Techstrong TV January 27, 2026

Hey everyone. Welcome back here to Techstrong tv. Hi, I, and happy to, uh, introduce my next guest to you.

His name is Evan Pros. Evan is a, uh, product marketing manager with Active State, and let's welcome him to Techstrong. Hey, Evan, how's it going, man?

Hey, Owen. Good. Thank you.

It's great to be here. Thanks for having us. It's good to have you on with us in Active State.

Evan, I always like to give our audience a sense of who's, who they're listening to. So I said, you're a product marketing manager, and a lot of people may say, oh, marketing, you know, bad word, but give, give people a sense of your journey, Evan, how, you know, how'd you get here? Definitely.

So, I mean, honestly, my interest in technology kind of goes way back to my university days. I went to a very technical university and was around, you know, a lot of software engineers and a lot of engineers in general. And I think that was the first time in my life I had that realization where you sort of understand why those things are cool and you want to get closer to them.

Uh, you know, I was studying psychology, so way, way off from that. And so my objective was like, how can I find a way to get closer to the world of products and these things that I'm starting to be interested in? And I was doing some marketing work at the time and, uh, there was an opening at SAP for an internship, uh, to do product marketing.

And so I sort of got my foot in the door at SAP, you know, over a decade ago starting out in product marketing. And since then I've tried to really continue to be close to the product and technical world. Um, before my role here at Active State, I spent a bit of time at VMware and Broadcom working on the Tanzi division there.

And so I worked with Sure, um, application modernization technology specifically on the consulting team. And so we worked with a lot of customers to help them go and modernize legacy infrastructure, you know, move them from monolithic code bases to something like a cloud native development framework. And so, um, yeah, like you say, I've really been around technology for the greater part of my career.

And I would say too, you know, product marketing in particular, our job is to listen to the customer, is to understand what their problems are. And so I may be marketing, but I spent a lot of time chatting with the, uh, you know, world of DevSecOps and hearing firsthand sort of what they're experiencing in their day to day. Gotta ask you a question that's not a guitar neck I see behind you, is it?

It is, it is. Well, that makes you a bonafide tech dude. If you've got the guitar in the room with you.

I know. Are you, are you good? Can you play well?

Or, or you just hack around? You know, I'm kind of getting back into it. I play drums for most of my life, but, uh, drums are not the most conducive to a little apartment in Toronto.

So, uh, no guitar's a bit more manageable for sure. Yeah. So They're a lot more conducive now.

And you can get drum pads electronic and just wear, uh, uh, EarPods or something, you know, earphones Totally, Totally Compared to banging skids. But yes, it, it amazes me though, you know, as someone like me who, who speaks to a lot of people here on video like this, the amount of tech people who have guitars in their rooms, it, it might be approaching 50%. It's nuts.

Yeah, I think I would agree with you. I think going back to my time at VMware, you get on a call someone, and like you say, 50% of the time there's a wall somewhere in the back with, you know, at least a Couple. Yep.

More than one even. Anyway, good stuff, Evan. Let, let's talk active state, right?

It's a, I've known about active state now for oh three or four years. A good friend of mine was there a while ago, but I'm sure there are people out here in our audience who are not familiar with active state. How would you describe it to them?

Yeah, definitely. So, like you say, active spa, active state has been working in the open source software space for actually a couple of decades now. And we really got our start way back help organizations package and distribute open source languages.

So namely, you know, legacy technologies like Pearl Tickle and Python for use in sort of more common enterprise applications, mainly porting them to Windows. And so today I think, you know, a lot of people think of us as the Pearl Tickle and Python people, but a lot has changed over the years. Uh, of course infrastructure has evolved and so has teams need for open source in general.

And so over the past couple of years, our focus has really been on taking that ability to build open source from source and extend it across all of the major language ecosystems. So in doing so, we're tackling a lot of the complexity in things like solving complex dependency chains and ensuring that open source can build in a repeatable and predictable fashion for any o operating system. And sort of the, the result and what this, why this matters for customers is now we've developed a catalog of over 40 million built from source open source components.

And in doing so, we're able to give customers access to these components. And they know that they always will have the fewest amount of vulnerabilities possible, you know, it's safe from malicious code that might be injected somewhere in a supply chain attack. And we're always able to provide them the latest and greatest version of that open source.

And so the great part about this catalog is customers can consume it in the way that makes the most sense for their business. That could be simply, you know, mirroring the component into their package registry and using them like they would any piece of open source or that could be coming to us and saying, Hey, I need a container image with this software inside of it and I need it to be secure and updated for me on a continual basis. And so, you know, that story of container sort of relates to what we're talking about today.

But really, I guess in short, you know, that's a lot of rambling. Our goal is to help software development teams improve their security posture without slowing down the application teams as a result. Love it.

Couple of questions. Yeah. Follow up on that.

Look, AI's changing everything, Uhhuh, especially AppSec, especially in open source. I guess maybe we could come into it when we talk about the report, but I wonder if AI has had any sort of, uh, impact on that. But even before we get to 11, just housekeeping for people who might be, want to go find out more about active state, where can they go?

No, the answer is very simple. com. Uh, specifically if you're looking for the report we're gonna chat about, we have a resources tab, you'll find it there.

No problem. Very cool. All right.

Let's talk about this report. It's the 2026 state of vulnerability management and remediation report, container security edition. Um, what do you, what do we get in our hands around here, Evan?

Yeah, absolutely. So, uh, we started doing this report annually a couple of years ago. And the first iterations were really about asking, you know, our customers and the community at large about how they are dealing with open source vulnerabilities.

You know, their ability to sort of go and remediate them and the trends they sort of see going forward for the future of this. Um, obviously we've been talking with a lot of customers over the past couple years and containers, as we know, were sort of the prevailing infrastructure for teams to start deploying applications. And so we said, let's go and ask these same questions from a container point of view.

And so, um, last year we interviewed 250 DevSecOps professionals. So you can think titles like, you know, application security, uh, very true DevOps and platform engineering titles, as well as a lot of engineering leaders. And we, we sort of ask them the same things like, how are you managing vulnerabilities in your container images?

Is this something you're able to scale and keep up with on an ongoing basis? What are the key challenges you're facing going forward? But also, you know, on a more positive note, we ask them where do they see advantages, uh, going forward in the future to solve this problem?

What are they looking forward to, uh, exploring in 2026 when it comes to vulnerability management? Very cool. Um, you know, I love when you've done a report kind of a couple years, so you build up like sort of a body of knowledge.

'cause it gives you, you know, with that Monday morning quarterback kind of view, right? Where you could look across years and see trends that build not just over the course of a year, but over the course of years. Um, but let, let's focus in on this, this, uh, year's report.

Evan, what if I asked you, Hey, ev what were the three key takeaways from the report? How would you answer me? Definitely.

So I think the most striking thing for me was, um, of all of the people we interviewed for this report, 100% of them said in some capacity, containers are critical to their production workloads. So, you know, maybe that's not surprising given the audience, but every single person we talked with said, containers are something I am invested in and I'm interested in. And, you know, stand alone on that stat, it's not particularly interesting.

But I think what what makes it really striking is we also ask them how likely is it that you've experienced some form of container related security incident or breach over the past 12 months? And of that same set of people, 82% of them said they think they have likely experienced some issue in that timeframe. And so when you compare, you know, the number of a hundred percent of adoption versus 82% security incident, you really have to think like, what is going on here?

Um, you know, it's pretty clear containers have become basically near universally adopted, but are we keeping pace with the security measures that we need to put in place to solve that? Are we able to even tackle this problem? And so I think we knew this was a problem, but seeing that 82% number was something that really kind of stuck out to me as, wow, this is a bigger problem than we might think.

So that, that is sort of the foundation for all of this. The second thing I thought was really interesting is, um, we also ask companies, you know, how likely as a result of these vulnerabilities in your containers have you potentially run into an issue with a compliance audit or some sort of governance issue? And again, 78% of organizations said they think they've probably likely failed a compliance audit in that same timeframe.

And so you start to see this story go through of, you know, containers are important, we're not able to keep up with the vulnerabilities in them. And the outcome of that is that, you know, audits are failing. CVEs are, you know, super prevalent with inside their own environments and the, you know, the outcomes of that are kind of crazy.

You think about, um, you know, the potential penalties of an audit failure, maybe that's financial, maybe that's reputational. And so just sort of that combination of the through line is, is quite shocking. And then I think the sort of final thing that's kind of crazy to that me is that, um, when we asked why do they think this is happening, um, you know, what's causing this, A huge proportion of them cited visibility into their container images as sort of the root cause of this.

And I think, you know, if you think over the past few years, things like SBOs and scanners have been talked about, you know, endlessly and teams have spent time implementing these into their pipelines. But the takeaway here is sort of, even though we have this sort of surface level visibility from the tooling, the outputs of that tooling isn't really giving anyone any meaningful outputs. Yeah.

And, and, and it's, it's, it's literally you use the word surface, it's the surface. It's not very deep. Yeah.

You know, I think this is why Evan, we've seen like companies like SU, for instance mm-hmm. Right? Come out with their own, um, like for their suse enterprise Linux or whatever they call it, right?

They, they have their own certified packages that are hardened to check for security. We're seeing, uh, who SUSE had bought that company, oh, I forget the name of the company. It's their cloud native company Rancher.

Right? Right. They're, they're doing a similar thing via rancher with like hardened certified containers that are what they say they are.

And SUSE is going to vouch for the security. It's not just suse. A lot of companies are are now trying to say, Hey, we'll, we'll, we'll stand behind the container image you got from me.

The problem though, quite frankly, is sometimes you're trading that open source freedom, Right. To get locked in to a particular vendor's, you know, distro or what have you. And, um, and I don't know if people are comfortable doing that, in all honesty, right?

Yeah. They, they people want freedom. Um, but on the other hand, you know, the container, I mean, there's just a, as you said, we don't really, you know, we could scan con containers the same way we scan other infrastructure doesn't mean we remediate it.

Right? And even if we're scanning it, it's only as good as what that scanner knows today, not what zero day or new vulnerability comes out tomorrow. Yes.

Um, let me ask you another question. Yeah. Anything in the report that kind of made your eyes pop open and say, whoa, I didn't see that coming?

Yeah, I mean, I would say there's sort of two things that I thought were super interesting actually, just going back to what you talked about, about, um, good. A lot of organizations are going and trying to build this model where they're saying, Hey, use our standard source for like you say, container images or whatever output may be. And we actually did ask a question, which was, how much do you trust, you know, we use the language curated catalog, um, to effectively that's a fair word.

Yeah. Effectively mean the same thing. And 77% of uh, you know, are the respondents said they do trust this model versus, say, going out to the open internet and pulling, you know, an artifact.

But what's really interesting is we also ask them like, how frequently is your team actually just going to the open internet anyways in sort of pulling from, you know, whether it's Docker hub or one of the language repositories. And 90% of them said, oh, well that's actually still what we're doing. And so I think to your point, there's a lot of interest in this model of, um, how do we go and get secure open source from a vendor?

But, you know, either people aren't finding what they're looking for, the convenience of going to, you know, the open internet is still sort of prevailing. And, uh, I mean, I think for us at Active State, that's great to know considering we're sort of on a mission to go and rebuild as much open source as we can and kind of cross ecosystems. So that's one thing I think is just that sort of disconnect between, uh, intention and reality.

And then the second is on ai. Of course, you know, we probably can't escape any one of these interviews you do without talking about ai. But, um, one of the interesting positives, uh, from the report as well is that a huge amount of people kind of said they believe that AI is going to be one of the technologies that sort of is the tipping point to solving this problem of remediation.

They expect that, you know, whether it's through automation or through some form of AI vulnerability management, this is something they're looking to invest in going forward. And this surprised me, not because, you know, we know AI is popular, but just the idea of it being so close to your code base or, you know, touching potentially Cody wrote, I thought this was an interesting statistic as well. It is, because, you know, you must had a lot of optimists in your survey, right?

Yeah. Because a lot of people say, oh, no, AI's gonna make it worse. Right?

Right. Because the, the bad guys are using AI and, you know, we don't know what's going on there. And we automate, we go faster and we take humans out of the loop.

And, you know, AI is less secure. But I'm glad to see that so many folks actually think it is gonna help. 'cause I I'm in that camp, I think, you know, I don't think it's gonna be nirvana from day one, but I do think over time we're going to see it really helping out here.

Right. And I, I, well, I'm an optimist too. com under resources and it should be there.

Yeah, absolutely. I think that's the easiest way. com, you can hover over the resources tab and I believe it's right there.

So, um, yeah, I think very cool, easy way to find it. Yep. And you know, I I I wanna leave people with this again, I wanna return to active State in their mission, right?

Yeah. Give it to 'em again, if you don't mind. For sure.

So I think, like you said, you know, people are looking for a place to find secure, open source. They don't want to have to deal with the vulnerability challenges that come along with open source. As we know, everyone's got endless amounts of it in their stack today.

And really what we're doing at ActiveState is building a secure and trusted source for as much open source as we possibly can. So, like I said, we've amassed a catalog of over 40 million open source components that spans every major link language ecosystem. So think Python, Java, JavaScript, and teams can come to us and effectively plug right into that catalog that could be getting those packages to replace the ones they're pulling from places like Pi Pi or NPM or like, you know, in terms of this report, they can come to us and say, I need a container image that's minimal, that's secure and only has the exact pieces of software inside that I need.

So really our objective is to give people access to open source they know is free from vulnerabilities, is, you know, built by a trusted source in a hardened environment. And that is flexible enough for them to use without having to go and say, Hey, development team, like retool the entire way you're working, put new tools in place. That's not how we operate.

We're simply slotting into what teams are doing today. I love it. Evan, thanks for coming here on Tech Truck tv, man.

I appreciate it. Good report here with this, uh, 2026 edition. Come back and keep us posted about what happens at Active State.

Of course. Thanks for having me. Appreciate it.

My pleasure. Evan Pros, product manager, product marketing manager, excuse me, for active state here on Tech Trunk tv. We're gonna take a break.

We'll be back with more. Hey everyone, this is Alan Hummel, CEO of Techstrong welcome, welcome to this very special virtual event that we are producing in partnership with our friends at Microsoft. The event is titled, unlocking the Future of Agentic Experiences.

And it's gonna be a series of videos in, in this virtual event that you're gonna be able to, you know, take a look at and, and interact maybe with some of the analysts and speakers here. I really think you're gonna enjoy and get a lot out of these videos in this event. And look forward to hearing your feedback.

I'd like to kick things off with our keynote and it's our keynote. 'cause I think we've got two terrific speakers in this one. And it's around the future of apps, right?

And it features Fu Futurum, CEO and principal analyst Daniel Newman. If you've ever seen Daniel on any, either many TV shows or, or, uh, conferences that he keynotes, you know, he what a dynamic thought leader he is. I think you'll enjoy it.

And Daniel is gonna be speaking with none other than Ryan Cunningham. Ryan of course is corporate VP for the power platform at, uh, Microsoft. And you know, Ryan is gonna share with Daniel and with you the all up vision.

The, you know, the all around vision for power platform. We're going to connect the dots between apps, agents, and interfaces, right? Ryan, and, and you know, with Daniel are going to illustrate how Microsoft is leading automation in this AI era.

He's gonna articulate how Microsoft is enabling every organization to build, govern and scale intelligence solutions with unmatched speed and trust driving the future of ag agentic apps. It's a great discussion and I think it's a great learning experience. So here's Daniel Newman and Ryan Cunningham.

Alan, thanks so much for that introduction and to introduce myself, I'm Daniel Newman, CEO of Futurum. Very excited to be here today with all of you and even more excited to introduce my guest for this conversation. Ryan Cunningham from Microsoft.

Ryan, why don't you say hello to everybody and give a little bit of background on the work you do at Microsoft. Uh, Thank you Daniel. It's awesome to be here with everybody today.

So, I'm Ryan. I'm the corporate Vice President for Power Platform here at Microsoft. So, uh, look after all the teams of, uh, uh, product people and engineers and designers that are building, uh, really our low code application platform and the future of where that is going.

Uh, you know, really excited to talk to you about that today, Ryan. I've been working, uh, with and around your team for many years as an analyst. It's been great to follow.

Of course, the change that's been going on in this market is extraordinary. And I think that everyone out there is gonna gonna leave this, uh, conversation knowing a little bit more. And hopefully maybe you'll give us a little bit of that, uh, secret sauce about all the stuff Microsoft's doing.

Nothing too secret though, you know how that goes. Oh, I know. So let's, Let's start big.

Uh, I mean, when we talk about the future of apps, connecting agents, interfaces, applications, you know, what is the kind of the North star for Microsoft? What are you, what are you guys heading towards here? Yeah, uh, look, it's a, it's a crazy time to be alive in a business application platform, uh, environment, right?

Because, uh, this whole world is, uh, being turned upside down in actually two dimensions at the same time. Uh, one is how we build software, uh, radically changing in a world of agents and, and vibe coding and everything that is filling up our LinkedIn feeds as technology professionals. What's really interesting right now is the dramatic expansion in efficacy of what I can build and the dramatic expansion of who can participate.

At the same time, You have to be evolving the platform even more and even more quickly to, to get them what they need and what they're trying to do to accomplish the, the future that they're trying to build. Yeah, a hundred percent. And, you know, I I would say to, to even build on your last comment 'cause it's relevant here.

Um, it's not just an opportunity for more people to tinker and build things. It's actually really an imperative. Like, if, if we're really gonna accept the premise that every company that wasn't born yesterday is operating inefficiently and needs to, to rapidly advance in a world of agents, then the expertise you need is not just the AI technology expertise.

You actually need to go get all of the process expertise, you know, all the humans who know what it really means to run a more efficient HR department or finance department, or, you know, whatever it is, they're sitting with a real job in that department today. You gotta go figure out how do I harness that expertise and bring those tools right to the, to the point where the process is actually happening today. And that's where you need a higher abstraction platform that has agents built into it that help do the coding, that help do the work.

Microsoft does have some really unique approaches in this space. And, and particularly if you look at this broader world of how software is getting built and code generation and agent swarms and every other term we're coming up with right now, you know, where we're really focused right now, particularly in the space of business applications and productivity is really make that relevant to the way companies run and operate. You know, we're not out there to, to, uh, you know, serve any possible whim of any possible developer on the planet.

There's lots of great tools for that. Microsoft makes some of them in other places. But here we're really focused on the, the core operating system of a company.

And by, by that I don't mean windows. I mean sort of all the business applications, business processes, specialist teams of people that today make a company tick. We're seeing consolidation in this era.

Customers have a ton of choice. Yep. Everyone kind of says use our agent thing, right?

Um, what we're gonna wanna see is, you know, the orchestration is gonna be super important. And then of course the, the speed, flexibility, access to all the tools, data, cloud, and of course Microsoft's in a very small group, right? Companies that has pretty much all of those things, right?

Um, not all, not the only, but one of a very small number. And I think that makes you competitive. I wanna go to the, the pragmatic side because the, uh, viewers here are probably thinking about, you know, how do I do this?

How do we do this in our firm? You know, we hear some of those stats about AI ROI and the enterprise and, and, uh, let's just say that I'm a, I'm a absolute believer, but I do think there's some hurdles, you know, what are those kind of key enablers you're seeing fundamental enablers, enterprises, you know, need to get right now, right? To make sure that those, those POCs and those production, uh, AI projects start to work and really show value.

Yeah. We're seeing customers, um, adopt exactly the mentality you're talking about. You know, not just how do I run the current process faster, but what if I fundamentally changed the process itself, um, to really great effect.

Um, you know, we've, uh, we've shared some stories of retailers, um, that are starting to use agents and apps and automation together to totally change how they do things like fraud detection and, uh, even refunds and returns management. Um, you know, if I go contact an online retailer and say, I want a refund, uh, you know, traditionally that's a human going and vetting, is that a real customer? Did they buy something or is this fraud?

Does it meet our return policy? Which is by the way, usually like a 50 page PDF that changes once a quarter. Um, you know, and then do I want to issue the refund or can I save them as a customer?

And that's super slow, it's super inefficient and it's really expensive and often it's outsourced to vendors. Um, you know, can I go implement an agent that does that instantaneously, or at least does major parts of it instantaneously, um, you know, really starts to change my operating and my risk profile and my customer relationships. And so, you know, even in use cases like that, starting to see, you know, millions of dollars of value unlocked really quickly and just better customer satisfaction, actually the balance of value is really shifting towards that process expertise.

Um, and I think part of the challenge though is just, you know, very few people with real Jobs woke up this morning and said, God, I want to build a business application, or I want to automate a process. That's just not a thing that happens to most regular people. Um, but a whole lot of people woke up this morning and said, man, this part of my job sucks.

That could be better. You know, I wish we didn't have to burn so much time doing X. Right?

And, and really harnessing that energy, that value those skills and those people, and bringing great tools to them. That's part of the whole thesis behind why a platform is, is critical right now. You know, what does it mean to totally change that interface into a human and agent collaboration space?

What does it mean to go see the activity of what agents are doing on your behalf when they need your input? Let's talk a little bit about Plan Designer. Yeah.

Uh, you know, we're seeing, we go from manual to automated to, you know, to agentic level orchestration, which is great. One of the key things too is gonna be trust. We gotta trust our systems.

We gotta be sure that, you know, the agent, uh, workflows we're building, that they're inspected, that they're constantly modified to be sure that they're right, that they're traceable. Like talk a little bit about kind of how Plan Designer can help companies. 'cause that's a lot of work, by the way.

Yeah. That's a lot of work that can automate or, you know, streamline some of that outta the process. Yeah.

com. You can try it today. But, uh, what it really is, is of a different kind of AI centric development experience.

Um, you know, you go type into that box a business problem. We do not assume that you just want us to spit out a thousand lines of JavaScript that you, that you need an app. Um, like a lot of vibe coding platforms today, we actually do what a real software team would do.

In fact, we've built in a digital software team, we've trained a requirements agent, a process agent, a data agent, a solution architect agent. It's a highly collaborative environment. This is not a sort of throw a paragraph over the fence and watch magic happen.

It's really sort of training and teaching people with process expertise, how to think like software architects and solution architects so that they can know up ahead of time, why do I want AI to do certain things? Where do I want it to work? How do I want it to interface with humans?

And that's really the foundation of that trust in the system. Have you seen, uh, some examples out there of Plan Designer being sort of delivering promise? 'cause it sounds super optimistic.

Are people using this? Oh, a Hundred percent. We have started to see really interesting sort of challenges thrown at it.

Um, you know, we have, uh, customers in highly regulated financial services context that are taking decades of old homegrown, uh, non-compliant software that was built over, whether it's, you know, hacked in Excel or built one off and sort of saying, can I use this to rapidly modernize what I had before in a way where, you know, traditionally going and turning all that old stuff into full stack software was just incredibly costly and, and cost prohibitive. Um, you know, starting to bring those things into plans and generate a more robust plan for modern software moving much faster. Um, we've even seen huge extremes of that.

I've, I've, I've seen a customer take, you know, 50-year-old cobalt code and just paste it into plan design and say, what the heck is this program doing? And can you help me build a better version of it? Um, and actually the results were pretty promising.

So, um, you know, people are getting really creative with, you know, bring the problem, bring the challenge, bring you know, sort of the business area that you want to improve, and then start working with these agents and on this digital software team to, to design a solution. So, you know, we're doing all this work. We are trying to train people to think differently, remove constraints, whatever's possible.

But the UI is, that seems to be the next frontier. Like the old enterprise software's like, these are the things you can move and these are the things you can't, and what you can customize and here's what you can't and here's your dashboard. And it's like, great.

But in the future, like Right, I might just wanna say, Hey, you know, Microsoft, whatever. Yeah. Uh, this is what I wanna know today.

Right, right. And then I wanted to obviously learn based on my behavior over time, what I wanna know. Right.

And I want it to continuously Yeah. Like things like that, like Right. How does the, how do you see being in, in this space so much, the kind of UI evolving?

Yeah. Um, you know, I think, um, specifically chat as a UI is super compelling and natural for a lot of things. Um, I do not believe that we're gonna go regress 40 years of a, of UI innovation and go all back to chat in the command line though.

Like, there's a lot of things for which text is actually a terrible modality. Um, you know, in which, uh, you know, just paragraphs are are not great. Um, and, and I think there's, there's a more underlying thing here that you're touching on, which is a lot of traditional experiences, whether it's text-based or, or visual.

Assume a human shows up knowing an intent, right? As opposed to, you know, an agent being really proactive and taking care of something for me, or pushing me an update or a notification when I need to know it. Um, and so I think those experiences start to evolve a lot.

What gets really interesting is where they meet, you know, and we really see a lot of this, uh, you know, task-based data entry, repetitive stuff, increasingly getting delegated to agents on your team. But that means you'll need to work with that team in a totally different way, right? And, and where a, you know, traditional CRM system or HR system or, uh, you know, whatever, you know, pick your business application was, you know, previously, like we talked about people typing into boxes and then other people viewing reports.

You know, what does it mean to totally change that interface into a human and agent collaboration space? What does it mean to go see the activity of what agents are doing on your behalf when they need your input? You know, when they're blocked on something or they've noticed a trend or, uh, you know, there's a form they tried to fill out but didn't complete, then that's an important meeting space to go have experiences and user experiences.

Um, and a lot of times those do need to be structured in a visual way. A lot of times they could happen, you know, ephemerally or, or with a chat message, but how do you route people to the right place at the right time? Um, you know, we're working across all of those fronts, you know, that's why we have a robust set of tools in copilot studio for, for building the agent part of, of, uh, all of those things.

It's why we have a ton of evolution in power apps, you know, sort of becoming this new agent centric experience where I can see a feed of that activity. I can have agents help me, uh, do the work in the applications. Um, and those two worlds will just continue to evolve together as we start to bring things into the future.

Yeah. So you heard me talk a little bit earlier, Ryan, about governance. Um, governance is part of the, the critical, uh, constraint.

And one of the things that differentiates software, right? The reason we can't just use open AI for everything would be because it doesn't know how to handle the data. Be like, oh, let me talk about, you know, help me do a job offer or help me do a compliant healthcare notice to somebody.

Like, it doesn't how to do that, right? So building applications that do know how to do that is the key you gotta build up with. I of course, we wanna go fast, right?

So fast is the new, the new role, right? But the trust and scale are, are are the other words. I know you often use these words, but like, you know, what do you think and where are companies sort of struggling with governance, uh, and scale here with automation and, you know, kind of how do you think what you're building an agent oversight can help them?

Yeah. So I'd say there's a couple dimensions to governance and scale. You know, there's the breadth dimension.

We have a whole lot more people who now can build a whole lot more things. How do I make sure that all that stays on the straight and narrow when I can't centrally top down code review every single thing that every single person an agent is doing. And then there's sort of depth scale.

You know, when I do wanna roll out a mission critical solution to a hundred thousand employees that has AI in it, how do I make sure that that AI is not just functioning, but actually continuing to get better every single day? Um, and, and you know, the, the good news is we're not inventing any of that from scratch. You know, breadth, scale and depth scale.

Were a challenge in the first generation of power platform. Um, and something that we've built a ton of capability into the platform over the last couple of years to really, uh, tackle at huge scale. And we call that, uh, the managed platform set of capabilities.

