Techstrong TV February 24, 2026

Hey, everyone. Welcome back here to Text Trunk tv. You know, I haven't had the pleasure of, of having this gentleman on.

It's kind to be a couple years, I bet already. Uh, Bart Giordano, Bart is the president over at Ruckus Networks. We're happy to have him back.

Hey, Bart, how are you man? I'm Doing really great, Alan. It has been too long.

So thanks very much for inviting us back into this forum. Uh, you know what? Don't make it like it's my fault you couldn't come back anytime.

Just drop a note and say, Hey, I got something to talk about. Mm-hmm. You bet.

But thank you. Thank you for coming. Um, Bart, as I mentioned, you're the president over at Ruckus.

We're going to get into Ruckus in a second, but before we do, give folks a sense kind of, of how you wound up to be president here, what your career path has been like. Well, thanks Alan. And, and again, thanks for having us onto Techstrong.

So, um, I've built a career here in Silicon Valley over the last, gosh, I hate to say 25 years now. I get it. Yeah, Exactly.

Uh, I actually started off, uh, as a, as a software engineer and as my, my career evolved in that realm, and I started interfacing more with, with product managers and others, um, I got really curious about the front end of of businesses. Um, I, I started off writing software at Cisco and transitioned to, uh, the semiconductor industry, which is where I really caught my teeth in, in wireless. Um, and, you know, ultimately joined Ruckus to lead their business development organization.

That was almost 11 years ago now. And Wow. Uh, throughout my career at Ruckus, I've had the opportunity to lead sales, uh, run product management, uh, and I've been general managing the business for about four years now, and it's the best job I ever had.

Good for you, man. Good for you. Bart.

Did you ever think hardware would be as sexy as it is again? Well, you know, I think the reality is, hardware's a very important part of the story, but what's happened is companies have evolved to full stack solutions. So we sell a lot of hardware.

What makes the hardware really fantastic and what helps us deliver solutions that really solve customer challenges is the hardware, the firmware running on that hardware, the applications in the cloud to manage really complex environments, and now incorporating artificial intelligence into that in order to automate a lot of network management. So it's the full stack that comes together to, to solve business problems for our customers that we call purpose-driven networking at Ruckus Networks. Very cool.

I I think there's a point there that Bears kind of sharpening up a bit, which is you could have the greatest hardware, you could have the greatest semis, you could have the greatest chassis platform, whatever. If you don't have the software stack optimized for it, it just doesn't comp no pun, it just doesn't compute. Right.

It just doesn't work. Yeah. And, and that software stack, you know, depending vendor to vendor to vendor, there's always an element of kind of, let's call it in-house Yeah.

Software, right? Yeah. And, and oftentimes that in-house software, a lot of the hardware vendors are open sourcing to get it into the hands of as many people as possible.

And then there's the ecosystem that develops around it, right? And that, and that's really what separates a lot of the, the haves from the have nots, right? How big that ecosystem, how deep it is.

Yeah. Philosophy at Ruckus has always been around openness, right? Yeah.

So we believe a, like, to your point, a lot of the value in the solutions we bring are going to be derived by the APIs at the, the top of our stack that will allow us to fit into our customer's existing workflows and infrastructure environment, and enable third parties to bring their own value based on the telemetry we can give them out of the network. And, you know, our philosophy really is, if you're gonna add a feature, write the API first. Um, yeah.

We are a very API driven, uh, organization, and we want you to be able to get the full functionality out of that full stack, uh, from our, from our APIs. Great. You know what, Bart, I realize we jumped right into it here.

We didn't even kinda give Ruckus a proper introduction. I'm assuming a lot of people out here have heard of Ruckus, are very familiar with Ruckus even, but I'm sure there's a lot of people who aren't. Certainly.

Why don't we, why don't we get everyone on an even footing here? Bart, give us kind of the ruckus story, if you will. Yeah.

So Ruckus is a 20 plus year old company now. We celebrated our incorporation, uh, after two decades in June of 2000 and, and 24, you know, we started as a, a wifi business, uh, an enterprise wifi solution that solved a very unique problem, um, of distributing high definition video around a home. Um, before that was a use case that we all took for granted.

Mm-hmm. Obviously, our business has, has evolved considerably. We are, uh, a full fledged enterprise networking portfolio today.

Um, both enterprise wifi campus switching, and then, as I mentioned, an entire software stacked on top of that that's now AI driven. That is solving some of the toughest challenges in enterprise networking. Uh, we tend to be very focused on vertical market segments where we think our value proposition resonates, where, where the problems are the toughest, that's sort of where we really shine.

So you think of places that, um, struggle with extreme user density, um, stadiums or arenas or airports or, um, you know, networks that have very dynamic physical environments, a factory or a warehouse where things are moving around, uh, quite frequently, and you can't make assumptions on the day you install that network of what it's gonna look like tomorrow. Um, and so you have to have an adaptive resilient system that's able to perform under those dynamic and, and demanding conditions. And that, that's where Ruckus really thrives.

We serve anything from, um, a smart home, uh, to a higher education campus, to a university, um, to some of the, you know, uh, largest venues in in, in the world. Um, we do a lot in municipal municipalities where they're deploying wifi, for example, on the streets of, of New York City. So really challenging environments.

Um, that's where you wanna select Ruckus. That's where our, our platforms tend to shine. Excellent.

Excellent. You know, look, I, you're, you can say it because you work there, but I can, you know, for me, and this is going back before I started, you know, uh, tech Strong, I was, what, 12 years ago? This goes back to when I was at Still Secure and some another, you know, another startup that I had found.

It really the way the kind of the wifi in the office kind of shook out for us was you could play with a lot of these solutions that, let's face it, they're really home solutions that you're using in an office. And I'm not naming names, and it's not that they're bad, you know, today's meshes and wifi sevens and all that. We've come a long way from back in the day.

Yeah. But if you wanted to get an industrial wifi solution right. That is gonna be reliable, you know, and people aren't gonna be wasting their time, you know, rea reattaching, reattaching reattaching renewing and, and all the other stuff, rockets became kind of the gold standard for, for office grade, enterprise class wifi.

Yeah. And that even if you were in a hotel sometime, you know, any kind of commercial setting, it, it really became, Yeah. I appreciate you calling that out.

I think, um, ruckus was really born out of serving largely guest facing public wifi networks, which have a very, uh, discrete problem to solve, maybe from even a traditional co carpeted office or corporate environment, you know, in a corporate environment. Um, typically you're dealing with, with very symmetrical RF space, um, not a large density of users. Right.

Particularly today. Yeah. Right.

You, you don't get everybody coming in the office, no office. Yep. And you have an IT organization that is actually controlling the devices that come on that network.

Um, and your users tend to be fairly sophisticated, you know, compare that with a hotel or out on a city street, um, or in a classroom where you can't make any assumptions about the sophistication of your users. You're dealing with a very dynamic environment. You're going to see every possible conceivable device, uh, ever made with wifi connectivity come onto that network.

So you can't make any assumptions about the, the nature of the devices. You're gonna see. Some of them might be, Well, the nature of the use is 20 years old.

Yes, Exactly. 'cause some of those people are just devious and they just wanna figure out how to get around the, the policies or whatever, right. Devious or, or, or not technically sophisticated.

Um, And they just need, well, and that's the other str Yeah. They very technically devious people or innocent, you know, newbies. Yeah.

It runs the gamut, I guess. And It just, and it just has to work. So Ruckus was really designed for that case where the environment is extremely dynamic.

Um, you're dealing with a large diversity of, of users periods of extreme high density, and you need to bring carrier grade and, and enterprise class reliability. Um, and so when you solve for that, almost everything else seemed simple by, by comparison. Absolutely.

Look, I remembered in the early days of wifi, and you know, I traveled most of my life, right? Like, you, we, we've all, um, it was 50 50 in a lot of hotels, right? You know, whether what, what they would tell you, oh, you're in this room.

Well, the WAP for that's really down far. We may have to transfer you to another wap. It wouldn't automatically move you from wa.

Thank God for companies like Ruckus who kind of made that painless. That's really how we made a nameless for ourself because, um, I mean, you, you take it for granted today, but if you go to a hotel property with your family, and I experience this, and your kids are complaining the entire week about how they can't get on the network and sort of ruining the vacation, and now your wife's a little bit upset that the the kids aren't happy, you're probably not going back to that property. And more than likely you'll go on to TripAdvisor or one of these other, um, platforms and, and complain about it, right?

Which is the death now for a hotel property and the general manager there who's measured on guest satisfaction and, and loyalty. And when we started off in the hospitality space, we were actually able to correlate the installation of a Ruckus network with a market increase in the guest satisfaction at, at that property. So I think you've hit on something that's real deal right there that we've all, all experienced before.

Yep. Hey, Bart, I I wanna jump into the topic of discussion today, but before we do, people who wanna find out more about Ruckus, maybe there's some hotel operators out there right now and saying, my God, where have you been? I need this.

How, how do they, how do they get on onto the ruckus, sort of on-ramp here, if you will? Yeah. Ver very simple.

com. com is a great place to start. Excellent.

All right. If it's okay with you, Bard, I want to kind of pivot a little bit and talk about, you guys recently announced your, you're a pro A-V-I-C-X switch portfolio with AV enhanced update to management platforms. Look, those are, you know, that's some technical jargon we threw out there, but what's it mean?

So, um, you know, when I, when I was growing up, I was always tinkering with electronics, and I was the one that would set up the VCR for the family and get the TVs connected and figure out how the, all the remotes work. And back in those days, um, there were, and, and subsequently many different standards applied to connecting AV equipment. You had RCA Jacks, um, for connecting video equipment, and you had these stereo jacks for connecting, uh, audio equipment.

Um, and then that evolved to standard like HDMI, and you would end up with like 50 different cables coming out of the back of your TV depending on what you were trying to, to connect. And if you had to do that over long distances, it became pretty challenging. Uh, more recently what's happened is, uh, a lot of those standards have converged onto running over traditional IP networks.

And so there's this, this convergence happening in the audio video industry where they want to take advantage of the fact that every building, every facility, every venue has an IP network today. 'cause they're providing connectivity for lots of different services. So as that convergence is playing out, um, you know, you have traditional a AV folks, um, who are maybe not as familiar with, uh, IP protocols and, and networking standards that are now thrust into this world of running, um, you know, high definition video and very low latency audio over a traditional IP infrastructure.

And so our goal with the introduction of the ICX Pro AV line is to really dramatically simplify running these traditional AV protocols over the, the corporate network. And so what we've done is we've configured kind of an out of the box experience, uh, plug and play, if you will, so that if you wanna run foreign eight k video, um, over an IP network and you wanna run really high, um, quality audio, you can do that without really intimate knowledge of, of networking itself. And that really is the, uh, advancement that we've made in our, our pro AV line is enabling AV professionals to leverage IP networking to move very low latency and very low jitter, uh, audio visual protocols over these networks.

Look, I'm a bit of a power user. I admit it. You know, my name's Alan, and I'm a power user.

