not saying this from a doomsayer standpoint, but I do think the problem is infinite, right? There is no singularity where we reach where code cannot become vulnerable. There's two, because something is always coming along that's better, right?

There has. I don't think that's going to stop. Now, that said, Rich, I know you've done some thinking around, well, what do we do about something like this?

And maybe we should first comment. Alan, I know you were saying previously some thoughts around the coming together of Glasswing and what these organizations are going to try to do or we think they're going to try to do. How do you respond to this situation, I guess is really where I'm going to.

" No, they actually did something really good, I think, in terms of Anthropic's response. They said, "We can't sit on this. We've got to do something.

We can't play chicken little, but what could we do, and who could we do it with? " And they won't be the only ones, the Ciscos and Palo Alto Networks and Apples and Nvidias, people like that. Well, there's 40.

There's 40 in the- There's now 40. Yeah, exactly. In this initial, not class, but this initial cohort or whatever of- Mm-hmm ...

people who have been given access to this code. You know what was interesting? Were there any government entities in there?

Not in the initial. I don't know that there were any. Rich, did you see any?

Linux Foundation was the only kind of non-corporate. Yeah, I didn't see any that were announced. I think we can assume that some to some degree, particularly because it's an international issue.

And look, the odds are the government has had access to this and probably shot themselves in the foot by going after them. Going after Anthropic as a supply chain risk. Well, that's true, right?

" I'm not going to rehash that whole thing. Yeah. But clearly, I think this had to be-In their not even rear view mirror, in their front windshield view of why they said we cannot let any government or any entity who's going to use this, I don't want to use the word evil, but is going to use this offensively.

Well, I don't think we can assume that our government doesn't have this somewhere, not even their own version. I'm not even going to assume that they don't have access to Mythos right now. And look, bluntly, all right, let's be honest, I'm not personally pleased with the direction our government's going for a while, but nation-states are going to do what they're going to do.

I've always long said this. I've always supported. I'm like, I don't love that the NSA has to do what it does and some of our agencies, but that's the world that we live in.

Yep. And I accept that. So I'm not going to say that I don't want the government ever to have their hands on this or anything else.

I think what they're doing with Glasswing, though, is let's get as much of the big core stuff as we can, knock down all the stuff Mythos could find, and Mythos does appear to be the best tool at this right now. It was built to find vulnerabilities and fix them, just write secure code. Let's let it do its thing.

Let's get everybody involved and fix as much as we can for as long as we can. I do know that there are others applying. I believe that number is probably greater than 40 now.

I don't have inside knowledge, but I know people have been, like, shared requirements that they have to be-- There's security requirements around their access to the system and how they have to handle their security. They have already said they're opening it up to open source projects and maintainers of major projects. Let's knock down as much of that threshold as possible.

Because, Mitch, to what you said, even if there's better magic later, the magic we have for now, we can constrain to some degree. Exactly. I do think it's an absolute s**t show for enterprises because we're so f****d.

Because it's one thing for Apple, or even Cisco's got all sorts of crap going back however many generations, and the other hardware vendors out there. Like for enterprises, especially the large ones, reams and reams and reams of code. I don't think patching is going to-- Because it's all off-the-shelf stuff.

It's custom code. But that's the point. Our whole security business has been built on finding bugs and patching them, finding bugs and fixing them, or until I can fix them, let me kind of wall them off or make them inaccessible until I can fix them.

And whether it's a finite or infinite amount of vulnerabilities that you're going to find, there's going to be a s******d more than we have now, and we have the ability to patch in a given timeframe. And I'll make one other thing. There's probably some mathematics to the amount of people you add to Project Glasswing to the likelihood or propensity that that code finds its way out sooner than we'd like it- The code can't find its way out.

Well- Like, use the model on hosted infrastructure. You could steal probably all the Mythos code, but you still wouldn't be able to run it anywhere you want to run it. There's so much there.

However, stolen token and somebody's quietly pretending, but they have controls. I've got the screen up. Hours ago, I started to fill out to apply to make sure that my account is cleared so I can do security research with it.

They're gatekeeping. They're doing more. That's only going to last for so long.

It's only going to last for so long. I think they're trying to flatten the curve, to use that COVID term again. But Daryl- Well, it isn't just about stealing the code.

It's someone can not steal the code to run it, but steal the code to develop their version of it. Or steal the API keys to- Or steal the keys, yeah, exactly. So there's lots of scenarios about how that could be used and misused, abused, leveraged.

And then the other thing is, there's a reason why we have government, right? And whether you like the government or not, when things get so big, going to the moon, in '68, '69. When things get so big, you want some entity capable of managing this and also who maybe doesn't necessarily have a horse in the race or an ulterior motive, though government has ulterior motives, too.

But I guess what I'm asking is, is Anthropic the right leader to lead-- Well, they obviously developed the tool, but are they the right party to lead this consortium to do this in a way that is, A, secure, B, the fastest, most efficient way possible, because every second's going to count, of doing this, right? Of rolling this out and in essence, building a community around it overnight, at the same time. They're going to have to create some kind of governance structure, sort of like a Linux Foundation does or something.

There's got to be some coordination. I'm not saying- You think there is? I don't know.

I don't know. I don't think so. Well, it certainly could fall apart and that couldn't happen.

It can go either way. One thing we know for sure, it's not going to be the federal government stepping up and say, "We'll lead this effort," and blah, blah, blah, because that's just not the path, the ethos- No, I don't think it is. You know what, Rich?

that they're pursuing. I remember going to a meeting in RSA in 2006 or '07. Jim Reavis was there with Hop and a bunch of other folks.

The CSA came together pretty quickly Yeah, I think the- Ryan Scott ... the problem is these businesses are not going to be willing to give up that level of control. I think they're honestly-- Look, I don't think Microsoft is always doing a great job at security these days, but their response team does a really good job of cross-industry coordination and takedowns, working with national law enforcement agencies.