And within it, there is managed governance, managed security, managed operations for lifecycle a LM management, stuff like that. Um, and may managed availability even, how do I go ensure high availability run disaster recovery drills for critical workloads. All of that is built into solutions baked, uh, on the power platform.

Um, and all of that value accrues to this next generation of components being built as well. You know, an agent built in copilot studio benefits from all of those managed capabilities. Um, a new app built in power apps with intelligent capabilities in IT benefits from that entire stack.

Um, and so that's why, you know, you start to see even highly regulated financial services firms, government agencies, um, et cetera, really trusting Microsoft here, as opposed to a 20 person startup that was founded yesterday. Um, you know, to, to really take the bet on standardizing for this, this segment of, of software. Um, then you get into the operational oversight, okay, I have agents doing work.

How do I have humans managing the work of those agents? That's not a developer role anymore. That's really an operational role.

You know, what does it mean to be an agent manager or an agent boss in a claims department at an insurance company or in a supply chain, uh, operation? You know, that's where we need these new interfaces. And that's what power apps is building in with concepts like the agent feed.

You know, how do I build a, a purpose-built oversight experience for really high volume activity of, of agents? This is one of those things that like, right, there's so much doubt across the industry about being able to do this in a sort of, when you give up the human in the loop or even just have one maybe guiding, but you're moving so fast, it's like, um, you know, are they safe? Are they auditable?

Because when you're in a business, everything you just to be traceable and trackable Yep. Uh, is predictable the outcome. Like, hey, you're gonna have an agent interfacing with your customers, or you're gonna have an agent, uh, doing a bunch of accounting work, which by the way, it's like a spiral one mistake, and it's just Sure.

You know, how that goes. Yep. Like, how are you guys overcoming that doubt, you know, through the guardrails you're putting up, through the oversight, the accountability that you kind of baking into your platform.

Because I think you get over that hurdle, Ryan, we move a lot faster. You know, I think what's interesting here is actually a lot of our customers have had to build these systems already. You know, a lot of our customers already operate critical processes across massive employee bases and even larger vendor teams that operate at arm's length already today, right?

And we've already had to go build in a, in a world of a whole lot of variability of, of who's doing a task. How do you create an audit trail? How do you create rules?

How do you create data policies? How do you create oversight? A lot of those concepts exist today because there is variability in the human system, right?

And so a lot of the way we, we approach this, okay, how do you adapt those existing concepts, policies, features, capabilities? How do you adapt that to a world where it's humans and agents doing the work? And what are the sort of incremental, you know, sort of 10% shifts that you need to make in those systems to accommodate agents, um, but not completely, you know, pave them and re re rebuild them from scratch, right?

Because a lot of these sort of trust concepts, uh, or zero trust concepts in a security concept are already built into to the system. Um, and so there's a ton of work we're doing there in the managed platform in, uh, you know, a lot of the ways that, uh, you know, a lot of the Microsoft security governance and oversight concepts apply to agents. Um, and, and that's again, one of the benefits of building on a mature platform and a mature system in Microsoft is, uh, you know, we're not having to recreate all that stuff from scratch, like a, like a point solution startup would have to do.

Yeah. So the, the last thing is just on, specifically on security. Um, security is a super hot topic.

Yep. What do the customers, how do you want them to think about the approach? Because in the end, like you can get it all governed and right, but you have to keep your doors closed, locked.

And, you know, that's an increasingly large problem. AI is, is much, uh, enabling it, uh, as it is fixing it, right? Well, look, I mean, we could probably spend an entire hour on, uh, uh, security and threat model approaches in the, in the AI era.

It is absolutely critical. And like any security challenge, there is no silver bullet. You know, every customer needs to have a defense in depth strategy and needs to think about what am I doing from a data security perspective?

What am I doing from an exfiltration perspective? What am I doing from an access perspective? Uh, you know, the good news is we have a lot of that built into the platform today.

You know, even a customer building their first copilot studio agent and using the managed power platform to roll it out. We'll see a security score in the power platform admin center, we'll see AI driven recommendations about what to do to improve that security score. Um, you know, it has a whole bunch of capabilities in there that, that go all the way to operate this in the cloud.

But with a private vnet, with your own managed encryption keys, um, you know, again, we have a lot of highly regulated, very security conscious customers that are working with the platform today. Um, I would say though, to zoom way out and look at that, um, and maybe connect it to some of the rest of the conversation we've had, it is absolutely risky to go too fast. It is also very risky to go too slow, you know, and the rest of the world is evolving, including threat actors and competitors, right?

And so the cost of standing still is probably the most costly positioned to be in. So let me let you know, as an analyst, uh, I have to ask you 'cause uh, I've got a few things. Uh, but, uh, what kind of in this whole evolution, this, this exciting moment for the future of apps and automation, uh, and agents, like what's kind of keeping you up at night, the biggest concerns that you see out there?

And then what are the kind of upsides for you? Like, what do you most kind of think could be the biggest surprise in, into the future? Give us that big yeah.

Visionary moment here, Ryan, to take us home. Look, I think, um, I'll start, I'll do that in reverse order. I think there's a ton to be excited about right now.

Um, and you know, I, I think, um, there's just so much potential and creativity that we can still unlock. net code in their life. Um, you know, what unites that community is this sense of we can make something better.

We can, this can be better, let's do it better. And, you know, I feel like we're at the precipice of just blowing a huge lid off of the ceiling of what you can do there. Um, and there's a whole lot to be excited about.

Um, I mean, you joke about a night job. I stayed up last night vibing a power app that's just a Tetris game because it was awesome and fun and so much faster to create it than it would have been in the last generation of the technology. And I think that's a tiny, tiny microcosm of, you know, go take that creative energy and apply it to everything that's inefficient about every aspect of every customer organization today.

You know, we're really standing on the precipice of completely rewiring how companies work, um, and doing it with people who, who have deep expertise in that process and a deep desire to make it better. And that's just incredibly exciting to me in this, in this moment. Um, and then to flip it around, okay, so what stands in the way of that?

You know, it really is all about speed and pace of iteration. And, and really it's about time to wrong. You know, there's, there's so much that we need to go invent and covent with customers and experiment with, um, and try, and nobody out there is perfect right now.

What, you know, what will define winners and losers for technology companies, for customers, for operations is how fast can you be wrong? And then how fast can you get less wrong and more, right? Um, so that's, that's the journey we're on.

That's the hill we're climbing. Um, but it's just a super exciting time to go think about what the, the top of the mountain can be. Brian, this was a lot of fun.

It was a great conversation. Appreciate you sharing a little bit about where all of this is heading. There's so much potential for companies to really start reimagining and yeah, realize just how big of a leap forward we, we are having right now with, with ai, with Ag agentic and the work that you're doing in power platform.

So Ryan, thank you so much. A Hundred percent really, really enjoyed the conversation. Daniel, thank you for the time.

Everything about the way we work is changing very quickly. Thanks to the advancements in applications and of course, agents automation and what interfaces may look like in the future are all gonna continue to change and they're gonna enable, and they're gonna power businesses to be more efficient and of course to be more productive. It was a great conversation over the last hour.

We really did reflect across not just power platform and how they are thinking, how Microsoft is thinking about building its future, but really about how businesses should be thinking about developing their future, removing constraints, being able to look at problems in new ways, and then being able to apply software and then being able to utilize resources in new ways that can deliver more value to your business and of course to the customers that you serve. And this is not gonna be easy. It's gonna take some time.

There's gonna be some effort, but it is something that can be done today and companies can start to extract value right now. And moving quickly is gonna be more and more important. That's something I'm seeing as an analyst, and that was clearly something that Ryan had seen as well.

We talk a lot about that is the customers that are moving faster gonna be the customers that get the biggest results, and of course, are able to benefit the most from those efforts. And lastly, we still have to keep all of those considerations that have existed with enterprise applications, with software that runs our businesses. And that's gonna be the governance, that's gonna be the controls, that's gonna be security.

And that, of course, is going to be putting people in the right roles and enabling them to do the work. All those things remain similar, but of course, with a new bend, we're gonna upskill the talent. We're going to think about problems in new ways, we're going to move more efficiently, and together we're going to drive the future.

Great conversation. Appreciate everybody spending the hour with me. See you all soon.

ai Leadership Insights series. I'm your host, Mike Azar. Today we're with Yvette Schmid, who's the CEO for Fusion Collective, a consulting firm.

And we're talking about, uh, AI regulations and specifically what's happening in New York state and how it might also pan out elsewhere, and maybe the differences between our friends in the state capitals and the nation's capital. But Yvette, welcome to s Shah. Thanks so much, Mike, for having me.

All right. So New York State passed this raise act, which was signed into law by the governor. And, uh, like most laws, there's a little bit of a difference between what ultimately was agreed upon and may be enacted.

But for those of us who don't live in New York and or who may not have been paying attention for that matter, what is the raise act? What does it do and, and why should, why should people pay attention to what's happening here? Well, that is a great question.

So let me walk you through what kind of happened with the New York State Raise Act, uh, what was passed by the New York Senate, and then ultimately what was actually signed into law in December by the governor of this wonderful state of New York. So in June of 2025, the legislative body of New York State, they passed what I would call a very people protective forward AI regulation that protected the people. It had mechanisms in it around, um, mandatory independent audits.

You know, when you do self-auditing, you're kind of like grading your own homework on that sense. So this act in June, it had external independent audits, um, to verify the claims that all these AI companies are making. It had comprehensive whistleblower protection.

So if someone was working at an organization that was seeing things that didn't kinda look right, they could report and be and be protected. There was penalties for wrongdoers that were up into the millions, like tens of millions for the first violation, which would actually probably deter bad behavior, you know, and in order to be considered or covered for, um, this act, it was based on compute thresholds. So you can't gain the system.

Now that passed, I was super happy in June. I was like, wow, this is gonna be amazing. But I kept reaching out to the New York State Senator.

I was like, well, well, when is this thing gonna get signed? Fast forward six months later, the governor of New York, she, what she signed and what was passed completely different. So think about independent audits gone.

So now it's being replaced with self-certification, whistleblower protections, completely gutted, not there, penalties slashed by 90%. So for the first violation, and here's what really gets me the compute thresholds. So it's hard to game compute because it's like electricity.

What you spent the, the, the, the, the cogans, you can't really game that. But you know what they did? Instead of having compute thresholds, they base it on revenue.

So now what you can do is create these corporate loopholes to restructure your organization. So now that your AI system that you've been developing, deploying doesn't meet the thresholds to be, to be oversaw by the RAISE act. So, and this is not my interpretation, this is not the world of Yvette.

This is a side by side. You look with what's passed in June and you look what the governor signed in December. And of course, none of this doesn't take place until January, 2027.

It's completely different. It's completely different. So how did that come about?

And was there some sort of, was the act discussed again in the Senate somewhere? In, in the No, No, no, no. This is where our lobbyists, our tech lobbyists, you know, tech, NYC, you know, Andreessen Horowitz, all the tech lobbyists, they got in and basically they gutted the regulation in order for it to sign.

And so what the governor and the, the state legislators is trying to say now is that the New York Raise Act is like nation leading. This is not nation leading. It's not nation leading at all.

I mean, basically what it does is it gives the, the 10 frontier model companies meta, Google, OpenAI, anthropic, it gives them a pass. And, and it was touted as, oh no, we can't have all this regulation because it's gonna, it's gonna stop innovation. It's not gonna stop innovation.

Really, it's doing is giving people a pass to do not the right thing. But now they gotta check the box saying, we did this, we did this, we did this, we did this, and it really does nothing. And guess who pays for it?

Us New Yorkers, the people who have to live with these systems that are commercializing the products. What people don't understand is that New York City is literally like a AI startup hotbed. There's over 2000 AI startups here in New York City alone, 2000.

They're doing everything from FinTech, healthcare, you name it. It has AI in it. They got some funding, and they're here in New York.

And I actually went to one of these startup meetings where they were doing pitch pitch decks, and they're like pitching their new ideas. And I asked five FinTech startups, I said like, um, you know, how are you thinking about ethics? They looked at me like I had six heads.

They're not thinking about ethics. They're not thinking about how their AI system that they're gonna commercialize and then launch onto us unsuspecting New Yorkers who are gonna use these products, the impacts that it's going to have. So it's, it's, it's, it's sad.

It's sad. So, So what should people be looking out for, or what should they be on guard for with these applications that are being rolled out, many of which are consumer oriented and financial services oriented? And are there things that are gonna happen that we're all gonna wake up in the morning and say, wait, who let this happen?

And maybe there'll be a backlash that, You know, um, Mike, there's, I say this all the time, if you wanna catch a squirrel and raccoon use shiny objects, but you don't do that to run a business. And I think how the organizations today that are getting this massive funding and how everything out there in our, at our fingertips has something to do with ai. You can put your, you can make yourself a storm trooper.

You can recreate a Star Wars theme. You can, you can see squirrels riding yachts and flying planes. You can do all these things, shiny objects, but no one's thinking about the cost of that.

When you want to turn yourself into an AI action hero, are you thinking about the power that it takes to run the algorithm and the compute and electricity to generate, you know what I mean? Like, no one's thinking, no one's shifting left, no one's understanding that this takes an immense amount of power that's coming from a data center that's sitting on a grid, that is a Tinder box at best. You know, that needs to be cooled.

Where are you gonna get the water from? Who, who's paying for the extra power being, being charged from the electric, from the electrical grid? Electricity is a, is a public re it's not private.

You just can't throw a data center in someone's backyard and flip the switch, and then all of a sudden no one, you know, who's gonna pay for the extra stress on the system? No one's really thinking that through, but they're looking at the squirrel videos and they're turning themself into AI action Heroes. I think we, we as consumers really need to think about what does this cost me personally?

No one's reading terms and conditions. So Mike, I'm gonna ask you, when a new platform comes out and you hear about it and someone's telling you about it, what do you do? You scroll right through the end, right?

And you hit click, click accept. Do you read, you know, like the nine pages of a terms of service? No, no, it does.

Because they wanna, they wanna use the glam bot. They wanna, they wanna use the app. They're not gonna read through that.

Wait, Wait, wait, wait. There, there, there was a document with terms of service in it. Where, where was that?

You know, like no one, no. People blow past that. And that's where if you read that, you probably wouldn't sign, you probably wouldn't hit accept, because that's where all of the details about what you're giving up as an individual.

And I, I like to say this, I like to say we have become, we have gone from being customers to a data point. We're no longer customers. You know, when you go into a store, like the customer's always, right?

Okay, I don't wanna use that. Like what? You go into a store they like, they actually care about your experience and how you felt and what you bought and the quality of the service you received.

That's gone. We are, we are just consumers. And so since we're consumers, that whole element of reading the terms and conditions, no one wants to read the terms and conditions.

Why? 'cause they just wanna use whatever, whatever product you're hawking today. So do you think that this will become a real political campaign issue as we go forward and people will start voting based on these AI issues?

Because to your point, it's not just my electric bill, of course, but it's also crazy things like, you know, grok is letting you take pictures of people and, you know, distributes accordingly. And, you know, this is kind of not the kind of society maybe we wanna live in. You know, Mike, I I, I don't know if it's gonna become like a political issue because the, the folks down in DC have literally are, are making moves to make sure that no state law can impede AI innovation, right?

All this is being tucked under innovation. Um, but when I tell you what I'm about to tell you, this should really elevate for you. And as, as your listeners here, um, so in the California state law, they have a similar AI bill, uh, to New York.

They have the enforcement act of the law about figuring out if someone did something wrong. It doesn't happen until 50 people die. 50 people that's in California.

So that, that means if your AI system, your product, your impacts 49 people adversely, or 49 people die, like there nothing happens. You can just keep running. This is per AI system in New York.

It's a hundred, a hundred people will have to die in order for the enforcement provisions of the raise act to go into effect. So, so let me just break that down to you. There.

It kind of shows you like who's important, right? Like if 75 people die, because an AI system, this is per system, right? So that's, your system does something unlive, 49 people, nothing happens.

Nothing happens. Another system does something under a hundred people, nothing happens. So the compounding effect thousands of people can be, can be unli and have adverse reactions.

And based on the laws on the book in New York and California, nothing will happen until that one system impacts a hundred people in New York State. So a hundred people have to be unli before the enforcement element of the raise act to go into effect a hundred people. So now tell that to the other 75 people who have to plan funerals, right?

Mm-hmm. I mean, when, think about that, like, there's no, there's no, there's no recourse for those, for those people. And I think that is what that, I think that's what's gonna move the needle when, when adverse actions start happening, and then people look to their legislature in the laws and say, go after them legally they can't.

Mm-hmm. From an enforcement perspective, I think that is going to move the needle. And to add insult to injury, Mike, guess who the regulatory body in the New York state, in New York state is for the, the Raise Act and the, uh, large frontier models and developers that fall under that.

I have no idea. Department of Finance. Hmm.

So the bank, so the group who regulates banking is the enforcement agent for large frontier models who fall on the raises, the Raises Act here in New York. What do they know about that? Let me ask you something too though, about, well, you know, let's take these incidents where there might be a fatality, but who's to determine what the cause of death was?

I mean, was it the, the self-driving car? Was it a car accident? Or did the AI do it?

Because, you know, at that point, if I classify it somewhat differently, then I'm under the threshold, right? Yes. And this is where gaming the system comes out.

Because if you go on compute Mike, you can't gain compute, but you can restructure your organization. And I'm gonna give you an example. So, um, let's use, let's use, let's use meta.

Let's use meta. So you have the mothership, they can spin off or, or, or think more about like, like pharma. Like pharma, uh, Pfizer, they have an r and d arm, which is separate and exempt, but the r and d arm is funded by the, the corporate, the parent company, right?

But they're separate. But if you put the r and d for your model under a separate entity, it doesn't meet the threshold. If your, if your revenue is under 500 million, that's how you can gain the system in New York, because the New York is, you have to have 500 million annual revenue plus your model size in order to, to be considered a covered entity under the raise act.

But you can do some corporate restructuring where, oh, I can do all my development under this other separate entity. It doesn't meet the revenue threshold, so I'm exempt. So I think that's where people, people, that's how you can gain the system.

And, and then the onus is gonna be on the per on the family, on who's left over on who was harmed to figure out who shot John and who to sue. But based on the raise act, as long as they make under 500 million, they don't harm a hundred people. They're not regulated.

And that entity might be registered in Delaware anyway, so it might not even be a normal New York kind of issue. Um, is this gonna play out in every state? I mean, are we gonna see the same effects?

Somebody's gonna, you know, pass a law and then we're gonna see this play out again and again where lobbyists come in behind the law and or that was at least as it was passed, and before it's enacted, there's gonna be all this, you know, activity in the, what did we used to call this? The, the, the smoke filled room. So, um, there, I, the la at my last count, Mo there's like 19 or 20 states in addition to, uh, including California and New York who passed on things that are passing bills and legislation that is AI adjacent.

You know, they're banking things under, like data, you know, data for data brokers and how you can use people's data and consumer protections. They're not coming out and saying like straight, like ai AI system laws and, uh, rules and regulations. They're doing that.

They're also, um, everyone is kind of like on the clock with the executive order that came out from our current president about the moratorium on AI laws on the state. And so if the federal government determines that your law, potential law is gonna be discriminatory or, or mentions anything about discriminatory, they will shut you down and and sue you. So you can't, so that that law will never be enacted under the guise of ai.

And we need to innovate. So I do think, like the challenge is gonna be, you got states who don't want the federal government coming in, blowing stuff up, right? Under the guise of AI innovation, right?

So they're gonna, they're gonna be creative, maybe do things on the privacy and, and, and under data protection and consumer protection, maybe that route. And then you have the federal government where it's put the moratorium on states. It's like you can't pass any law that it impacts AI on their innovation, or you don't get federal funding for your state.

That's, that is kind of like the, the, the, I won't say the networking, but the horse trading going on behind rooms. That's the horse trading going on. If you want federal funding, you can't do this around ai, you know, and I think it's gonna be hard for states to, to stay out of the AI legislation race, but it's also gonna be hard for them to really get in and do the protections that's needed for us, the citizenry of their, of their states.

So do I what, call up my local congressmen to express my concerns in outrage? Or is this gonna have to be like, everybody's gonna have to take to the streets to force the conversation? I think it's gonna be a little bit of both.

I mean, I mean, not to get super political, but just think about the, the Affordable Care Acts, you know, like hundred millions of people will not be able to afford health insurance anymore. Millions. They've, they have, they're calling their, they're calling their senators, they're, they're calling everyone.

And it's, and that's still kind of not working. So I, I, I, I don't know. I mean, honestly, Mike, I mean, I don't know.

I think we as a people need to figure out, you know, what's more important, you know, and, and, and it's not about red state, blue state, Republican, democrat, inspirational person, whatever, whatever, whatever, whatever, um, uh, class you, political class you wanna put yourself or label you wanna put on yourself at the end of the day, it's like, is this the world that we wanna live in? There you have it. Hey folks, whether it's a law or a end user licensing agreement, by all means, don't forget to remember.

Try that again. Hey, folks, regardless of whether it's a law or the licensing agreement for a piece of software, be sure to read the fine print. Yvette, thanks for being on the show.

Thanks, Mike. And thank you all for watching the latest episode of the Textron AI Leadership series. You can find this episode and others on our website.

Please check them all out. Until then, we'll see you next time. Welcome to Security Boulevard, the cybersecurity podcast from The Future Room Group.

Each episode explores a variety of topics within cybersecurity and the technologies that drive it. com, the Security Boulevard, YouTube channel, Textron tv, and all of your favorite podcast platforms. Before we jump into this week's episode, let's meet today's panel.

And I'm gonna start with our friend Alan. Alan, it's good to see you again. Tom.

Great to see you. We are, uh, happy to be, I'm happy to be here today. It's a little cold down in Florida.

The iguanas are dropping out of the trees, but, um, happy to be on Security Boulevard today. I, I love that that is the measure of how cold it is in Florida, is things are falling out of trees. Uh, yes.

Another place that it's generally pretty cold is in Canada, and that means that we're joined by our friend Fernando. Fernando, it's good to see you. Thank you.

I was squinting about the a it's cold in Florida. I, I, I appreciate it. I totally do.

I'm originally from Brazil, and I understand how in a warmer climate, sometimes what might be considered cold in for them is not necessarily cold for places that are more used to cold anyway, sorry. Uh, Fernando Montenegro leads, uh, security research with, uh, with foot and, and it's such a joy to be with, with, with you guys again. So even if I am a little bit cold, we had to deal with, uh, with about the foot of snow or so, uh, a couple of days ago, and Snower broke actually, so, yay.

Fine. Uh, I'm Tom Hollingsworth. I'm the event lead for security at Tech Field Day, and I'm happy to be here as well, even if I am a little bit chilly.

But the good news is that today's topic is rather hot. Uh, so let's jump in because you may have seen news, uh, in the last week or so, uh, that Jen Easterly has been appointed as the CEO of the RSA conference. Um, this is really interesting because, uh, she was formally a part of, uh, CS a, uh, these, uh, government cybersecurity organization.

Um, she is a very well-known person in the security space. Uh, she's provided a lot of leadership over the years. Uh, she's a graduate of West Point.

She spent 20 years in the Army. Uh, she's held some very senior roles there. And then she transitioned into a post where she was advising the US government on, uh, cybersecurity matters.

Um, she was, uh, she left that post and she was gonna take a point, uh, post at West Point that, uh, disappeared, I guess we'll put it that way. Uh, but now our RSAC has decided that she should be the person to kind of lead the way that that conference is going. com talking about this and giving some of your thoughts about why you think this is a good thing for RSAC.

Absolutely. Tom Jen Easter, easterly led csa. She just wasn't just a part of it.

She was the director of it. And for those of you out there who may or may not be familiar with csa, it's not just an organization that, uh, advises the US government in many ways. It sets the tone, it sets the mark, it sets the, the road for how the US government should do cyber and more than the US government, what I think was really unique and special about CSA and IT, and an extended, even before Jen took over, when my friend Chris Krebs led CSA before Jen was a unique government private public government corporate partnership to safeguard our critical infrastructure here in the us whether it be government infrastructure or private infrastructure, talking about electric grids in public, uh, uh, public water, and, you know, truly critical infrastructure communications.

And so, SI's role was, you know, for a relatively new organization, right? CI's role was, I think, very oversized. And, and the charter was big.

The, the, you know, they cut it to, they cut the CSA budget and moved that money to ice, basically. Um, um, Jen was, uh, Jen and well, as well as most of cisa leadership was axed. And then, as you mentioned, Tom, she was appointed a chair at West Point.

And, you know, I'm gonna be a little less drunk diplomatic venue. It wasn't eliminated for political reasons. It was deemed they didn't wanna have her on.

But this is where you gotta admire Jen Easter. She never stopped leading. She never stopped leading, even in the face of that intimidation in the face of those political enemies or whatever you wanna call 'em, she kept leading, she kept talking, she kept speaking, she kept appearing, she kept advocating for this community.

And that's just the person that RSA needs. The RSAC needs, the RSA community and conference needs. Right?

About two, three years ago, um, Hugh Thompson and his VC firm, I forget the name off the top of my head now, Crosspoint Crosspoint, Crosspoint Ventures Capital, they spun RSAC out as an independent organization and the char. And since that time, they've, they've really, you know, laid out a, a vision for what they want RSAC to be more than just a once a year gathering of the industry in San Francisco. They wanted to be truly the security community, a continuous security community.

And I couldn't think of a better person to make that happen and, and kind of plant the flag and be visible out there leading this than Jen Easterling. I'm, I'm, I'm a fan of hers too. Um, and, uh, uh, the thing I would add is that ing that community angle, right?

First of all, uh, I apologize if I say the RA conference, it's gonna take a while to get used to RFAC conference. So RFA community conference, I'll get there. But, uh, uh, for, for many, uh, listeners and viewers know that it's been the, the Foundational security conference for, for years in the industry, right?

Starting with cryptography. And, uh, it's poignant because, uh, it touches, I I agree with Alan. Like it, she, she, I, I think she has a very wise choice for this, because she's had a role in cryptography specifically, right?

She's had a role in, uh, the broader, uh, uh, public policy. Of course, she's had a whole in private sector, right? She was with Morgan Stanley for, for, for a few years, right?

Before taking over csa, right? And so I think that, uh, that she is, like I said, and, and, and then enlightened choice for this type of, of, of role. And I think that I'm, I'm not gonna get too much into the broader politics of it, but I'll say this.

I think that we are at the stage in the evolution of this industry where, yes, there are political ramifications one way or another. Fine, but broader than that, cyber has one. That's a, that's a thing that I've, that I've, uh, I've, I've mentioned a few times on, on, on this podcast and elsewhere, is that you all, you all remember Mark Andreessen's, uh, paper from, or I think from 2011, software is eating the world.

Yes, it did. It ate the world. And, and, and yes, sometimes there was indigestion, right?

And, uh, I think that this is, um, we, we live at a time, we live in a time where the interplay between, uh, technology and the rest of the world, we can't tell the part, I almost can't tell the part anymore. I'm just putting the, the finishing touches on a paper I'm writing on cyber physical systems, right? Which, uh, which it's basically the evolution of IT and OT security still, how we are, how we're fusing these systems together.