My home has over a hundred IP addresses. Like, I, I'm gonna wind up using a a c class myself pretty soon, But, You know, because I've, I've got 20 something, so I think I got 27 Sonos devices, right? So I actually have a sub network of just Sonos running underneath my SSI, you know, my regular wifi network, right?

And then I, I ethernet into my TVs, but well, I actually ethernet into my streaming devices usually. And then HDMI from the streaming devices to the TVs. 'cause I use a lot of Apple TV and all that stuff.

I, I'm not your typical home user, let's put it at that. And I have eight K TVs, I have 4K TVs, and I'm, you know, and Dolby Atmos and any, any kind of new, you know, things out there. I, I live this life, right?

I, I, and it's, I'm almost my own campus in my own house. But it's so important because the last thing you want is to have all of that great of equipment and you got a fuzzy picture, right, right in the middle of the Super Bowl. That's just not acceptable.

Right. And, you know, and whether we're talking about it at my house or I'm talking about it at a restaurant or, or a, a corporate gathering, today's audience has very low tolerance for fuzzy pictures, buffering, you know, beach balls, bad sound, that sounds like robotics or something like a robot talking and e even on planes, right? I mean, I can't stream on the plane.

What are you good? Is this 1998? You know?

And so I would imagine this is something that customers are demanding, right? The market market's demanding. Yeah.

And to solve that problem that you just described, um, what historically happened is you would build a bespoke, almost air gapped AV network to run all that traffic over because you're very concerned that all my other traffic may disrupt it. And you'll get the buffering, or you'll get the, the dropouts, which again, people have no tolerance for if in a public setting, they can put you in a very embarrassing situation if you're trying to produce an event. And, you know, our goal is that you should be able to run all of this traffic over, um, one network, whether that be your, your standard corporate traffic or your AV traffic.

And the network itself is smart enough and in an automated way can identify the AV traffic and prioritize it to ensure a very high quality of service, even if you have bursts of traffic coming from your other, your sources. So, um, we want to simplify the network design. Uh, we wanna provide a very consistent, um, and, uh, out of the box experience when you're deploying this and allow those networks to converge, which ultimately saves customers time and, and money when they're deploying and operating this infrastructure.

You just described us here at Tech Trunk. Uh, you know, we were talking before we got on that, I'm in my tech trunk studio today, and we, we actually have three different sets, right? Where we could be shooting concurrently and then we're streaming, you know, streaming up into the neck, bringing stuff down, and, and that's exactly what we, you know, we have a QOS and we, and by the way, we have three different bandwidth providers coming in here, right.

All fiber, because we can't afford to be down. We need that kinda redundancy. And that's exactly our challenge, right?

Having A-A-A-Q-O-S sorta router or switch, if you will, that brings in all three of these bandwidth providers divvy up our, or, or prioritizes our traffic based on, you know, our, uh, wishes and, and normalizes all of this, right? And oh, and by the way, we need wifi for everyone sitting at their desk. That's right.

Right. Just good old wifi. And, um, it's not easy and it's not getting easier because I think the lesson, and you've probably seen this in your years at Ruckus, we're never going to use less balance.

We're never gonna want less speed. We're never going to transmit less information. You know, I remember when I thought my 30 megabit hard drive was more than I'd ever need.

Right? Right. And the, the mindset and the mindset now, and, and, and we take it for granted to the extent now the, we perceive this as a utility, right?

The reliability is the same as the power of the water. It just always has to work. And by the way, you ask Me, well, that's the expectation.

If You ask me to give up one of those, I'm gonna give up the hot water before I give up the wifi. Definitely a few of my engineers here qualify with that. I'm pretty sure.

But yes, you're right. But it is, I mean, it, the today's consumer, and I don't mean it as a consumer like CI mean, consumer of bandwidth, let's call it. Right?

Right. Whether they're in an enterprise or at home, their demands and expectations are, you know, sky high. I, I wanted it to work.

It's like the old macro added, you know, I just want it to work. I don't care what you're doing. I want it to work all The time.

And there's, uh, I think, um, you know, being in this industry and, and running this business, I have a deep appreciation for the complexity underneath all of that to make it work. Um, yeah. And, you know, we've got really incredible and talented engineers that, that, um, work tirelessly to ensure that at the end of the day, um, the customer can take it for granted, and they can perceive this as a utility, regardless of whether you're passively browsing over the wifi or you're transmitting your eight K video over a, a, a network.

Uh, it's gotta work under any conditions. Um, what that enterprise grade quality and liability. Absolutely.

com and look up more information about this new switch portfolio with the AV enhancements. That's right. You know, I think one of the things that, um, maybe caught us a little bit by surprise when we were, uh, developing these advancements is not only were the, the capabilities in terms of the, the protocols themselves really important, but also the aesthetics of the solution.

Right? Oftentimes, these are going into a home, and if you open, open a typical wiring closet in, uh, an office, you know, you see wires coming out of the spaghetti front of these panels and patch panels in a home, they don't wanna see any of that, right? So we actually had to physically put the, uh, switch ports on the back, so you just see a nice, clean flush, uh, panel.

com. Let us quick, one other area I wanted to hit on, BARR. I know we're running low on time, but you guys also recently, uh, announced a strategic relationship with Crestron, one of the biggest Yeah.

Uh, you know, communications solutions providers in the world, and you joined the, uh, S-D-V-O-E Alliance. Certainly Put 'em together for me so people know what we're talking about. Yeah, I think, you know, in the realm of a av uh, home AV solutions, smart home solutions, building management solutions, Crestron really stands out among the leaders.

And so ensuring that we are interoperable, uh, with our pro AV solutions out of the box with Crestron was very important. And in partnering, uh, and joining the S-D-E-V-O-E Alliance, we have access to all of these protocols and, and the way to measure and test, um, the fact that we are compliant and, and interoperable, um, is really important there. So, um, these two partnerships are, are ones that are core and fundamental to our success in, in this space, and we're really proud to be part of these organizations and their programs.

Fantastic. Um, what is the S-D-V-O-E alliance? What's S-D-V-O-E stand for for people who are not familiar, Um, video over something, something video over ethernet?

Um, yes. At the end of the day, there are very unique sets of protocols that have been devised in order to transmit, you know, a high definition video and, and, uh, audio over a traditional IP network. And so the S-D-V-O-E Alliance defines a standard by which you can do that.

And if you adhere to that standard, you're gonna be able to provide that very high quality of service, even for, um, low latency or latency sensitive and jitter sensitive traffic. Like, like video and audio. Absolutely.

I'll just close it with this. You know, we, we recently in our, the, the Homeowners Association where I live recently went through a thing to adopt a, a new, uh, bandwidth provider. And a lot of this stuff came out, you know, we, they came in to talk to us, and the idea is, you know, sure, you might use 5G wireless today, and it works for on your standard or HD definition, and you don't really do much.

But with AI and, and everything that's coming down our pike, even in the home or, and some en vs working from home using video teleconferencing and stuff, you can't afford to be, you know, running on, I mean, running, running on, you know, a cable where you're getting 40 megs up tops, you know, and maybe even a gig down, but 40 meg up tops, it's just not gonna cut it in three years or five years. Yeah. You need, you need a big boy, and I don't mean it in a bad way, but you need, you need a pro solution that, that, you know, is gonna enjoy all these new great things that we have available to us, But simple to deploy and manage.

And I think that's, well, that We're ultimately Our philosophy. Take all the complex, absolutely take all the complexity in the underlying solution, but make it very simple to adopt in a plug and play fashion. That really was our design approach with this latest pro ev line of switches.

I love it. Bart, we gotta run. We, we went way over time, but it was great catching up with you.

Don't stay away so long. Come back and keep us posted. We'll be back.

Thanks so much for the time, Alan. We'll talk soon. My pleasure.

Bargi Orano, president Ruckus Networks here on Techstrong tv. We're gonna take a break. We'll be back.

Hey everyone, it's Alan Hummel from Techstrong. Welcome to our next session in our dynamic series of conversations between the select thought leaders at Microsoft, as well as the, some of the analysts from the FU group. In this session, we have Tiffany Tracy, VP of product management for the power platform at Microsoft, and as well as analyst from Futurum Group, Keith Kirkpatrick, the session.

This ti this session is titled Agentic Automation. In this session, Tiffany is gonna lead us on a deep dive into the operational realities of agentic automation. It's a world where apps, agents, and chat are converging to reshape enterprise execution.

We hope you'll discover how AI empowers everyone with a special focus on those who need accessibility and disability support. You're gonna learn how business users supervise autonomous agents that execute, escalate, assist driving inclusive productivity, expect insights into multi-agent orchestration, human in the loop governments, and chat led transformation across support and product activation. So, another great session.

Here's Tiffany and Keith. Thanks, Alan. I'm Keith Kirkpatrick, research director with the Futureum Group covering enterprise software and digital workflows.

Today we're gonna be talking about agentic automation and how it is reshaping enterprise execution where apps, agents and chat functionalities are conversing to assist across workflows driving the external engagement through the delivery of personalized intelligent experiences and streamlining interactions. And, hello, my name is Tiffany Tracy, and I'm the VP of product management for the power platform core, which covers our power apps, power automate power pages, RPA, and process mining. I've been with Microsoft for 25 years in a variety of product roles, and looking forward to the conversation today, As we're both aware, we really can't get away from a discussion about today's technology without talking about Agen ai.

And I wanted to first start off by asking you about some of the ways in which agen AI is changing the way customers are engaging with businesses on a day-to-day basis. Yeah, so I think it's great if we first start with the fact that agentic AI is going to change the way we work, right? We're moving much more into these human led agent operated environments.

And some of the big changes that come with that are, we're gonna move much more from this very task-based focus to a more intent and goal-driven focus. And we're gonna move from working like in a particular app to really working across apps with that we'll see this synergy of humans that are, uh, you know, driving what we're gonna do. They're adding business intelligence, they're guiding, we're gonna have agents that really do a lot of the, the execution work.

We're gonna have intelligent apps where these agents and humans can dock in to manage everything. And we're still gonna have automations like we have today for very deterministic workflows. When we put all of that together, what we get from a customer experiences, they're going to get much more personalized and contextually relevant experiences, uh, much faster and with a lot less effort on their part.

And in fact, in many cases, we see that customers are, organizations will be able to expand the audiences that they can actually serve with this technology. So, like a simple example that, that might be, I'm on a flight, turns out I'm gonna miss my connecting flight. You know, today when I land I might get a, a text message that I've missed my connecting flight.

But you see, very quickly I'll land, the airlines has already rebooked me with an agent. They're gonna let me know what my new flight is, and then if that doesn't work for me, they're gonna gimme a human to escalate. That's going to change in these kind of customer experiences.

You talk to me a little bit about how we're going to see all of this automation, uh, intelligent automation be managed. So one of the powers of this agentic transformation is you begin to get intelligence on tap. So you have these different agents that you can leverage for different business functions.

A level one agent, I think most of us have probably experienced in this point, and that is AI, is maybe we're asking it questions or it's giving us a set of information. And then you have level two where the human is actually directing the agent to conduct some sort of task. And then the business rules, um, dictate when the, the human will get involved.