Anthropic here has already brought in Microsoft and Google. They brought their competitors into the fold as part of this because they understand the implications of this on a- Well, they're also covering their a*s, Rich, to a certain extent. Well, yeah.

Let's be honest about it. This isn't all noble. " They didn't suddenly become altruistic, no.

Right. It's not altruistic. But what alternative is there?

Any organization you'd want to stand up, like us, like CSA or others, they're not going to hand this responsibility over to someone like us with a Linux Foundation or OS. Well, yeah, a foundational model. Yeah, I think they're going- It worked for open source, may not work for this.

I think for now and the speed everything is moving, and these organizations and governance bodies, you know how long those things take to- Yeah ... move in, even CSA. If you look at our origins, I've only been there full time since October, but to get to what CSA today is, is very long.

It's almost 20 years. Yeah. There will be roles for governments in regulation of AI later, because more for social collapse and workforce-related issues than anything else.

But I think for this, doing an industry consortium on their own, pulling everybody in, and you know what? It's their house, it's their tool. And fortunately, appears they're doing the right thing.

Well, trying to anyway. Rich, let's talk about that paper you wrote, I guess- Yeah ... it was back in February.

And it has neutron star kind of flavor to it, where that's really what we're talking about. In a supernova, the core of the star remains, but everything else gets blown away. Yeah.

And a lot of choice, heavy elements and good stuff makes its way into the galaxy. So it's like the baby goes out with the bathwater. There's a lot of destruction in supernova.

Yeah. So the core collapse metaphor, I was looking for a metaphor and looking for something obscure. I've done weird ones, like quantum physics and tidal forces, and for this one, it hit my head.

I felt like there was just something there about a collapse and a rebirth. That's where I started from. And then I looked at the math of core collapse, and what's wild about it is you have fusion in the core, and it goes from hydrogen to helium, through the elements, gets to silicon, which is funny, because I didn't realize it was silicon, was the last element where you can still have fusion, where the force of fusion is able to fight the force of gravity pulling in.

Then when it converts to iron, iron absorbs energy. It doesn't give up energy during fusion. And so you hit a certain amount of iron in the core, and as the rest of the fusions move out into different layers, it collapses in less than a second, and then there's a shockwave, and it blows all the outside of the star out, and that's where supernovas come from.

What's left? It's a neutron star. It's iron.

It's effectively, or a core of iron that's there. I thought that's a great metaphor for what we're facing here. Because as we've gone, it's not a doomsday.

It's an end of time, but it is the end of how we practice security for a long period of time. We've done a good job. We've done nothing wrong.

Our detect, scan, detect, patch cycles, our incident response, threat detection, our responsive aspects of security have been the right thing to do. It allows an organization, the business to move fast, and allows us to do our best to mitigate risk internally. But now we're getting to a point where we can't react faster.

And as much as we'd want to use the automation ourselves, it doesn't matter how fast we can automatically create a patch, because we can't let prod go down. And it can't just apply any patch without prod going down, as has been proven time and time and time again. So what I think is going to happen is going to blow away a lot of crap we have in security that's just-- It has some level of value, but it's not really a core.

It's like, of what really helps, which is getting back down to security boundaries and segmentation and isolation. Those are the things that I think are really going to help us. Even moving into zero trust, I think that stuff's going to make a huge difference.

It's fundamentals we know how to do. And really, because what it does is it forces the attackers, it changes their math. All of a sudden, they have to get through multiple security barriers.

There's not one vulnerability or exploit that's going to slice through everything. So the math for what they have to get through changes and becomes more complex, and that will balance the equations. I think the danger that we face is, let's go back to first principles, which is great.

I think that's absolutely a fantastic thing to do. The things we know to work and build back. But that's the point, is I think we have to build back from first principles.

A, we have to use AI to solve the problem that we created with AI, because it has to happen at machine speed faster than we can do it. On the other hand, I don't think we can put all our eggs in one basket. This is a combination of the moon shot, Apollo 13, and Armageddon all in the same time.

We've got to have multiple paths to figure out how do we avoid the ultimate scenario we want to avoid. And, part of me thinks that if we truly believe the rate of code creation is plummeting down in terms of what it takes to do it. You don't need a mass amount of people.

You and I don't need 20 developers to go write an application or system or whatever we want, do it ourselves. As that races to the bottom in the effort and the sophistication of what you can do, you can make an argument. Some things we should be building a parallel infrastructure on the new way of doing it, so that we're taking advantage of not only what we know as first principles, but we know of how to create secure code, things like that.

So my point being, I'm not saying that's the answer. What I'm saying is, the point is all the things we assume aren't possible, someday they will be possible. And those days, as for some of that, may be very soon.

So let's think out of the box in terms of take some of those constraints away we still think we have. Now, how do we respond? And let's leverage our best minds that way, too.

But Mitch, are you trying to change the engine while the car is on the track still? I think you got to. I don't think you can ride a dead horse if a dead horse is dead.

No. And also to play devil's advocate to what you said, Rich, is the same mathematics that work against us in the amount of code being generated, the amount of scanning or finding vulnerabilities that AI enables, and both of those will be turned against... We'll put up more pickets along the defensive line, but there's going to be more AI that hits those pickets faster as well.

So what we're really playing is almost a delay game, saying, "Look, I'm going to put up as many... I know none of these are perfect. I know none of these are going to stop it permanently.

" But what am I buying time for? Is the cavalry coming, right? Do I hear a bugle in the background and here they come?

Or is it just inevitable? Or- Well, it's homeostasis. " Yeah.

Or what we need to do to continue. And that, to this day, has been one of my favorite phrases. And if we look at this particular situation, if the bad guys destroy the economy, they can't make money anymore.