And it's so clear that it requires us to reach across the public private partnerships to, to reach, to, to, to work with governments, to understand regulation, to work with private sector, to understand constraints, to work with, uh, with vendors, to, to have the right incentives in place, right? To, uh, to move this industry forward. And, and, and, uh, Tom, I'm just, Jo, I'm just in my mind here joking about all the, the, the economic terms one can drop in the context of incentives and externalities and so on.

I, I'll, I'll refrain from that for a second. The Thing to me though, kind of going into what you guys have said is there is a huge value in having an organization like CISA around to kind of take that burden off of the government, because let's be fair, everyone knows that the government moves at the pace of a stunned snail and molasses on the best of days. But that's kind of the way that the government is supposed to do things, right?

They have to, there's certain rules that they have to do to, to figure things out and to be able to implement policy and, and procedure and things like that. So to have an organization like CISA that was sitting there saying, well, no, we need to be a little bit more proactive. We need to get out there in front of these things.

If you'd have asked me two or three years ago, uh, you know, back when Krebs still ran the organization, um, organization, I, I think that this is, this is a great thing, right? Like, like they're, they're leading the way. They're transforming the way that people look at cybersecurity, but more importantly, they are being honest with all of us about where the deficiencies are.

They're saying these areas need to be beefed up. These are the people that are creating problems for us. The issue is when the leadership above you doesn't want to hear that, or, or worse, when the leadership above you gets really mad that you make an empirical statement of fact that they disagree with, and they have the power to cut off your paycheck and your funding and everything like that.

So even though I kind of started this segment by being a little neutral, now that I'm giving you my opinion, I think it's pretty stupid personally, because you can't pretend that people aren't telling you bad news is coming, and then when the bad news shows up go, I don't know how anyone possibly could have foreseen this. And Jenny Shirley's sitting over there going, yeah, I don't know how anybody could have possibly told you that this was going to be a horrible idea. Hmm.

Really? You can't get rid of leaders like Jen and Chris and a lot of those other senior leadership people who are now gone just because you disagree with them. In fact, I'm gonna give everybody out there a little a tip.

Um, if you're going to evil overlord school, which I am, and I know a lot of other people are, always have somebody around you that's willing to tell you the truth, just make sure they know they need to leave after they do, so you don't get angry and, you know, like drop them into a bat of boiling sharks or whatever. But somebody has to at least be the, the voice of reason in the room, right? It's like, you remember the Roman triumphs.

There was always somebody in the chariot reminding the generals that famous fleeting, and they're all gonna hate you tomorrow. You've got to know that you, you can't live in a, in an idealized world where yeah, nothing bad could ever happen to the us. We're the, the biggest, baddest kid on the block, and yet we still get hacked all the time, because it turns out we're also the juiciest target on the block.

So I think that the kind of leadership that Jen can offer the industry is that perspective of what happens when policy fights against other policy, when facts are fighting fantasy, and how do you square those things inside of an organization? Because if you think that this is just a discussion between a government agency and the executive branch, I would like to see what happens when the CISO runs headlong into the CEO and the chairman of the board at any organization where they're like, you can't tell people that our security is bad, the stock price might go down. Yeah, I, I, I was, uh, when, when you brought up that the, the thing in my mind immediately went to, uh, world War Z, or me being Canada World War Z, right?

The, the, the, the zombie movie. And, and I remember that I mentioned this because in the context of what they call the tense man rule, right? So the, the, the idea that somebody has to think outside the box, right?

And to a large extent, I see, um, I see CSA in the United States, uh, other agencies in other countries. I'm speaking from Canada here, right? Um, there is this, and, and, and this is why I go back to why I think her, uh, assignment or her, uh, position in, in the RSAC organization is, is so interesting.

It's because from an economics perspective, right? How to solve an, uh, an externality or, or how to solve a problem where the consumer themselves are limited in what they can do, right? Is that you solve it further upstream as much as possible, right?

So what, uh, what cis a and other agencies do in terms of helping with guidance for, uh, resource strapped organizations. So addressing the cis a, uh, calves they're known and exploitive vulnerabilities, for example, right? Um, I'm also reminded of, uh, Wendy Nader's concept of, uh, the, the cybersecurity poverty line, right?

In, in that, how do we help organizations get better? Uh, how do we when they don't have the resources to do as much? So I think that this is a role that I, that, Alan, to your point, if, uh, the RFAC organization is, is more of a year round thing, it helps with this kind of broader message year round, right?

Um, so yes, I think that, uh, uh, I'm navigating the, the, the politics carefully here because we do have audiences on, on, on both sides. I have an opinion too that I think that I would like to see more collaboration, not less, but, um, but, uh, uh, sorry, I lost my train of thought here. I think that, that there's a, a lot of positives in this, in this assignment.

So I've got a few thoughts here, Tom and Fernando, on what you both said. First of all, in, in regard to the role of CSA within the government, I, I think, I think it speaks volumes that the fact of the matter is the last two directors of csa, as I mentioned before, and Tom you mentioned Chris Krebs, Chris was fired, fired in 2020 for saying that the election was not fixed or fraud. And the president at the time fired him as a result.

And as a matter of fact, same president has directed the Department of Justice to investigate Kris, whether you want to call it retribution or whatever, but to continue harassing him, Jen Easterly and c were fired 'cause she was a Biden administration primarily. They, they purged the Biden administration to put loyalists in there. At the same time, they degraded the budget and scope of the agents.

That's that. You, you can't look backwards. You can only hope that as we go forward, the necessity of sisa, like organizations win the day.

And, and we do put priorities in place there with that. In terms of RSA at Fernando, you pointed out today, it seems the US government is still on their retribution kick with this and has now directed, and I don't know if this is true or not. We just saw a report on LinkedIn has directed us agencies to pull out of the RSA conference.

Who loses? Well, at some level, we all lose because we should have one community, which is kind of the message behind RSAC. But ultimately, I think the federal agencies lose a lot more than the rest of us, because if they isolate themselves, if they go to a pre CSA thing of being up on an ivory tower without integrating into the community, without understanding learning, cross pollinating ideas, theories, technology.

No, no. Government is an island today. No nation is an island today.

No person is an island today, right? Today, more than ever, we need a strong cyber community. We need a strong public private partnership.

It's sad that it has to come to this. It's sad. However, I know Hugh, I know Linda Gray.

Martin, I know Brita, glad I know the people behind RSA, they, they're not stupid people. They, they didn't go into this with blinders on or blinkers on, not realizing this may be a potential repercussion, but I think they're in it for the long game. This too shall pass.

And, and that's my take on it. All set. Let's Move on to some happier news.

And my happier, I mean, some people are getting paid. Um, one of the things that Alan brought up when we were doing some research for this show is the fact that there are a lot of cybersecurity companies that have recently emerged from stealth, and they are driven by ai, specifically AI penetration testing, ai identity security, and AI agent platforms. And I know that we've discussed this quite a bit on some previous episodes of Security Boulevard so far, talking about the need for securing agents, how agents are gonna provide security in different areas.

But I always go back to what does the Smart money say? And in this case, the smart money, which is, you know, tens if not hundreds of millions of dollars are investing in companies like Novi and Seven AI and Opti to provide these kinds of services. Betting big on what that next, uh, company that's gonna have a groundbreaking security offering is gonna be.

So I kind of want to toss this out to, to you guys a little bit. Do you think that these companies are doing some great research knowing that they're just on the cusp of some amazing breakthrough? Or is this the typical startup mentality of, I've just gotta keep the runway going long enough for somebody to buy me?

Look, I, you know, I've been involved with VCs for many years before I did Techstrong, I spent 20 years plus in the VC back startup world. I have good friends in the VC space. The VC model is not a do good a charity model, right?

Mm-hmm. They're in it for the money. And if they're investing this kind of money, and, and let me just quantify when I say this kind of money seed rounds of $80 million, $50 million seed rounds, a good seed round used to be $4 million, $3 million, a good a round, $12 million.

These people are raising 50, 80, and a hundred million dollars in seed money. That's like before market fit even money. So, you know, we're talking about a big amount of money.

And you know what you would think by rational smart people, smart money, as you said, Tom, so they see a huge return here. And, and the VC window keep in mind is they're not investing for 20 years now. They're not even investing for 10 years.

They wanna see a return of three to five years, seven at the outside. They gotta close that fund down in seven. So if you are seeing this kind of investment by these folks, you, you have to assume that they see, you know, a decent return within three to five years.

You know, um, when you're talking about 50, 80, a hundred million bucks, a decent return is not a pittance either. You're talking billions of dollars probably, right? All the VCs talk about 10 baggers, 10 Xers.

That's, you know, Fernando, I see you wanna say something? Go ahead. Yeah, no, I, I, I, I, I, uh, similar to you, I've, I've, I've been around and, and, and I like to track the, the, the money where it goes and, and so on.

And, um, what I find is that there is a, uh, I always say that VC money is like rocket fuel, right? And it, uh, it works wonderful if you put it in a rocket, right? If you happen to not be putting it in a rocket, That might not be the best thing, right?

And, and we've seen tremendous, uh, we've seen tremendous, uh, uh, businesses that grow sometimes bootstrap, right? Uh, and, and they, they grow to a certain size and, and that's fine. And, and they may have, uh, and they may deliver value back, right?

Um, the thing on my mind about the, the, the current, uh, the current funding is that it's very much we are, uh, we as an industry, like we, we we're funding the startups because, because they need to absolutely move fast on things, and they need to move fast on things without that, they need the runway. That's, they, they need to be able, they, they need the runway to, to, for the tech to mature, but they need to move quickly so that they do capture the kind of early mover advantage, right? And at, at Tuum, there are three trends that we're majorly tracking, right?

We we're tracking the modernization of security operations, the modernization of security infrastructure, and the modernization of security governance. Those are the three main ones. I'm, I'm, I'm involved in, and we're definitely seeing this 2026, like to go back to your three to five year thing, 2026 is one of the, one of the things we're calling now is we are definitely expecting that this is the year where we start seeing that rubber meets the road, uh, reality of agentic security, agentic workflows in security operations, right?

So, can I get my AI sock off the ground doing meaningful work for me in a correct fashion, right? So this is very much the time to be putting money into these type of, of, uh, of startups. And I'm navigating carefully because like, we don't do vendor endorsements, right?

So I'm, I'm observing the, the observing the space. I know the, the, the seven AI folks and, and, and some of the others, right? So, um, this is very much a time to be doing that.

And I, identity is another one, right? Mm. Uh, we saw the, the, I mean, Palo Alto drop $25 billion for CyberArk.

The deal should close in the, in the, in the near future, right? Uh, we saw a massive funding round for, uh, SAVI back in December, I think it was 700 million, I believe. Uh, and, and, um, so identity is very much the second, uh, element that, uh, I'm, like I said, I'm, I'm, I'm working on a, on a paper on cyber physical systems, and, and one of the things that pops up is just managing the, the, the explosion on identity.

We're past the, the, the human scale, like, as we like to call it, for managing these things. So this is very much a time for this funding. I think that thematically, sorry, I'm long-winded comment, but thematically, I think that, that these are very interesting areas to invest in.

Well, I'll, I'll reserve judgment on the vendors themselves, right? But it it, but it is very much a time to do this. But Alan, you raised a phenomenal point, which is this is not being done for charity, right?

And this is being done to position these organizations to be successful. Uh, what my message to, to security practitioners and and executives is that you have to understand the, the, the, the pricing dynamics that, that play on here. Like, Are you going to switch from a, uh, ingest based pricing for events to your sim right?

To, uh, to an incident based pricing for your ai? So, oh, look, if I handle an incident, it costs X much, right? So my, my, uh, my advice to, to, to practitioners is stay on top of these trends, right?

These vendors and, but understand how incentives are aligned and how the, the, the pricing is gonna change moving forward, right? Lemme caveat that Fernando, and I realize on time, I'll try to move it along. Don't assume as a security practitioner that the company that raised the most money is the best solution, right?

This VCs don't operate like they're at a, a, a racetrack. And you bet on horse number seven, and I bet on horse three and let the best horse win. The best horse doesn't always win.

As a matter of fact, there's a school of thought in the VC that if I give the, my investing company, my company, that I invested in so much more resources Than the next guys have, right? They will have more money to make more noise and do more marketing and more sales, even if their product is mediocre at best, right? Because they have more money, they're gonna win.

And winning here means the biggest liquidity event, the biggest return on my investment. And so sometimes you look and say, well, this company raised more company A, raised more money than company B, company A must be more valuable, company a must have better technology. No, if that was the truth, we'd all still be on OS two war, right?

Or whatever the latest OS two is. Um, it's, there's a, there's a rhyme and a madness to VC investing that sometimes gets lost. And, and so pick the best solution for you.

Oh my God, yes. Uh, there is a, uh, me in economics, there is a, uh, there's a famous paper by, uh, uh, or not so famous, perhaps by Ian Greg called The Market for Silver Bullets, right? Yeah.

And, and, uh, the, the interesting thing there is that it explains that market for silver bullets. And, and I promise not, no, not an economics lesson in last five minutes, but it refers to a famous paper called The Markets for Lemons, right? Which was a Nobel Prize for George Akerlof and others back in 2001, I believe, on information asymmetry, which is a foundational concept, which is how do you value the quality of something, right?

And, um, or how do you discern the quality of something? And I think that this is phenomenal information for security practitioners. Alan, to your point, people have to discern what is the quality of what they're buying and how you're gonna do that.

And, uh, I mean, we could make an entire series on, on economics, but, uh, there is a, the, there is a concept of signaling, and the concept of screening signaling is when you as a vendor, like you signal the quality that you have, Alan, to your point, I have more money I'm gonna signal to the market that I have all of this. And then, but the flip side of that is screening. As a buyer, how do you create the process that screens out the quality of what you are buying?

And I mentioned this here, this all comes full circle, because as a, as a practitioner, right? My, my advice to you is that you are being in, you are increasingly being affected by broader geopolitical events, right? This thing is increasingly important, right?

You cybersecurity is that much more strategic, right? And you need strong communities in part to help you with the signals that if somebody participates in that community in a, in a, in a good manner, that's a signal, right? And that community can help you create the screening criteria that you are gonna use on your evaluations, right?

So again, it, I I, I know it sounds like a joke, but everything turns around economic screen, right? And, and as you observe exactly as Alan said, as you observe the, the, the, the investments that, that had been made, yes, by all means, it's an important signal, but it's not the only one. So buy what you need and we can talk about other stuff later on.

Sorry, I, I, again, I I, I get too excited about this. That's okay. We love people that get excited about what we talk about here on the podcast, but we hope that you're also getting excited about the things that we do that are not on the podcast.

Fernando, what have you got coming up that people should check out? So we just published our, uh, we just finished our data set and cybersecurity decision makers, and it lines up, uh, uh, a lot of this, these trends I'm talking about. So I'm really excited about that.

Uh, I'm finishing my paper in Cyber Physical Systems. Uh, I promise that it'll be done today, maybe tomorrow, and sent to, to peer review and, and, and whatnot. And, um, I'm starting to plan what my, uh, my participation at RSA is gonna be like.

I'm really looking forward to that. And yes, it's, uh, it's, it's starting for industry analysts. We get particularly busy around, uh, uh, spring and fall, right?

So, yeah, I'm, I'm, my calendar is working weird. Great. Now, Alan, what about you?

You know, it's that funny time of year, Tom. We just fi Tom. We just finished, uh, predict 2026 last week, which is our kind of look ahead to the year.

We, I think it's the first time we've done anything like this. We had Fernando and virtually the entire, uh, FUTURUM analyst team each doing their sessions. I think eight of them I was, I was involved in right asking SI loved it asking, but it was great.

It, and, and it's available on demand now for anyone who wants to go check it out, predict 2026 do com. You could go get them there. We also announced the DevOps do com winners there.

And we actually had the analyst from, uh, RSAC there for Fernando, giving the RSA view of 2026. Speaking of RSA, we're in full blown mode getting ready for that. Our, uh, annual DevSecOps event at RSA, the Monday of RSA week in Moscone is coming up this year.

It's surrounds securing AI native dev, which is in many ways what DevOps or a big part of what DevOps is today. We have a great speaker lineup, including David Brynn, who's like a Hugo Nebula award-winning sci-fi author, but also a PhD at as a JPL and a, an AI profit from the eighties and nineties even. He's keying.

So check that out. Um, I am taking the film crew or one of our video crews here from Textron up to Blue Origin, Jeff Bezos, space Company. And we're gonna be interviewing, we're gonna go to their headquarters here in, uh, in the Space Coast in Florida.

And we're gonna do some video coverage of what's going on there. And I'm just a little boy in me is very, very excited. Um, but other than that, you know, it's keeping the wheels on the tech strong and working with our friends at Tech Field Day and the rest of FU Group and, you know, trying to have fun.

Because at the end of the day, if you're not having fun end, it's just a job. Well, speaking of Tech Field Day, we are going to be at RSAC this year. We've got a great lineup of presenters so far, including Veeam and Object First, which are now the same company.

Uh, and we also are gonna be hearing from Commvault in several more. com, and you can see the lineup that we've got coming up in March. But also, don't forget to check out all the great events that we've got going on, uh, AI Infrastructure Field Day, uh, AI Field Day, uh, security Field Day, networking Field Day.

We've got a lot coming up. You can check out our calendar there. We also wanna thank you for listening to this episode of the Security Boulevard podcast.

If you enjoyed this conversation, you know what to do. Head over to YouTube or open up your favorite podcast app and subscribe so you don't miss any of our episodes. We would also love it if you would leave us a rating, a review, and, and maybe a comment just so that you know, um, kind of people are reading what your thoughts are on the show.

And that helps us get out to a wider audience. com in the Future Room Group. com, our Techstrong TV website, or check out the Techstrong TV app.

It'll run on Apple tv, Roku, iOS devices, uh, PlayStation, Xbox, whatever. We'll, we'll make it work. Um, we also hope that you follow us on Security Boulevard, uh, the social media areas, you know, X, Twitter, LinkedIn, you know what to look for.

Security, BLVD, that's who we are. Uh, we hope that you are enjoying all the great content that we're putting out here and across the future and group, thank you for tuning in. We'll see you all next week.

More horsepower, more power. Get those horses moving faster. Your ai, it's huge.

It needs more power. Or does it, can you actually do great things for your business with less horsepower and do things more efficiently? Join me on the Tech Field Day podcast as we drive this stage coach through the ideas of efficiency in AI infrastructure.

Welcome To the Tech Field Day podcast, where we bring together a group of IT technical experts to discuss a single idea about key concepts in the industry. This podcast features a variety of perspectives from members of the tech field they delegate, and it's often recorded in association with one of our events. In this case, AI infrastructure Field.

Day four Tech Field Day is part of the Future Group, and this podcast is also published, uh, on our sister company site. Techstrong TV on this episode will be discussing that AI needs resource efficiency and that more horsepower isn't the only direction. But before the discussion, let's meet who's on the panel today.

Hi, I'm Pete. We, uh, I've been around networking for a long time now. Retired, still doing it 'cause I think it's fun.

Hey, I'm Gina Rosenthal. I'm a product marketing manager. I've been doing that for a while, been doing product marketing for AI since about 2017.

And I'm Andy Banta. I've been hanging around the infrastructure industry for quite a while. Um, mostly from the aspect of it.

And I'm Alist Cook. I'm the event lead for AI infrastructure Field day here at Tech Field Day. And one of the themes that we see is that AI needs to kind of grow up from this land grab and this idea that massive amounts of infrastructure, ridiculously powerful GPUs stacked up in, uh, rack after rack with hopefully a very strong flaw and liquid to get to ridiculous numbers of, uh, kilowatts, hundreds of kilowatt of power being delivered through a single rack.

Um, I've long felt that there needs to be a much more efficient way of delivering ai. I was hoping there'd be some revolution where this more horsepower would cease to be the issue, because all of this horsepower and all of this compute power, all that energy has a cost. It's really expensive to generate these things.

It's really expensive to build these data centers. And as we've covered in the tech fields and news rundown, there are contracts for more data centers to be built to host AI than have ever existed in the past, exist now. So this is a huge build out for ai, uh, using vast amounts of resources.

And even if we set aside the difficulty of actually producing those, the cost to people producing them, is that even a sensible thing for us to be doing with the planet? Should we be generating AI by heating the entire planet up with these massive GPUs? And it's kind of a a point of, of difficulty along here.

Um, Andy, you've been around this, this block a few times before you've seen massive infrastructure get built out and maybe get more efficient. Can you see that happening here with ai? Well, I, I think it has to, uh, one of, I, I've actually been, um, talking about the power consumption used for data centers and AI data centers in general for the past couple years.

But one of the things that I would be really interested in hearing from, from the AI infrastructure companies out there is how they're doing things more efficiently, not how they're doing things faster or more densely dense or dense, uh, or various different ways of adding more and more. But it's, you know, tell us something about some algorithms that you're using to make more efficient use of the hardware that you have available or the speeds that you have available, or talk to us about a way, uh, a technique that you come up with to do more with less and, and instead of just telling us how you can do more, that's really what I'm interested in hearing more of from infrastructure companies. I completely agree, and I've got a slightly, uh, different perspective on the whole market.

I think the companies that developed the very large models needed, um, vast funding because of the huge costs that go into those LLMs, and they couldn't afford to specialize, uh, because they really needed something that would have a vast potential market. Unfortunately, what I think has happened is that they've assumed that's the future. I'm not sure could, it's certainly got a role particularly for conversational, um, interactions, I guess to put it.

But if you are trying to model something, be it network troubleshooting or, um, uh, some biological process or something, maybe a smaller dedicated model that knows about, say, computer networks, um, might be more suited to the task and a whole lot more efficient to run. So that's kind of a question in the back of my head. I, I don't have an answer, I'm just kind of watching the space, uh, with intense interest.

I agree with both of y'all. And Andy, I agree with the whole idea around power. When you think about, if you read any type of description of what, uh, the data centers are being built for, it's described in gigawatts.

So, um, it's not a back to the future reference, but it's actually how much power they need to run, um, these servers and to run the different components of the servers. They never talk about the data, they never talk about how much data that will serve us. They never talk about how much data will be created.

They never talk about, you know, the actual part of ai, it's the end result of it. They only talk about what it takes to run it. But when you do an infrastructure, when you do any kind of architecture, you're always looking at what is the workload that's going to be run on it.

And it's not at top speed because not everybody can afford to run everything at gigawatt speed all the time. Not only that, but if you think about what is ai, this is common, I'm gonna always come back to this. What is ai?

AI is what we used to call right now. What what is available from AI is what we used to call high performance computing. So machine learning and deep learning, and you don't need gigawatts of power to run those types of workloads.

So why aren't we talking about this as a true architecture instance, right? Like, what needs to happen, how much data you need, what do you need for each section of the pipeline that we're gonna be doing to transform this data? Um, those are kind of different questions, but I think those are important.

So we kind of skip over the whole, we can design for this, it's a workload, this is what we know how to do, and if it's a workload, we know how to make it run more efficiently. So I I'm with you. I I wanna hear more about that.

Well, you touched on something that I've been focusing on, which is, uh, where's the data? And I think we're gonna see that during the ai, uh, infrastructure field day, uh, presentations, because if the data's not local or if you've got, uh, such a huge LLM that you need to run your, um, training in multiple sites, then just accessing large amount of data is yet another barrier as well as latency and bandwidth and power, Right? And I mean, the, the other piece of this that I, I really wanna try to address on some of our discussion here is that the, um, in addition to data, the ability to actually create the data isn't being done efficiently.

Uh, and Fabrica presented at one of these sessions a long time ago before they got consumed, and part of their presentation was talking about the fact that the LAMA model is only, uh, theoretically capable of using about 70% of the GPU is available to it, and in practice is only using about 30% of the GPU is available to it. And that is clearly showing that more is not what you need here. What you need is to actually do the good old fashioned software engineering to make these models more efficient, to make use of resources that are available to them.

And that is really part of the efficiency that I would love to hear people talk about. Uh, Gina made this point a little bit earlier, uh, when we were in the pre-discussion for this about why aren't people looking at solutions similar to VMware of, uh, of sharing resources among various different processes. Uh, and you know, I I think G can offer a little bit more information on what she was thinking, but, uh, that's like an excellent question that we don't hear from Ethan VMware these days.

I think VMware has a hard time getting the message out, but, um, they have a lot, they've had a lot of tools for a long time where you could do things like virtualize the GPU and split it into, I wanna say 16, but it might have been eight to deliver that, that that vir that, uh, power to different virtual machines. So the same thing we did with Oracle back in the day, remember nobody thought you could virtualize Oracle. That, that it would be, you would cost so much because you needed those servers to be bare.

You needed to, uh, put that Oracle OS right onto the server and that's how you had to run it. But once you started looking at, no, these are workloads, you can virtualize all of it, we can virtualize every component of it from a VMware perspective, and it's virtualization in general. I'm sure it's all of the virtual, um, virtualization hypervisors that can do that for you.

But, but it, we're not thinking about it that way. I think it's, it's, it's definitely the hype that's driving that. Like you have to have ai, you get ai, you have to have this many servers and this many GPUs.

That's the formula, the blocks, and that's kind of how they're being sold. I don't see anybody pushing back and saying, nah man, we need, what we're needing to do is we're needing to take this historical data, do this with it, it's gonna cost this much for us to crunch through it, and this is what we actually need to install in our data center. But people were doing this before the days of ai, they were doing it when you went to super compute, you would see people doing cool things on bare metal.

And I know this because we were there with VMware saying, and you could also do this with virtualization. So it, it, it's just workloads. And I think that the architects and the engineers need to get back to, to that piece, which would also force people back into the what is the use case?

Why are we gonna do ai, what's on this side? What's on the other side, and what do we expect to report back? You know, what, what's this gonna gain the company if we, Yeah.

And, uh, it's, um, and VMware certainly did do virtualization of GPUs and they, they did it both, they did it both in software and they also were able to split out the hardware functions of various different GPUs and spread those to various different VMs. And through some of their later technology, they were actually able to share those share across the network. Um, I, one of the other concepts that has been brought up that I really haven't seen a whole lot of traction on is there are CXL vendors out there who are attempting to say, harvest the memory from your, um, systems that you were shutting down and put it into a cxl rack that you can actually use on a new system.

The idea is that doesn't go bad, can last for a very long time. And even if it's not the newest, most, most fast that's out there, you can certainly make use again. So, I mean, the, in addition to efficiency, we also don't hear too many people talking about reuse or sharing of resources.

We're gonna have to, right? Because what happens now when all of a sudden the prices of everything is going through the roof, you can't get rid of your memory, you can't, you really have to hold onto it because if you don't hold onto it, you, you're not gonna buy any new, unless you pay three times what you're already paid, what you paid for it yesterday. So we're in this memory crunch because they can't make it fast enough.

The same way you can't get ahold of GPUs because they can't make them fast enough, can't manufacture them. We're in a place where the chips are getting smaller, but getting doubling in, in capacity size. So they haven't really, um, perfected that, um, that, that in the, in, in the manufacturing plants to get those rolling and get those out to customers.

So many of them are already pre-sold And they're pre-sold, so you can't even get them once you, once you get ready to go deploy this. So you're gonna have to get creative and figure out how do you architect for this workload with what I got or what I can maybe find on eBay for a decent price. Right.

Well, Jena hit on another, um, thing that I think is key, which is shorthand would be ROI, but what's the company benefit from what people are doing? And that's kind of the challenge with everybody does ai, uh, which seems to be the, a meme in some companies, and it really is much more helpful to start thinking about ROI. But another factor in it is that maybe not everybody, just like not everybody is cut out to be a programmer.