And it may be just giving the human information so they can make a better decision. And then level three is where you see these agents actually taking action aligned to the business rules and the human being in the loop aligned to whatever business rules you set. So what you'll find is that the goal of how we're thinking about agentic AI is we want humans to continue to work in the way they do today.

We want them to have a personal assistant that transcends with them throughout their day, whether in their business data, their productivity data, whatever tasks they're doing, and then they will have intelligent apps that let them manage some of these autonomous agents, but those agents can dock into their personal assistant, they can dock into their agents. So we really want that humans continue to work the way they do today, that this AI will sort of collaborate seamlessly with them. And that's why you see that using both intelligent apps and kind of copilot in this chat interface have their place depending on what the human's trying to accomplish.

And so we want this all to kind of slot in more seamlessly versus thinking about it as like they, they have to change as much the way they work. Right, that makes sense. But I guess one thing that I'm, I'm particularly curious about is as we move into this world where we have agents that work alongside of humans, and there are obviously gonna be agents that work sort of autonomously, obviously still with a human in the loop to make sure that they, that they don't go off the rails.

How do you actually coordinate multiple AI agents across a platform to make sure that, you know, the agents do what they're supposed to do when they're supposed to do it? Yeah, it's an excellent question. It, it's very inherent in, in the platform we're building, uh, uh, across both copilot studio and power platform, and of course some of the pieces in Azure.

But it is very straightforward to design for a particular agent, what its rules are, what it's allowed to do, what knowledge it has, what memory it has, what kind of guardrails it needs to follow. Mm-hmm. And what we see as customers are moving to these level three agents is they're really thinking through their business processes and chunking those up into reusable components.

So maybe for instance, you, you interact to gather information from an external company, and you do that for several business processes. You might build a dedicated agent that does that and, and gathers that information that will have a set of business rules that you set for that agent. It will have a set of points where you escalate to a human or where the agent can actually take action, and then that agent may talk to another agent.

Again, you define what that communication is and the business rules. So it's very configurable to what your business policies are, what your risk tolerances, depending on the, on the impact. The other piece is it's quite straightforward to evolve those business rules.

So maybe for instance, you start with an agent that makes recommendations on approving insurance claims or approving purchase orders. You might say that when you start, every single one of those has to be validated by a human. Then maybe you say, wow, that's going really well.

If it's, you know, under such amount a thousand dollars, the agent can auto approve if it's over that the human still has to make that decision. And then you keep ratcheting that up as you build confidence in the, the agentic system you've created. And those things are very straightforward to configure and continuing to evolve Actually.

How does power platform help to sort of manage that, that, as you're talking about multi-agent orchestration across different modalities, whether we're talking about chats, uh, applications and backend systems, because that seems like that's gonna be a core sort of, uh, requirement as organizations, whether they're dealing with regulated industries or not. Absolutely. So when you think about the power platform one, we, we have a tremendous amount of line of business, large scale apps running on the platform today.

And I think it's really important to note for those customers, we are going to bring AI to where they're working today and let them use AI to add even more value to the, the applications they have today. Then we're introducing new tools, uh, for building agents and some of these intelligent apps that will, will dock the agents in. All of that will still run on the power platform managed environments.

So all of the governance that you're used to in the power platform will extend to this agentic transformation so that customers have confidence that they are running in a managed environment, that they have the ability to set the policies to manage it, to audit it, to understand RAI, all of the different components they need. But that will be within the, the core platform that they have come to, to trust in, in managed environments. Yeah.

Tiffany, you just mentioned something that's really interesting and, and you've been talking about it throughout our conversation about the idea of human in the loop governance. I'm curious, how do you actually embed that into agentic workflows without sort of slowing down automations or creating unnecessary bottlenecks? So human in the loop can be orchestrated at any milestone in the process that makes sense for that process or that business.

This is one of the places that we think intelligent power apps is going to play a large role. So you can imagine that I might have, you know, a thousand automations or a thousand agents that are running, and I have this intelligent app that lets me go through and quickly approve, guide, change, whatever needs to happen to ensure that the human is guiding but not slowing down the process. And I think this is one of the roles we see for intelligent apps as we go forward.

What about, you know, the other thing I've heard about is the use of adaptive risk models and how that might help ensure that agents just remain compliant with any kind of regulatory or even indu or even, uh, business guidelines. Can you talk to me a little bit about that? So for every agent solution, the organization really needs to think through a concept we call evals.

And those evals are what are letting you know that the quality, the functionality, the reliability is all within your guidelines. And so it depends on the agent solution, but you are going to have metrics that tell you the functionality and the reliability. It's gonna let you know the quality of the response.

If it's a agent that's creating some sort of UX or interface, you're gonna have metrics that let you test if that is, is high quality and functional. Um, and then of course you're going to have evals around responsible ai. And so depending on the solution, one of the first things you want to do as you get started is define for the type of solution you have, what are the areas that will be key and what are the metrics and tests you want to use?

And then there'll be multiple ways to ensure that those metrics are on track. So we've heard a lot about agent ai, but one of the things that I hear from talking with companies is that there's still a little bit of fuzziness or confusion around what sets, uh, agentic AI apart from some of the chatbots or assistance that we become, become accustomed to dealing with in our everyday lives. There's a number of things.

One is that an agent, if you give it to them, has memory so they can remember previous conversations with you. They can remember previous context. The second is that the agent can learn, you can continue to train it on knowledge, and it can continue to learn and help be more and more helpful as it goes along.

It also has not just the initial, uh, knowledge that you trained it on, but it has generative ai, which helps it to fill in the knowledge that you've given it. So you can think of it has all the power of the, the orchestration and the LLM or the larger language model with your specific information on top to personalize it. All of those are things that chatbots could not do.

Chatbots also could not take action. So chatbot was really, it was a great at the time, but it's really more of like a q and a with very curated answers. When we get to LLM, it has all of these richer capabilities, and so it's not only quicker to get the information back to the human, but it also can do more of that on its own because of the context, the shared memory, the knowledge, and the fact it can take actions.

Well, one of the things I think that a agentic AI is really sort of building on is that chat modality where you're able to use natural language to interact with it. Uh, do you see that as being sort of, you know, another sort of real selling point for using AG Agentic ai? Because you are able to, you know, anyone can interact with it.

You don't need to have, you don't need to program, you don't need to remember specific terms or anything like that. Natural language interfaces are going to have a large role in AG AI because as humans, that's an interface that we, like, we enjoy and has a much lower barrier for people to participate in. So I think natural language and being able to, you know, type what you want an apt to do, or what you want an agent to do for you and be able to go create that will absolutely have a large role in that.

Again, I think it will depend on the business solution. We also know that humans are more comfortable in sort of like a personal assistant, like a co-pilot realm talking back and forth because that's how they interact with their other coworkers. And so we really want as much as possible to have the human still work and the way that they're accustomed to working.

So they might, you know, ping a coworker to ask a question. Now they might ping their, their personal assistant to ask that question. There will be places where they'll actually go into an intelligent app because that's the best interface for them.

And then they may continue to ask their personal assistant questions about that app. So they will be much quicker to learn about that app and what they're doing. But then natural language interface is definitely gonna play a key role because of the way it lowers the barrier and allows humans to continue to interact with the technology in a way that they're most comfortable.

So it sounds like what you're describing is sort of an agent first or, or assistant first, uh, approach to interacting with systems. Is that kind of what we're, we're moving toward? I would kind of flip it around.

I think it's a human first, a human led. I think that human is going to have a personal assistant like copilot that transcends their day with them, understands their productivity context, their business context, you know, how they like to communicate, how they don't like to communicate. It's gonna be more kind of, I'll call it, connected with the human and their personality.

And then I think there's gonna be a set of intelligent apps and agents that mm-hmm. Dock into those places. Agents may dock into your apps, agents may dock into your personal assistant depending on what they do, all that together we'll build kind of the new tapestry of how we work and how we move forward.

But I think it's the human at the center with these technologies helping to make them more productive and giving them more time to think strategically, to be creative and to think about what they can do next. We, we know from all kinds of studies that 80% of of people in organizations say they don't have enough time to do what they wanna do, to think about the things they wanna think. So we're thinking about how we empower that human and how they now have more time for those strategic creative things.

And then this technology is, is really helping them along the way. Tiffany, one thing you mentioned is that AI should be for everyone. And I'm curious if you could talk a little bit about how Agentic automation can help ensure that people with disabilities aren't just included, but actively empowered as they're working and using enterprise workflows.

Yeah, this is an area I feel extremely passionate about, what we've seen so far with, uh, particularly co-piloting and some of the automations that have been done in, in teams and some other places. So, you know, there's lots of different situations that, that people with disabilities face. Um, you may have someone who has hearing loss and now with the transcript on a meeting they can fill in where something wasn't quite clear to them.

You may have, uh, someone who has a DHD who focusing on the meeting and the notes. Um, they feel like they miss out in both fronts. I think.

I think that's a human experience across the board now with meeting notes and the transcription, like you can stay a hundred percent focused on the conversation, the meeting, and know the rest of that is going to be there for you. You could flip this over to other environments like schools or education where the concept of meeting notes can help students take notes and lectures and they can have it all there. So they're focused on their learning in the moment.

I mean, a lot of these, uh, agentic AI pieces are gonna help humans be fully present in the moment and know all this other stuff is there for them to use later, but they're not having to multitask in the moment. And the, the numbers are showing, uh, people see the real impact to that. They feel like the quality of their work is better.

They feel like they are more included, they feel like they have better performance, and they feel like the meaning of their work is actually gone up. We're just seeing the beginning of all the impact that this is going to have for us. Tiffany, can you gimme an example where a agentic AI has provided an outsized impact above and beyond what you either might have expected or what we could have previously done?

Yes. We see many times that the spark for starting with AI is around efficiency or productivity, but what we're hearing from customers is they're seeing a number of other vectors of impact. Um, accessibility and inclusion has been a really strong one, which I'll talk about.

Uh, being able to upskill and learn has been another one that's come up quite strongly. In fact, ey uh, Ernst and Young recently did, uh, a study where they interviewed over 300 people who had been using Microsoft Co-pilot, uh, asking them how did it impact their work. All of these 300 people identified as having a disability.

Mm-hmm. And over 75% of them said they felt like copilot had made them more productive at work. They kind of laid that along three lines.

One was removing barriers, 88% said they were doing better communications by using copilot than they had in the past. They also talked about feeling more included and feeling like the quality of their work had gone up. That was over 85%.

And they also talked about feeling like they were getting more meaning out of their work because of their productivity and the quality. So that is just a tremendous, uh, like additional benefit that we're seeing from AI where organizations are able to ensure that every team member is bringing their best selves to work and doing the best role that they can. And I think we will just see more and more of this as we move forward, because as copilot and some of the other AI continues to learn even more and more and becomes more personalized, it can even help in other ways that will be very valuable for people.

So Tiffany, I was wondering if you could share some examples about how ag agentic technology is being designed with accessibility in mind. Yeah, so as you know, Microsoft's had a, a long history of thinking about accessibility features in our products, whether that's been sort of an Xbox and assistive controllers or office and, and the many accessibility features we provide there. That same sort of mission is, is moving into ag agentic ai.