And the nation-states can't fleece the citizens anymore. Yeah. Or whatever it is that they do.

So there's going to be a homeostasis. And even what OpenAI said, there's going to be a rough transition period, which I think is true. I think it's worse than they're talking about.

Because what they're referring to is, going to what you said, Mitch, where we're generating massive amounts of code, but we're going to be using these AI agents to do the security assessments on that code after we produce it. I would not want to be a code scanning tool right now because these things are going to just pump up- No, those are history. Right.

Yeah. If you look at with the security agents sitting there and checking and validating the code right along that lines as we produce it, and it's the same AIs that are doing the attacking, it's going to balance out. That's for new stuff.

And I think that's what we're seeing right now, and that's I think what the focus of Glasswing is, is let's get to a better baseline. And they can't fix everything and everything, but if we can knock out the major operating systems, open source projects, and security tools, that gives us, as defenders, now we've got some anchors that we can work with to put in our security barriers. But, as I said in going to your infinite, and Mitch you're still on mute, your infinite canvas, that's the enterprise and the large enterprises.

They've got so much floating around in there that- ... it's not going to be new code. So that's where rethinking defensive strategies.

Maybe we'll finally do zero trust for real, which I think could very much help. I think it's a continuous equilibrium that you're reaching. In other words, you're constantly moving to the next equilibrium of what you're capable of doing and preventing and what they're capable of going after.

And it isn't just because you're working hard at it, it's also because the technology is changing fast enough. The agent that does the security assessment or the fixing of whatever we did five minutes ago, tomorrow will be that much better than it is today. So the tools are advancing rapidly, very rapidly.

So are you racing to a point of, okay, there's a point where you can't get any better, or is it still there is an infinite amount of space between here and infinity? And I think that's probably more the answer. But I think a good point that you're making is not everybody can do that, right?

Yeah. No. Mitch's extra screen shop that has- And the security poverty line issue ...

my whole computer can't do that. So, I want to talk about two separate things here because time is short. Number one, the effect on the security industry itself.

We said the rules have changed. The game is changing. All three of us were at RSA, what was it?

Two or three weeks ago now. That floor, I don't know, 600 something vendors or so on that floor. Well, besides all of them saying they do agentic AI, what's the likelihood of half of those companies being around in two- I think 80% go away.

For two reasons. Yeah, for two reasons, I think. I think one, legitimately, we only have so many dollars to spend on security, and it's going to be forced to move towards the things that stop the actual attacks that we are experiencing.

Yep. So, a lot of these complex things and subtle things, and I'm going to buy this for whatever, stuff goes away. The other side of it is, I think the floor to build and maintain some of this tooling is...

Guys, we've all been vendors. How secure was your ship? Oh, infinitely.

Yes. All of those products frequently relied on being in the environment where you could wall them off. Well, no, we were selling an appliance.

So what if we got them from Dell? They were appliances. Yeah.

And it's going to force... Now look, can you do it? Sure.

I'm building my monitor over here, coding something up with Claude, and I have a security agent running alongside my cost agent, my engineer, my architect, my designer. All of those running simultaneously. What's coming out of that is going to be pretty solid from a security standpoint.

You know what? " And there's going to be a lot of people who don't want to do that, Rich. Yeah.

Yeah. Well, they're going to hard knock. Therein lies the issue.

What you're talking about is could we buy enough time to, in essence, recycle our entire code base in the world, and recycle it in a secure fashion so that this doesn't work on it, right? That we don't find good anything. Here's the neutron star scenario, though, where you were talking about earlier, Rich, is probably none of us believe that's possible, right?

So at some point, there is a winnowing of what survives, right? Not every corporation that builds software, whether it's an insurance company or it's Cisco, whatever it is, not every company can survive. And you could even see a sort of a Hunger Games-ish kind of environment of saying, "We are going to pick who the survivors are going to be.

We're sorry, we have to decide. " Or- This is sci-fi scenario ... yes, it is.

And maybe it's a three-body problem. I'm not sure what it is, but it may turn out, and I suspect it will be, that if this is not everybody who crosses the finish line, there will be some casualties along the way, and some of them will be self-inflicted. There's- Because it's not possible for it all to happen that way.

Though I hate to be the dooms guy, but it just doesn't seem realistic to me we're going to get everybody there. It's fine, though. So I was at a dinner with a bunch of younger security professionals, all cloud-focused people last year, and we're sitting at the table and they're debating platform versus product.

And is it all- Oh, God ... going to be the platform, or are you going to get the specialty product? Well, I got a knack for you.

Huh. " Uh-huh. " And I'm like- Yeah, exactly ...

oh, my God, they had no idea- Yeah ... that this was just- No, and that's why people who don't learn history are doomed to repeat it. And you're right.

But this wipes all that crap away. It wipes all that crap away. But let me throw a real out-of-left-field curve ball at you guys.

What about if some organizations say, "You know what? " Mm-hmm. "I'm going to go old school.

" Right? " If this goes the direction we're talking about, that will absolutely happen. There'll be communities- Yeah ...

" Or wherever, in Longmont, or wherever- The anti- ... in the world. The anti-computer folks.

It's going to be Nederland, Mitch. It'll be Nederland. Nederland.

Thank you. Or worse. You dialed it in much better.

I remember going up to Nederland when I had to play some Colorado. That was a dead guy celebration. But I'm serious.

There were some left over folks. This is like "The Stand" or pick whichever sci-fi kind of book or scenario. " Well, if enough people do that, they can start to form economies.

Whether it's just trader economy or whatever it kind of thing is. There are people who have survival kits in their house, ready to walk out if the water and the power go out, and all hell breaks loose on the streets of downtown, whatever city you live in. So, is this going to kick this off?

Don't know yet, but it sure could go that way, I think. Yeah, I don't think so. I think, again, going back to the homeostasis, the equilibrium.