People have their job they wanna do, and they may have a idea that AI can help them, but right now, uh, how to prompt A LLM and, uh, get good results and sort of cycle that is, uh, something that's not for everybody. And we're starting to see some mechanisms coming, uh, gait and some of the other things that help with automating that sometimes even in massive ways, which could be a problem. But, uh, when is this, when is AI sort of experimentation gonna be easier for, uh, Joe Schmo in marketing or whatever to use, uh, That the right thing to have happen?

Because as we're talking about this as, as you doing AI through resource efficiency, what are the tools that that abstract away the intelligence of the operator, right? That, that take away the specialization of being able to work with the AI tool? Well, that puts more load on the ai.

That means that we need more horsepower in that AI to handle the fact that we're asking somebody who, who is not specifically skilled or oriented towards understanding the tool to just throw simple language stuff at this tool. This is how we're getting this idea of needing more and more horsepower. I think coming back to one of Gina's points was that having an AI tool that is specific to a task rather than a general purpose ai.

So building into your application instead of using, uh, a full 7 billion or 20 billion parameter model, that is a general purpose model. Having a model that's specifically set up to handle maybe, uh, analyzing the productivity of your, um, factory floor. Having an AI that is specifically trained for that function is gonna be more efficient than feeding the all of the information about your production floor into a general purpose model.

And that's where we need to look at that resource efficiency versus simply building more horsepower. There isn't a single solution here, there isn't a single answer to this. Sometimes in order to get value out of ai, we're gonna need to a very specialized AI that does a very specialized task.

And I come back to some of the early discussions around this, that a lot of the time it was still the, uh, predictive ai, the old fashioned machine learning that, uh, was looking for trends and data and, and, and extrapolating those trends and data a lot of the time, that's what the production AI was. And strapping a chat bot, large language model on top of a huge amount of resources wasn't necessarily the right way to solve this solve. Another of the themes that we saw across our AI field days, uh, as, as though we're maturing, was the idea that chat bots aren't the answer.

They, the AI needs to be invisible inside the application doing whatever it's doing. Uh, it needs to not be the, the primary interface. It needs to just be the thing that makes the thing better.

To quote Bobby Allen say, you know, AI should disappear and and should be task specific. Well, that's where maybe the LLM gets used in a slightly different, uh, form of age, uh, use where it recognizes what field a question, what type of question is being asked, or what type of inferencing is is being requested. And then it calls on a dedicated model that, uh, for instance, like what Cisco's done with an in-house network trained, uh, model to actually answer the question.

So it calls an AI agent rather than a software code agent. That's a classic program. Yeah.

Yeah. And I mean that's, I think that's part of where Alistair was going. I think part of it, uh, the idea of the efficiency could be that you, you don't need to train something on the entire world of knowledge to, for a specific thing.

And I mean, if, if you go in with the idea that we only need to train something for a specific piece of knowledge, then you, you probably can do it more efficiently. And it, it's, uh, you know, you talk about Cisco, a a friend of mine who worked at a MD said that one on one of their early models of their, uh, virtual assistant that was based on an AI model that he, the first thing he did was ask him, what is Epic? Which is the name of, uh, desktop?

And, uh, the virtual assistant couldn't answer it for them. Uh, one of the things that, you know, you brought up, I, I think it's unfair to say that Joe Schmo in marketing, this is like LLMs are the perfect tool for marketing, right? And I know people aren't giving the right prompts yet, but, um, we had a conversation about this this morning on the Textron game.

What happens when, um, what happened with email, when email first came out, everybody couldn't use it. I mean, I had to support post drops who were astrophysicists that really had a hard time with email. So, you know, because it was so new, it was something brand new that nobody knew how to do.

Um, and they didn't, they lost, they didn't understand the rules. But now you can't imagine having an organization that doesn't have a proper email system running one way or the other. And I think that's how it's gonna be with ai.

AI is gonna be how we communicate with computers in the future, right? This is how, and now going forward and it's gonna get more and more, we'll, we'll figure out the latency problem, we'll figure out the power problem, but people dunno how to use it now because nobody knows how to use it now. Like the few people that do are, I would say the very, very technical people don't understand how important those marketing people are in the organization and how they can pick the information out and distribute it back.

Again, defending marketing, because I'm product marketers, so have to do it. But, but I, I think you know that, that very technical people forget that that data that we're moving around and trying to transform things into, one of the way it gets transformed is by the, the knowledge and the point of view that the people that aren't technical that are gonna take a little longer to train them on the prompts and, and how to do things properly, they understand the way to pull the information out because they have the vocabulary, everything else that nobody else wants to learn about marketing. If you're not a marketer, you're a technologist, you don't care, you don't wanna learn that, but the marketers will know the right words to pull that out and pull the information outta the data.

And that's really what a lot of those LLM, um, workflows are all about, is to help pull information outta data. So I think some of this is just, we are in such early stages and we were bombarded absolutely bombarded with hype about what this is and how you don't get on board, your company is gonna be sunk and all the rest of it, you know? So I think it's really important to remember that all of us are suffering from height overload and we're gonna get there because this is how we communicate with computers now.

Yeah. But this goes back to the point, yes, I, I agree with exactly what you're saying, but I, I think, uh, some of the, some of what's being lost here is that, um, the efficiency that you actually would get, lemme back up that this is, this is making things more inefficient rather than, um, more efficient. And I think one of the things that we, we lose sight of is actually paying attention to the genuine computer science necessary.

And instead, we, we keep adding layers that are, uh, wasting cycles to get the same job done. Thousand percent agree. Have you ever looked at stuff that looks like front page like AI stuff looks like front page from Microsoft way back in the day?

Yes, It does. Yes, I agree. I agree with you.

So will it optimize when it looks like, um, MySpace instead of the front page? I think that'll be a little bit optimized, but that's like when they're just, that's probably like when they're just to the point where it's too much and then they're like, holy crap, we gotta pull this back and make this really work for people and we've gotta make it good. Now, One other challenge that I'm, I think is lurking here with the idea that everybody does AI is, uh, it takes me back probably several decades to, uh, ro it, uh, the prospect of people just learning spreadsheets and doing corporate financials on a spreadsheet and screwing up a formula with consequences.

And that's actually good news from the AI perspective is we've been here before, so people learning and making mistakes, uh, hopefully you can fence them and be aware that, that that's a potential problem. But, um, I think assisting people with frameworks that, uh, minimize the mistakes is probably a useful thing to think about In terms of resource efficiency. Um, I, I really don't expect that an unskilled user should be handed here.

Here's an AI that is a general purpose. Ai, you can do anything you want with it, and we're not gonna tell you any limitations around that, right? That's, I don't think that's a good way of using ai.

AI should be invisibly embedded into the thing you're already doing. So as a, as a marketing person, Jen is per perpetually writing documents, writing, um, presentations. And if you're going outside of that, using AI to generate some things and then come back into it, the workflows rock, let's say there's just another layer being added that adds no value.

The AI should, should actually be embedded, however frustrating. It's to have the, uh, Google sheet say, would you like me to generate everything for you? Alright.

That's where it should be. Uh, the AI should be a feature that makes the application you are using makes the tool you are using function better. It shouldn't be a separate place that you have to go.

Um, some of the evidence that we're misusing the separate place is, is absolutely ask the ai what is epic when you can go to Google and say, what is epic? And be taken to the documentation that describes exactly what Epic is. People are using, um, chat GPT as a replacement for search and finding that chat.

GPT isn't necessarily up to date on the latest news. It certainly doesn't know, uh, about the ice storm that's coming to the eastern US uh, this week, or about the landslips that happened close to me here in New Zealand over the last couple of days due to the weather. Um, but I can find that information through Google search, right?

Using AI and particularly chat interfaces for the wrong things is gonna lead to poor results. And I think hiding them away, Don't you think that if you, I'll go back to my front page, you know, that's why front page was so awful because it had everything in one, one place. So don't you think that we're gonna end up having more bloat problem and more resource problem if, um, if we put everything in the place?

Well, data sovereignty is the other thing I'm sitting here thinking, because if you have, uh, people just asking chat GPT, uh, well, it's already happening that, uh, very private and sensitive information is getting exposed because it's sloshing out into the ai. And given some recent results where people have been able to reproduce entire books or major chunks of books by feeding, by iteratively prompting the LLM, uh, they could probably get at that secret data, uh, confidential data as well, which is not a good thing. Returning to, to one of the things that Gina said that, so the sort of bloat to building AI into everything, I think you've got a really vital point how rebuilding, putting AI into every single application independently as we're seeing at the moment isn't efficient.

Is it? It's the same thing again and again and again, uh, but we're seeing some movement towards some standards about how you inject ai, uh, or specific knowledge in AI into an application technologies like MCP, um, standardizing the way you attach to an ai. So I don't think there's necessarily the need for that, that complete rebuild.

Uh, and there's other standards like the agent to agent standards because as Pete was saying, a lot of the stuff is, is actually gonna be done by agents rather than directly by human interaction. So I think there are developments in that space of not having to rebuild, redeploy, uh, do again, exactly the same thing we've done in the past. So I think there is hope for us that the AI delivered into a specific applications doesn't have to be a completely from scratch or really an efficient reimplementation of some other ai.

Uh, of course that's probably what gonna, what we're gonna see first because that's how you get to a minimum viable product. Uh, I think Pete mentioned that, that idea of, uh, we built huge large language models and, and so that's the way we view all of AI needs to be this huge amount of resource for these huge large language models. Again, I I view that a little bit as a minimum viable product.

I really hope as maturity turns comes along, we'll see more efficiency, more reuse of technology, and more use of tools that are specialized to a single function and that do that function more efficiently. The thing is, we've gotta stop the pace of going for more and larger, which was coming back to our original premise, more and larger isn't necessarily the right way to go. Um, so yeah, I, I think I've rambled all over the place on, on a bunch of stuff we've talked about.

Uh, and I, I really do hope we do see more efficient use more tasks, specific use of large language model AI and, um, at some of that maturity of working out how we're getting business value rather than just the, um, arms race to acquire as much resources we can. Because if we don't, somebody else will acquire that resource and, and we'll lose, I think in the end, if all you do is acquire resource and never use it, you are going to lose anyway. May as well, uh, look at efficiently using those resources that you acquire.

Well, there's competition for the resources. There's also time to market. So if you're using massive resort costly, uh, resources and training a model, you have to build this Mongo data center and everything just to get rolling, that's a long lead time.

And so anything you can do to make it lighter weight, it affects, uh, improves your time to market, Right. I, and you know, I I think one of the other places where we could potentially see some efficiency is, uh, being able to filter out AI generated content when we're actually building our models. Uh, it's one of the things that that's, we, I mean, we, we end up with, uh, hallucination amplification when we do that.

And it's, um, it also means that we're, we, we end up with AI that's seeded with a imaginary information to begin with. And that's, that was one of the terrifying things about Deep Seek was, was when they built deep seek, one of the things they did was use a lot of AI generated content to teach the ai. And yeah, that does seem like fantasy land being used to build another fantasy land.

And that doesn't translate well to being useful in the real world generally. I think one of the other struggles is right, you know, of course a marketer I use, I use, um, Microsoft. And, um, one of the things that's gotten way better is their copilot, especially if your documents are on the platform, that's gotten way better.

But you talk about, um, uh, the bloat is there and the BLO is there because the systems underneath of Office Doc, you know, online office are not all the same. They've come from mismatches of what they have and put up on, you know, the different, different sites and we use them, but you can see it when you try to start to run this whole pipeline, you know, writing and producing and editing and adding things and that kind of thing, because you can't do it all in one place. So I think that that's a problem too, is like your businesses are going into AI and they might be going out and buying whatever they can to be the most powerful and the fastest and blah, blah, blah, but they're reaching data that they're using data, they're organizational data that's, uh, all sorts of stuff, maybe even on tape.

There's a lot, that whole piece they're saying. That's what I've heard is that whole piece of preparing the data to actually be used by a model and to be used to make some business battle that take value. That takes a lot of time and a lot of doing.

And you think about rehydrating things from tape and getting things into an object ready, if that's the way you built things, how, how that looks for everything to be consumable by the model. So it's, it's, we we're gonna have a lot more before we can get to the trim down thing, even if we're trying to, so like, we've got this problem of not being able to get the components, this whole problem with getting the data ready, you know, and then making it, um, palatable for the business users to use. So it's a, there's a lot to be done.

Did you just say garbage in, garbage out? Yeah, that's what I said. I think that that idea of bringing data together from different sources leads to a, a sort of disconnect where, as you say, it's not all the same format or naming of things.

And this is the semantic layer that Brad Shiman from Futureum Research has been writing about recently. I'll be presenting, uh, a little bit of his research at, uh, infrastructure Field Day tomorrow. And so I think there's gonna be a continuing conversation at our infrastructure field day about how you build this infrastructure, how you make it valuable, and we're probably gonna come in with a lens of how you make it efficient.

Andy Pitton, Gina, uh, here in, in, uh, Santa Clara with us and I have a, a collection more awesome delegates. Uh, so before we fill out hours and hours of this conversation, I think I'm gonna put a line under it here. And thank you all for joining us today at the Tech Field Day podcast.

So before we close out this podcast, where can people connect with each of you and maybe continue this conversation or maybe decide they wanna buy you a beer at your local, uh, Bar? I can be found on LinkedIn. Um, my initials PJ Welcher should find me.

You can find me on LinkedIn too, and I'm so excited that my podcast partner will be with me at Tech Field AI Field Day, and you can find us at Tech Aunties. Okay. And you can find me on LinkedIn as well, Andy Banta, uh, as well as on Blue Sky Social, and I, uh, my, my occasional, um, blog posting on andy banted substack com.

And of course, you could find me, Alistair Cook on LinkedIn and all of your favorite social media, as well as at AI Infrastructure Field Day this week. Looking forward to having some great, uh, conversations with people there. So thank you so much for listening to this episode of the Tech Field Day podcast.

And of course, if you enjoyed this discussion, subscribe on whatever your favorite podcast application is, or on YouTube so you don't miss a single episode. Uh, give us a nice review as well, and a, a high rating because you love coming and listening to the Tick Field Day podcast, particularly when we have such entertaining delegates joining us that will help other people to find the awesome contact. This podcast is brought to you by Tick Field Day, the home of it experts from across the enterprise and a part of the Future Group.

For upcoming events and more episodes, head to tick field day com slash podcast or view us on Tech tv. Thanks for listening, and of course, we'll see you next week on the podcast. Hey everyone, welcome back here to Techstrong tv.

Hi, I'm happy to, uh, introduce my next guest to you. His name is Evan Pros. Evan is a, uh, product marketing manager with Active State, and let's welcome him to Techstrong.

Hey, Evan, how's it going, man? Hey, Owen. Good, thank you.

It's great to be here. Thanks for having us. It's good to have you on with us and active state.

Evan, I always like to give our audience a sense of who's, who they're listening to. So I said, you're a product marketing manager, and a lot of people may say, oh, marketing, you know, bad word, but give, give people a sense of your journey, Evan, how, you know, how'd you get here? Definitely.

So, I mean, honestly, my interest in technology kind of goes way back to my university days. I went to a very technical university and was around, you know, a lot of software engineers and a lot of engineers in general. And I think that was the first time in my life I had that realization where you sort of understand why those things are cool and you want to get closer to them.

Uh, you know, I was studying psychology, so way, way off from that. And so my objective was like, how can I find a way to get closer to the world of products and these things that I'm starting to be interested in? And I was doing some marketing work at the time, and, uh, there was an opening at SAP for an internship, uh, to do product marketing.

And so I sort of got my foot in the door at SAP, you know, over a decade ago, starting out in product marketing. And since then I've tried to really continue to be close to the product and technical world. Um, before my role here at Active State, I spent a bit of time at VMware and Broadcom working on the Tanzi division there.

And so I worked with Sure, um, application modernization technology specifically on the consulting team. And so we worked with a lot of customers to help them go and modernize legacy infrastructure, you know, move them from monolithic code basis to something like a cloud native development framework. And so, um, yeah, like you say, I've really been around technology for the greater part of my career.

And I would say too, you know, product marketing in particular, our job is to listen to the customer, is to understand what their problems are. And so I may be marketing, but I spent a lot of time chatting with the, uh, you know, world of DevSecOps and hearing firsthand sort of what they're experiencing in their day to day. Gotta ask you a question that's not a guitar neck I see behind you, is it?

It is, it is. Well, that makes you a bonafide tech dude. If you've got the guitar in the room with you.

I know. Are you, are you good? Can you play well?

Or, or you just hack around? You know, I'm kind of getting back into it. I played drums for most of my life, but, uh, drums are not the most conducive to a little apartment in Toronto.

So, uh, no guitars a bit more manageable for sure. Yeah. So They're a lot more conducive now.

And you can get drum pads electronic and just wear e uh, uh, EarPods or something, you know, EarPods Totally, Totally Compared to banging skids. But yes, it, it amazes me though, you know, as someone like me who, who speaks to a lot of people here on video like this, the amount of tech people who have guitars in their rooms, it, it might be approaching 50%. It's nuts.

Yeah, I think I would agree with you. I think going back to my, my time at VMware, you get on a call with someone and like you say, 50% of the time there's a wall somewhere in the back with, you know, at least a couple. Yep.

More than one even. Anyway, good stuff, Evan. Let, let's talk active state, right?

It's a, I've known about active state now for oh three or four years, or a good friend of mine was there a while ago, but I'm sure there are people out here in our audience who are not familiar with active state. How would you describe it to them? Yeah, definitely.

So, like you say, active space, active state has been working in the open source software space for actually a couple of decades now. And we really got our start way back helping organizations package and distribute open source languages. So namely, you know, legacy technologies like Pearl Tickle and Python for use in sort of more common enterprise applications, mainly porting them to Windows.

And so today I think, you know, a lot of people think of us as the Pearl Tickle and Python people, but a lot has changed over the years. Uh, of course infrastructure has evolved and so has teams need for open source in general. And so over the past couple of years, our focus has really been on taking that ability to build open source from source and extend it across all of the major language ecosystems.

So in doing so, we're tackling a lot of the complexity in things like solving complex dependency chains and ensuring that open source can build in a repeatable and predictable fashion for any o operating system. And sort of the, the result and what this, why this matters for customers is now we've developed a catalog of over 40 million built from source open source components. And in doing so, we're able to give customers access to these components.

And they know that they always will have the fewest amount of vulnerabilities possible, you know, it's safe from malicious code that might be injected somewhere in a supply chain attack. And we're always able to provide them the latest and greatest version of that open source. And so the great part about this catalog is customers can consume it in the way that makes the most sense for their business.

That could be simply, you know, mirroring the components into their package registry and using them like they would any piece of open source or that could be coming to us and saying, Hey, I need a container image with this software inside of it and I need it to be secure and updated for me on a continual basis. And so, you know, that story of container sort of relates to what we're talking about today. But really, I guess in short, you know, that's a lot of rambling.

Our goal is to help software development teams improve their security posture without slowing down the application teams as a result. Love it. Couple of questions follow up on that.

Look, AI's changing everything, Uhhuh, especially AppSec, especially in open source. I guess maybe we could come into it when we talk about the report, but I wonder if AI has had any sort of, uh, impact on that. But even before we get to it, Evan, just housekeeping for people who wanna be, want to go find out more about active state, where can they go?

You know, the answer is very simple. com, uh, specifically if you're looking for the report we're gonna chat about, we have a resources tab, you'll find it there. No problem.

Very cool. Alright, let's talk about this report. It's the 2026 state of vulnerability management and remediation report, container security edition.

Um, what do, what do we get our hands around here, Evan? Yeah, absolutely. So, uh, we started doing this report annually a couple of years ago, and the first iterations were really about asking, you know, our customers and the community at large about how they are dealing with open source vulnerabilities.

You know, their ability to sort of go and remediate them and the trends they sort of see going forward for the future of this. Um, obviously we've been talking with a lot of customers over the past couple years and containers, as we know are sort of the prevailing infrastructure for teams to start deploying applications. And so we said, let's go and ask these same questions from a container point of view.

And so, um, last year we interviewed 250 DevSecOps professionals. So you can think titles like, you know, application security, uh, very true DevOps and platform engineering titles as well as a lot of engineering leaders. And we, we sort of ask them the same things like, how are you managing vulnerabilities in your container images?

Is this something you're able to scale and keep up with on an ongoing basis? What are the key challenges you're facing going forward? But also, you know, on a more positive note, we asked them where do they see advantages, uh, going forward in the future to solve this problem?

What are they looking forward to, uh, exploring in 2026 when it comes to vulnerability management? Very cool. Um, you know, I love when you've done a report kind of couple years, so you build up like sort of a body of knowledge.

'cause it gives you, you know, uh, with that Monday morning quarterback kind of view, right? Where you can look across years and see trends that build not just over the course of a year, but over the course of years. Um, but let, let's focus in on this, this, uh, year's report.

Evan, what if I asked you, Hey, ev what were the three key takeaways from the report? How would you answer me? Definitely, so I think the most striking thing for me was, um, of all of the people we interviewed for this report, 100% of them said in some capacity, containers are critical to their production workloads.

So, you know, maybe that's not surprising given the audience, but every single person we talked with said, containers are something I am invested in and I'm interested in. And, you know, stand alone on that stat, it's not particularly interesting. But I think what what makes it really striking is we also ask them how likely is it that you've experienced some form of container related security incident or breach over the past 12 months?

And of that same set of people, 82% of them said they think they have likely experienced some issue in that timeframe. And so when you compare, you know, the number of a hundred percent of adoption versus 82% security incident, you really have to think like, what is going on here? Um, you know, it's pretty clear containers have become basically near universally adopted, but are we keeping pace with the security measures that we need to put in place to solve that?

Are we able to even tackle this problem? And so I think we knew this was a problem, but seeing that 82% number was something that really kind of stuck out to me as, wow, this is a bigger problem than we might think. So that, that is sort of the foundation for all of this.

The second thing I thought was really interesting is, um, we also asked companies, you know, how likely as a result of these vulnerabilities in your containers have you potentially run into an issue with a compliance audit or some sort of governance issue? And again, 78% of organizations said they think they've probably likely failed a compliance audit in that same timeframe. And so you start to see this story go through of, you know, containers are important, we're not able to keep up with the vulnerabilities in them.

And the outcome of that is that, you know, audits are failing. CVEs are, you know, super prevalent with inside their own environments and the, you know, the outcomes of that are kind of crazy. You think about, um, you know, the potential penalties of an audit failure, maybe that's financial, maybe that's reputational.

And so just sort of that combination of the through line is, is quite shocking. And then I think the sort of final thing that's kind of crazy to that me is that, um, when we asked why do they think this is happening, um, you know, what's causing this, A huge proportion of them cited visibility into their container images as sort of the root cause of this. And I think, you know, if you think over the past few years, things like SBOs and scanners have been talked about, you know, endlessly and teams have spent time implementing these into their pipelines.

But the takeaway here is sort of, even though we have this sort of surface level visibility from the tooling, the outputs of that tooling isn't really giving anyone any meaningful outputs. Yeah. And, and, and it's, it's, it's literally you use the word surface, it's the surface.

It's not very deep. Yeah. You know, I think this is why Evan, we've seen like companies like suse, for instance mm-hmm.

Right? Come out with their own, um, like for their suse enterprise Linux or whatever they call it, right? They, they have their own certified packages, right.

That are hardened to check for security. We're seeing, uh, who SUSE had bought that company, oh, I forget the name of the company. It's their cloud native company Rancher.

Right? Right. They're, they're doing a similar thing via rancher with like hardened certified containers that are what they say they are.

And SUSE is going to vouch for the security. It's not just suse. A lot of companies are are now trying to say, Hey, we'll, we'll we'll stand behind the container image you got for me.

The problem though, quite frankly is sometimes you're trading that open source freedom, Right. To get locked in to a particular vendor's, you know, distro or what have you. And, um, and I don't know if people are comfortable doing that, in all honesty, right?

They, they people want freedom. Um, but on the other hand, you know, the container, I mean there's just, as you said, we don't really, you know, we could scan containers the same way we scan other infrastructure. It doesn't mean we remediate it.

Right? And even if we're scanning it, it's only as good as what that scanner knows today, not what zero day or new vulnerability comes out tomorrow. Yes.

Um, let me ask you another question. Yeah. Anything in the report that kind of made you eyes pop open and say, whoa, I didn't see that coming?

Yeah, I mean, I would say there's sort of two things that I thought were super interesting actually, just going back to what you talked about, about, um, a lot of organizations are going and trying to build this model where they're saying, Hey, use our standard source for like you say, container images or whatever output may be. And we actually did ask a question, which was, how much do you trust, you know, we used a language curated catalog, um, to effectively that's a fair word. Yeah.

Effectively mean the same thing. And 77% of uh, you know, are the respondents said they do trust this model versus say, going out to the open internet and pulling, you know, an artifact. But what's really interesting is we also asked them like, how frequently is your team actually just going to the open internet anyways and sort of pulling from, you know, whether it's Docker hub or one of the language repositories.

And 90% of them said, oh, well that's actually still what we're doing. And so I think to your point, there's a lot of interest in this model of, um, how do we go and get secure open source from a vendor? But, you know, either people aren't finding what they're looking for, the convenience of going to, you know, the open internet is still sort of prevailing.

And, uh, I mean, I think for us at Active State, that's great to know considering we're sort of on a mission to go and rebuild as much open source as we can and kind of cross ecosystems. So that's one thing I think is just that sort of disconnect between, uh, intention and reality. And then the second is on ai.

Of course, you know, we probably can't escape any one of these interviews you do without talking about ai. But, um, one of the interesting positives, uh, from the report as well is that a huge amount of people kind of said they believe that AI is going to be one of the technologies that sort of is the tipping point to solving this problem of remediation. They expect that, you know, whether it's through automation or through some form of AI vulnerability management, this is something they're looking to invest in going forward.

And this surprised me, not because, you know, we know AI is popular, but just the idea of it being so close to your code base or, you know, touching potentially Cody wrote, I thought this was an interesting statistic as well. That is because, you know, you must have had a lot of optimists in your survey, right? Yeah.

Because a lot of people say, oh, no, AI's gonna make it worse. Right? Right.

Because the, the bad guys are using AI and you know, we don't know what's going on there and we automate, we go faster and we take humans out of the loop. And, you know, AI is less secure. But I'm glad to see that so many folks actually think it is gonna help.

'cause I I'm in that camp, I think, you know, I don't think it's gonna be nirvana from day one, but I do think over time we're going to see it really helping out here. Right. And I, I, well, I'm an optimist too.

com under resources and it should be there. Yeah, absolutely. I think that's the easiest way.

com, you can hover over the resources tab and I believe it's right there. So, um, yeah, I think easy. Very cool, easy way to find it.

Yep. And you know, I I I wanna leave people with this again, I wanna return to active state and their mission, right? Yeah.

Give it to 'em again, if you don't mind. For sure. So I think, like you said, you know, people are looking for a place to find secure, open source.

They don't want to have to deal with the vulnerability challenges that come along with open source. As we know, everyone's got endless amounts of it in their stack today. And really what we're doing at Active State is building a secure and trusted source for as much open source as we possibly can.