So we can think about what are the new accessibility features that maybe in the past weren't as feasible that now we can bring to the forefront. Some of them are already out. You think about teams meetings, teams, transcripts.

You think about things like copilot, being able to ask questions across all of your graph data. As we move forward, we see even new opportunities. For example, the teams team is thinking about how today in a team's transcript you have whatever has been said verbally, you know, might be another language, might be in English, might be in multiple languages, but it's what was spoken in the future.

What they wanna do is include what was signed in the meeting into the transcript. So everybody has a complete transcript, whether that was spoken or whether that was signed. And that's just one example of the many type of agentic AI features that we feel like is now feasible that we're exploring.

So I was wondering if you could tell me about how age Agentic automation has really streamlined very personal or sensitive, uh, processes and procedures. One of the areas that would be a, a great example of this might be human onboarding. So we each come to a new role or a a a new set of work with various, uh, backgrounds with strengths and places, things we know nothing about.

And agentic AI can really personalize helping that human on board in a way that they feel completely comfortable. They can ask many questions, they can get access to many resources, they can get recommendations and guidance that will help them learn at a much quicker pace, but not something, whereas in the past, they would've had to share very broadly with their new team that they didn't understand a concept or they didn't have this experience. Or maybe it's very difficult in a, a large conference room to to hear, uh, the, the voices.

And so Agen AI has an opportunity to really help speed up that onboarding, personalize that onboarding, and do it in a way that is really taking the human into account and helping them do that in the best way possible in a way that's sensitive to things and very positive and productive. Well, thank you very much, Tiffany, for a great conversation and real insight into the world of ag agentic technology. Thank you, Keith.

I really enjoyed our conversation today. It's always fun to talk about the transformation that's ahead of us and how agentic AI is gonna help all of us move forward. Today, we heard a lot about agents, and I think some of the things that really resonated with me was the fact that ultimately to have success, you need to start with humans looking at processes and goals and then bring in the technology.

Now of course, there's a need for platforms that can really provide an orchestrated agent experience across intelligent apps, agents, and of course, all of the workflows that are integral to really driving real business benefits. And ultimately, the other thing that really, really sort of, uh, resonated for me is the ability of agent technology to improve the experience of people who may have disabilities, and to do it in a way that really takes into account how they're feeling and not really kind of separating them from the rest of the employee base or other customers, but to do it in a way that's empathetic and again, can really drive outcomes. Hello and welcome to the latest edition of the Techstrong Insight series.

I'm your host, Mike Bazaar. Today we're with Jonathan Wall, the CEO for Run Loop ai, and we're having a little chat about, well, AI agent safety. They're starting to show up everywhere, but we're also starting to become aware of well, just how powerful these things might really be, and we don't know exactly what they're doing and who might be using them when we're not looking.

Jonathan, welcome to show. Yeah, thanks so much for having me, Mike. It's, it's great to be here.

It can't help wonder if maybe we're a little bit over our skis when it comes to AI agents. I think people are deploying them and they're seeing new products all the time, but we're also starting to see a lot more, at least proof of concepts and some examples of how these AI agents can be compromised. So do we not think through all the security implications of all of this, but what's your assessment of where are we?

Yeah, okay. That's a pretty broad question. Uh, I would say there's a, a couple kind of, a couple things to click into there.

Um, one would be just kind of around how people are using agents and then how people are deploying agents at scale. Um, I think one kind of curious thing, or something that I find a little puzzling or interesting is how many people are trusting these very powerful agents with really pretty broad access to their laptops. Um, so your laptop, you know, if, if for me, for the sake of argument, if I happen to be doing a infrastructure risk code, push to AWS, I'm signed into AWS I'm credentialed for network access to our production environment.

Um, if I'm running cloud code as, you know, user wall on the various same laptop, you know, these guys have done great things, they've put in good guardrails, but, uh, that, that cloud instance running is me, has access to a, a lot of the capabilities I have access to. Um, so kind of one topic would be, you know, how safe, uh, is it run on your laptop? I think that is, you know, kind of an area of, of open discussion.

Um, I think then the, uh, you know, like kind of another dimension of this would be once you've deployed these agents to the cloud, right, where they can presumably run at scale, um, how do you provide them access to the correct things, but also prevent them from doing damaging things or, or, you know, expatriating data to unin unintended sources. So is it just now a matter of time before there's gonna be a series of catastrophic events involving AI agents and there'll be some backlash, or can we get in front of this a little bit and maybe put something in here to prevent that from happening? I would hope we can get in front of this.

I think you've seen, like there've been a couple little flare ups. You know, there, uh, I think last summer there, there was an engineer on, uh, on social media kind of be moaning the fact that, that they accidentally just, uh, deleted their production database you see in the AI agent. Um, so I think there are some isolated incidents.

Um, I would credit a lot of the agent builders to working really hard in terms of adding sandboxing. So like the Claude folks, codex folks, Gemini folks, um, they do do their very best to sandbox, uh, the agents that run on your laptop. So, you know, there are certainly preventative steps people are taking on your laptop.

I think when you start to deploy to the cloud, people are starting to take steps, but there's a lot of work left to do. Um, you know, we think being very cautious about how you isolate the agent. So it's, it's in a sandbox that it can't escape.

And even if it does escape that sandbox, it can't do kind of, uh, migratory attacks against its neighbors. Um, we think that's necessary, uh, particularly in the case where someone might, you know, maliciously use the agent, right? You can do a lot of things, uh, to try to make the agent not do bad stuff, but, um, clever actors can kind of override that.

I, I think we saw this with that kind of Chinese state sponsored attack that leveraged Claude that split up kind of their attack into lots of innocently seeming smaller tasks to try to not be noticed. Um, so there's a bunch of stuff that people are trying to do on your laptop when you actually deploy to the cloud. Um, you have a lot more control, right?

Um, the deployment environment is exactly how you set it up to be, right. You can control what context is on there. Um, if people are doing a good job in terms of isolating these agents inside of containers and micro VMs, you can be pretty confident that they can't do kind of transitive attacks on their neighbors.

Uh, you know, and in robust cloud environments, as you well know, um, give you the opportunity to have like very strict like network isolation and network boundaries as well. Do we have the tools and technologies required to achieve that goal? Or do we need to maybe invent something that doesn't exist yet?

But is it more a question of let's implement stuff that we already have that we haven't broadly adopted yet to deal with this? Or do we need a different approach altogether? That's a really good question.

I think it's kind of a blend of both answers. Um, I would say that for the most part, we have a lot of the primitives we need, at least at the kind of traditional compute layer. Um, we have a lot of the preti primitives that we need.

It's really a matter of composing them in an opinionated way so that it's easy and ergonomic to, uh, to kind of isolate these agents and be more confident, uh, in, in what it is they're able to do or not do. Um, you know, to give an example, right? Like micro VMs are super powerful.

Uh, they're used widely. Uh, they, you know, they're great. Um, you know, container technology exists, it's great.

Um, there's wonderful network technologies like we use cilium ourselves, um, that let you do really fine grain networking controls. It is great. Uh, it's just the, the problem then becomes how do you compose, you know, a lot of different layers of the stack in a fashion that is ergonomic and easy to use, um, so that people who are developing and then deploying these agents can, can, you know, reap the rewards of, of, of these kind of compelling technologies.

Are security people conscious of all of this, or are they just kinda waiting and watching? And I asked the question because I feel like nobody wants to be the proverbial party pooper, right? Everybody's having a great time with AI and agents, but nobody wants to be the one standing in the middle of the room going, you know, be careful out there.

It could be doom and gloom. So are they just kinda waiting for the crisis to emerge before they kind of step up a little bit more aggressively than they have to date? Yeah, I would say there are like a lot of different surface areas to contemplate here, right?

Like if you, if you look at the laundry list of things I just gave you, right? Like, uh, like network isolations, micro VMs, like these are very like nuts and bolts, like, uh, kind of physical infrastructure layer considerations. These are the kinds of things that I think people are really dialing into right now.

Um, like a lot of our customers, you know, our, our company Run Loop AI supports these things, but it's, a lot of it is customer driven so that, you know, people are aware. Um, I think that is a surface area that's like a little easier to reason about, I think some of the kind of AI level things and, and the prompt injection stuff is a little more open-ended and is a little bit harder to reason about. Um, I think when you throw, you know, more extensible patterns in the mix, like MCP, uh, like it kind of introduces another even broader surface area.

So I guess I would say that I do think that, that across the board people are, there are different security experts worried about different layers of the stack and doing different things. I don't know that there's any holistic solution in place just yet though. So what's your best advice to folks about how to approach this?

Because I think that there is a lot of nuanced issues and at the same time, there's a lot of technology that you need to master and they may not be familiar with. So is there a, a, a savvy way of thinking about all this and maybe having this conversation with the leadership of the company? Yeah, it's kind Of like, I mean, it's, it's, it sounds a little boring, but it's the like, kind of the classical thing, right?

Like, you start with a position of like, what is technical ne technically the bare minimum of necessities? How do you set up like a lease privilege environment and then gradually add things as you really need them, right? And, you know, this is why we think like a micro VM and good network isolations are really the right building blocks from there.

You also need to be very careful about the content that you're, you're making available and the tools you're making available, uh, you know, to any agent. And, you know, one layer above, you need to make sure that the agent never has direct, direct access to any sort of credentials that could be, you know, made, rendered public via a prompt injection. Uh, so it, I think it's, it's kind of the same old story for security, right?

Like you, you have to have a, an approach where you start from good principles least privilege access, and you kind of layer things on as minimally as possible for the thing to actually then function. Mm-hmm. Do you think auditors will soon figure this out and start asking more difficult questions of people?

And will there be more compliance violations because the auditors will be like, well, I don't care if it was ai, the rules the rule. Yeah, this is gonna be an interesting one. I think the security engineers, I think, kind of, at least in my experience, tend to kind of front run the compliance and audit type people.

Um, so hopefully we've, we've raced ahead, so by the time they start asking these questions, we have good answers. Um, right now, I'd say from an audit perspective, we're kind of in the kind of phase of like, hey, log everything, and then we can see whose fault or what went wrong when it broke, as opposed to, uh, being a little more sophisticated. Mm-hmm.

Um, but I, I think that will come, Do you think there will be more regulations about the usage of AI agents? Or does, does lawmakers even understand how these things work yet? And maybe it's a little bit beyond their core capability at the moment, but at some point, will somebody look at all this stuff and start making some new rules?

Oh, I think, you know, lawmakers love to make laws. I'm sure they'd love to. Um, yeah, I guess I would say it's an industry that is in many ways, like kind of our, uh, maybe this is kind of our challenge is this, is this kind of nascent technology kind of, you know, grows to become mainstream and widely adopted technology is to, to see if we can sufficiently conform to like the existing regulatory standards with like mod modest extensions versus having like sweeping new, you know, laws and compliance burdens put in place.

I, I would certainly hope so. Um, you know, I would certainly hope we, we can arrive at that outcome where there's, for every, you know, whether it be SOC two or, you know, GDPR or any of these kind of standards, I would hope that there's just modest AI extensions to them as opposed to new entirely new regulatory regimes that are really wide reaching. I, I hope So.