We'll get through this. Because I don't think people want the alternative. We're seeing that in other geopolitical areas right now, where people are starting to realize the consequences of some of these certain decisions.

I hope so, Rich. I don't want to make this about geopolitics, but I hope so, man. Well, I think it matters if, do you have a breakdown that's sufficient?

This is kind of the- Yeah ... zone zero scenario of there's no more power anymore for some long, it's the same time. There's no water anymore.

Something like that that would really be massively disruptive to society. Now you've got a upheaval kind of situation. So you got to believe, Rich, those conversations, Alan, are all about what are we protecting first?

Yes, we need to do multiple things, but there's a Maslow's hierarchy of digital survival- Right ... that we need to go after first, whether it's nuclear, power, water, financial systems, blah, blah, blah. And to your point, it may not be the bad guys that do it.

It could be the models themselves to do it. Not to be too- No, but that's- ... paranoid ...

so that's protecting from a point out. Pick the most critical- Yeah ... things and build out.

Yep. Don't you think that we need to have a government involvement at that level, some public-private partnership to make some regulation, cooperation? Maybe tax dollars have to go into this.

I don't know. We see that in Europe. Yeah.

Europe's doing with the AI Act and with their attempts to manage things. The problem is I think anybody of all political sides would agree that we have a fully dysfunctional here. And the problem is the US is where most- But sometimes- ...

of this comes from ... you need a crisis to, and I hate to, again, be the clutching my pearls. But sometimes you need a crisis, especially in America, you need- I don't think ...

a crisis to bring us together. I don't think it happens unless there's already a major collapse. Look at what's going on with our inability to address climate change, which is a crisis.

And I'm very historically pro-government, and I would agree with you. I think we're not in a place socially for us. And the reason, I don't mean to sound so ethnocentric, US-centric, but this is where most of this technology is coming from.

It's here and it's China, largely. Yep. And they're going to be able to control what they have over there, but it's a very different society.

We're not in a position, I think, to have an effective government response within the near future. And I think all this is going to hit before that happens. Now, if we hit some of these big collapse, even then, we saw even with what we saw with COVID, there's only so long.

So I don't know. That's such speculation. I think what we do know is the bombpocalypse is here.

It's coming. We've got the first alarm bell. Somebody rang the bell.

The British are coming. It's here. What can we do now?

And I'm not going to wait for anybody else to come save me. I'm not going to count on anyone else coming in. I think that's what Anthropic is doing.

They realize, they're like, "Oh my God. " So we've got the xenomorph, and now we've got to figure out how do we best prepare the world for the release of the xenomorph, because someone else is going to steal their own xenomorph. And then we know how that ends.

So that's where we are today, and full credit for what they're attempting to do, and I hope it works. It's not a full solution. They're going to flatten the curve a little bit on some areas, and I think that's great, and that's a start.

For the rest of us, we need to freaking wake up as an industry. We need to do the things we know we can do. We can take concrete actions today that will dramatically prepare us and minimize the impact.

So when every day is zero day, that's where we're heading. Every day is zero day. Okay, that's our starting point.

We're now going from assume breach to every day is zero day. And that's a starting point that we can look at. We can do things.

We can- That's the new zero trust, right? Yeah. And as an industry, we adopted zero trust pretty much through and through.

Up and down stack. And- I want to throw out an idea, just- Go ahead ... and this is not something like the answer is this.

In a really weird, perverse way, maybe it's too late in the day and I'm having too much of what Rich is drinking. In a really weird and perverse way, we have a government response to this, and that's the tech companies. They are a government response- ...

because they have the relationships right- ... at the federal level. " Well, the relationship there is power and money, government.

Power and money of tech companies aligning on those two factors. It's survival for the tech companies, obviously. If there's money at the government level and power at the government level, those things align.

You've got your government. I'm not saying it's the right one or a good one, but in a way, we've got that oligarchy. What you're saying is, Mitchell, public good and good for tech interests are aligned, and therefore you have that alignment.

And you're right. Maybe. There's maybe something to that.

Who knows? Yeah. No, there is.

You're also saying we live in an oligarchy, which I cannot- That's what I'm saying. Exactly. Yes.

I don't think it's public good that aligns. Rich, you don't think we are? I mean, I know we are.

I'm just saying. Let's not go there. Yeah.

Let me come back to the security industryI don't care whether it's Palo, Ford, Cisco, Google, and The Wis, and whatever there is there. None of them are going to do this alone. If we're going to be successful, or semi-successful, as successful as we can be, this is where you need, truly, a security community.

You really do need to put down your shields a little bit to say, "Hey, it's a common good here. " Whether you're working at one of those companies I mentioned, or you're a CISO for a company in Baton Rouge, Louisiana, or New York City, we all have to band together here, because it's going to take that kind of effort. It takes a village- I hear you ...

to burn a witch. But- But here, it's going to take a world. Or a duck.

Yeah. But I think you're right. And you know what?

We have done this before. And, when Dan Kaminsky and the DNS vulnerability, and I still have trouble dealing with that, because he was a good friend before he passed away. And I remember him, he called me.

" That was the phone call. I hadn't talked to him in months. " That was during the bad cycle.

He called you. But that coordinated disclosure, we've seen rival companies come together before around some of these safety and security issues. That was just one example.

There have been others out there. So I think we're seeing that. I hope it just grows.

The problem we'll get into is it does get into politics. I don't mean US geopolitics, like the enterprise politics of who wants to work with who and who gets to be in the club, and people getting jealous- Mm-hmm ... because they're not in the club and they're not big enough to be in the club.

Or every little startup vendor thinks that they're the most important out there and they should be in the club. We're going to be dealing through all that, but I do think at the core, there is a recognition. The smart people...