So, like I said, we've amassed a catalog of over 40 million open source components that spans every major Lang language ecosystem. So think Python, Java, JavaScript, and teams can come to us and effectively plug right into that catalog that could be getting those packages to replace the ones they're pulling from places like Pi Pi or NPM or like, you know, in terms of this report, they can come to us and say, I need a container image that's minimal, that's secure and only has the exact pieces of software inside that I need. So really our objective is to give people access to open source they know is free from vulnerabilities, is, you know, built by a trusted source in a hardened environment.

And that is flexible enough for them to use without having to go and say, Hey, development team, like retool the entire way you're working, put new tools in place. That's not how we operate. We're simply slotting into what teams are doing today.

I love it. Evan, thanks for coming here on Text Truck tv, man. I appreciate it.

Good report here with this, uh, 2026 edition. Come back and keep us posted about what happens in active state. Of course.

Thanks for having me. Appreciate it. My pleasure.

Evan Pros, product manager, product marketing manager, excuse me, for active state here on Tech Drunk tv. We're gonna take a break. We'll be back with more.

Hey everyone, this is Alan Hummel, CEO of Techron. Welcome, welcome to this very special virtual event that we are producing in partnership with our friends at Microsoft. The event is titled, unlocking the Future of Agentic Experiences.

And it's gonna be a series of videos in, in this virtual event that you're gonna be able to, you know, take a look at and, and interact maybe with some of the analysts and speakers here. I really think you're gonna enjoy and get a lot out of these videos in this event and look forward to hearing your feedback. I'd like to kick things off with our keynote and it's our keynote 'cause I think we've got two terrific speakers in this one.

And it's around the future of apps, right? And it features FU CEO and principal analyst Daniel Newman. If you've ever seen Daniel on an either many TV shows or, or, uh, conferences that he keynotes, you know, he would've dynamic thought leader.

He is, I think you'll enjoy it. And Daniel is gonna be speaking with none other than Ryan Cunningham. Ryan of course is corporate VP for the power platform at, uh, Microsoft.

And you know, Ryan is gonna share with Daniel and with you the all up vision. The, you know, the all around vision for P Power platform. We're going to connect the dots between apps, agents, and interfaces, right?

Ryan, and, and you know, with Daniel are going to illustrate how Microsoft is leading automation in this AI era. He's gonna articulate how Microsoft is enabling every organization to build, govern and scale intelligence solutions with unmatched speed and trust driving the future of a agentic apps. It's a great discussion and I think it's a great learning experience.

So here's Daniel Newman and Ryan Cunningham. Alan, thanks so much for that introduction and to introduce myself, I'm Daniel Newman, CEO of rum. Very excited to be here today with all of you and even more excited to introduce my guest for this conversation.

Ryan Cunningham from Microsoft. Ryan, why don't you say hello to everybody and give a little bit of background on the work you do at Microsoft. Uh, thank you Daniel.

It's awesome to be here with everybody today. So I'm Ryan. I'm the corporate Vice President for Power Platform here at Microsoft.

So, uh, look after all the teams of, uh, uh, product people and engineers and designers that are building, uh, really our low code application platform and the future of where that is going. Uh, you know, really excited to talk to you about that today, Ryan. I've been working, uh, with and around your team for many years as an analyst.

It's been great to follow. Of course, the change that's been going on in this market is extraordinary. And I think that everyone out there is gonna gonna leave this, uh, conversation knowing a little bit more.

And hopefully maybe you'll give us a little bit of that, uh, secret sauce about all the stuff Microsoft's doing. Nothing too secret though, you know how that goes. Oh, I know.

So let's, Let's start big. Uh, I mean, when we talk about the future of apps, connecting agents, interfaces, applications, you know, what is the kind of the North star for Microsoft? What are you, what are you guys heading towards here?

Yeah, Uh, look, it's a, it's a crazy time to be alive in a business application platform, uh, environment, right? Because, uh, this whole world is, uh, being turned upside down in actually two dimensions at the same time. Uh, one is how we build software, uh, radically changing in a world of agents and, and vibe coding and everything that is filling up our LinkedIn feeds as technology professionals.

What's really interesting right now is the dramatic expansion in efficacy of what I can build and the dramatic expansion of who can participate. At the same time, You have to be evolving the platform even more and even more quickly, right? To, to get them what they need and what they're trying to do to accomplish the, the future that they're trying to build.

Yeah, a hundred percent. And you know, I would say to, to even build on your last comment 'cause it's relevant here. Um, it's not just an opportunity for more people to tinker and build things.

It's actually really an imperative. Like, if, if we're really gonna accept the premise that every company that wasn't born yesterday is operating inefficiently and needs to, to rapidly advance in a world of agents, then the expertise you need is not just the AI technology expertise. You actually need to go get all of the process expertise, you know, all the humans who know what it really means to run a more efficient HR department or finance department or, you know, whatever it is, they're sitting with a real job in that department today.

You gotta go figure out how do I harness that expertise and bring those tools right to the, to the point where the process is actually happening today. And that's where you need a higher abstraction platform that has agents built into it that help do the coding, that help do the work. Microsoft does have some really unique approaches in this space and, and particularly if you look at this broader world of how software is getting built and code generation and agent swarms and every other term we're coming up with right now, you know, where we're really focused right now, particularly in the space of business applications and productivity is really make that relevant to the way companies run and operate.

You know, we're not out there to, to, uh, you know, serve any possible whim of any possible developer on the planet. There's lots of great tools for that. Microsoft makes some of them in other places, but here we're really focused on the, the core operating system of a company.

And by, by that I don't mean windows. I mean sort of all the business applications, business processes, specialist teams of people that today make a company tick. We're seeing consolidation in this era.

Customers have a ton of choice. Yep. Everyone kind of says use our agent thing, right?

Um, what we're gonna wanna see is, you know, the orchestration is gonna be super important. And then of course the, the speed, flexibility, access to all the tools, data, cloud, and of course Microsoft's in a very small group, right? Companies that has pretty much all of those things, right?

Um, not o not the only, but one of a very small number. And I think that makes you competitive. I wanna go to the, the pragmatic side because a lot of the, uh, viewers here are probably thinking about, you know, how do I do this?

How do we do this in our firm? You know, we hear some of those stats about A-I-R-O-I and the enterprise and, and, uh, let's just say that I'm a, I'm a absolute believer, but I do think there's some hurdles, you know, what are those kind of key enablers you're seeing fundamental enablers, enterprises, you know, need to get right now, right? To make sure that those, those POCs and those production, uh, AI projects start to work and really show value.

Yeah. We're seeing customers, um, adopt exactly the mentality you're talking about. You know, not just how do I run the current process faster, but what if I fundamentally changed the process itself, um, to really great effect.

Um, you know, we've, uh, we've shared some stories of retailers, um, that are starting to use agents and apps and automation together to totally change how they do things like fraud detection and, uh, even refunds and returns management. Um, you know, if I go contact an online retailer and say, I want a refund, uh, you know, traditionally that's a human going and vetting, is that a real customer? Did they buy something or is this fraud?

Does it meet our return policy? Which is by the way, usually like a 50 page PDF that changes once a quarter. Um, you know, and then do I want to issue the refund or can I save them as a customer?

And that's super slow, it's super inefficient and it's really expensive and often it's outsourced to vendors. Um, you know, can I go implement an agent that does that instantaneously, or at least does major parts of it instantaneously, um, you know, really starts to change my operating and my risk profile and my customer relationships. And so, you know, even in use cases like that, starting to see, you know, millions of dollars of value unlocked really quickly and just better customer satisfaction, actually the balance of value is really shifting towards that process expertise.

Um, and I think part of the challenge though is just, you know, very few people with real Jobs woke up this morning and said, God, I want to build a business application, or I want to automate a process. That's just not a thing that happens to most regular people. Um, but a whole lot of people woke up this morning and said, man, this part of my job sucks.

That could be better. You know, I wish we didn't have to burn so much time doing X. Right?

And, and really harnessing that energy, that value those skills and those people and bringing great tools to them. That's part of the whole thesis behind why a platform is, is critical right now. You know, what does it mean to totally change that interface into a human and agent collaboration space?

What does it mean to go see the activity of what agents are doing on your behalf when they need your input? Let's talk a little bit about Plan Designer. Yeah.

Uh, you know, we're seeing we go from manual to automated to, you know, to a gentech level orchestration, which is great. One of the key things too is gonna be trust. We gotta trust our systems.

We gotta be sure that, you know, the agent, uh, workflows we're building, that they're inspected, that they're constantly modified to be sure that they're right, that they're traceable. Like talk a little bit about kind of how Plan Designer can help companies. 'cause that's a lot of work, by the way.

Yeah. That's a lot of work. Yeah.

You can automate or you know Yeah. Streamline some of that outta the process. Yeah.

com and you can try it today. But, uh, what it really is, is of a different kind of AI centric development experience. Um, you know, you go type into that box a business problem.

We do not assume that you just want us to spit out a thousand lines of JavaScript that you, that you need an app. Um, like a lot of vibe coding platforms today, we actually do what a real software team would do. In fact, we've built in a digital software team, we've trained a requirements agent, a process agent, a data agent, a solution architect agent.

It's a highly collaborative environment. This is not a sort of throw a paragraph over the fence and watch magic happen. It's really sort of training and teaching people with process expertise, how to think like software architects and solution architects so that they can know up ahead of time, why do I want AI to do certain things?

Where do I want it to work? How do I want it to interface with humans? And that's really the foundation of that trust in the system.

Have you seen, uh, some examples out there of Plan designer convene, sort of delivering promise? 'cause it sounds super optimistic. Are people using this?

Oh, A hundred percent. We have started to see really interesting sort of challenges thrown at it. Um, you know, we have, uh, customers in highly regulated financial services context that are taking decades of old homegrown, uh, non-compliant software that was built over, whether it's, you know, hacked in Excel or built one off and sort of saying, can I use this to rapidly modernize what I had before in a way where, you know, traditionally going and turning all that old stuff into full stack software was just incredibly costly and, and cost prohibitive.

Um, you know, starting to bring those things into plans and generate a more robust plan for modern software moving much faster. Um, we've even seen huge extremes of that. I've, I've, I've seen a customer take, you know, 50-year-old COBOL code and just paste it into plant design and say, what the heck is this program doing?

And can you help me build a better version of it? Um, and actually the results were pretty promising. So, um, you know, people are getting really creative with, you know, bring the problem, bring the challenge, bring you know, sort of the business area that you want to improve and then start working with these agents and on this digital software team to, to design a solution.

So, you know, we're doing all this work. We are trying to train people to think differently, remove constraints, whatever's possible. But the UI is, that seems to be the next frontier.

Like the old enterprise software. It's like, these are the things you can move and these are the things you can't, and what you can customize and here's what you can't and here's your dashboard. And it's like, great.

But in the future, like I might just wanna say, Hey, you know, Microsoft, whatever. Yeah. Uh, this is what I wanna know today, and then I want to obviously learn based on my behavior over time, what I wanna know.

Right. Then I want it to continuously Yeah. Like things like that, like Right.

How does the, how do you see being in, in this space so much, the kind of UI evolving? Yeah. Um, you know, I think, um, specifically chat as a UI is super compelling and natural for a lot of things.

Um, I do not believe that we're gonna go regress 40 years of a, of UI innovation and go all back to chat in the command line though. Like, there's a lot of things for which text is actually a terrible modality. Um, you know, in which, uh, you know, just paragraphs are are not great.

Um, and, and I think there's, there's a more underlying thing here that you're touching on, which is a lot of traditional experiences, whether it's text-based or, or visual. Assume a human shows up knowing an intent, right? As opposed to, you know, an agent being really proactive and taking care of something for me or pushing me an update or a notification when I need to know it.

Um, and so I think those experiences start to evolve a lot. What gets really interesting is where they meet, you know, and we really see a lot of this, uh, you know, task-based data entry, repetitive stuff, increasingly getting delegated to agents on your team. But that means you'll need to work with that team in a totally different way, right?

And, and where a, you know, traditional CRM system or HR system or, uh, you know, whatever, you know, pick your business application was, you know, previously, like we talked about people typing into boxes and then other people viewing reports. You know, what does it mean to totally change that interface into a human and agent collaboration space? What does it mean to go see the activity of what agents are doing on your behalf when they need your input, you know, when they're blocked on something or they've noticed a trend or, uh, you know, there's a form they tried to fill out but didn't complete, then that's an important meeting space to go have experiences and user experiences.

Um, and a lot of times those do need to be structured in a visual way. A lot of times they could happen, you know, ephemerally or, or with a chat message, but how do you route people to the right place at the right time? Um, you know, we're working across all of those fronts, you know, that's why we have a robust set of tools in copilot studio for, for building the agent part of, of, uh, all of those things.

It's why we have a ton of evolution in power apps, you know, sort of becoming this new agent centric experience where I can see a feed of that activity. I can have agents help me, uh, do the work in the applications. Um, and those two worlds will just continue to evolve together as we start to bring things into the future.

Yeah. So you heard me talk a little bit earlier, Ryan, about governance. Um, governance is part of the, the critical, uh, constraint.

And one of the things that differentiates software, right? The reason we can't just use open AI for everything would be because it doesn't know how to handle the data. Be like, oh, let me talk about, you know, help me do a job offer or help me do a compliant healthcare notice to somebody.

Like, it doesn't how to do that, right? So building applications that do know how to do that is the key you gotta build up with. I mean, of course we wanna go fast, right?

So fast is the new, the new role, right? But the trust and scale are, are the other words. I know you often use these words, but like, you know, what do you think and where are companies sort of struggling with governance, uh, and scale here with automation and, you know, kind of how do you think what you're building an agent oversight can help them?

Yeah. So I'd say there's a couple dimensions to governance and scale. You know, there's the breadth dimension.

We have a whole lot more people who now can build a whole lot more things. How do I make sure that all that stays on the straight and narrow when I can't centrally top down code review every single thing that every single person and agent is doing. And then there's sort of depth scale.

You know, when I do wanna roll out a mission critical solution to a hundred thousand employees that has AI in it, how do I make sure that that AI is not just functioning, but actually continuing to get better every single day? Um, and, and you know, the, the good news is we're not inventing any of that from scratch. You know, breadth, scale and depth scale.

Were a challenge in the first generation of power platform. Um, and something that we've built a ton of capability into the platform over the last couple of years to really, uh, tackle at huge scale. And we call that, uh, the managed platform set of capabilities.

And within it, there is managed governance, managed security, managed operations for lifecycle a LM management, stuff like that. Um, and may managed availability even. How do I go ensure high availability, run disaster recovery drills for critical workloads?

All of that is built into solutions baked, uh, on the power platform. Um, and all of that value accrues to this next generation of components being built as well. You know, an agent built in copilot studio benefits from all of those managed capabilities.

Um, a new app built in power apps with intelligent capabilities in IT benefits from that entire stack. Um, and so that's why, you know, you start to see even highly regulated financial services firms, government agencies, um, et cetera, really trusting Microsoft here, as opposed to a 20 person startup that was founded yesterday. Um, you know, to, to really take the bet on standardizing for this, this segment of, of software.

Um, then you get into the operational oversight. Okay, I have agents doing work. How do I have humans managing the work of those agents?

That's not a developer role anymore. That's really an operational role. You know, what does it mean to be an agent manager, an agent boss in a claims department at an insurance company or in a supply chain, uh, operation?

You know, that's where we need these new interfaces, and that's what power apps is building in with concepts like the agent feed. You know, how do I build a, a purpose built oversight experience for really high volume activity of, of agents? This is one of those things that like, right, there's so much doubt across the industry about being able to do this in a sort of, when you give up the human in the loop or even just have one maybe guiding, but you're moving so fast, it's like, um, you know, are they safe?

Are they auditable? Because when you're in a business, everything you just to be traceable and trackable. Yep.

Uh, is it predictable the outcome? Like, hey, you're gonna have an agent interfacing with your customers, or you're gonna have an agent, uh, doing a bunch of accounting work, which by the way, it's like a spiral one mistake, and it's just Sure. You know, how that goes.

Yep. Like, how are you guys overcoming that doubt, you know, through the guardrails you're putting up, through the oversight, the accountability that you're kind of baking into your platform? Because I think you get over that hurdle, Ryan, we move a lot faster.

You know, I think what's interesting here is actually a lot of our customers have had to build these systems already. You know, a lot of our customers already operate critical processes across massive employee bases and even larger vendor teams that operate at arm's length already today, right? We've already had to go build in a, in a world of a whole lot of variability of, of who's doing a task.

How do you create an audit trail? How do you create rules? How do you create data policies?

How do you create oversight? A lot of those concepts exist today because there is variability in the human system, right? And so a lot of the way we, we approach this, okay, how do you adapt those existing concepts, policies, features, capabilities?

How do you adapt that to a world where it's humans and agents doing the work? And what are the sort of incremental, you know, sort of 10% shifts that you need to make in those systems to accommodate agents, um, but not completely, you know, pave them and re re rebuild them from scratch, right? Because a lot of these sort of trust concepts, uh, or zero trust concepts in a security concept are already built into to the system.

Um, and so there's a ton of work we're doing there in the managed platform in, uh, you know, a lot of the ways that, uh, you know, a lot of the Microsoft security governance and oversight concepts apply to agents. Um, and, and that's again, one of the benefits of building on a mature platform and a mature system in Microsoft is, uh, you know, we're not having to recreate all that stuff from scratch, like a, like a point solution startup would have to do. Yeah.

So the, the last thing is just on specifically on security. Um, security is a super hot topic. Yep.

What do you, the customers, how do you want them to think about the approach? Because in the end, like you can get it all governed and right, but you have to keep your doors closed, locked. And, you know, that's an increasingly large problem.

AI is, is much, uh, enabling it, uh, as it is fixing it, right? Well, look, I mean, we could probably spend an entire hour on, uh, uh, security and threat model approaches in the, in the AI era. It is absolutely critical.

And like any security challenge, there is no silver bullet. You know, every customer needs to have a defense in depth strategy and needs to think about what am I doing from a data security perspective? What am I doing from an exfiltration perspective?

What am I doing from an access perspective? Uh, you know, the good news is we have a lot of that built into the platform today. You know, even a customer building their first copilot studio agent and using the managed power platform to roll it out.

We'll see a security score in the power platform admin center, we'll see AI driven recommendations about what to improve that security score. Um, you know, it has a whole bunch of capabilities in there that, that go all the way to operate this in the cloud. But with a private vnet, with your own managed encryption keys, um, you know, again, we have a lot of highly regulated, very security conscious customers that are working with the platform today.

Um, I would say though, to Zoom way out and look at that, um, and maybe connect it to some of the rest of the conversation we've had, it is absolutely risky to go too fast. It is also very risky to go too slow, you know, and the rest of the world is evolving, including threat actors and competitors, right? And so the cost of standing still is probably the most costly position to be in.

So let me, let me, you know, as an analyst, uh, I have to ask you 'cause uh, I've got a few things, uh, but, uh, what kind of in this whole evolution, this, this exciting moment for the future of apps and automation, uh, and agents, like, what's kind of keeping you up at night, the biggest concerns that you see out there? And then what are the kind of upsides for you? Like, what do you most kind of think could be the biggest surprise in, into the future?

Give us that big Yeah. Visionary moment here, Ryan, to take us home. Look, I think, um, I'll start, I'll do that in reverse order.

I think there's a ton to be excited about right now. Um, and you know, I, I think, um, there's just so much potential in creativity that we can still unlock. net code in their life.

Um, you know, what unites that community is this sense of we can make something better. We can, this can be better, let's do it better. And, you know, I feel like we're at the precipice of just blowing a huge lid off of the ceiling of what you can do there.

Um, and there's a whole lot to be excited about. Um, I mean, you joke about a night job. I stayed up last night vibing a power app that's just a Tetris game because it was awesome and fun and so much faster to create it than it would've been in the last generation of the technology.

And I think that's a tiny, tiny microcosm of, you know, go take that creative energy and apply it to everything that's inefficient about every aspect of every customer organization today. You know, we're really standing on the precipice of completely rewiring how companies work, um, and doing it with people who, who have deep expertise in that process and a deep desire to make it better. And that's just incredibly exciting to me in this, in this moment.

Um, and then to flip it around, okay, so what stands in the way of that? You know, it really is all about speed and pace of iteration. And, and really it's about time to wrong.

You know, there's, there's so much that we need to go invent and covent with customers and experiment with, um, and try, and nobody out there is perfect right now. What, you know, what will define winners and losers for technology companies, for customers, for operations is how fast can you be wrong? And then how fast can you get less wrong and more, right?

Um, so that's, that's the journey we're on. That's the hill we're climbing. Um, but it's just a super exciting time to go think about what the, the top of the mountain can be.

Brian, this was a lot of fun. It was a great conversation. Appreciate you sharing a little bit about where all of this is heading.

There's so much potential for companies to really start reimagining Yeah. And realize just how big of a leap forward we, we are having right now with, with ai, with Ag Agentic and the work that you're doing in Power Platform. So Ryan, thank you so much.

A hundred percent. Really, really enjoyed the conversation. Daniel, thank you for the time.

Everything about the way we work is changing very quickly, thanks to the advancements in applications and of course, agents automation and what interfaces may look like in the future are all gonna continue to change and they're gonna enable, and they're gonna power businesses to be more efficient and of course to be more productive. It was a great conversation over the last hour. We really did reflect across not just power platform and how they are thinking, how Microsoft is thinking about building his future, but really about how businesses should be thinking about developing their future, removing constraints, being able to look at problems in new ways, and then being able to apply software and then being able to utilize resources in new ways that can deliver more value to your business and of course to the customers that you serve.

And this is not gonna be easy. It's gonna take some time. There's gonna be some effort, but it is something that can be done today and companies can start to extract value right now.

And moving quickly is gonna be more and more important. That's something I'm seeing as an analyst, and that was clearly something that Ryan had seen as well. We talk a lot about that is the customers that are moving fast are gonna be the customers that get the biggest results, and of course, are able to benefit the most from those efforts.

And lastly, we still have to keep all of those considerations that have existed with enterprise applications, with software that runs our businesses. And that's gonna be the governance, that's gonna be the controls, that's gonna be security. And that, of course, is going to be putting people in the right roles and enabling them to do the work.

All those things remain similar, but of course, with a new bend, we're gonna upskill the talent. We're going to think about problems in new ways, we're going to move more efficiently, and together we're going to drive the future. Great conversation.

Appreciate everybody spending the hour with me. See you all soon. Hey everyone, welcome to Tuesday's, Textron Gang.

We're live on Tuesday. We're live every day of the week. Well, Monday to Friday.

We don't do it Saturday and Sunday, but um, welcome to today's show. We've got a lot to talk about. We've got a great gang to talk about it with.

Let me introduce you to our gang for today. We have got Sid Nag Sid, good to see you, to see Kate Scarcella. Hey Kate.

Hey, that still Cyber Podcast episode's up, uh, Rick be promoting it or played yesterday on text Drunk tv. We've got Chris Blos looking good, Chris, and of course, Mike Ard. Mike, how are you today?

I'm doing well. It's a little chilly, but all good. You know what, it's even chilly in Florida today, so we're we're I'm much sympathy.

Yeah, exactly. Well, it's relative. It's relative.

I get that it's relative, but it did, it did, you know, it was 80 degrees yesterday and then at night the wind came in and geez, it's gotta be in the fifties today, but it's gonna be in, I heard it's going down to 38. My wife tells me over the weekend, Wow, did you break out an actual sweater? Where are we going with this?

Um, well, I guess I did, I did make ready some sweaters for the weekend, you know, you know what they say, right? Small is violet in the world. But, um, anyway, you know, speaking of, of cold, it looks like MCP, which has been a darling since it came out about a year ago now, starting to show some warts.

Mike, what's the story? So under the heading of, you know, why we can't have Nice things, but a lot of folks have started to deploy their first wave of model context protocol, MCP servers. These are the servers that provide access to data sources, to AI agents and AI applications.

It's originally developed by Anthropic, and now, you know, it's being advanced under the heading of the Linux Foundation. But, um, cybersecurity researchers surprise, surprise, have discovered these MCP servers and are testing them. And you'll be sad to hear, but there are actually flaws in these things.

And the first wave of these things. And it looks like, you know, we might have some issues. And Kate, I'm wondering what your thoughts are here, but didn't we kinda rush this MCP thing out once more time?

Oh man. So, right. So what caught my attention is that the new, new AI vulnerability is where it shows up.

We're spending a lot of time securing how AI agents are asked to do things, but for real risk is emerging in how they actually operate once they're running the, this distinction matters because it shifts AI security from prompt problems to system architectural problems. And I think for me, it's like, what the heck? Uh, how can we be surprised?

I mean, this whole, i I, it's, it really is Groundhogs Day, and I know people are gonna get tired of me saying this, but we've seen this, this, this AI is basically augmented our augmented selves in how we're doing this. Um, and how we are running, um, AI agents. It's, it's just that we're doing things, but we're doing them faster, and then we're surprised at the same vulnerabilities that they, they were before are showing up today.

And it's like, I don't get it. It's the same architecture. So what's the surprise here, folks?

That's my question. What's the surprise? Work with me here?

Help me understand. What's the surprise? I mean, it just boggles my mind that we develop protocols today, uh, without intrinsic security mechanisms built in.

Like, have we not learned from this before? I just, this reminds me of that Capital One breach that happened on Amazon. Remember that?

Yeah. Oh yeah, I do. Everyone was bleeding Amazon and then so an Apache server, those guys are running, then they're left to some sort of SSRF flag on to test and then never turn it off.

This is exactly Syd. Yes. I, it's like, you know, it's unbelievable.

And, and the fact that you have, I mean, essentially with, with agents, so the proliferation of all these agents reading so many new attack surfaces, I mean, it reminds me of my networking days, right? Where you inject a new network element to the network, and not only do you need security built into that element, but you also need the networking protocols to have intrinsic security mechanisms built in. Right.

IT SAC and all that. It was Genesis, right? Right, right.

And here we are developing an MCP protocol and we haven't learned our lessons. I mean, come on guys. It's big pain.

And it's not surprising though, right? You know, it, like you say, Kate, you know, these overlooking in my, you know, short tenure in this over the last couple decades, we've been saying we should do these things. And there's a lot of yes butts, yes.

But that's really hard. And the whiz is, and we keep coming up with compensating controls, that's good enough and whatever, but is we, I I, I don't know if there's a layer below this. I think we're driving down to the bedrock on these issues, right?

Yeah. That you have to do this. Yes.

And there are no yes butts and, and look big fan of MMCP, we use it all the time. Agents running around doing all sorts of things. But if you don't have, if you're not tracking, if you're not authenticating, uh, authorizing and tracking the results of everything and checking across like good operational technology power grid people do and build serious systems that are really gonna be important, you do them a certain way that in cybersecurity and inf information technology, we have been just saying, yeah.

Yes. But we'll do, we'll put this in here right now, and you can count on not at the speed, not at the scale. No.

Yeah. So let me ask you this though. Do you think that there's some irony in the fact that we have spent billions over the last, I don't know, countless numbers of decades trying to secure data and then along comes an MCP server and we're like, yeah, sure.

You know, just, you know, bidirectional open transfer, and, uh, you know, security be damned. Well, you know what I'm doing right now? I'm looking for my string of pearls to clutch Shocked.