What is that one thing you see people doing today that just makes you shake your head a little bit and go, folks, we need to be a little bit smarter about this, because if we're not, things might go south. Uh, I think this is getting buttoned up rapidly now, like kind of in response, I think, to the, the state sponsored attack that, that anthropic revealed, uh, last fall. But I do think running stuff on your laptop, you know, kind of as your user, um, launching an agent that has access to lots of files and lots of state on your system and lots of credentials, I think that was a little bit wild.

Um, I think now the labs, the major lab, the major labs and, and, and, you know, Claude is doing a great job of this, are, are really Gemini as well, codex all of them are really, really trying to put good sandboxing in place for your local laptop. But, uh, you know, I think ultimately, at least in my opinion, the right answer is to not be running too many of these things directly on your laptop for them to have dedicated sandbox cloud environments, you know, and ultimately, hey, like, I don't want just one or two agents running. I might want lots of them.

So, you know, the scale of the cloud is appealing in, in that regard anyway. Um, so that, that might be something that, you know, uh, I guess in the past that made me a little worried, but, uh, people are working pretty hard on that as well. All right, folks.

Well, you heard it here. Hey, you know, we gotta figure out how to maybe limit the scope of the potential breach, which in fundamentally just comes down to we gotta run more of these things in isolation so that if something does go wrong, it doesn't go wrong everywhere. Hey, Jonathan, thanks for being on the show.

Thanks so much. Cheers. All right.

And thank you all for watching the latest episode of The Techstrong, that AI Leadership series can find this episode and others on our website. We invite you to check them all out. Until then, we'll see you next time.

Once more unto the breach. Dear security researchers, welcome to Security Boulevard, the cybersecurity podcast from the Futurum Group. Each episode explores a variety of topics within cybersecurity and the technologies that drive it.

com, the Security Boulevard, YouTube channel, tech Strong tv, and all of your favorite podcast platforms. Let's meet today's guest before we jump in, starting with our old friend, Mr. Allen Shimmel.

Allen, it's good to see you. Good to see you, Tom. How are you, man?

I'm, I'm good. It's, uh, getting kind of interesting trying to keep up with all the security news out there, but I think we've got a fun topic for today. Yes.

It, it's, you know, that old, I don't know if it's an Irish proverb, an or ancient Chinese saying or something in Hebrew, but may you live in interesting times. These are certainly interesting times, or Fernando's gonna tell me he was actually Brazilian, but No, no, no, no, it's not, it's not Brazilian, Brazil, right now, as we're recording this, Brazilians are busy wrapping up Carnival, so yeah, they're not thinking about, that's Proverbs. They're Probably still asleep, but luckily someone woke up to join us and that voice is Fernando Montenegro.

Fernando is good to see you again. Oh, it's lovely to be here. Thank you so much.

Alright. And of course, I'm Tom Hollingsworth. I'm the event lead for all things related to security here at Tech Field Day.

Uh, let's jump into today's episode. I'll give you a hint. We're gonna be talking about ai, but we've got a couple of topics that we want to discuss that kind of meld together.

Uh, the first one is the fact that, uh, anthropic has started kind of letting clot off the leash a little bit. Uh, it has done some vulnerability scanning and managed to turn up over 600 vulnerabilities, uh, across various open source projects. And, and that has some security researchers asking some very interesting questions about the capabilities of AI systems to be able to do, uh, threat modeling, threat hunting.

Uh, one of them in particular that I thought was kind of interesting, I believe it was in Ghost Script, uh, was a vulnerability that no one had been able to find for years. And, uh, the way the system actually found that vulnerability was novel. It, uh, in short, it said, well, this was a problem that they patched years ago, but did they manage to patch every instance of that across every software release?

And it actually found out that they hadn't. And so it used that as a potential avenue for exploit. So I kind of want to, I wanna jump out here by saying to the, the group is the power of AI in this case, the ability to iterate across every version of every product to find something that we might have missed along the way.

Lemme jump in just for a second. Uh, I think that one of the things that we have to, let's go back for, forget AI for a second, right? Normally, how would we find vulnerabilities, right?

You can, you can read the source code, you can, uh, brute for something like we've, we've done fuzzing forever, right? Mm-hmm. What I find fascinating about this is that this is it.

What AI can do or, or, or what at, at, at a very expensive cost. We can get into the cost later, but what AI seems to be able to do is to quote unquote reason through these different stages of analyzing a piece of code. And, and what I personally find fascinating is not so much the number of vulnerabilities it's found, but the fact that it went through these methods that we're codifying these methods along the way.

And, and of course, if we're codifying them now, it, uh, it, uh, it behooves us to think that we'll see, uh, more efficient finding in the future. Like, where else can this be applied to? So that's, that's the thing I found really interesting about this.

I I think you gotta look at this with a little historical context. And Tom, you, you touched on it there before we had AI and before we had Claude Opus. And let's be clear, this isn't just Claude, it's Claude Opus.

Yes. 6. But before we had these things, how did we find vulnerabilities?

How did we find bugs? Well, hopefully we did a lot of testing pre-release and found bugs and fixed them before. But the fact of the matter is, most bugs in, in production systems, we found two ways.

The really bad way is the bad guys found it, and they exploited it and made an attack. And my goodness, when the stuff hit the fan, we said, how did this happen? And we find out, and now we, and then we patched it.

That's the worst case scenario, right? A better case scenario was good guys found it. Somehow or another we found it.

And it was very hit or miss for many years, especially when I first got into security with the advent of bug bounties, right? And, and, uh, oh, I forget her name now, she worked, Katie, Katie, Katie, Yes. Started with the, and probably the, you know, the, so the rise of security researchers who were just out here looking for bugs, and, and they got paid a couple dollars when they found they got paid a lot of money.

It was a big bug. But with those security re researchers came the rise of fuzzing, right? I remember when fuzzing was a new thing, but with fuzzing, you could, you could go to any open source project or any kind of website or whatever and hit it with a fuzzing scanner that would, you know, this before we had ai, I said, but it would cry to a lot of different variations and see if it found anything.

It was like, you know, putting a blind person in a round room and saying, go find the corner. Um, yeah, it, it really hit or miss what we have here with ai. It, it doesn't fuzz like a fuzzing scanner does, but it takes fuzzing to the empty degree.

It could look at the code and run the permutations, if you will, to find those corner cases, to find those, you know, situations where something could be exploited. com. I wrote about this, this called, opens the greatest security researcher of all time.

It's the fastest, it found 600 bugs in open source projects in a few days. It's like a year's worth of, of research in a few days. So fundamentally, that changes the game, right?

Our friend Fernando, our friend, Gotti, Gotti Everett, and, and a young lady from Google, and I'm, I think it's Heather, but I, I may have her name wrong, but it's in my article, they called this to the day, six months ago. They said, we're gonna have a, an apocalypse, a vulnerability apocalypse where AI's ability to find new vulnerabilities will outstrip our ability to keep up with it. They say, give it six months, and almost six months to the day later, this came out.

So I don't wanna disagree with you, Alan, I finally get to say that. I don't wanna disagree with you, but I have some problems with this. So here's my first problem.

It, it discovered 600 vulnerabilities, right? Where's the CVSS details for those? They didn't publish them.

In fact, of the 600 that they published, they only talked about three projects, which already kind of makes me wonder what's going on, because I didn't realize this until I did some research. 5 had a little problem with the Malick call in programming? Uh, it would flag Malick as a potential vulnerability every time, because Malick can be overflowed, even though the programmers would immediately point out, you realize that we wrapped it in an error handler so that if it ever did overflow, it would immediately dump out and it wouldn't actually create a vulnerability.

But just like an overeager intern that's three days out of college, it would flag every instance of Malick that it found not realizing that there's probably no better way to do that, because all you gotta do is go out to the Lennox Colonel mailing list and wait for three months until someone suggests rewriting the Linux kernel in c plus plus. Because everybody does it, it, it's, it's a truism because everybody thinks that there's a better way to do it, even though the guy who's been writing it for the better part of 30 years knows there's no better way to do it. Uh, just grab the, the comments for some of the drivers that have been submitted.

Some of them, I love the comments of like, don't ever f and touch this, because nobody knows how it works, but it works. That's the perfect thing for AI to go. No, no, no, I can rewrite that.

I think it's also telling that you brought up the Bug bounty program, because one of the problems that we're seeing with AI is that AI tools are causing bug bounty programs to get shut down. All you gotta do is go look at the curl utility. They had to shut down their bug bounty, like absolutely crater it because so many people were analyzing the curl programming database with AI tools, and they were catching all of the errors.

And I used the quoting fingers there on purpose, and then they were submitting them hoping they were gonna get a hundred bucks or a thousand bucks. And finally the maintainer said no more. Because I can tell when it's ai, I can tell that you aren't actually doing any of the, the research around why that was written way that it was, and you're just hoping for a quick cash in.

It's the same problem that we've seen a hundred times when there's a new tool out there that people think will lessen their workload. Their very first solution to using it is get rich quick. Because remember, script kitties back when they had, uh, nuclear weapons and push button capabilities, what did they do with them?

They used them to start extorting companies. They used them to start trying to break into places where the security was subpar until we improved our security. I think we're in a, uh, we're in an era of AI kitties where they have access to these massive tools and they, they can pay $20 a month just like the rest of us, and then they can go out and try to basically recoup that cost by doing all these things.

And I think what's ultimately gonna end up happening is either the programmers are gonna have to get better, or they're gonna have to put some very strict rules in place. We will not accept submissions from these tools. Um, you need to provide like documentation or exploitability, otherwise we're done.

So we're, we're, I'm, I'm conflating a bunch of different things here and, and I'm sorry, fitting in between in, in the context that I see different problems at scale here, different, the different things playing out, right? Uh, I very much agree that yes, we should see more about those 600 vulnerabilities for sure. The other thing to keep in mind is that I, from where I've seen, from what I've seen, that exercise costed 20,000, right?

It's not as if, hey, you're gonna pick up a cloud subscription, uh, tomorrow and then start fuzzing your way, start vulnerability finding your way across things, right? So there is a cost to these things, which of course, for a large criminal enterprise or a mid-size criminal enterprise, and increasingly a small size criminal enterprise mm-hmm. Right?

Is not, is not outta the realm of possibility, right? Which ties us back to look at all the, the open capacity that's available right now with open claw instances that are, that are available at like 19,000, 20,000 or whatever, right? But, sorry, I, I, I digress.

There is absolutely what, what I find, what I found fascinating about the the opus thing is that it's, it's how it navigated the problem. I think that the navigation of the problem was phenomenal, right? The other thing is that about the Bug bounty programs, right?

And, and I'm thinking here about the fact that like, when we talk about AI security, we always talk about AI for security, security for ai. And one use case we rarely talk about is security from ai. What happens when your adversaries start using ai?

And, and I think about this overflow in security bug bounties as as kind of that problem, right? It's kind of like, uh, fraudsters trying to overload a, a, uh, a call center, right? But in, I think that the approach here is to, uh, uh, curate more, like of course it becomes a more expensive, uh, to run a bug bounty program, right?