This is it. That report that I had somebody today in one of my little channels say was just a bunch of marketing. " And does it have marketing aspects to it as well?

Yeah. But I can't refute what's in there. They brought the receipts.

Is that really what- They've got hashing. We've heard this too from people. That the leak of it coming out early with the leak of their code, it's all manipulation.

Guys, we're about out of time. I'm going to ask you one last question, if you don't mind, individually. What are the signposts?

What are the signals we will see that, holy s**t, this is worse than we even thought, or, you know what? It's not going to be so bad. I think we could get in front of it.

What should we be looking for? Rich, I'll let you go first. Mitch, I'll give you the last word with it.

For the, oh God, we're screwed, it's when stuff goes down. I think that's if- But stuff goes down every day, Rich. Well, okay.

So here's what I'm looking at. If this shows up in an open model in six months, and it might, and we haven't gotten our ducks in a row, and we see widespread outages of banks and power plants and schools and hospitals, we're f****d. Then we're f****d.

And then it's going to be... This is a Y2K moment. It is.

Except we don't have years to build up to it, we have months. A dusk. How do we know it's working?

Because that doesn't happen. Because- It's the old security way, right? Nothing happened.

We're doing our job. Yeah. Okay.

Mitch, what about you? " We are solidly in s**t zone territory if that happens. DEF CON Level what?

That's... Yes. You're now at the top level, so hang on.

Strap on, buddy. Yeah. Fair enough.

Rich, Mitch, I'd love to continue this conversation. Let's give it an AI time. We'll give it a week or two.

The world will change. We'll come back and take another look, and we'll replay this. You're right, Alan, because I think every couple weeks, every month...

The whole Anthropic thing, I heard rumors about that. I had some people tell me some stuff, like at RSA, of things that they'd seen and debates going on internally at Anthropic, and that wasn't that long ago. And if I think about three months ago, six months ago.

So I don't know where we're going to be in three or six months. There's a veil in front of us. I don't think we can fully predict.

I think we can see the shape of things. I don't think we're helpless. I think it's very easy to get caught up in the, "This is like a disaster" thing.

People, they vapor lock their brains, because it's just overwhelming. But there's concrete things we can do here. Let's get started, let's do the work, and we'll get through this.

We're going to end it on that note of good news from Rich Mogull. Hey, thanks for watching. Mitch, Rich, thank you.

We'll be back with more, as I said, maybe in a week or two on this, but until then, we're out. Thank you very much. My name is Dennis Nungucin, and I'm excited to tell you a little bit about Lightyear and the telecom operating system that we're building today.

So before we get going, we can kick off with just some quick intros on who you're speaking with here. My name is Dennis Nungucin, and I am the CEO and co-founder of Lightyear. Founded Lightyear with Ryan nearly seven years ago.

Ryan, you quickly want to introduce yourself? Yeah. So co-founder as well, CTO at Lightyear, so I handle all things tech and product, and very excited about just the opportunity and the space and what we're able to build.

So going to have a fun time talking more about that with you here. Absolutely. So before getting into Lightyear, I'll just give one minute on a set of problems that you are all likely very deeply aware of, and it is that telecom is not built around the customer.

So in particular, the telecom vendors who sell you things like your internet connectivity, your wide area networking connectivity, your data centers, your phone systems, they don't build any aspect of their operations to benefit the customer. All of the workflows around telecom, whether it be quoting a new circuit, managing an install, evaluating diversity, negotiating a renewal, ticketing, it's all manual. It's offline.

It requires lots and lots of follow-up labor to get things done. And oftentimes, enterprises are making telecom decisions without objective data in hand because it's not easy to identify what vendors are serviceable at a site, what an ideal price point at a given point in time or at a given location looks like, and how vendors perform in different aspects of the network. And the lack of digitization of all of this stuff makes it difficult to keep track of what's even in your network.

What services do you have running? When do services end? When are your notice dates?

When do I need to get on top of this renewal? Et cetera. A lot of enterprises we speak to, even large, well-known Fortune 100 enterprises, may be operating out of spreadsheets or homegrown systems to do so.

You add all of this up, and we see just a ton of inefficiency when buying and managing telecom, which costs the modern enterprise time and money. And so that's why we've created Lightyear. Lightyear is a software product that we call the telecom operating system or a sort of system of action for telecom.

So our platform digitizes and automates the entire telecom life cycle end-to-end, aiming to set you up for continuous and systematic cost optimization. Underlying the platform are three core products. First is procurement, then our network inventory manager, and expense management.

And all of them seamlessly tie together. They can be used sort of as one individual product or seamlessly together, which is how most of our customers use them. So our procurement software allows you to digitally conduct telecom RFPs and get services installed, and it's driven by proprietary network intelligence, pricing intelligence, and AI-powered automation, so you can get the best pricing and most exhaustive results every single time for the set of services that you want to buy, while also having a very streamlined procurement process.

Our network inventory manager is a digital system of record for all of your telecom services, allowing you to track all of the various details of what's in your network, eliminating the need for spreadsheets, and it automates a bunch of different actions that go into life cycle management, like placing tickets on your services or re-shopping a service prior to renewal. Our expense management offering is basically the first AI-native telecom expense management platform, and it handles all of the pain of telecom invoicing and payments, including invoice receipt, cost allocation, variance analysis, custom reporting, and bill payment on your behalf in whatever form you'd like. And you add all of this up, enterprises who leverage Lightyear see over 70% time savings and 20% cost savings on their telecom vendor management, while they're also set up for continuous savings all the time, benefiting from the most fulsome carrier network and price data set in the industry.

And it's worth noting, this is a software product and system through and through, but we also offer dedicated white glove support and representation throughout to all of the enterprises that work with us, so it's not just sort of a clicking to buy if that makes sense. You can also work with us consultatively through every aspect of your telecom life cycle. So let's dig in a little bit further into each one of these products and their specific features and benefits.