Let me, let me just, let me just frame this up for you here. I've got security people upset that we didn't think about security and just rushed headlong, torpedoes be damned into the abyss, right? You've got this whole MCP protocol that literally is a year old.

It's a year old. I think it came out last December, so maybe a year and a month, and it, within three months, it was the de facto standard Yeah. For how AI agents are gonna communicate with our data, with our infrastructure, with each other.

You're blaming tigers for having stripes. Yeah, right? This is, this is the way, this is the way of the world in it.

We do it, we get it, we do it fast, we get it out there, you know, we'll fix it later. And, and then we find out about the security flaws, the security people clutch their pearls, you know, and, and, and we, we patch as we can until the next floor comes out, or until the next thing goes. Go ahead, Kate.

Yeah, No, I, okay, so first of all, I'm not clutching any pearls. Okay, fine. Um, because, because I'm not surprised, like one of the things that I've been saying no, is that we, we need to really, before we just like launch, I mean, security has been an afterthought for, for decades, right?

I, I mean, you know, Sid, you talked about networking, you know, being, you know, part of the, part of the network. I mean, I just remember walking into, um, very large organizations and being like, okay, clear text everywhere. And, and you're just like, you know, the same thing is basically happening.

And, and I want us to really take a pause because we can't, we've already seen this story played out. We know what happens. You know, we're gonna be creating all these cybersecurity tools, doing bolt on, blah, blah, blah, blah, blah.

We've seen the story. Why can't we actually write the ending on this? I don't understand it, Chris.

Well, right. You Know? Yeah.

The stand up for security piece, right? You know, and, and what, what non-security people think is that security people are out here, you know, pushing the perfect thing that there's a perfect thing we're not getting into. And Alan, you've walked on the deck of my boat decks of my boats.

I've done this show on two handmade solar powered boats that I slowly sailed up and down the coast of Florida for three years with hurricanes and madness. And you, you know, you can ish. Those were not perfect boats by any stretch.

We're not trying to build perfect cybersecurity by any stretch. We're not gonna make perfect MCPI don't frankly care if MMCP is secure or not. I don't expect that it is.

I will run in a way that it's insecurities known, unknown, won't sink my boats. And we can build these systems. Security people actually know this really well.

We're really pragmatic. It's the non-security people looking at over, over us and saying, I thought you wanted the per you, where's the perfect, there is no perfect, there's no perfect boats sink. Sometimes have two.

I don't know. We, we can build this. Well, we, it's not about vulnerabilities.

So let me ask you this then. So this whole nonsense that we bang the drum about called security by design, just flat out b******t or what, Hey, hey, Hey. Yeah.

I mean, I, I I, I'm appalled that commercial vendors didn't bother to harden this protocol on their own, right? I mean, it's one thing, it's one thing having, it's one thing, having a protocol as a standard is another thing where Anthropic git, MCP server had this flaw with prompt injection chaining, right? And then in the case of Microsoft or the market down MCP server had a problem with SSRF.

So, hey, you know, okay, the standardized guys go and do their own thing. They develop a standard, but as a commercial vendor, it's their responsibility to harden these protocols. And they didn't do this.

I mean, that just, it just is just strange, I think. So maybe, maybe we need better collaboration between, uh, commercial vendors to look at these problems upfront and go beyond the standards, but agree to some sort of a, you know, way to speak to each other from a commercial vendor connectivity perspective, for lack of a better term that has these sort of hardening functionalities built in. Right?

So maybe that's the way to go. I don't know. Well, you look at, you know, anthropic people watching this show, like, you know, it's a good company, good folks, it's the motivation cycle, right?

You know, for everything I just said, you know, as a security person, I expect flaws. However, I look at how we produce things, I said, you're exactly right. You know, what is the motivation stack in developing and releasing that?

I think everybody involved did great work, love the code, but, you know, is there is our, our production motivation checking con the conversation, is that appropriate? And the answer is no. So is that, is that, I'm wondering if there's a cost associated with doing these things.

And because the AI adoption is still mostly a vendor conversation and less of a consumer conversation, you know, the cost factor is something people are not thinking about, and therefore they don't wanna jack up the cost back creating this additional hardening in the protocol, uh, and that that's resulting in these kinds of disasters, right? I don't know, what do you guys think about that? And, You know, it's that, I, I think that is a possibility, but I, I think the bigger motivator here is there's a gold rush going on and everybody wants to be the first one in the creek panning for gold.

And, and you know what I mean? And so, well, this MCP, we gotta get an MCP server out. Mike, how many pitches have we gotten from PR agencies over the last year announcing that one of their clients has now had their own MCP server out Thousands.

And I can't wait to see which one of them winds up on the front page of some report somewhere saying that their platform was the very one used by cyber criminals to steal all kinds of interesting, sensitive data. Yeah, Absolutely. I mean, this is, but, but let's not blame ai.

This isn't an AI specific issue. Yeah. This is a, this is a pervasive issue within technology within development, where as much as we, you know, I've never seen a survey that didn't have security in the top three priorities, right?

It's always in the top three. But as many of those surveys as we've seen, the fact is if it gets in the way of getting stuff out to market fast, it loses Always. And, and I'm sorry, Mike, go ahead.

No, no. I, Jake, I, you know, the, that's the point right there. No, let me ask you what the outcome is.

So here's the thing, do we go back and quote unquote fix this protocol? Or are we gonna just add another overlay of security on top of it to make it more secure enough? No, it'll be, it'll be continued to be fixed.

It's, it's evolving and extending and, and it'll be fixed. But this is why, look, one of the biggest things in security I've seen over the last 10 years is the move from pure prevention to resilience, right? And if that's what you mean by Mike, by putting a layer of abstraction or something in, maybe that's one way of providing some resilience.

But, you know, smart security people have moved over to resilience saying, Hey, we're not gonna stop trying to prevent things, but, but stuff's gonna happen. And when stuff happens, we've gotta be prepared. Mm-hmm.

And then I gotta go hunting around for every MSAP server and client that's out there, and then I gotta add some stuff on top of it to secure it. And it's a lot of work for creating for these people. Yeah.

But you know what? We're getting rid of all these junior people. We gotta keep the, we gotta keep jobs here.

And it's not on top, it's under, you know, it literally, you know, the UI died last year, right? The user interface, the entire internet is gone and is struggling along. We're trying to recreate it, adding more layers on top.

And Mike, you're exactly right. This cannot be solved. This particular issue where security by layering more on top, you know, we need to build it right underneath.

And you know, Alan, you're right, it's gotta be resilient. But I think there's an opportunity here, there's a market opportunity. You know, my, my boss at Bell Labs once told me, you know, network management is an artifact of somebody who made a error in building the protocol, right?

So if you didn't have the right network protocols, you needed management on top of that. So, So, so it's like, It's like the idea of a service mesh or a new sort of overlay capability or whatever, MCP management, if you wanna call it. I mean, there's opportunity for tool vendors to go make a run of that, make tons of money, right?

I mean, it's absolutely. We'll end on Sid's optimistic note here, right? There's, I'm in this room full of horse manure.

I know there's a pony here somewhere. Alright, let, let's, let's jump, let's jump to our next I let's jump to our next one, breaking the AI locket. You know, this is a, this is a shot at Nvidia.

Mike, what's the story? Yeah, this is kinda interesting. I think it's still in the realm of, uh, computer science project, but a fell on the Reddit forms that a MD has set up is claiming that he used Claude from, uh, anthropic to essentially find a way to reverse engineer some of the Cuda code so he could port it and run it on the A MD AI accelerators instead of invidious GP use.

And I think we've talked about the idea in the past that, you know, people will use AI to reverse engineer all kinds of interesting things. But, um, I guess, uh, Chris, when you look at this, what's your take on, you know, are we gonna see a lot more of this stuff? And do you think that, you know, people will start porting frameworks to different AI accelerators as a result?

Yes. You know, it's, so a week or two ago, I think I shared on, on this series, you know, I was talking to somebody who in the past had broken a lot of license, you know, software license, uh, coats, you know, and had that dark, dark pass or a person always funded. But they said something to me that said, there's no point in doing that anymore.

Why? Why bother breaking a license key if you can't have access, access to code? Just build your own, you know, just express the intent to have this functionality through a properly put together AI system, and you will get that code.

And that's where we're going. And, and you can do it now. We do it, I do it all the time.

Right? You know, we, and that it is not a matter of re reverse engineering. It's just saying, I want this set of functionality, add this to what we have already.

Do it in the way, you know, we always do it so I can trust it. And you, when it blows up, it's not gonna take us down with it and you're done. You know?

So the whole idea of being a vendor is different, right? And I, I've been there, seen it, done it, you know, here's the license key and so on and so forth. I've, but I've been arguing since the beginning, since the early nineties that it's really about relationships, you know?

And this, uh, I guess I, at this age, I am here for the horror stories, but in, in Atlanta, the very first day of launching the border Air firewall server, where these two folks came up, asked two sets of really good questions, and they came back and asked another question, I'm like, I really don't know the answer to that. And on my feet, I said, well, look, if you buy this firewall product, you can build one. But what you're, what you're really buying is a relationship with people who do this for a living.

And when, and if there's a vulnerability found, they will live on caffeine and anger until it's fixed. That's what's valuable. Not the ability to have the code.

Now, 30 something years later, we've gotten used to this idea that you're my customer and I've got you, you're locked into my ecosystem. Those days are over. If you don't have a customer relationship, you will not have customers.

Ian, I I, let me tell you, I think it's gonna take more than a relationship. I, I think, think what we're looking at here is just such a major disruption in not just open source software, but all software, right? You know, no, no less than Patrick dubois who gave DevOps its name, posted something on LinkedIn the other day.

I commented on that, you know, all these tools, he was using these open source tools. A lot of them haven't been, been being updated lately with like, not, there's not a lot of new code being, um, added to the project or so forth. And he reached out to some people and it's because they were taking the open source code into their, you know, cord code or whatever and saying, Hey, this is the code base, but I want to add this functionality and it does it for them and it works pretty damn good.

And they don't have to rely on the community or rely on the vendor to update that code. Chris, what you are saying, maybe you don't want say, 'cause you don't want to get in trouble, but you could say, Hey, I like what Datadog does on observability and it uses Tel and these other things. Build me an app similar to that, that uses this.

So Earl, so point that through for a minute. Syd, I'm gonna ask you this question 'cause I think you're close to it. So does this turn all the software publishers into, you know, the 1970s equivalent of music publishers trying to figure out who's using cassette tapes to steal music?

Because, you know, they're gonna be like, Hey, who used my code or who used my code to inspire this code? That, and is that even feasible to discover? Yeah, I think there's definitely the element of, of what you just mentioned that jumps out at me when I read about this announcement.

But I think if you look at NVIDIA's, CUDA, right? Has been dominant. Why has it been dominant is because, you know, years of tooling libraries and the investment that actually makes switching out of the Nvidia ecosystem extremely challenging, right?

So I think the idea of cloud's code ability to port and attack coda based capability into AMD's rock, and in 30 minutes, essentially a sales, the Nvidia coda moat in many ways, right? So, I don't know if I answered your question directly, but I think it's a good thing because that, that reduces the dependency of the, the AI workloads strictly on NVIDIA's guda functionality. That's in a lock in.

I mean, I know we often talk about Nvidia Cuda functionality as a Switzerland of sorts that transcends Switzerland, right? Multiple LLMs from different vendors, right? So there's that, but in a way it's also a very lock in moat that people cannot get out of once you get into that.

Yeah. So, so when, when, when cloud does something like this where they take that and put it into a a MD rock m you know, in 30 minutes, so less or whatever, I think that's a good thing. If, if that's sort of my, my take on it.

You know what I, I, I just did an interview with my friend Paval Baron, uh, platform engineering labs, and he used the term infrastructure builder, and I said, Paval, don't you mean platform engineer? He said, no, this is much bigger. He said, today, we're all builders, we're all builders, we're all software builders, we're infrastructure builders.

We are music builders, creative builders. What? And that right there is the secret sauce of ai.

It turns us all into builders. It turns us all into software engineers. It turns us all into developers.

It turns us all into publishers. And that's scary. Yeah.

I think, But I actually, Go ahead. Yeah, go ahead, Kate. I was gonna make a point which follow up with Alan's point, which is essentially, I think with this kind of stuff, you know, AI tools might actually drive more competitiveness, right?

Sure. Ecosystem. So to your point about Alan, uh, about music builders and that, and analogy, I think this really part of a broader trend where AI enhances developer productivity, right?

So the more the merrier, the more folks can participate in this ecosystem, and that's a good thing. Yeah. And that is, yeah, that's a, that's a great thing, I think, um, because it really does, I think, bring in the original intent when we started to think about computers and, and Chris, I'm sure you can understand this part about, um, the democratization, right?

Of, of digital devices. And I mean, that's something that I think we who have been doing this, I guess all of us on this call have been doing this for a really long time, understand that original 10. And I think AI actually does that for us.

I think it, it equalizes this field that for some never even imagined, imagine, you know, never even imagined that they could do something like this. So I think it's, it's a great, great equalizer. And what I'll say is that when you're going down through your list, Alan, I noticed that you didn't mention cybersecurity.

So I still think that cybersecurity is a after, after afterthought, unfortunately. But what I do think is, um, is that I, and my hope, um, is that there's, there's, there's code that should be thrown out. And, and my hope is, is that as we become more productive citizens in this augmented selves, that, that we are becoming, that we dump the bad code.

You know, that's my hope. So in all of this, I have a question for Ellen. How does anybody make any money in a world where I can just look at somebody else's software and just decide by intent to create my own version of it?

That, and I'm probably not even using their core source code because, well, I'm just copying the intent, Their functionality. I let, I, let me take that one because go ahead. This is back to my old war story.

It's like you could have built a firewall yourself with open source code before the firewall market started. Most people don't because that's not their, their expertise, you know, and we're not gonna automate the entire universe, you know, we'll automate a lot of parts. And if it's scary to you, look, the freedom of speech is scary.

Open source is scary, democracy is scary. It's much, much easier. I don't know if any of you know any, any folks who grew up in under the Soviet Union and so forth, but is is a really clear, when you're 40 years old and the the wall fell, you never adjust it.

Too many choices how to, it's much easier to live in inside a controlled environment. And if I'm scared because my position is threatened as a journalist, a, a, a professional or whatnot, maybe I should be, maybe I've gotten a little comfortable, you know, is there no value left in human activity anymore? That's, that's silly.

There's lots. Is there no decency, Senator? Yeah.

Um, No, but great point, Chris. I love it. Absolutely.

Let, Yeah, but I mean, and that's exactly what I'm getting at. Yeah. Yeah.

Now I, but I'm gonna, let me, let me give you some good news so we don't end this on a pessimistic No, I Thought that was optimistic. What do I, yeah, I got so, Well, it's optimistic in, in terms for the every man, but if you, you know, if you're a shareholder in some tech companies right now, you, what are you burning your stock? But, um, but here's the deal.

Let, let's take music for instance. I could use AI and I could create some synthetic music, and it may be good, you may like what I create, it's going to write the words for me. It's gonna write the melody and I'm gonna play it.

I may have an AI person singing it, and you're gonna say, damn, that Alan's creative. But then take those sane tools and put them in the hand of a musician of a, of a professional who's from that vertical. And the synthetic music they turn out is probably on hold a hell of a lot better than mine.

The same thing putting coding tools in the hands of a professional developer versus a hack. The same thing putting writing journalism tools in Mike's hands versus someone who's not a writer, right? So I think while it's a great equalizer across the board, it also is a great enhancer of what, where your skills already lie.

So if you already have an affinity and a skillset, this enhances that. Yeah. I think, and I think that's something to think about.

I think you, again, back to your, I love your music analogy. I mean, yeah, yeah. You can create all the music you want using ai, but, but you're in Beethoven.

Yeah. That's a Yeah. But those are sort of, you're creating music based on maybe somebody else's musical, uh, works.

But I think the best music is created by musicians who can improvise in real time, right? And that is what I always tell, you know, there's always this discussion on LinkedIn too. I dunno if you guys follow, uh, whether AI can replace the, uh, um, the, the analyst community like us, right?

Uh, I think, you know, it's almost impossible because what we do as analysts is not just follow a certain sequential path, like a what a com, what a transformer model would follow into the sequence transaction. But we do real time context switching when we're talking to a client, right? And that's same with a good musician, A good musician improvising real time.

They will not follow an AI algorithm to create music. And I think that's the difference. So I think, I think where human expertise still matters in all aspects of AI in the AI world and high performance computing in this case in A GPU computing, Right?

Mike, you wanna say something? I was just gonna say, you know, and I'm probably in this here, but I would say, you know, just because AI tells me how to perform surgery doesn't mean I should do it on myself, because well, just 'cause you can do something doesn't mean you should. Absolutely.

All right, let's jump, let's jump, let's jump to our next, uh, segment. Moving in maybe a little less ai, but cloud native Clarity. See, the CNCF good folks at CNCF recently came out with a survey, Mike, about Kubernetes clusters.

Yeah. And they're pointing out in the latest report that I think it's 82% of the respondents said they're running Kubernetes in production. Now, you know, that varies widely from one organization to another, and not all of 'em are even running containers apparently.

But, um, it does seem we've reached some sort of, uh, a crossing of the proverbial Rubicon when it comes to finally using Kubernetes. It's only taken a decade or so. And, uh, this probably still a long way to go here, but Syd, you're an analyst.

What's your assessment of what's going on in this cloud native computing marketplace as we know it? Yeah, I mean, you know, cloud native is such a broad term, you know, it's so many, it means so many different things to so many different people. But I think one thing this highlights is that containerization and Kubernetes utilization is definitely the defacto standard for orchestrating, you know, containerized apps today, right?

It's no longer as an emerging technology, right? I mean, yeah, there's still virtualization clusters floating around and there's plenty of those. But I think this really highlights what does this do for, in terms of level of adoption for teams that previously resisted Kubernetes, right?

So we had this whole evolution of Kubernetes that ran on bare metal versus ran running on virtualized environments. And the national thing to do was to run it on virtualized environments because nobody wanted to rip out the underlying layer, although it was more efficient to run it on bare matter, right? So, so I think really this really brings out the fact that Kubernetes is really part of the broader cloud operating system or the operating model.

Uh, and I think the survey also highlights how organizations should prioritize investments across the whole cloud native construct of things like, uh, the service measures and CICD pipelines, observability, and all of that. And then finally, I think, you know, what does it do for the AI workload, right? And, uh, and I think Kubernetes definitely is going to enhance running AI workloads, especially in the world of AgTech because, because of the efficiencies that are built into that Kubernetes layer, right?

So running an operating system, uh, coupled with, you know, GPUs and, and software we talked about, CUDA, all of that, orchestrating all of that, I think Kubernetes has a huge role to play. So that's sort of the dark horse of the elephant in the room that we should probably talk about more in that from the context. Alan, here's the part of this thing that I'm struggling with.

So just because I downloaded Navy Open Telemetry and maybe I've got some other tool from the landscape doesn't really make me cloud native, right? I mean, I technically, I guess I am, but uh, you know, I'm not really, so, you know, do we need to rethink or maybe redefine what it truly means to be cloud native in the sense that I've got workloads that can dynamically scale up and down because, you know, I'm leveraging Kubernetes to the full extent. And there's just a different level of maturity here that Cloud native really signifies that, you know, gets lost in the data.

You know, Mike, I wrote an article during KubeCon in, uh, Atlanta in November. I guess that was rankled some of the people at the, uh, CNCF as you know. Um, but the real point of the article was, look, there's more to Cloud Native and there's more to CubeCon Con than Kubernetes today.

The fact of the matter is Tel Open Telemetry, which is the second biggest uh, uh, project in the CNCF is growing much faster than Cobe is even, and CO's growing, make no mistake. This survey bears it out and they put it out for that reason. But when you take Tel and Prometheus and Grafana and all of the observability projects together, it, it is like a Saturn to cube con's Jupiter, right?

And the question then becomes is, is CNCF big enough for the two of them? Do we need to break out the, the, uh, observability projects? 'cause our, to Mike, to your point, does that really make you cloud native?

Or does that just make you a good user of observability because they're independent of Kubernetes? A lot of the other 200 odd projects do revolve around Kubernetes, right? Like moons of Jupiter.

But the hotel and the, and the observability stuff is, is, is its own gravity. Well, and so that's what it is. But the, the thing about this adoption is I don't think anyone's surprised to hear 82% of organizations are deploying, uh, Kubernetes based, uh, infrastructure.

You know, it, it's been a couple years now where if any new greenfield, uh, projects you're developing are probably done 80, 80% of 'em, and the survey bears it out, 75 80% are based, uh, you know, are on a UB infrastructure. What's, what's really is the Kubernetes clusters. So how many clusters of Kubernetes are running in a given app in a given infrastructure?

Used to be 1, 2, 3, got very hairy, you got thing, you got people running dozens of clusters, hundreds of clusters of Kubernetes. And that's really, that's not easy, right? That's the Kubernetes isn't easy to begin with.

This is really hard. So to see in this survey that people are running clusters like that is, is really the sign of maturity more than the 82% number said to Yeah, I was gonna make another point. I was some notes before I came to this discussion.

The 82% number is not surprising. Absolutely right? Al but I, what caught my attention is 66% of respondents are running at least some AI inference workloads on Kubernetes clusters, Right?

And that's the key is, is Kubernetes going to be the orchestrator for our AI infrastructure? Or I think back to Kuda, I think Nvidia was making a play for Cuda to be the orchestration, the orchestration layer, the orchestrator, the Kubernetes for AI infrastructure. Nvidia is that, again, that Again goes back to the expansion of the Nvidia moat, right?

Yeah. Does the world, world wants a direction is a question, right? NVIDIA's been on red Black, right?

They bought the people who make swarm, which is the alternative to Kubernetes for VC world and that they have invested a lot of stuff in Kubernetes. But let me come full circle here on that last session. Um, Chris, if I have a monolithic application running on a virtual machine, can I not use something like Claude to reverse engineer it in, well maybe more than 30 minutes, but maybe an hour.

So it turns into a lovely cloud native application that I can run on Kubernetes, just thinking, yeah, In short, yes, if you can't do it now, you'll be able to do it in the future. But then it takes us back to the last segment and you have to decide if you want to maintain it and support it or if you'd like someone else to be the, be the expert at that, you know? Well, no, But it could, it could certainly convert it to a microservices based model, right?

Which would lend itself well to that. But you know, to me the question is do you fix what ain't broke? Why, why would you do it?

Do you have nothing else to do? Is is all the rest of your, is everything else on your business Just because Timmy jumped off the bridge? Are you gonna jump, are we back to that again?

Well, Well at least, at least the theory is, is that the application will scale up and down and cost less to run because it runs cloud native versus a monolithic app running on a virtual machine where you've got a bunch of static resources dedicated to and it's Expensive. Alright? Alright.

So let me, I was a little late coming on seat on set today because I was having a meeting with our video team and I was hammering home that I want us to do editing of videos using ai. I want our ai, I want the AI to edit the videos. They're re like Textron gang, when do we switch from a full screen of Mike to the panel shot to Chris talking should be easy enough.

Whoever's talking gets the main screen and then when no one's talking or there's people talking, it goes to the back. You know, it should be something AI could do. I don't need a person doing it.

And we went back and forth and back and forth and then came the real kicker. A lot of our videos, not yours Mike, 'cause you do yours on your computer, but a lot of our videos that we shoot here in studio are shot in 4K. They may not be played in 4K on your computers because streaming 4K is not easy and your computer may not play 4K video, but we shoot them here in studio in 4K to have the highest quality to begin with possible.

And those 4K videos, the average 4K video is somewhere between 16 and 20 gigabytes. Now, AI could edit 'cause it's a relatively simple edit, but uploading that 16 to 20 gigs to the AI engine and what AI is going to cost us to edit through a 16 to 20 gigabit file. And it's, it's actually cheaper to have a human do it.

And that is the, the kicker until AI is economically cheaper to do it at a high quality like that, we shouldn't just because we could doesn't mean we should. So you mean spending $10 million to replace a couple of baristas in a coffee shop doesn't make a lot of economic Sense. Exactly.

com all over again. I, you know, it costs me, it costs me a dollar for every 80 cents I sell, but I'm gonna make it up in scale. Well, you're not, you're not.

Yeah. Until we get that right, you're not doing it. And it comes full circle right to, to your first question to, you know, block a when we were talking, right?

It's, it's, it's about the money at the end of the day, whether we like it or not, it's about money. Yeah. So, so I, you know, I don't know if we should convert it to cloud native just 'cause we can't, So we shouldn't go through all those massive AI data centers.

All these vendors are planning it, investing billions and billions of dollars anymore. Well Look at all the jobs it creates. Okay.

That right? Alright. Oh God.

Alright, let's end it on that note, let's end it right there. Hey gang, thanks. Tha this was a lot of laughs.

This was fun. It was good hearing smart people talk about these things. I hope you've enjoyed it out there.

We've got tech drunk tv following up, Sid, Kate, Chris, thank you Mike, as always. Thank you. Um, I think we've got, uh, tech Field Day this week coming up, so stay tuned for that.

Hey, there's a new episode of, uh, Mitchell and I still cyber starring this lady, Kate Scarsella in this episode. You might wanna check out on Text Drunk tv. Um, and we'll be back tomorrow with more gang.

Until then, this is Alan Shimmer, we're out. Hello and welcome to the latest edition of the Techstrong AI Leadership Insights series. I'm your host, Mike Azar.

Today we're with Yvette Schmid, who's the CEO for Fusion Collective, a consulting firm. And we're talking about, uh, AI regulations and specifically what's happening in New York state and how it might also pan out elsewhere and maybe the differences between our friends in the state capitals and the nations capital. But Yvette, welcome to s Shah.

Thanks so much, Mike, for having me. All right. So New York State passed this raises act, which was signed into law by the governor.

And, um, like most laws, there's a little bit of a difference between what ultimately was agreed upon and may be enacted. But for those of us who don't live in New York and or who may not have been paying attention for that matter, what is the raise act? What does it do and, and why should, why should people pay attention to what's happening here?

Well, that is a great question. So let me walk you through what kind happened with the New York State Raise Act, uh, what was passed by the New York Senate and then ultimately what was actually signed into law in December by the governor. Of this wonderful state of New York.

So in June of 2025, the legislative body of New York State, they passed what I would call a very people protective forward AI regulation that protected the people. It had mechanisms in it around, um, mandatory independent audits. You know, when you do self-auditing, you're kind of like grading your own homework on that sense.

So this act in June, it had external independent audits, um, to verify the claims that all these AI companies are making. It had comprehensive whistleblower protection. So if someone was working at an organization that was seeing things that didn't kinda look right, they could report and be and be protected.

There was penalties for wrongdoers that were up into the millions, like tens of millions for the first violation, which would actually probably deter bad behavior, you know, and in order to be considered or covered for, um, this act, it was based on compute thresholds. So you can't gain the system. Now that passed, I was super happy in June.

I was like, wow, this is gonna be amazing. But I kept reaching out to the New York State Senator. I was like, well, well, when is this thing gonna get signed?

Fast forward six months later, the governor of New York, she, what she signed and what was passed completely different. So think about independent audits gone. So now it's being replaced with self-certification, whistleblower protections, completely gutted, not there.