But I think there's still, there's still an they, those can still be faced, right? Because have enough curation so that you can have, uh, like some automated, uh, uh, uh, triage early on and then at some point, and, and, and the bug bounty, um, companies have done this. I mean, hacker One and Bug Crowd and, and some of the others, right?

Have invite only programs. Hey, you can only submit you, you'll only accept you if you're un invited. Like, it's not, it's not as, it's not as of, of, um, as democratic of, hey, open up to the entire world, but it's an option, right?

But anyway, I think that the, the, the broader point here is that there is, uh, there's tremendous value to what's being done. We're just trying to adapt to it. That's the, So, lemme lemme weigh in here, Tom.

Bless your heart. Listen, he got all Southern on me there. Yeah.

Well, you know about fair play, but are you trying to make the argument that all of a sudden AI has created a situation where we have, have more vulnerabilities that aren't necessarily reachable, exploitable or workable, or what you're really saying is meaningful and this is just clogging up the pipes of poor vulnerability, mediators, workloads. Is that the hill you wanna die on? Because that's a hill that I've been watching the battle on for about 30 years.

Nothing's changed. A, uh, don't blame AI for that. This, this is something that's been going on a long time.

You've got your telephone book and for those of you who remember what a telephone book looked like, a telephone book full of vulnerabilities every time you use the scanner, and it was job security, right? It was like painting the Barno Bridge back home in New York. They start right after New Year's on one end, they finish right on the other end, right around Christmas.

They take that week off and then start again on the other end for the new year. That's what vulnerability remediation's been like for as long as I've been in security. It, it's not new.

No, you're Right. V vulnerability discovery is not new. 'cause we've been looking for these things for years.

Any good programmer will do that. What's happened is, is that the speed that we can find them has drastically increased. And it goes back to things like Problem Yeah.

Like encryption keys, right? It used to be that cracking any kind of password or something like that would take orders of magnitude more time. But we have gotten to the point now because of the massive amount of compute power that we have with the ability to precalculate rainbow tables that effectively any numeric password is, is instantly broken.

Even lowercase passwords with a mix of numbers and letters probably takes about three days. Whereas it used to take like three weeks at, at the best case. So the problem is, we, we now have to adapt faster.

AI has shrunk the window for us to find these things and remediate them. Yes, it has. May I introduce, bring into the conversation.

I, I was working for an economic term. May I bring into the conversation the concept of the Red Queen hypothesis, right? It's actually not, uh, it's actually not, uh, as much economics as it's evolutionary biology, right?

But it's how much, uh, you have to keep running, right? Just to stay in place. Mm-hmm.

Right? And I think that, uh, what what was notable to me on, on, on, and, and Alan, I agree with you wholeheartedly. Vulnerability's been around forever.

What what is changing is that, oh, look, this thing needs to be fixed. Not in 285 days. This thing needs to be fixed in a week at best, if not soon.

Well, That's prioritization though, for now, right? Yeah. You can't fix all 600 in a week.

You gotta figure pick, you gotta pick your battles. But lemme lemme also Tom to a, a couple of the other points you made and Fernando made, why don't we have the list of CVEs and the whole list of 500 or 600 vulnerabilities? 'cause until patches exist for them and we're ready to patch them, it's called responsible disclosure.

If, if, if, if the, if the Anthropic people put that list out before there were patches out there, I I call for them to be hung from the nearest tree. You don't do that. You can't do that.

You can't do that. But Agreed, That, that, that's first of all. Second of all, though, here's the, the real politics of this guys.

If Anthropic or the good guy, quote unquote good guy, security researchers aren't using these tools to find these vulnerabilities, you know, who is of course, the bad guys, and they're gonna find them and they're gonna pick the ones that matter, right? They've got, they're, they're well organized, they've got great resources, and this is available to them too. So there's a bit of a race here, right?

And, and it's not a new race. It's just, as you both have said, AI has upped the stakes. And that's what Gotti and, and the woman from Google, You're thinking about Heather Atkins, she's, she's amazing.

Like she's one of the powers behind Google Chrome, right? Yes. Yessing.

And yeah, That's what the race, not that all these vulnerabilities exist. I think we all suspect they're out there, but how the heck do we keep up with this? And that brings me to the next article I wrote, son of MBO or Open versus Opus.

It takes AI to beat ai, my friends, right? And I think of all open could be a platform's, T cells, a platform's immune system waiting in, in our bone marrow, if you will, about platforms to take their marching orders to go out and, and remediate these, assuming we have re remediations, uh, to go out and remediate all these vulnerabilities that these ai, these AI are finding, whether they're found by white hat, black hat, gray hat, no hats, right? We, we, we need something that scales.

And I think ai, you, you're gonna need AI is the bottom line here. And absolutely, and I think we've seen some of this, some of this happening. I, I would argue that, uh, the, by the way, I love the, the the of multiple, like the, like, that was so much fun.

The, the, the re the thing I would mention though, that is that what I think organizations and practitioners should be on the lookout for is not just on the capabilities, right? It's not just, can you, uh, uh, do we release a swarm of agents to fix vulnerabilities, right? It's is our operating environment are our development practices, are our, uh, software pipelines, is our change management process, uh, capable and ready for this type of autonomic, uh, uh, operation.

I remember that this, I go back years. I remember having a cloud a con, this was the earlier days of cloud speaking with the, the cloud architect for a very large financial institution. And, and the guy was nearly in tears, right?

Because he was telling me, look, uh, this was the time of, of, of how quickly can you deploy to prod, we can roll things out to prod within an hour, right? Uh, and it's amazing and, and it's wonderful, but Cab Change advisory board still only meets twice a month, and every change has to be approved, right? It was so, uh, uh, that, that experience stuck with me forever, right?

It's like, can the way that we're running things, uh, match what the technology environment looks like? So my, my push to, uh, to people is, okay, great, you can deploy all the agentic technology you want, but if you can't let the technology actually do its thing, if it's really helpful. So here, here's a lesson I learned very early on in my cybersecurity career.

You know, Mitchell, Mitchell, Ashley and I were two of the three co-founders of a company called Still Secure. We had intrusion prevention, vulnerability management, network access control. At the time, intrusion detection was the standard, right?

It detected an intru, a potential intru intrusion, and alerted you at the time. Vulnerability scanning once a year was a, a wish, you know, uh, you know, that's what you would hope many organizations did it. We came up with automations to automatically block the most obvious intrusions to automatically remediate, do a work, put in a workflow, and remediate vulnerabilities failed miserably.

Failed miserably. You know why? People were afraid to automate remediation.

Fernando, much like your discussion, I probably had a discussion five or 10 years before yours because the cloud wasn't around yet, but it was with one of the global CIOs for Citi. Back then it was called Citibank. Yeah, it was still Citibank.

Now, of course, it's just Citi. How long does it take you to do your Microsoft patch Tuesdays to get your patch? Tuesday stuck.

90 days. Now remember, patch Tuesday came out once a month. Once a month.

They were three months behind. And some of those patches were, were needed. You had critical why, Peter, why, why 90 days?

Because we have to test it across our entire network before we can approval. Make sure it doesn't break anything because we'd rather live with the vulnerability than break something else. Very similar to your cloud story.

This, now, I think the world has changed. I think we're more accepting of remediation when I speak to the vulnerability, vulnerability vendors today, Fernando, like Qua, and I'm sure you speak to them too, Qualys, rapid seven, whatever. I forgot who owns EI now, but the, the company behind the EI scanner, um, you know, the, the AppSec scanners, they're all building automated remediation in, I don't know, you know, Qualys has this concept of rock risk operation center Yep.

Where you make, you know, a, a weighted decision on should I automate the remediation or, or maybe wait for a cap. But I think the world is changing. We are becoming more, um, forgiving or, or, or open to automated remediation.

We have to, when you've got this thing finding 600 vulnerabilities, even if only a quarter of are, are serious, we can't wait 90 days or even 30 days. And, and, and I think that that is where we work. We help, we, we, we should be helping people be more nuanced about their environments, right?

There are environments where, yes, we should wait 90 days for a, because we wanna make sure it doesn't break. But here's the big thing. That environment has to have compensating controls to account for the fact that they may be right.

And, and that nuance of how far do you, uh, uh, how much do you add in terms of compensating controls is a risk-based decision, right? Uh, and requires a, um, a, a deeper understanding of the threat environment and, and the operating environment of where, how, what does your organization actually do? How does it do it?

And so on, right? Which to bring this back to, to, to Claude Opus, I find it fascinating that it accelerated it in my view. Like in, in this calculus, I see Claude Opus changing the threat environment.

It basically said, look right. For any kind of software that you're running, assume that someone can find vulnerabilities that much faster. If that is true, however they find it, what changes in how we proceed?

Oh, you know what? Perhaps we segment our network, these sec these machines here, or these systems here we put on on different controls and these ones and so on, right? It's the Red Queen hypothesis.

Sorry. It's like you, you're, you, you're, you're changing, you're running just to stay in place. So I would posit that the reason why it's taking 90 days in, in Alan's specific case, but more importantly, the reason why it takes so long to roll out patches is risk.

We know that. But my posit there is you can't fire an agent or a script. Now you're probably thinking to yourself, yes, you can, you can disable it or whatever.

Yes. But you can't make it feel shame. And that's what people want when they, they point at somebody to say, you shouldn't have done this.

They don't want to improve the behavior. I mean, yes, they don't want it to happen. They want that person to feel shame for having done it.

They want to slow down the way that things are done, because risk does not like speed. That's always been a problem. But, but who they, in this equation, In this case, it's the stakeholders in, in finance, in, in business continuity.

The people who stand to lose money for any downtime, the people whose job is resource allocation and, and they don't like doing things twice, they don't like unknowns. Because a vulnerability is a known problem. A patch that fails is an unknown problem because we don't know how to fix the patch.

And Microsoft has actually had a problem with that as of late, the last couple of rounds of their big Windows 11 updates have had to roll a few things back because, oops, that interaction didn't work the way we wanted it to. In fact, I found about a one last night, it's causing problems because the patch for the patch is causing problems. And so it's like your three patch patch patches behind where you should be, because every time you try to apply them, it breaks something new.

So let me bring up this idea, because I, I, I, I was thinking about this while you guys were discussing about what happens when we just kind of open it up and say, okay, we trust the systems enough to solve these problems. What happens when the attackers know that? So if you guys remember Star Trek, the next generation, when they captured Hue the Borg, they had a plan.

They were gonna implant a, basically an unsolvable problem into Hue and send it back to the collective and cause the collective to crash. What happens when I know that AI agents are the ones that are scanning for vulnerabilities, and I start doing things to mess with them to hide my real payloads? Uh, remember the the infinitely expanding zip file problem where you had a, like a 38 deep nested zip file that would constantly unpack itself until it overwrote your hard drive?

Like, what if I leave one of those for an AI agent to find, or what if I code everything in poetry so that it evades the, the detectors like The note Star Trek one right there. Remember, there was a, a species who spoke like in parables and poetry and Dharma and Gilad at gra. Exactly.

Exactly. But, but that's the thing, right? Is once I start crafting my evasion techniques to evade the scanners, who catches it after that?