And, we're going to go through a product demo in a bit that'll edify this far, far further. But our three core products, once again, are designed to power your telecom life cycle from start to finish. So first, our procurement platform digitizes the telecom service procurement process from RFP through to install.

You can digitally create a telecom RFP, conduct exhaustive vendor searches powered by our proprietary network intelligence and pricing dataAnd then manage your service installations digitally via our install project manager. And throughout the process, during procurement, you can leverage network engineering design support from our solutions engineering team if you'd like. For example, let's say you need to evaluate KMZ routes, augment routes for diversity, or meet various engineering specifications you may have.

And then in the install process, we have an implementation team that oversees all installs ongoing and makes sure that things are going to timeline, throwing red flags and utilizing proprietary escalation paths to get things done if things are not going to time. And you can use this to manage procurement and install for one site or 10 sites or 100 sites or even 1,000 sites at a time. And you can imagine how a system like this can make that process exponentially more efficient the more that you're managing.

Post-install, Lightyear's Network Inventory Manager acts as that digital system of record for your network inventory. It'll track over 30 unique data points for each telecom service that goes into your network, including your contract details, your service SLAs, your static IP information, your LAN and WAN configuration, vendor contacts, et cetera, end-to-end, all in one place. It'll also automate a bunch of life cycle management workflows, such as ticketing for MACDs, re-shopping services prior to renewal, things of that nature.

And you can also utilize our API to keep all of your network information up to date or push and pull information to and from other enterprise systems such as ServiceNow, Meraki, et cetera. Finally, our expense management offering provides AI native support for telecom invoicing and bill payment, digitizing invoices for you, offering granular reporting, capturing variances and bill issues automatically, and handling payments on your behalf in whatever form that you'd like with one simply monthly consolidated bill, if you prefer, so that you never see a service outage due to non-payment, a late fee, or services that may be misbilling and never get caught. So all three of these services are effectively managed services.

So think of them as like a managed software offering with our team available to provide you with white glove support end to end. Once again, in procurement, we can help you with network engineering and design and white glove implementation, project management, even KMZ review, route augmentation. In network inventory and expense management, we'll provide you a white glove onboarding process to make sure that your network data is onboarded properly and accurately and dedicated support resourcing throughout the entirety of your experience working with Lightyear.

It's worth noting that procurement is actually free to use. ai and sign up for an account right now if you wanted and go bid for a service. We're able to monetize on that service via a commission that would otherwise go to the service provider sales rep selling you the services that you'd otherwise go about buying, so it doesn't increase the cost for service.

And network inventory manager and expense management are SaaS subscriptions. Effectively, you'll get a SaaS offering, in addition to white glove support to onboard all of your network. So Tony Mattke here.

This sounds like it's a differing offering than traditional telecom agents, right? I think everyone here has probably used an agent to manage your circuits that gets paid using those same commissions. Obviously, you guys are going above and beyond that with your expense management.

But what about the providers that don't have the back end to deal with an automated service like this? So local fiber providers, local wireless telecoms, things like that. Yeah.

So that's a great point. Part of our monetization, to your point, is similar to what you'd see from a telecom agent, but I do want to differentiate just the offering here and who it's for and what it can do. So to your point, the expense management offering is quite differentiated, but also I denote the procurement and inventory management is extremely differentiated.

If you work with the average telecom agent, they're quite oriented toward an SMB or mid-market customer because they're typically one or a few people working manually to process quotes, manage installs, and help you out with things related to your telecom. But they're not really built for enterprise scale because of the lack of systems. Our procurement offering, we can manage systematic quoting driven by proprietary network intelligence for hundreds of sites at a time globally with over 1,000 provider integrations.

We can also handle lots of really complex network engineering tasks built for really Fortune 100 or Fortune 500, where we have a number of referenceable customers that might be difficult for the average telecom agent. The average telecom agent will be incentivized, given the commission structure, to keep services billing and hope that you forget about them so that their commissions keep rolling. But the couple things to note are, one, we will sell you providers that don't actually offer any commission to us.

So that's one very important differentiation point from what you'd see in the typical telecom agent model and-Two, we've built an entire provider-facing backend to automate and standardize provider processes to handle some of the notes in your question, in particular, where it's like, oh, what about smaller, more regional providers? We work with tons of smaller and more regional providers, as well as all the global providers, where on the really big providers, we have dedicated and proprietary support resourcing, given the amount of volume we're driving. We can drive a better price or a better overall experience given some of the scale we're working with, and we can access a lot of smaller providers that otherwise might be difficult to access from a telecom agent.

Does that help answer the question? Somewhat. To be blunt, I've had telecom agents manage, as a single person running a telecom agency, and we're just one customer managing 1,300, 1,400 circuits for us, doing an amazing job of doing it.

So I'm kind of confused when you say that your procurement side is much more efficient. That's fair, and I don't want to say that no telecom agent has ever done that before. I would just denote, like in managing 1,300 to 1,400 circuits, given we're doing that for a number of customers today, there are just many aspects that go into that process that would be better done by a computer or software tool than a human.

And that's where we've been able to drive a lot of value for customers. In fact, most of the customers that we work with at that scale have evaluated but not utilized telecom agents because of inability to manage their network due to scale issues. But there are some very good ones out there, for sure.

I have a quick question just on the life cycle aspect of this. I think you're talking like a greenfield life cycle management. What if a customer is migrating to your platform?

Are they forced to purchase new circuits that get delivered, then they're fully in your platform, or can you brownfield circuits that are existing with that they already have? That adds a lot of work too, to just migrate to your platform. Yeah.

So migration is for sure unattractive if it results in having to buy a whole new network, and we understand that. So all of the customers we interact with have an existing network of some sorts, and sometimes they want to make changes, sometimes they don't. Our network inventory manager onboarding involves just gathering all of the data that goes into your existing network as it is today and building out a holistic system of record for what exists.