Penalties slash by 90%. So for the first violation, and here's what really gets me the compute thresholds. So it's hard to game compute because it's like electricity.

What you spent the, the, the, the, the cogans, you can't really game that. But you know what they did? Instead of having compute thresholds, they base it on revenue.

So now what you can do is create these corporate loopholes to restructure your organization. So now that your AI system that you've been developing, deploying doesn't meet the thresholds to be, to be oversaw by the RAISE act. So, and this is not my interpretation, this is not the world of Yvette.

This is a side by side. You look at what's passed in June and you look what the governor signed in December. And of course none of this doesn't take place until January or 2027.

It's completely different. It's completely different. So how did that come about?

And was there some sort of, was the act discussed again in the Senate somewhere? In, in the No, No, no, no. This is where our lobbyists, our tech lobbyists, you know, tech, NYC, you know, Andreessen Horowitz, all the tech lobbyists, they got in and basically they gutted the regulation in order for it to sign.

And so what the governor and the, the state legislators trying to say now is that the New York raise Act is like nation leading. This is not nation leading. It's not nation leading at all.

I mean, basically what it does is it gives the, the 10 frontier model companies meta, Google open ai, anthropic, it gives them a pass. And, and it was touted as, oh no, we can't have all this regulation because it's gonna, it's gonna stop innovation. It's not gonna stop innovation.

Really, it's doing is giving people a pass to do not the right thing. But now they gotta check the box saying, we did this, we did this, we did this, we did this, and it really does nothing. And guess who pays for it?

Us New Yorkers, the people who have to live with these systems that are commercializing the products. What people don't understand is that New York City is literally like a AI startup hotbed. There's over 2000 AI startups here in New York City alone, 2000.

They're doing everything from FinTech, healthcare, you name it. It has AI in it. They got some funding, and they're here in New York.

And I actually went to one of these startup meetings where they were doing pitch pitch decks, and they're like pitching their new ideas. And I asked five FinTech startups, I said like, um, you know, how are you thinking about ethics? They looked at me like I had six heads.

They're not thinking about ethics. They're not thinking about how their AI system that they're gonna commercialize and then launch onto us unsuspecting New Yorkers who are gonna use these products, the impacts that it's going to have. So it's, it's, it's, it's sad.

It's sad. So, so what should people be looking out for? Or what should they be on guard for with these applications that are being rolled out, many of which are consumer oriented and financial services oriented?

And are there things that are gonna happen that we're all gonna wake up in the morning and say, wait, who let this happen? And maybe there'll be a backlash that, You know, um, Mike, there's, I say this all the time, if you wanna catch a squirrel and raccoon use shiny objects, but you don't do that to run a business. And I think how the organizations today that are getting this massive funding and how everything out there in are at our fingertips has something to do with ai.

You can put your, you can make yourself a storm trooper. You can recreate a Star Wars theme. You can, you can see squirrels riding yachts and flying planes.

You can do all these things, shiny objects, but no one's thinking about the cost of that. When you want to turn yourself into an AI action hero, are you thinking about the power that it takes to run the algorithm and the compute and electricity to generate, you know what I mean? Like, no one's thinking, no one's shifting left.

No one's understanding that this takes an immense amount of power that's coming from a data center that's sitting on a grid that is a tinderbox at best. You know, that needs to be cooled. Where are you gonna get the water from?

Who, who's paying for the extra power being, being charged from the electric, from the electrical grid? Electricity is a, is a public re it's not private. You just can't throw a data center in someone's backyard and flip the switch and then all of a sudden no one, you know, who's gonna pay for the extra stress on the system?

No one's really thinking that through, but they're looking at the squirrel videos and they're turning themselves into AI action heroes. I think we, we as consumers really need to think about what does this cost me personally? No one's reading terms and conditions.

So Mike, I'm gonna ask you, when a new platform comes out and you hear about it and someone's telling you about it, what do you do? You scroll right through the end, right? And you hit click, click accept.

Do you read, you know, like the nine pages of a terms of service? No, no, it does, because they wanna, they wanna use the glam bot. They wanna, they wanna use the app.

They're not gonna read through that. Wait, wait, wait, Wait. There, there, there was a document with terms of service in it.

Where, where was that? You know, like no one, no, people blow past that. And that's where if you read that, you probably wouldn't sign, you probably wouldn't hit accept because mm-hmm.

That's where all of the details about what you're giving up as an individual. And I, I like to say this, I like to say we have become, we have gone from being customers to a data point. We're no longer customers.

You know, when you go into a store, like the customer's always, right? Okay, I don't wanna use that. Like what you go into a store they like, they actually care about your experience and how you felt and what you bought and the quality of the service you received.

That's gone. We are, we are just consumers. And so since we're consumers, that whole element of reading the terms and conditions, no one wants to read the terms and conditions.

Why? 'cause they just wanna use whatever, whatever product you're hawking today. So do you think that this will become a real political campaign issue as we go forward and people will start voting based on these AI issues?

Because to your point, it's not just my electric bill, of course, but it's also crazy things like, you know, grok is letting you take pictures of people and, you know, distribute accordingly. And, you know, this is kinda not the kind of society maybe we wanna live in. You know, Mike, I I, I don't know if it's gonna become like a political issue because the, the folks down in DC have literally are, are making moves to make sure that no state law can impede AI innovation, right?

All this is being tucked under innovation. Um, but when I tell you what I'm about to tell you, this should really elevate for you. And as, as your listeners here, um, so in the California state law, they have a similar AI bill, uh, to New York.

They have the enforcement act of the law about figuring out if someone did something wrong. It doesn't happen until 50 people die. 50 people that's in California.

So that, that means if your AI system, your product, your impacts 49 people adversely or 49 people die, like there nothing happens. You can just keep running. This is per AI system in New York.

It's a hundred, a hundred people will have to die in order for the enforcement provisions of the raise act to go into effect. So, so let me just break that down to you. There, it kind of shows you like who's important, right?

Like if 75 people die, because an AI system, this is per system, right? So that's, your system does something unlive, 49 people, nothing happens. Nothing happens.

Another system does something under a hundred people, nothing happens. So the compounding effect thousands of people can be, can be unli and have adverse reactions. And based on the laws on the book in New York and California, nothing will happen until that one system impacts a hundred people in New York State.

So a hundred people have to be unli before the enforcement element of the raise act to go into effect a hundred people. So now tell that to the other 75 people who have to plan funerals, right? I mean, like, think about that.

Like, there's no, there's no, there's no recourse for those, for those people. And I think that is what that, I think that's what's gonna move the needle when, when adverse actions start happening, and then people look to their legislature in the laws and say, go after them. Legally they can't, from an enforcement perspective, I think that is going to move the needle.

And to add insult to injury, Mike, guess who the regulatory body in the New York state, in New York state is for the, the Raise Act and the, uh, large frontier models and developers that fall under that. I have no idea. Department of Finance.

Hmm. So the bank, so the group who regulates banking is the enforcement agent for large frontier models who fall on the raise the Raises Act here in New York. What do they know about that?

Let me ask you something too though, about, well, you know, let's take these incidents where there might be a fatality, but who's to determine what the cause of death was? I mean, was it the, the self-driving car? Was it a car accident?

Or did the AI do it? Because, you know, at that point, if I classify it somewhat differently, then I'm under the threshold, right? Yes.

And this is where gaming the system comes out. Because if you go on compute Mike, you can't gain compute, but you can restructure your organization. And I'm gonna give you an example.

So, um, let's use, let's use, let's use meta. Let's use meta. So you have the mothership, they can spin off or, or, or think more about like, like pharmac, like pharma, uh, Pfizer, they have an r and d arm, which is separate and exempt, but the r and d arm is funded by, uh, the corporate, the parent company, right?

But they're separate. But if you put the r and d for your model under a separate entity, it doesn't meet the threshold. If your, if your revenue is under 500 million, that's how you can gain the system in New York, because the New York is, you have to have 500 million annual revenue plus your model size in order to, to be considered a covered entity under the raise act.

But you can do some corporate restructuring where, oh, I can do all my development under this other separate entity. It doesn't meet the revenue threshold, so I'm exempt. So I think that's where people, people, that's how you can gain the system.

And, and then the onus is gonna be on the per on the family, on who's left over on who was harmed to figure out who shot John and who to sue. But based on the raise act, as long as they make under 500 million, they don't harm a hundred people. They're not regulated.

And that entity might be registered in Delaware anyway, so it might not even be a normal New York kind of issue. Um, is this gonna play out in every state? I mean, are we gonna see the same effects?

Somebody's gonna, you know, pass a law and then we're gonna see this play out again and again where lobbyists come in behind the law and or that was at least as it was passed, and before it's enacted, there's gonna be all this, you know, activity in the, what did we used to call this? The, the, the smoke-filled room. So, um, there, I, the LA at my last count, Mo there's like 19 or 20 states in addition to, uh, including California and New York who passed around things that are passing bills and legislation that is AI adjacent.

You know, they're banking things under, like data, you know, data for data brokers and how you can use people's data and consumer protections. They're not coming out and saying like straight, like ai AI system laws and, uh, rules and regulations. They're doing that.

They're also, um, everyone is kind of like on the clock with the executive order that came out from our current president about the moratorium on AI laws on the state. And so if the federal government determines that your law, potential law is gonna be discriminatory or, or mentions anything about discriminatory, they will shut you down and and sue you. So you can't, so that that law will never be enacted under the guise of ai.

And we need to innovate. So I do think, like the challenge is gonna be, you got states who don't want the federal government coming in blowing stuff up, right? Under the guise of AI innovation, right?

So they're gonna, they're gonna be creative, maybe do things on the privacy and, and, and under data protection and consumer protection, maybe that route. And then you have the federal government where it's put the moratorium on states. It's like you can't pass any law that it impacts AI on their innovation, or you don't get federal funding for your state.

That's, that is kind of like the, the, the, I won't say the networking, but the horse trading going on behind rooms. That's the horse trading going on. If you want federal funding, you can't do this around ai, you know, and I think it's gonna be hard for states to, to stay out of the AI legislation race, but it's also gonna be hard for them to really get in and do the protections that's needed for us, the citizenry of their, of their states.

Yeah. So do I what, call up my local congressman to express my concerns in outrage? Or is this gonna have to be like, everybody's gonna have to take to the streets to force the conversation?

I think it's gonna be a little bit of both. I mean, mean, not to get super political, but just think about the, the Affordable Care Acts. You know, like hundred millions of people will not be able to afford health insurance anymore.

Millions. They've, they, they're calling their, they're calling their senators, they're, they're calling everyone. And it's, and that's still kind of not working.

So I, I, I, I don't know. I mean, honestly, Mike, I mean, I don't know. I think we as a people need to figure out, you know, what's more important, you know, and, and, and it's not about red state, blue State, Republican, Democrat, inspirational person, whatever, whatever, whatever, whatever, um, uh, classy political class you wanna put yourself or label you wanna put on yourself at the end of the day, it's like, is this the world that we wanna live in?

There you have it. Hey folks, whether it's a law or a end user licensing agreement, by all means, don't forget to remember. Try that again.

Hey, folks, regardless of whether it's a law or the licensing agreement for a piece of software, be sure to read the fine print. Yvette, thanks for being on the show. Thanks, Mike.

And thank you all for watching the latest episode of the Techstrong AI Leadership series. You can find this episode and others on our website. Please check them all out.

Until then, we'll see you next step. Welcome to Security Boulevard, the cybersecurity podcast from The Future Room Group. Each episode explores a variety of topics within cybersecurity and the technologies that drive it.

com, the Security Boulevard, YouTube channel, Textron tv, and all of your favorite podcast platforms. Before we jump into this week's episode, let's meet today's panel. And I'm gonna start with our friend Alan.

Alan, it's good to see you again. Tom. Great to see you.

We are, uh, happy to be, I'm happy to be here today. It's a little cold down in Florida. The iguanas are dropping outta the chase, but, um, happy to be on Security Boulevard today.

I, I love that that is the measure of how cold it is in Florida, is things are falling out of trees. Uh, yes. Another place that it's generally pretty cold is in Canada, and that means that we're joined by our friend Fernando.

Fernando, it's good to see you. Thank you. I was squinting about the a it's cold in Florida.

I, I, I appreciate it. I totally do. I'm originally from Brazil, and I understand how in a warmer climate, sometimes what might be considered cold in for them is not necessarily cold for places that are more used to cold anyway, sorry.

Uh, Fernando Montenegro leads, uh, security research with, uh, with Futu, and, and it's such a joy to be with, with, with you guys again. So even if I'm a little bit cold, we had to deal with the, with about a foot of snow or so, uh, a couple of days ago and snow Broke actually, so, yay. Fine.

Uh, I'm Tom Hollingsworth. I'm the event lead for security at Tech Field Day, and I'm happy to be here as well, even if I am a little bit chilly. But the good news is that today's topic is rather hot.

Uh, so let's jump in because you may have seen news, uh, in the last week or so, uh, that Jen Easterly has been appointed as the CEO of the RSA conference. Um, this is really interesting because, uh, she was formally a part of, uh, csa, uh, the, uh, government Cybersecurity organization. Um, she is a very well-known person in the security space.

Uh, she's provided a lot of leadership over the years. Uh, she's a graduate of West Point. She spent 20 years in the Army.

Uh, she's held some very senior roles there. And then she transitioned into a post where she was advising the US government on, uh, cybersecurity matters. Um, she was, um, she left that post and she was gonna take a point, a post at West Point that, uh, disappeared, I guess we'll put it that way.

Uh, but now our RSAC has decided that she should be the person to kind of lead the way that that conference is going. com talking about this and giving some of your thoughts about why you think this is a good thing for RSAC. Absolutely.

Tom Jen Easter, easterly led CS a, she just wasn't just a part of it. She was the director of it. And for those of you out there who may or may not be familiar with csa, it's not just an organization that, uh, advises the US government in many ways.

It sets the tone, it sets the mark, it sets the, the road for how the US government should do cyber and more than the US government, what I think was really unique and special about csa, and it, and it extended even before Jen took over, when my friend Chris Krabs led CSA before Jen was a unique government, private public government corporate partnership to safeguard our critical infrastructure here in the us whether it be government infrastructure or private infrastructure, talking about electric grids and public, uh, uh, public water, and, you know, truly critical infrastructure, commun communications. And so, CI's role was, you know, for a relatively new organization, right? CI's role was, I think, very oversized.

And, and the charter was big. The, you know, they cut it to, they cut Thea budget and move that money to ice. Jen was, uh, Jen, and well, as well as most of sisa leadership was axed.

And then, as you mentioned, Tom, she was appointed a chair at West Point. And, you know, I'm gonna be a little less Doug diplomatic venue. It wasn't eliminated for political reasons.

It was deemed they didn't wanna have her on. But this is where you gotta admire Jen Easterly. She never stopped leading, she never stopped leading, even in the face of that intimidation in the face of those political enemies or whatever you wanna call, she kept leading.

She kept talking, she kept speaking, she kept appearing, she kept advocating for this community. And that's just the person that RSA needs. The RSAC needs, the RSA community and conference needs, right?

About two, three years ago, um, Hugh Thompson and his VC firm, I forget the name off the top of my head now, um, Crosspoint Crosspoint, Crosspoint Ventures Capital, they spun RSAC out as an independent organization, and the char. And since that time, they've, they've really, you know, laid out a, a vision for what they want RSAC to be more than just a once a year gathering of the industry in San Francisco. They wanted to be truly the security community, a continuous security community.

And I couldn't think of a better person to make that happen and, and kind of plant the flag and be visible out there leading this than Jenny Sterling. I'm, I'm, I'm a fan of hers too. Um, and, uh, uh, the thing I would add, if that tying that community angle, right?

First of all, uh, I apologize if I say the RFA conference. It's gonna take a while to get used to RFA conference. So RFA community conference, I'll get there.

But, uh, uh, for, for many, uh, listeners and viewers know that it's been the, the, the Foundational security conference for, for years in the industry, right? Starting with cryptography. And, uh, it's poignant because, uh, it touches, I I agree with Alan, like it's, I I think she has a very wise choice for this, because she's had a role, role in cryptography specifically, right?

She's had a role in, uh, the broader, uh, uh, public policy. Of course, she's had a whole in private sector, right? She was with Morgan Stanley for, for, for a few years right?

Before taking over csa, right? And so I think that, uh, that she's, uh, like I said, and, and, and, and enlightened choice for this type of, of, of role. And I think that I'm, I'm not gonna get too much into the broader politics of it, but I'll say this, I think that we're at the stage in the evolution of this industry where, yes, there are political ramifications one way or another.

Fine, but broader than that, cyber has one. That's a, that's a thing that I've, that I've, uh, I've, I've mentioned a few times on, on this podcast and elsewhere, is that you all, you all remember Mark Andreessen's, uh, paper from, or I think from 2011, software is eating the world. Yes, it did.

It ate the world. And, and, and yeah, sometimes there was indigestion, right? And, uh, I think that this is, um, uh, we, we live at a time, we live in a time where the interplay between, uh, technology and the rest of the world, we can't tell the part, or we almost can't tell it apart anymore.

I'm just putting this, the, the finishing touches on a paper I'm writing on cyber physical systems, right? Which, uh, which it's basically the evolution of IT and OT security still, how we are, how we're fusing these systems together. And it's so clear that it requires us to reach across the public private partnerships to, to reach to, to, to work with governments, to understand regulation, to work with private sector, to understand constraints, to work with, uh, with vendors, to, to have the right incentives in place, right?

To, uh, to move this industry forward. And, and, and, uh, Tom, I'm just, Jo, I'm just in my mind here joking about all the economic terms one can drop in the context of incentives and externalities and so on. I'll refrain from that sort of second.

Uh, The, the thing to me though, I, it kind of going to, what you guys have said is there is a huge value in having an organization like CSA around to kind of take that burden off of the government, because let's be fair, everyone knows that the government moves at the pace of a stunned snail and molasses on the best of days. But that's kind of the way that the government is supposed to do things, right? They have to, there are certain rules that they have to do to, to figure things out and to be able to implement policy and pro and procedure and things like that.

So to have an organization like CISA that was sitting there saying, well, no, we need to be a little bit more proactive. We need to get out there in front of these things. If you'd have asked me two or three years ago, uh, you know, back when Krebs still ran the organization, um, I, I think that this is, this is a great thing, right?

Like, like they're, they're leading the way. They're transforming the way that people look at cybersecurity, but more importantly, they are being honest with all of us about where the deficiencies are. They're saying these areas need to be beefed up.

These are the people that are creating problems for us. The issue is when the leadership above you doesn't want to hear that, or, or worse, when the leadership above you gets really mad that you make an empirical statement of fact that they disagree with, and they have the power to cut off your paycheck and your funding and everything like that. So even though I kind of started this segment by being a little neutral, and now that I'm giving you my opinion, I think it's pretty stupid personally, because you can't pretend that people aren't telling you bad news is coming, and then when the bad news shows up go, I don't know how anyone possibly could have foreseen this and Jen Easterly sitting over there going, yeah, I don't know how anybody could have possibly told you that this was going to be a horrible idea.

Hmm. Really? You can't get rid of leaders like Jen and Chris and a lot of those other senior leadership people who are now gone just because you disagree with them.

In fact, I'm gonna give everybody out there a little a tip. Um, if you're going to evil overlord school, which I am, and I know a lot of other people are, always have somebody around you that's willing to tell you the truth, just make sure they know they need to leave after they do. So you don't get angry and you're like, drop them into a bad boiling sharks or whatever.

But somebody has to at least be the, the voice of reason in the room, right? It's like, you remember the Roman triumphs. There was always somebody in the chariot reminding the generals that famous fleeting, and they're all gonna hate you tomorrow.

You've got to know that you, you can't live in a, in an idealized world where yeah, nothing bad could ever happen to the us. We're the, the biggest, baddest kid on the block, and yet we still get hacked all the time because it turns out we're also the juiciest target on the block. So I think that the kind of leadership that Jen can offer the industry is that perspective of what happens when policy fights against other policy, when facts are fighting fantasy, and how do you square those things inside of an organization?

Because if you think that this is just a discussion between a government agency and the executive branch, I would like to see what happens when the CISO runs headlong into the CEO and the chairman of the board at any organization where they're like, you can't tell people that our security is bad, the stock price might go down. Yeah. The, I I I, I was, uh, when, when you brought up that the, the thing in my mind immediately went to, uh, world War Z, or me being Canada World War Z, right?

The, the, the zombie movie. And, and I remember that I mentioned this because in the context of what they call the 10th man rule, right? So the, the, the idea that somebody has to think outside the box, right?

And to a large extent, I see, um, I see CS a in the United States, uh, other agencies in other countries. I'm speaking from Canada here, right? Um, there is this, uh, assignment or her, uh, position in, in the RSAC organization is, is so interesting.

It's because from an economics perspective, right? How to solve an, uh, an externality or, or how to solve a problem where the consumer themselves are limited in what they can do, right? Is that you solve it further upstream as much as possible, right?

So what, uh, what CISA and other agencies do in terms of helping with guidance for, uh, resource strapped organizations is so interesting. The ci a, uh, calves they known and exploitive vulnerabilities, for example, right? Um, I'm also reminded of, uh, Wendy Nader's concept of, uh, the, the cybersecurity poverty line, right?

In, in that, how do we help organizations get better? Uh, how do we when they don't have the resources to do as much? So I think that this is a role that I, that, Alan, to your point, if, uh, the, our FAC organization is, is more of a year round thing, it helps with this kind of broader message year round, right?

Um, so yes, I think that, uh, uh, I'm navigating the, the, the politics carefully here because we do have audiences on, on, on both sides. I have an opinion too that I think that I would like to see more collaboration, not less, but, um, but, uh, uh, sorry, I lost my train of thought here. I think that, that there is a, a lot of positives in this, in this assignment.

So I've got a few thoughts here, Tom and Fernando, on what you both said. First of all, in, in regard to the role of CSA within the government, I, I think, I think it speaks volumes that the fact of the matter is the last two directors of csa, as I mentioned before, and Tom you mentioned Chris Krebs, Chris was fired, fired in 2020 for saying that the election was not fixed or fraud. And the president at the time fired him as a result.

And as a matter of fact, same president has directed the Department of Justice to investigate Chris, whether you want to call it retribution or whatever, but to continue harassing, Jen Easterly and CSA were fired 'cause she was a Biden administration primarily. They, they purged the Biden administration to put loyalists in there. At the same time, they degraded the budget and scope of the agency.

That's that you can't look backwards. You can only hope that as we go forward, the necessity of sisa, like organizations win the day. And, and we do put priorities in place there with that.

In terms of RSA at Fernando, you pointed out today, it seems the US government is still on their attribution kick with this and has now directed, and I don't know if this is true or not. We just saw a report on LinkedIn has directed us agencies to pull out of the RSA conference. Who loses?

Well, at some level, we all lose because we should have one community, which is kind of the message behind RSAC. But ultimately, I think the federal agencies lose a lot more than the rest of us, because if they isolate themselves, if they go to a pre CSA thing of being up on an ivory tower without integrating into the community, without understanding, learning, understanding, cross pollinating ideas, theories, technology. No, no.

Government is an island today. No nation is an island today. No person is an island today, right?

Today, more than ever, we need a strong cyber community. We need a strong public private partnership. It's sad that it has to come to this.

It's sad. However, I know Hugh, I know Linda Gray. Martin, I know Brita, glad I know the people behind RSA, they, they're not stupid people.

They, they didn't go into this with blinders on or blinkers on, not realizing this may have be a potential repercussion, but I think they're in it for the long game. This too shall pass. And, and that's my take on it.

All set. Let's Move on to some happier news. And by happier, I mean, some people are getting paid.

Um, one of the things that Alan brought up when we were doing some research for this show is the fact that there are a lot of cybersecurity companies that have recently emerged from stealth, and they're driven by ai, specifically AI penetration testing, AI identity security, and AI agent platforms. And I know that we've discussed this quite a bit on some previous episodes of Security Boulevard so far, talking about the need for securing agents, how agents are gonna provide security in different areas. But I always go back to what is the Smart money say?

And in this case, the smart money, which is, you know, tens if not hundreds of millions of dollars are investing in companies like Novi and Seven AI and Opti to provide these kinds of services. Betting big on what that next, uh, company that's gonna have a groundbreaking security offering is gonna be. So I kind of wanna toss this out to, to you guys a little bit.

Do you think that these companies are doing some great research knowing that they're just on the cusp of some amazing breakthrough? Or is this the typical startup mentality of, I've just gotta keep the runway going long enough for somebody to buy me? Look, I, you know, I've been involved with VCs for many years before I did Techstrong, I spent 20 years plus in the VC back startup world.

I have good friends in the VC space. The VC model is not a do good a charity model, right? They're in it for the money.

And if they're investing this kind of money, and, and let me just quantify when I say this kind of money seed rounds of $80 million, $50 million seed rounds, a good seed round used to be $4 million, $3 million, a good a round, $12 million. These people are raising 50, 80, and a hundred million dollars in seed money. That's like before market fit even money.

So, you know, we're talking about a big amount of money. And you know what you would think by rational smart people, smart money, as you said, Tom, so they see a huge return here. And, and the VC window keep in mind is they're not investing for 20 years now.

They're not even investing for 10 years. They wanna see a return of three to five years, seven at the outside. They gotta close that fund down in seven.

So if you're seeing this kind of investment by these folks, you, you have to assume that they see, you know, a decent return within three to five years. You know, um, when you're talking about 50, 80, a hundred million bucks, a decent return is not a pittance either. You're talking billions of dollars probably, right?

All the VCs talk about 10 baggers, 10 Xs. That's, you know, Fernando, I see you wanna say something? Go ahead.

Yeah, No, I, I, I, I, I, uh, similar to you, I've, I've, I've been around and, and, and I like to track the, the, the, the money where it goes and, and so on. And, um, what I find is that there is a, uh, I always say that VC money is like rocket fuel, right? And it, uh, it works wonderful if you put it in a rocket, right?

If you happen to not be putting it in a rocket, That might not be the best thing, right? And, and we've seen tremendous, uh, we've seen tremendous, uh, uh, businesses that grow, sometimes bootstrap, uh, and, and they, they grow to a certain size. And, and that's fine.

And, and they may have a, and they may deliver value that, right? Um, the thing on my mind about the, the, the current, uh, the current funding is that it is very much we are, uh, we as an industry, like we, we we're funding the startups because they need to absolutely move fast on things, and they need to move fast on things without, they need the runway. They, they need to be able, they, they need the runway to, for the tech to mature, but they need to move quickly so that they do capture the kind of early mover advantage, right?

And at, at Futurum, there are three trends that we're majorly tracking, right? We we're tracking the modernization of security operations, the modernization of security infrastructure, and the modernization of security governance. Those are the ones.

And 20 is one. Now, is now is, we are definitely expecting that this is the year where we start seeing that rubber meets the road, uh, reality of agentic security, agentic workflows in security operations, right? So, can I get my AI sock off the ground doing meaningful work for me in a correct fashion, right?

So this is very much the time to be putting money into these type of, of, uh, of startups. And I'm navigating carefully because like, we don't do vendor endorsements, right? So I'm, I'm observing the, the, the observing the space.

I know the, the, the seven AI folks and, and, and some of the others, right? So, um, this is very much a time to be doing that. And I, identity is another one, right?