Because if I've turned my scanning over to the system, who goes back to look at the logs at this point and go, wait a minute, you know, Chaco, when the walls fell, that doesn't sound like something one of my people would write unless it was Billy the Star Trek nerd over there in the dev system. But like, that's the deal. They, the attackers will always modify their, um, systems to evade the protections that we got.

It's one of the problems we face in the physical world, right? As soon as we started scanning everything for explosives, what did they do? They parked the explosives outside of the building.

And now you've got, that's why you have Ballards, and you can't park within 150 feet of a federal building now. So, but I, I think here's the, here's the weak link in that chin, Tom are, uh, the, the, the powers that be the people who own and operate the code, are they gonna purposely try to evade AI scanning vulnerability scanning? I can understand if the AI scanners are being for the bad guys, right?

That might be a way to kind of camouflage or, or what have you. But you know, for as long as I've been in security, and Fernando, you've heard this term, Tom, you've heard this term, this concept of self-healing systems. Mm-hmm.

Right? I think it was originally Cisco that came up with that actually. Mm-hmm.

But self-healing systems where why can't the platform the same way the platform today pre, you know, in software supply chain security is applying das and SAS and SCA scans. Why can't the platform do an opus scan and find things as well? And, and you know what?

Keep it, keep it in the family. Keep it behind the curtain before it gets out in the public. And, you know, the so-called hacker's eye view from, from outside.

Why can't we build this into our platforms and into our process? Well, part of it is that it costs too much. Like, uh, that we go back to economics, right?

Fundamental problem we have in this industry is that it's externalized risk, right? The, uh, we are navigating the scenario of how do you, How do, who pays, who's paying for this, right? At the end of the day, it's the end user organization that is spending that, that's paying an FT to patch.

It's an end user organization that is paying an an ft to do the scan to find what's vulnerable, right? Uh, it's, are you paying the scan or is it you just paying the AI company for tokens regardless, like the company's paying? So, uh, we go back to product liability laws.

At which point do we want this thing to, to, to normalize in terms of who's, uh, like we've had, and we as the three of us, like we discussed the changes at CISA a few weeks ago, right? Uh, where is secure by default in all of this, right? And, and Tom, I just wanna go back to the, the Star Trek references.

I wouldn't, I wouldn't mention those. I would go back to the hunt for red October. Do you remember how Seamen Jones found the red October?

Yeah, It was, he did not believe the computer, because the Computer didn't know what was going on. But what he did was he picked up the, so for, for those who haven't watched the October, I highly commend. Yeah, right?

Uh, but sorry for the spoiler there. One of the way that, the way that, uh, that a very, very, very cleverman finds the, the, the red October, which supposed to have stealth propulsion drive, right? Is that he takes the sound and he, and he speeds it up by a factor of 10, right?

And then it becomes, what, what was just a, a very low hum becomes a, which is obviously manmade. And that's how they find it, right? I mentioned this in the context of the way that we address these kinds of, of, of prompt injections and, and, and this type of bypassing of, of, or, or this time of, or this type of trying to gain the AI scanner is by having a second level scanner that doesn't watch for vulnerabilities.

It watches for anomalies in the primary path, right? Uh, so if it's something that says, look, nobody's supposed to be talking about poetry, right? That's an anomaly.

So how we compose the systems, right? It works in our favor too. It's not, let's, let's end this on a positive note, it's not just about attackers having lay of the land, it's that we can use these things for defense too.

So I'll leave you with this thought. The reason why we are where we are right now is because context is expensive. Yes.

It's, it's, so if I ask you, have you ever seen the hunt for red October? The answer is easy, yes or no, it's binary. But then I say why?

That's the expensive part. So if we want to translate this into modern economics, the first part is easy, right? Detecting is the vulnerability there or not?

Why or how is it exploitable? That's where you're gonna start burning tokens, is because you've gotta provide the context. And that's why we have had such a hard time with this before, is because nobody likes yes or no, nobody likes on or off.

They want to know context. And for a human context is actually fairly easy to provide because our brains are wired to do it. But when we're trying to replicate that system in electricity, in water usage, in token consumption, that's when we start seeing the actual cost behind it.

And I think that that's the challenge that we're gonna have to get over is because it's because we are always gonna want to know why. So I, I think that's the difference between just a scanner and an AI scanner. I, I think the autonomous nature of AI ha has to have the y built in.

If you'll, Yes, It can't just give you a scan result, it has to have the wide built in. But you know, Fernando, you mentioned product liability loss. Product liability loss is what's reasonable for a product manufacturer to do, to prevent an injury, to make sure it's safe product, et cetera.

That same reasonableness test, which is the test of negligence, we'll apply to owners of code who say, I don't wanna know. I don't wanna use the AI scanner. I don't wanna know.

I wanna bury my head in the sand. And if something happens, I guess I'll find out. And, and that at some point a jury is gonna decide whether that was a reasonable risk and whether or not they're liable for someone's or many people's damages.

And that's the way our system works. And that's the way, and I, and I agree, and that's where we're going. And that's like, I, I perhaps I should start, stop talking economics and start talking law.

I'm not a lawyer. I don't come from a, I come from a from a family of, of, of people in the legal profession. But, um, yes, that's where we're going.

And, and that's how this industry is evolving. And that's not necessarily a bad thing. It just means that we're now that much more strategic for society at large.

Absolutely. Let's embrace That. I think we're gonna go ahead and wrap it here.

But please stay tuned for our law versus ethics episode, which will be coming up soon. 'cause I just made a note that we're gonna talk about that. Uh, but before we go, I wanna make sure that everybody knows that these are two of the hardest working men in the industry right now, uh, because they are writing so much stuff.

Um, Alan, I'm pretty sure you probably wrote a blog post while we were sitting here knowing how, how productive You're Well, I did, I did pull it up. What I want for later. I did some, you know, some of the ideas you had Fernando were talking about.

I put them on this screen to It. Now, one of the other things I wanted to bring up here is Textron Gang has been doing live recordings, like, like you've been broadcasting live. That's kind of exciting.

Live. So we recorded this at 10 in the morning, east Coast time. I'll be live on Textron Gang today at noon.

I'm live on Textron Gang every day at noon. Make sure Monday and Friday, Make sure you're tuning in for that 'cause like that. Those, those are some fun discussions.

Um, Absolutely. Fernando, whatcha working on? So, uh, we're just, uh, kicking off.

So we just published in December, uh, our cybersecurity decision maker survey data. And I can spend five days talking about the, the, the, the data. We're just kicking off the new edition for that.

So that should be coming the April timeframe. Uh, before that, there's all the excitement around covering the, the RFA conference and, and what's coming around that. So that's, that's what's occupying my mind right now.

Exactly as of right now. My calendar for the conference is 99% full kind of thing, but, um, but uh, yeah, that's, that's, that's what top of mind. Plus writing about all things ai.

Of course, I haven't, I'm writing on ai. I got one more thing I wanna throw on the pile for people. By the time that people listen to this, we should have published our initial list of what we're calling the Quantum Security 25, the 25 Leading Thinkers in Quantum Security, post Quantum Security.

We're doing that in, in partnership with our friends at Digi Cert. And if you think this AI stuff is crazy about security, what do you see? What Quantum's gonna do to it?

And uh, so go check that out as well. The Quantum Security 25. I'll remind you that if you wanna see what quantum will do to security, I suggest you check out the Seminole Work sneakers with Robert Redford.

Um, That's a great movie. Astronomy, I get to quote that. And hackers all the time.

And people think I'm kidding and I'm not, because believe it or not, risk architecture really did change everything. Thank you, Angelina, Julie. Yeah, these movies were ahead of their time.

Well, We hope that you enjoyed listening to this episode 'cause I had a lot of fun recording it. But if you did, we would love it if you joined the conversation, check out our YouTube channel and maybe download this in your favorite podcast application of choice. Like if you're running or mowing the lawn or whatever it is you do in, in your spare time.

Uh, but when you do, do one of three things for us, leave us a rating, leave us a review or leave a comment. Agree or disagree. We, we just wanna have some fun discussion going on 'cause that really does help the show grow.

com and the Future Room Group. com is the place to go. You can also check out the Techstrong TV website or the Techstrong TV app.

I'm trying to get it running on an old iPod video. Uh, check in for the results. But if you have any other smart device, I'm sure it'll work on that.

Apple tv, Roku, iOS, Android, you name it. We will also want you to check out Security Boulevard on X, Twitter and LinkedIn. The handle is security, BLVD.

And there's a lot more content that you wanna check out there. We wanna thank you all for tuning in. We'll check you all out next week.

I am Ted Weatherford. I'm VP of Business Development. I've joined with John, who's our distinguished engineer and architect on our E-Series products.

Nice to be here. Yeah. And I'm gonna cover the X-ER products Now.

Uh, the X-er product is, uh, ethernet switch. And what distinguishes it from all the other ethernet switches literally is that it's programmable and its programming model is a load store type model. You have 3072 little Harvard architecture cores inside this ethernet switch chip.

Um, all the competition is approaching the problem with a fixed pipeline. They may call it programmable, but at the end of the day, it's a fixed VLIW pipeline with fixed elements and programmable elements, and it has a fixed latency and you don't have the flexibility to do tasks in parallel. What we've done is run to complete model with this 3072 little Harvard architecture cores.

And it gives us two things. It gives us more flexible than any ethernet switch chip that's available or has ever been designed with an actual architecture I'm showing here that allows us to scale down or up really gracefully to call it an FPGA. 'cause it kind of looks like an FPGA floor plan would be a complete mis misnomer, but it is symmetric.

And if you look at all the little squares, there's 64 of them and each of those 64 squares has 48 processors. Okay? And they're run to complete.

So when you go to program this, you're not forced into a pipeline, okay? Of sequential steps where you write the code, you turn the code 90 degrees and you drop it into the pipeline. You literally can do recursion, you can do whatever you do within your instruction space and the time you have for the minimum packet size.

We've sized all the caches, we've sized all, all the clocking so that you have this amazing low power device with tons and tons of header processing. You can, you could do 11 layers of MPLS, for instance. So all kinds of IP, inside ip, any kind of encapsulation, whether it's already a standard or something that's developed.

And I'm gonna, um, so yeah, thank you. Uh, alter ethernet, things like that, these sorts of things that are starting to come outta the woodwork UA link. I'm guessing that's UA link here, but, um, how does that play in this space?

It's exactly where this shines. And for alter ethernet or eon or some of the ethernet centric extension protocols that are coming out for ai, we're, we're, we're, we're there. We can ship this and some of the physical layer mechanisms like the layer two retries, there's things in there that we didn't catch with this particular tape out.

But, uh, protocol wise, uh, congestion management wise, um, the PA in flight packets for the servo loops for all your congestion management, all that's dialed in and completely flexible and build your own server for any scheme. Um, so it, it's uh, it's ready for that, uh, better than all the other products 'cause they're fixed in function. Um, and that was the one exception is the retry.

And then on the, uh, the UA link reference, this is not a UA link switch. That's correct. It's not, um, I'll just offer the latency of this switch while we're at it.