So we don't push any network changes unless you want to make network changes. Okay. Yeah, follow-up on that.

Scott Robon. How much do you overlap with source of truth systems for automations and automation platforms? Do you also put IP address management under network inventory manager?

What does that overlap look like? NetBox, Autobot- Yeah ... OpsMill.

We integrate with NetBox, and we have a number of customers that utilize us alongside a NetBox. Okay. And the important distinction there is the set of data that we deal in is not easily discoverable, like your telecom contract details, your WAN vendor details, your prices, in some cases, certain IP addresses, things of that nature.

So we will build that record for you and make it easy to pull into a tool like a NetBox and also keep it up to date as your network changes. For example, if you disconnect a circuit, you add a circuit, things of that nature, and that's the value prop that people who may utilize a tool like a NetBox as a source of truth would see benefit from Lightyear. The other thing is, in a NetBox, you can log these details partially manually if you would like, but let's just say you have a network issue, and you want to change out your telecom vendor or denote a billing issue or an SLA breach.

You have to do that on your own. We would go and do that for you via the platform. Does that make sense?

Yep. Okay. What do your target customers look like size-wise, or what kind of range are your ICP covering?

So we work with companies of all sizes. Today, we have about 400 enterprise customers, including a bunch of companies you would have heard of, like Okta, Palo Alto Networks, Mattel, Pegna, Five Guys, and there are also a number actually in the Fortune 100 that for confidentiality I can't list on this slide that are bigger than all the companies on here. We also work with a lot of mid-market and what I'd call the higher end of SMB- Mm-hmm ...

that maybe you wouldn't have heard of but are dealing with smaller scale networks than some of the companies on here or some of the companies that I noted. So I'd say basically, so long as you're a notch above SMB, you would see value from this platform, but primarily mid-market enterprise and above. You had me at Five Guys, so thank you.

So, Ben Story here. Curious, do you do anything with managed services providers where they are dealing with the smaller guys, but maybe they're dealing with 200 smaller guys. Is that part of your business model?

Yeah. We do have a few customers that basically are scaled consolidations of small businesses or forms of MSP, so long as there's a fit in the offering. Awesome.

Thank you for all the questions, and in respect of time, I'll also keep going on here so I don't lose track of the presentation. But keep them coming. So-Hopefully all of the previous discussion was helpful to understand sort of what the offering is.

And now let's visualize your hypothetical telecom life cycle as it would work within Lightyear's closed system, where when quoting in your replacement service, you can use Lightyear to conduct a digital RFP that'll use network and pricing intelligence to ensure you get the best provider set and pricing every single time. Implementations will be project managed by Lightyear to take the pain of dealing with carriers off of your hands. Post-install, all of your service details on your new service will be maintained in Lightyear's network inventory manager.

You'll have fingertip access to all the pertinent network details in case you need to deal with a configuration change, outage, MAC D ticket, that sort of thing. Prior to renewal, we will automatically re-shop your services or renegotiate existing pricing to see if better pricing is available. If you utilize us for expense management as well, each month we'll handle invoice receipt and auditing for you, automatically capture variances, catalog all your expenses, make sure you know what's taxes and fees versus contracted, et cetera, handle billing disputes as they arise, and potentially handling payments for you with one monthly bill.

Finally, via our API, you'll be able to integrate Lightyear's data across all of your core systems. For example, a NetBox, a ServiceNow, et cetera. And with this new system in place, you'll no longer need to utilize a manual process or system to track your telecom data, and you can stay on top of telecom costs on an automated basis.

Dennis, quick question for you. Jason Gennert. When it comes to cloud expenses, whether it's AWS, GCP, Azure, Megaport, et cetera, do you guys, from a telecom expense management perspective, do you do anything with those today as far as integrating those platforms?

We don't do cloud expenses today. That's a little bit out of our scope given there is tooling exist today that's sort of purpose-built for cloud expenses that is quite good. So we try to stay within the realm of telecom.

However, if where telecom and cloud begins to intersect, we do support, for example, Megaport or Network as a Service. That very much falls into some form of the wireline realm, so we support that. Also, if you're getting direct cloud connectivity, for example, like a wireline connection to an Azure AWS on-ramp, that sort of thing, we support that as well.

Okay, cool. One other question real quick while I have you. On the diversity question, I see that you guys have the fiber maps, so you can see physical diversity.

Do you have anything that would cover logical diversity of, say, autonomous systems and things like that? And do you have that today? And if not, is that something you're considering or might be on the roadmap?

We can validate, for example... Well, so when you use the term diversity, there are sort of infinite levels of diversity that you- Right ... can dig into if you so choose.

So yes, we can't tell exactly. So, beyond just physical path diversity, we can validate points of entry, we can validate gear at the site, we can validate locations of gear at the site. However, depending on how deep you want to go, we'll actually need to just coordinate with vendors and gather data and automate that process for you.

Okay. It's not like we have a magical sort of eye into every single nook and cranny of a physical facility, if that makes sense. Sure.

And I'm more thinking of it, like logical diversity of autonomous systems. So say you get two different service providers and they're both upstream somewhere. There's one AS that if there's a problem, then both of them go down.

This is something that I encountered a lot with SD-WAN designs, looking at that in advance to make sure that there's no interdependencies on the two service providers upstream. But just saying that that would probably be a useful tool for somebody, something to consider maybe. Because that data's out there.

You can mine it from BGP tools or other looking glasses where you can see that stuff, pull it in, and see if those providers are interdependent. So, something to consider. We have a couple of what I'd call more network-centric customers that are effectively building backbone networks.

That diligence items like this in the context of their diversity, it's not as common in the just typical enterprise use case. And we're able to, via our solutions engineering team, evaluate things like this, but it's just more of a consultative type project. Okay, cool.

Thank you. I've got a question for you too, Dennis. Bruno Aulmann here.

So far it seems like we've talked about wired connectivity. Do you manage wireless connectivity as well, whether it's through WISP or cellular networks for network connectivity, things like that? Yep.

We do all forms of wireless. So that means like LTE, 5G, WISPs, sort of like wireless point-to-point type thing, satellite. So we do all of that.

Okay. Excellent. Thanks.

So again, as noted, over 400 enterprise customers across the sort of size and industry spectrum as well, seeing value from Lightyear. And- Can we go back to the wireless for a moment? I just thought of- Sure.

If you're doing some things with that, do you manage MVNO type things for people? If- Well, it depends. So if you're using it as sort of like an MVNO as a wireless connectivity option- I'm thinking the other way around.

I was wondering if you did any work to allow some of your customers to partake in, say, an MVNO that you worked with all the time or that you ran. Oh, no. So again, whether your network project involves routine connectivity sourcing for individual sites as they come up or a full network transformation project, basically our software process and team can help you get to a better outcome.

So, in the context of these questions, we've talked about all sorts of projects, but routine single-site connectivity sourcing, regardless of your setup, we can do large bulk multi-site connectivity, very strategically leveraging data and software to make the process significantly more efficient. We can do full network transformations like an MPLS to SD-WAN and underlay or SD-WAN vendor change and underlay change, or very engineered mission-critical network procurement, sort of in the lane of the types of diversity like that Jason was just asking about. And finally, with Lightyear, you'll benefit from digitization and automation of the full telecom life cycle.

You'll leverage the best proprietary data set in telecom around network and pricing intelligence. You'll get fulsome installation project management and escalations. You'll have a self-updating system of record for enterprise networks to automate life cycle management, keep all your enterprise systems up to date, and you get easy EPA integration into core enterprise systems.

And I will hand it over to Ryan just to give a minute or two on some exciting product updates. Yeah. So 2026 should be a pretty exciting year for us.

On one end, Dennis had kind of walked through some of the pillars of our platform in procurement, inventory, and expense management. We're looking to add another pillar on there to really complete the life cycle in circuit monitoring, which will allow us to get a better understanding of what is actually happening with your network. How much capacity are you potentially using?

How can you use all that data to kind of shape and take actionable insights on where you should change or modify your network or things like that. So we're really excited to get that pillar introduced to really have the fulsome vision that we've been trying to build out for the past few years, which will be really exciting. On top of that, I'm sure everyone here has experienced the AI evolution that's happened.

In our minds, there's a lot that we can do with our current platform to really elevate what was possible with the new AI advances. And so we're looking at that from a handful of angles. First is starting from the user level.

You can kind of imagine basically the ability to speak naturally with all of your data on your network, right? Understand and find data that you might not have been able to find before, extract unique insights out of that, build out charts, all these kind of things where maybe platforms in the past weren't able to necessarily show you exactly what you wanted or be able to find what you need out of it. We're trying to move from just ask the question to point out and give the answer across that.

So that'll be extremely helpful. Then you look at the kind of systems level here, and there's a lot that we've really expanded our vision on- Ryan, just one second. Dennis, could you re-share those slides for us, please?

The presentation was done. I was pulling up the demo for the next session, if that's all right. Oh, okay.

Just wanted to double-check if you'll go ahead and pull up that demo. Keep going, Ryan. Cool.

Sorry about that. Nope. All good.

So then the second level is what can we do now that wasn't possible before with AI on the operation side, the procurements, the installations? How can we improve what was possible there? And so we're building out a lot of automations and workflows that really enhance just always-on coverage there, having updates coming in twenty-four seven, making sure that on top of the pipelines that we've already built and the human touch that we have, we're able to add that next level of intelligence as well to make sure that your network is working for you rather than you having to necessarily take those actions.

And then the last piece is then looking at the overall level is how can you utilize intelligence to really enhance what's possible for enterprises and move towards software that's actually soft, right? We have done a great job of being able to automate and build out these flows for customers, but everyone has their own unique needs, right? There's different sizes of companies, they have different networks, they have different needs, and we're building a layer on there that allows them to really tap into our existing flows and customize it in all points of those process, whether it's what quotes you're selecting or what your implementation looks like and what happens in those stages.

And then on top of that, just making everything interconnected with the way that people want to work and communicate today, whether that's through their own agents, through APIs, all those kind of things. So we're really trying to enhance the offering that we have today and make it integrated into the level of what customers might expect in the future and move Lightyear to basically being a system of action for enterprise telecom. And so that's what we're really excited and pushing on.

We've got a lot of stuff kind of in the works right now that we're going to be releasing very soon, and we're really interested to see the impact it's able to provide on how people really look at, evaluate, and build out their networks. So, Ben Story here. Question on going back to the very beginning of what you were talking about with the new product that you're looking at for circuit monitoring.

Are you planning on pulling that information from the providers, or are you going to be doing some sort of on-premises collector of some sort to do SNMP data or some other means? Yeah, we're still trying to evaluate exactly what the solution is going to look like there, with the goal being how can we facilitate all of our other products, right? There's other products out here that are very deeply integrated, both in hardware and software layers.

We want to make sure we can extract the information necessary to make the other parts of our platform really valuable. And so basically the levels we need to get there to just understand, like uptime, downtime, capacity, all those kind of things. Yeah.

Because what's concerning from my perspective is the telecoms, half the time, don't know that their circuit's down until I start calling them. So if we're relying on their monitoring, that's worthless. Yeah, exactly.

No, it would likely be some sort of software tie-in to IPs or something like that. And ideally, we'd want to do that on as low of a integration level as possible, but there may be deeper things we have to do there, depending on what that ends up looking like. Thanks.