Um, a UA UA link is a very low latency switch. Uh, it's backend scale up centric. This is a front end scale out or a backend scale out a a product.

Um, and we can get down to, you know, 400, uh, and 50 nanoseconds, which is screaming for a traditional scale out switch. I mean, your broadcom's at 800 when you really measure 'em. So the, one of the advantages of having a run to complete architecture is you, you can dial in the latency to be as good as it gets.

So Ted and Jack Poller with Paradigm Technica, can you talk a little bit more about run to complete and what that means for You? Yeah, thank you. So, um, there's really three different architectures.

There's a Von Noman of Harvard and of data flow, uh, and run to complete, uh, speaks to, um, an architecture where you have an instruction set, uh, that you're running, right? Uh, and you'll run to, you complete the overall operation of the packet frame coming and being modified and being sent out. So the frame shows up, ethernet, it gets modified, it gets shipped on its way.

Uh, and what run to complete allows you to do is have complete flexibility. You don't have to, uh, handle the packet one piece at a time, sequentially. You can move around anywhere in that packet header or that packet within a window.

So the run to complete is a amount of time or clock cycles. You have to do work, but that work does not have to be only sequentially. That's my level of understanding.

Yeah, it's more flexibility and it allows you to do things in parallel. And there are many packet operations that can be done in, in parallel. So you, you end up saving, um, time and getting latency from it, uh, and not being caught off guard if protocols change or you have something interesting where it really matters.

'cause all of us use standards, right? Mm-hmm. It matters with all of the instrumentation and telemetry people, the observation and the troubleshooting of these network is getting increasingly complex.

And this kind of model just allows you to build the best instrumentation of telemetry, um, with, with really less constraints. Yeah. So it's symmetric and it'll scale either way.

So each one of those blocks is a 400 gig block. So if I want to go build a 400 gig, a tiny little switch, I just do one block. If I wanna scale up to 400 terabit and, uh, and I shouldn't have said that number, um, then, then you increase the block size.

Um, so it, it does have that sort of, um, geometric scaling up and down in this graceful, symmetric way. Um, which you won't see when you look inside the, the fixed function data center switches, you'll see pipelines and they're fixed in nature and there's a number of them. I'm not gonna cover this, it's an eye chart, but I want to point out that we have large amount of packet buffer.

We're very low power. 8 T in derivatives. It's the same dye, but we down clock it.

You can turn the SerDes down. The sardis can be all different speeds. So we're software defined even at the physical layer.

You can have Sardis coming in at a hundred and going out at 25 with different modulation schemes. You can mix and match. And this is actually really, really, really sexy because you've got these new fabrics up there with a hundred giger that have just been deployed last summer and they'll be around for a while.

And then downward, you've got all the legacy. So you can run a 10 gig, 25 gig, 50 gig, a hundred gig, 200 gig with whatever series and whatever modulations you want. So it really gives you this building block for looking backward as well as forward.

8? It's 'cause we're going after the edge. And I'll cover that later.

We're going after half rack, full rack, two rack. We're going after satellites, we're going after base stations. Okay?

Um, the performance is there, the chips are here, the boxes are out by our, our Taiwanese friends Act. In an edge core, you can just measure everything, but you gotta show people some performance if you're claiming to be programmable and lower power than than a Broadcom or an Nvidia or a Cisco or a a barbell. So we do that, and that's what this is.

It's the watts on the left and it's breaking down the certis, the core, you know, and it's showing what your max and and mins are over, over that. 8 T switch that's programmable at under 200 watts. It's disruptive.

Um, this is showing you efficiency of the most important thing about a switch, besides its rad switches or connectivity at the end of the day, and how much bandwidth and how many different connection points or ports you can have. But the other thing that matters, and it really matters is the shared memory or not buffer the frame buffer. The packets come in and do they come in fair?

And can you utilize, in times of rustiness, can you utilize the whole buffer that you paid for without overrunning it? So in our example here, we take 127 ports running it at a hundred gig each, and we ram it out 100 gig port, and we find out how long. So the packet buffer fills up, does it overrun?

And then we do it, you know, at the different, over subscription rates and different packet sizes. And we sew that the utilization never drops below like 86 or something. And in real world tests.

That's amazing. Okay. So if you're a switch head like I am, then you're like, oh, wow, that's amazing.

The, the, the Tomahawk products that are dominating the market. Ted, yeah. Ray Luc Silver, still trying to get a handle on this.

You're not actually generate, you're not actually manufacturing deep use. You're actually manufacturing the chips that would go into DS or ships that would go into switch. We Have two products, they're both chip products.

I'm covering the switch first. It's a separate tape out and it's just an ethernet switch chip with 120 800 gig er on, it's a, it's a switch chip. Next we're gonna cover our EERs, which is a DP.

So we have two products. It is amazing. 200 engineers doing two products of this complexity.

Is it? It's a lot. So we have two chips.

They go together nicely. They have the same SER ip. They play really well together.

'cause the highest volume opportunity is the top rack and the front end interface or the backend interface into the server or the GPU server. And so we book in that with these two products, especially for the edge, um, root chip company, two chips. Um, I want to, uh, I'm gonna pick up the pace a little bit.

This is showing, um, the fixed pipeline and the map pipeline approach, which is not ours against this run to complete full SDN. We can imitate the other architectural approaches. Um, they can't imitate us.

So we can make the trade-offs between latency or the amount of work you're doing and the amount of power you're spending. Um, so this is more of a deep dive for somebody that wants to compare these products to data flow architectures or fixed function stuff. But suffice it to say, we're trying to say that we have, you can have multiple pipelines, you can have branches, you can have, um, a physical connection and a logical connection that's flexible.

Uh, Challenge with something, yeah, like this in the past has been latency. I mean, to do a, to do something that's not pipeline, an non map pipeline and achieve the line speeds has always been impossible before It's pr We're proud of it. Yeah.

Uh, I'll give you a clue if you're designing for your worst case and you're building a pipeline, you've got a lot of stages you don't need. If you build with us and you put our 3000 processors in, in a line, if you want to pretend it's a pipeline, uh, you can, and you'll just have less instructions. Or you could have one processor handle a whole packet.

You can build a pipeline like they do, or you can have one processor handle one flow. You have this whole range. I guess The question is what's the clock speed and you know, how Sure, how fast do you be able, are you able to maintain Yeah.

Line speed across, you know, however, 128 ports I guess. 8. It's, it's mind bending.

Um, and I can just say that the team, uh, is basically on their eighth or ninth generation network processor or switch when you combine the people. We have people from Motorola, Freescale, uh, you know, Nvidia, Broadcom, um, Juniper, Cisco. It's a pretty senior strong team that's been doing network processing, DPU and switches for, you know, 30 plus years.

Yeah, no, it, it is, you know, if you, before we had the products, it can be a lot more, uh, interesting debate. Now we just have the products so you can just put 'em on the test and test. In fact, we have built-in self test that we don't advertise, but you, that's a really nice feature we have too.

8 terabit of, of line rate. Every port has, its built-in Xia tester. Um, so you can even test the device in its own print circuit board without an expensive $3 million tester.

So programming model is always the challenge for programmable products. We have an assembler that we've wrapped in Python and we provide libraries. You've gotta configure the tables for forwarding the tables for security, the tables for quality of service, the meters, the counters.

You have to set all that up and they, their structures. And we have libraries and you have to program this thing in our assembler. However, we opened up the instruction set and our first customer, which we did a PR on, uh, called oxide, uh, they're a local, uh, cloud as you know, in field.

Yeah, they, they wrote a P four compiler on it. So this is a simple risk instruction set. I shouldn't call it risk.

It's technically a Harvard architecture, but it's a small little instruction set that you'd be familiar with if you're a, a programmer, especially somebody that really programs deep and they just wrote a compiler on top. So our whole ethos is it's open, do what you want. And we also have plans of putting out a P four compiler early next year also.

'cause we have a lot of customers that really want that, that higher level or what I would would call fourth generation language. It's kind of dated terminology, but, um, so today we give you courses, we've got all the examples, um, and we haven't had a customer we had to write all the code for. They've all taken the classes and written the, written the code and uh, and uh, done quite well.

And one of them is, uh, all foreshadow is SpaceX. So we're really excited about that. Um, the architecture and the normal stack of what you target to on the very bottom, I'll start there.

You've got the switch device, that's what you really care about. But you can also do simulators and you can also do, um, hardware emulators. We built our own hardware emulator.

We have a room full of FPGAs of design. We did ourselves, we do all our own hardware emulation. We don't buy hardware emulators.

Uh, we have our eval boards, uh, which are just, uh, rack systems, uh, you know, heats of boxes with front panel ports like you'd see in a top rack switch or a fabric. And then this just shows the network operating system down and what we provide, um, and we put all this, you know, on open, anybody can get to it. Uh, and the network operating system of choice for all of us now as Sonic.

Uh, and we do our own sonic distribution and then we have two partners that provide hardened sonic as well. Um, so that's what your, your normal stack looks like. And this is what a box looks like.

I have it right over here. I just wanna say it's real, it's available. This particular one, um, uh, is what we call the universal switch because the MPA connectors are Q SFPs and you can put whatever you want in them.

Each little rectangle is four C days and the SerDes can run it whatever speed you want. And there's common media for four by 25, 4 by 50, two by 50, et cetera, et cetera. So that you can build a top rack here, which we call a, a top rack upgrade or a tor upgrade so that again, you can connect to any kind of speed up and any kind of speed down.

You can migrate from older network interfaces to newer ones or maybe one storage box has a certain kind of thing and it's in the same rack with a server or a GPU server. Got Got a question? Yeah.

Specifically about the, the tour here. Um, do you think, and you can theorize here a little bit, do you think once 2 24 er comes around, you'll be able to stick with the same form factor, low power and not go liquid cooling? Depends straight up on how much bandwidth you want.

Straight on bandwidth. 6 T, you could stick with this. Yeah.

2 T would be harder. Yeah. Uh, it'd be harder.

Um, that's, I that I'd have to defer to a switch expert. Um, that's the answer. Okay.

Yeah. Maybe, maybe 51 2. But yeah.

And, and our architecture, um, is really on par at a geometry level with the others. So if we do a hundred terabit switch right. It it's gonna, it's gonna be a thousand watts.

Yep. So what we've done to just be so disruptive on power Now, full disclosure Sure is we went to five nanometer when everybody else was still in the old place, you know, was going forward with very large rated switches and we did it to capture the edge. Yeah.

The economics of the edge, the power of the edge, and the right amount of connectivity for the edge. Um, I got an example on that coming. Um, I'm gonna just move faster.

We built this for a large, uh, hyperscale for this exact thing. Their particular format is just a different cage. This is a 16 by 800.

So that's the tour they happen to use. Uh, and this gives them a benefit of half the power, a half the Rackspace, um, uh, a quarter of the cost of that product was GA 24. Yeah.

So how long has this puppy been out there? We first sampled this April of 2024 and we called it generally available. Both our products have been first spin, no metal spins to market.

We called it generally available in November of, of 2024. And it's been in mass production since summer of 25. Yeah, no, this is out there.