We saw the, the, I mean, Palo Alto dropped $25 billion for CyberArk. The deal should close in the, in the, in the near future, right? Uh, we saw a massive funding round for, uh, SAVI back in December, I think it was 700 million, I believe.

Uh, and, and, um, so identity is very much the second, uh, element that, uh, uh, I'm, like I said, I'm, I'm, I'm working on a, on a paper on cyber physical systems. And, and one of the things that pops up is just managing the, the, the explosion on identity. We're past the, the, the human scale, like I really like to call it for managing these things.

So this is very much a time for this funding. I think that thematically, sorry, I'm long-winded comment, but thematically, I think that, that these are very interesting areas to invest in. Well, I'll, I'll reserve judgment on the vendors themselves, right?

But it it, but it is very much a time to do this. But Alan, you raised a phenomenal point, which is this is not being done for charity, right? And this is being done to position these organizations to be successful.

Uh, what my message to, to security practitioners and and executives is that you have to understand the, the, the, the pricing dynamics that, that play on here. Like, are you going to switch from a, uh, ingest based pricing for events to your sim right? To, uh, to an incident based pricing for your ai?

So, oh, look, if I handle an incident, it costs X much, right? So my, my, uh, my advice to, to, to practitioners is stay on top of these trends, right? These vendors and others, but understand how incentives are aligned and how the, the, the pricing is going to change moving forward, right?

Avi, that Fernando, and I realize what's low on time, I'll try to move it along. Don't assume as a security practitioner that the company that raised the most money is the best solution, right? This VCs don't operate like they're at a, a, a race track.

And you bet on horse number seven, and I bet on horse three and let the best horse win, the best horse doesn't always win. As a matter of fact, there's a school of thought in the VC that if I give the my investing company, my company, that I invested in so much more resources, then the next guys have, right? They will have more money to make more noise and do more marketing and more sales, even if their product is mediocre at best, right?

Because they have more money, they're gonna win. And winning here means the biggest liquidity event, the biggest return on my investment. And so sometimes you look and say, well, this company raised more company A, raised more money than company B, company A must be more valuable, company a must have better technology.

No, if that was the truth, we'd all still be on OS two war, right? Or whatever the latest OS two is. Um, it's, there's a, there's a rhyme and a madness to VC investing that sometimes gets lost.

And, and so pick the best solution for you. Oh my God, yes. Uh, there is a me in economics, there is a, uh, there's a famous paper by, uh, uh, or not so famous, perhaps by Ian Grigg called The Market for Silver Bullets, right?

Yeah. And, and, uh, the, the interesting thing there is that it explains that the market for silver bullets, and, and I promise not, no, not an economics lesson in the last five minutes, but it refers to a famous paper called The Markets for Lemons, right? Which was a Nobel Prize for George Akerlof and others back in 2001, I believe, on information asymetry, which is a foundational concept, which is how do you value the quality of something, right?

And, um, or how do you discern the quality of something? And I think that this is phenomenal information for security practitioners. Alan, to your point, people have to discern what is the quality of what they're buying and how you are gonna do that.

And, uh, I mean, we could make an entire series on, on economics, but, uh, there is a, there is a concept of signaling, and the concept of screening signaling is when you as a vendor, like you signal the quality that you have, Alan, to your point, I have more money I'm gonna signal to the market that I have all of this and that. But the flip side of that is screening As a buyer, how do you create the process that screams out the quality of what you are buying? And I mentioned this here, this all comes full circle, because as a, as a practitioner, right?

My, my advice to you is that you are being, you are increasingly being affected by broader geopolitical events, right? This thing is increasingly important, right? Cybersecurity is that much more strategic, right?

And you need strong communities in part to help you with the signals that if somebody participates in that community in a, in a, in a good manner, that's a signal, right? And that community can help you create the screening criteria that you are gonna use on your evaluations, right? So again, it, I, I know it sounds like a joke, but everything turns around economics for me, right?

And, and as you observe exactly, Aval said, as you observe the, the, the, the investments that, that be made, yes, by all means, it's an important signal, but it's not the only one. So buy what you need and we can talk about other stuff later on. Sorry, I, I, again, I I, I get too excited about this.

That's okay. We love people that get excited about what we talk about here on the podcast, but we hope that you're also getting excited about the things that we do that are not on the podcast. Fernando, what have you got coming up that people should check out?

So we just published our, uh, we just finished our data set and cybersecurity decision makers, and it up a trends I'm talking about. So, uh, and finishing my paper in Cyber Physical Systems. Uh, I promised that it'll be done today, maybe tomorrow, and sent to, to peer review and, and, and whatnot.

And, um, I'm starting to plan what my, uh, my participation at, uh, RSA is going to be like. I'm really looking forward to that. And yes, it's, uh, it's, it's, uh, it's starting to get busy for industry analysts.

We get particularly busy around, uh, uh, spring and fall, right? So, yeah, I'm, I'm, my calendar is looking. We are great.

Now, Alan, what about you? You know, it's that funny time of year, Tom. We just fi Tom.

We just finished, uh, predict 2026 last week, which is our kind of look ahead to the year. We, I think it's the first time we've done anything like this. We had Fernando and virtually the entire a futurum analyst team each doing their sessions.

I think eight of them I was, I was involved in right, asking questions. I loved it, but it was great. It, and, and it's available on demand now for anyone who wants to go check it out, predict 2026 com.

You could go get them there. com winners there, and we actually had the analyst from, uh, RSAC there, Fernando, giving the RSA view of 2026. Speaking of RSA, we're in full blown mode getting ready for that.

Our, uh, annual DevSecOps event at RSA, the Monday of RSA week in Musk Moscone is coming up this year. It's securing AI native dev, which is in many ways what DevOps or a big part of what DevOps is today. We have a great speaker lineup, including David Brynn, who's like a Hugo Nebula award-winning sci-fi author, but also a PhD at a JPL and, uh, an AI profit from the eighties and nineties even.

He's keynoting. So check that out. Um, I am taking the film crew or one of our video crews here from Textron up to Blue Origin, uh, Jeff Bezos Space Company.

And we're gonna be interviewing, we're gonna go to their headquarters here in, uh, on the Space Coast in Florida. And we're gonna do some video coverage of what's going on there. And I'm just a little boy in me is very, very excited.

Um, but other than that, you know, it's keeping the wheels on Tech strong and working with our friends at Tech Field Day and the rest of futur Group and, you know, trying to have fun. Because at the end of the day, if you're not having fun, it's just a job. Well, speaking of Tech Field Day, we are going to be at RSAC this year.

We've got a great lineup of presenters so far, including Veeam and Object First, which are now the same company. Uh, and we also are gonna be hearing from Convault and several more. com, and you can see the lineup that we've got coming up in March.

But also, don't forget to check out all the great events that we've got going on. Uh, AI Infrastructure Field Day, uh, AI Field Day, uh, security Field Day, networking Field Day. We've got a lot coming up.

You can check out our calendar there. We also wanna thank you for listening to this episode of Security Boulevard podcast. If you enjoyed this conversation, you know what to do.

Head over to YouTube or open up your favorite podcast app and subscribe so you don't miss any of our episodes. We would also love it if you would leave us a rating, a review, and, and maybe a comment just so that you know, um, kind of people are reading what your thoughts are on the show. And that helps us get out to a wider audience.

com and the Future Room Group. com, our Techstrong TV website, or check out the Techstrong TV app. It'll run on Apple tv, Roku, iOS devices, uh, PlayStation, Xbox, whatever.

We'll, we'll make it work. Um, we also hope that you follow us on Security Boulevard, uh, the social media areas, you know, X, Twitter, LinkedIn, you know what to look for. Security, BLVD.

That's who we are. Uh, we hope that you are enjoying all the great content that we're putting out here and across the Futureum group. Thank you for tuning in.

We'll see you all next week. More horsepower, more power. Get those horses moving faster.

Your ai, it's huge. It needs more power. Or does it, can you actually do great things for your business with less horsepower and do things more efficiently?

Join me on the Tech Field Day podcast as we drive this stage coach through the ideas of efficiency in AI infrastructure. Welcome To the Tech Field Day podcast, where we bring together a group of IT technical experts to discuss a single idea about key concepts in the industry. This podcast features a variety of perspectives from members of the tech field they delegate, and it's often recorded in association with one of our events.

In this case, AI Infrastructure Field, day four Tech Field day's, part of the future. And Group in this podcast is also published on our sister company Site Techstrong tv. On this episode, we'll be discussing that AI needs resource efficiency and that more horsepower isn't the only direction.

But before the discussion, let's meet who's on the panel today. Hi, I'm Pete Welcher. Uh, I've been around networking for a long time now.

Retired, still doing it 'cause I think it's fun. Hey, I'm Gina Rosenthal. I'm a product marketing manager.

I've been doing that for a while, been doing product marketing for AI since about 2017. Yeah, and I'm Andy Banta. I've been hanging around the infrastructure industry for quite a while.

Um, mostly from the aspect of it. And I'm Alistair Cook. I'm the event lead for AI infrastructure Field day here at Tick Field Day.

And one of the themes that we see is that AI needs to kind of grow up from this land grab and this idea that massive amounts of infrastructure, ridiculously powerful GPUs stacked up in, uh, rack after rack with hopefully a very strong flaw and liquid cooling to get to ridiculous numbers of, uh, kilowatts, hundreds of kilowatts of power being delivered through a single rack. Um, I've long felt that there needs to be a much more efficient way of delivering ai. I was hoping there'd be some revolution where this more horsepower would cease to be the issue, because all of this horsepower and all of this compute power, all that energy has a cost.

It's really expensive to generate these things. It's really expensive to build these data centers. And as we've covered in the tech fields and news rundown, there are contracts for more data centers to be built to host AI than have ever existed in the past.

Exist now. So this is a huge build out for ai, uh, using vast amounts of resources. And even if we set aside the difficulty of actually producing those, the cost to people producing them, is that even a sensible thing for us to be doing with the planet?

Should we be generating AI by heating the entire planet up with these massive GPUs? And it's kind of a a point of, of difficulty along here. Um, Andy, you've been around this, this block a few times before.

You've seen massive infrastructure get built out and maybe get more efficient. Can you see that happening here with ai ai? Well, I, I think it has to.

Uh, one of, I, I've actually been, um, talking about the power consumption used for data centers and AI data centers in general for the past couple years. But one of the things that I would be really interested in hearing from, from the AI infrastructure companies out there is how they're doing things more efficiently. Not how they're doing things faster or more densely or, uh, or various different ways of adding more and more.

But it's, you know, tell us something about some algorithms that you're using to make more efficient use of the hardware that you have available or the speeds that you have available. Or talk to us about a way, uh, a technique that you've come up with to do more with less. And, and instead of just telling us how you can do more, that's really what I'm interested in hearing more of from infrastructure companies.

I completely agree, and I've got a slightly, uh, different perspective on the whole market. I think the companies that developed the very large models needed, um, vast funding because of the huge costs that go into those LLMs, and they couldn't afford to specialize, uh, because they really needed something that would have a vast potential market. Unfortunately, what I think has happened is that they've assumed that's the future.

I'm not sure could, it's certainly got a role particularly for conversational, um, interactions, I guess to put it. But if you are trying to model something, be it network troubleshooting or, um, uh, some biological process or something, maybe a smaller dedicated model that knows about, say, computer networks, um, might be more suited to the task and a whole lot more efficient to run. So that's kind of a question in the back of my head.

I don't have an answer, I'm just kind of watching the space, uh, with intense interest. I agree with both of y'all. And Andy, I agree with the whole idea around power.

When you think about, if you read any type of description of what, uh, the data centers are being built for, it's described in gigawatts. So, um, it's not a back to the future reference, but it's actually how much power they need to run, um, these servers and to run the different components of the servers. They never talk about the data.

They never talk about how much data that will serve us. They never talk about how much data will be created. They never talk about, you know, the actual part of ai, it's the end result of it.

They only talk about what it takes to run it. But when you do an infrastructure, when you do any kind of architecture, you're always looking at what is the workload that's going to be run on it. And it's not at top speed because not everybody can afford to run everything at gigawatt speed all the time.

Not only that, but if you think about what is ai, this is common, I'm gonna always come back to this. What is ai? AI is what we used to call right now.

What what is available from AI is what we used to call high performance computing. So machine learning and deep learning. And you don't need gigawatts of power to run those types of workloads.

So why aren't we talking about this as a true architecture instance, right? Like, what needs to happen, how much data you, you need, what do you need for each section of the pipeline that we're gonna be doing to transform this data? Um, that, those are kind of different questions, but I think those are important.

So we kind of skip over the whole, we can design for this, it's a workload, this is what we know how to do, and if it's a workload, we know how to make it run more efficiently. So I I'm with you. I I wanna hear more about that.

Well, you touched on something that I've been focusing on, which is, uh, where's the data? And I think we're gonna see that during the ai, uh, infrastructure field day, uh, presentations because if the data's not local, or if you've got, uh, such a huge LLM that you need to run your, um, training in multiple sites than just accessing large amount of data is yet another barrier as well as latency and bandwidth and power. Right.

And I mean, the, the other piece of this that I, I really wanna try to address and some of our discussion here is that the, um, in addition to the data, the ability to actually create the data isn't being done efficiently. Uh, and Fabric had presented at one of these sessions a long time ago before they got consumed, and part of their presentation was talking about the fact that the LAMA model is only, uh, theoretically capable of using about 70% of the GPUs available to it. And in practice is only using about 30% of the GPUs available to it.

And that is clearly showing that more is done. What you need in here, what you need is to actually do the good old fashioned software engineering to make these models more efficient, to make use of resources that are available to them. And that is really part of the efficiency that I would love to hear people talk about.

Uh, Gina made this point a little bit earlier, uh, when we were in the pre discussion for this, about why aren't people looking at solutions similar to VMware of, uh, of sharing resources among various different processes? Various, uh, and you know, I, I think Phoenix can offer a little bit more information on what she was thinking, but, uh, that's like an excellent question that we don't hear from Ethan VMware these days. I think VMware has a hard time getting the message out, but, um, they have a lot, they've had a lot of tools for a long time where you could do things like virtualize the GPU and split it into, I wanna say 16, but it might have been eight to deliver that, that that vir that, uh, power to different virtual machines.

So the same thing we did with Oracle back in the day, remember nobody thought you could virtualize Oracle. That, that it would be, you would cost so much because you needed those servers to be bare. You need to, uh, uh, put that Oracle OS right onto the server, and that's how you had to run it.

But once you started looking at, no, these are workloads, you can virtualize all of it, we can virtualize every component of it from a VMware perspective, it's virtualization in general. I'm sure it's all of the virtual, um, virtualization hypervisors that can do that for you. But, but it, we're not thinking about it that way.

We're, I think it's, it's, it's definitely the hype that's driving that. Like you have to have ai, you get ai, you have to have this many servers and this many GPUs that that's the formula, the blocks, and that's kind of how they're being sold. I don't see anybody pushing back and saying, nah, man, we need, what we're needing to do is we're needing to take this historical data, do this with it, it's gonna cost this much for us to crunch through it, and this is what we actually need to install in our data center.

But people were doing this before the days of ai, they were doing it when you went to super compute, you would see people doing cool things on bare metal. And I know this because we were there with VMware saying, and you could also do this with virtualization. So it, it, it's just workloads.

And I think that the architects and the engineers need to get back to, to that piece, which would also force people back into the what is the case? Why are we do AI's on this side? What's on other side, and what do we expect to report back?

You know, what, what's this gonna gain the company if we, Yeah. And it's, um, and VMware certainly did do virtualization of GPUs, and they, they did it both. They did it both in software, and they also were able to split out the hardware functions of various GPUs and spread those to various different VMs.

And through some of their later technology, they were actually able to share those across the network. Um, I, one of the other concepts that has been brought up that I really haven't seen a whole lot of traction on is there are CXL vendors out there who are attempting to say, harvest the memory from your, um, systems that you were shutting down and put it into a cxl rack that you can actually use on a new system. The idea is that DR doesn't go bad, can last for a very long time.

And even if it's not the newest, most, most fast DRAM that's out there, you can certainly make use it again. So, I mean, uh, in addition to efficiency, we also don't hear too many people talking about reuse or sharing of resources. We're gonna have to, right?

Because what happens now when all of a sudden the prices of everything is going through the roof, you can't get rid of your memory. You can't, you really have to hold onto it because if you don't hold onto it, you, you're not gonna buy any new unless you pay three times what you're already paid, what you paid for it yesterday. So we're in this memory crunch because they can't make it fast enough.

The same way you can't get ahold of GPUs because they can't make them fast enough, can't manufacture them. We're in a place where the chips are getting smaller, but getting, doubling in, in capacity size. So they haven't really perfected that, um, that, that in the, in the manufacturing plants to get those rolling and get those out to customers.

So many of them are already pre-sold And they're pre-sold, so you can't even get them once you, once you get ready to go deploy this. So you're gonna have to get creative and figure out how do you architect for this workload with what I got or what I can maybe find on eBay for a decent price. Right.

Well, Jina, you hit on another, um, thing that I think is key, which is shorthand would be ROI, but what's the company benefit from what people are doing? And that's kind of the challenge with everybody does ai, uh, which seems to be the, a meme in some companies, and it really is much more helpful to start thinking about ROI. But another factor in it is that maybe not everybody, just like not everybody is cut out to be a programmer.

People have their job they wanna do, and they may have a idea that AI can help them, but right now, uh, how to prompt a l LM and, uh, get good results and sort of that is, uh, something's everybody, and we're starting some mechanisms, uh, gait and some of the other things that help with automating that sometimes even in massive ways, which could be a problem. But, uh, when is this, when is AI sort of experimentation gonna be easier for, uh, Joe Schmo and marketing or whatever to use, uh, as opposed to somebody who's a computer science, uh, specialist And, and then Pete, is that the right thing to have happen? Because as we're talking about this, as, as you doing AI through resource efficiency, what are the tools that that abstract away the intelligence of the operator, right?

That, that take away the specialization of being able to work with the AI tool? Well, that puts more load on the ai. That means that we need more horsepower in that AI to handle the fact that we're asking somebody who, who is not specifically skilled or oriented towards understanding the tool to just throw simple language stuff at this tool.

This is how we're getting this idea of needing more and more horsepower. I think coming back to one of Gina's points was that having an AI tool that is specific to a task rather than a general purpose ai. So building into your application instead of using, uh, a full 7 billion or 20 billion parameter model, that is a general purpose model.

Having a model that's specifically set up to handle maybe, uh, analyzing the productivity of your, um, factory floor. Having an AI that is specifically trained for that function is going to be more efficient than feeding the all of the information about your production for into a general purpose model. And that's where we need to look at that resource efficiency versus simply building more horsepower.

There isn't a single solution here, there isn't a single answer to this. Sometimes in order to get value out of ai, we're gonna need to a very specialized AI that does a very specialized task. And I come back to some of the early discussions around this, that a lot of the time it was still the, uh, predictive ai, the old fashioned machine learning that, uh, was looking for trends and data and a and, and extrapolating those trends and data.

A lot of the time, that's what the production AI was. And strapping a chat bot, large language model on top of a huge amount of resources wasn't necessarily the right way to solve this. Another of the themes that we saw across our AI field days, uh, as as they were maturing, was the idea that chat bots aren't the answer.

They, the AI needs to be invisible inside the application doing whatever it's doing. Uh, it needs to not be the, the primary interface. It needs to just be the thing that makes the thing better to quote Bobby Allen.

So AI should disappear and, and should be task specific. Well, that's where maybe the LLM gets used in a slightly different, uh, form of age agentic, uh, use, where it recognizes what field a question, what type of question is being asked, or what type of inferencing is, is being requested. And then it calls on a dedicated model that, uh, for instance, like what Cisco's done with an in-house network trained, uh, model to actually answer the question.

So it calls an AI agent rather than a software code agent. That's classic program. Yeah.

Yeah. And I mean, that's, I think that's part of where Alistair was going. I I think part of it, uh, the idea of the efficiency could be that you, you don't need to train something on the entire world of knowledge to, for a specific thing.

And I mean, if, if you go in with the idea that we only need to train something for specific piece of knowledge, then you, you probably can do it more efficiently. And it, it's, uh, you know, you talk about Cisco, a, a friend of mine who worked at AD said that one on one of their early models of their, uh, virtual assistant that was based on AI model, that he, the first thing he did was asked him, what is Epic? Which is the name of, uh, desktop?

And the virtual assistant couldn't answer it for them. One of the things that, you know, you brought up, I, I think it's unfair to say that Joe Schmo in marketing, this is like LLMs are the perfect tool for marketing, right? And I know people aren't giving the right prompts yet, but, um, we had a conversation about this this morning on the Textron gang.

What happens when, um, what happened with email, when email first came out, everybody couldn't use it. I mean, I had to support post drops who were astrophysicists that really had a hard time with email. So, you know, because it was so new, it was something brand new that nobody knew how to do.

Um, and they didn't, they lost, they didn't understand the rules. But now you can't imagine having an organization that doesn't have a proper email system running one way or the other. And I think that's how it's gonna be with ai.

AI is gonna be how we communicate with computers in the future, right? This is how, and now going forward, and it's gonna get more and more, we'll, we'll figure out the latency problem, we'll figure out the power problem, but people don't know how to use it now because nobody knows how to use it. Now, like the few people that do are, I would say the very, very technical people don't understand how important those marketing people are in the organization and how they can pick the information out and distribute it back.

Again, I'm defending marketing because I'm product marketers, so have to do it. But, but I, I think you know, that, that very technical people forget that that data that we're moving around and trying to transform things into, one of the way it gets transformed is by the, the knowledge and the point of view that the people that aren't technical that are gonna take a little longer to train them on the prompts and, and how to do things properly, they understand the way to pull the information out because they have the vocabulary, everything else that nobody else wants to learn about marketing. If you're not a marketer, you're a technologist, you don't care, you don't wanna learn that, but the marketers will know the right words to pull that out and pull the information outta the data.

And that's really what a lot of those LLM, um, workflows are all about, is to help pull information outta data. So I think some of this is just, we are in such early stages and we were bombarded absolutely bombarded with hype about what this is and how you don't get on board, your company is gonna be sunk and all the rest of it, you know? So I think it's really important to remember that all of us are suffering from hype overload and we're gonna get there because this is how we communicate with computers now.

Yeah, but this goes back to the original point. Yes, I, I agree with exactly what you're saying, but I, I think, uh, some of the, some of what's being lost here is that, um, the efficiency that you actually would get let back up, that this is, this is making things more inefficient rather than, uh, more efficient. And I think one of the things that we, we lose sight of is actually paying attention to the genuine computer science necessary.

And instead, we, we keep adding layers that are, uh, wasting cycles to get the same job done. Thousand percent agree. Have you ever looked at stuff and it looks like front page like AI stuff looks like front page from Microsoft way back in the day.

Yes. Yes, I agree. I agree with you.

So will it optimize when it looks like, um, MySpace and see the front page? I think that'll be a little bit optimized. But that's like when they're just, that's probably like when they're just to the point where it's too much and then they're like, holy crap, we gotta pull this back and make this really work for people and we're gotta make it good.

Now, One other challenge that I'm, I think is lurking here with the idea that everybody does AI is, uh, it takes me back probably several decades to, uh, ro it, uh, the prospect of people just learning spreadsheets and doing corporate financials on a spreadsheet and screwing up a formula with consequences. And that's actually good news from the AI perspective, is we've been here before, so people learning and making mistakes, uh, hopefully you can fence them and be aware that, that that's a potential problem. But, um, I think assisting people with frameworks that, uh, minimize the mistakes is probably a useful thing to think about In terms of resource efficiency.

Um, I, I really don't expect that an unskilled user should be handed here. Here's an AI that is a general purpose. Ai, you can do anything you want with it, and we're not gonna tell you any limitations around that, right?

That's, I don't think that's a good way of using ai. AI should be invisibly embedded into the thing you're doing. So as a marketing person, Jen is per perpetually writing documents, writing, um, presentations.

And if you're going outside of that, using AI to generate some things and then come back into it, the workflows rock, let's say there's just another layer being added that adds no value. The AI should, should actually be embedded, however frustrating. It's to have the, uh, Google sheet say, would you like me to generate everything for you?

Right? That's where it should be. Uh, the AI should be a feature that makes the application you are using makes the tool you are using function better.

It shouldn't be a separate place that you have to go. Um, some of the evidence that we're misusing the separate place is, is absolutely ask the ai, what is epic when you can go to Google and say, what is epic? And be taken to the documentation that describes exactly what Epic is.

People are using, um, chat GT as a replacement for search and finding that chat. GPT isn't necessarily up to date on the latest news. It certainly doesn't know, uh, about the ice storm that's coming to the Eastern US uh, this week, or about the landslips that happened close to me here in New Zealand over the last couple of days due to the weather.

Um, but I can find that information through Google search, right? Using AI and particularly chat interfaces for the wrong things is gonna lead to poor results. And I think hiding them away, Don't you think that if you, I'll go back to my front page, you know, that's why front page was so awful because it had everything in one, one place.

So don't you think that we're gonna end up having more bloat problem and more resource problem if, um, if we put everything in the place? Well, data sovereignty is the other thing I'm sitting here thinking, because if you have, uh, people just asking chat GPT, uh, well, it's already happening that, uh, very private and sensitive information is getting exposed because it's sloshing out into the ai. And given some recent results where people have been able to reproduce entire books or major chunks of books by feeding, by iteratively prompting the LLM, uh, they could probably get at that secret data, uh, confidential data as well, which is not a good thing.

Returning to, to one of the things that Gina said that, so the sort of blow to building AI into everything, I think you've got a really vital point how rebuilding, putting AI into every single application independently as we're seeing at the moment isn't efficient. Is it? It's the same thing again and again and again, uh, but we are seeing some movement towards some standards about how, how you inject ai, uh, or specific knowledge in AI into an application technologies like MCP, um, standardizing the way you attach to an ai.

So I don't think there's necessarily the need need for that, that complete rebuild. Uh, and there's other standards like the agent to agent standards, because as Pete was saying, a lot of this stuff is, is actually gonna be done by agents rather than directly by human interaction. So I think there are developments in that space of not having to rebuild, redeploy, uh, do again, exactly the same thing we've done in the past.

So I think there is hope for us that the AI delivered into a specific applications doesn't have to be a completely from scratch or really inefficient reimplementation of some other ai. Uh, of course that's probably what we're gonna see first because that's how you get to a minimum viable product. Uh, I think Pete mentioned that, that idea of, uh, we built huge large language models and, and so that's the way we view all of AI needs to be this huge amount of resource for these huge large language models.

Again, I I view that a little bit as a minimum viable product. I really hope as maturity turns comes along, we'll see more efficiency, more reuse of technology, and more use of tools that are specialized to a single function and that do that function more efficiently. The thing is, we've gotta stop the pace of going for more and larger, which was coming back to our original premise, more and larger isn't necessarily the right way to go.

Um, so yeah, I, I think I've rambled all over the place on, on a bunch of stuff we've talked about. Uh, and I, I really do hope we do see more efficient use more tasks, specific use of large language model AI and, um, some of that maturity of working out how we're getting business value rather than just the, um, arms race to acquire as much resources we can. Because if we don't, somebody else will acquire that resource and, and we will lose.

I think in the end, if all you do is acquire resource and never use it, you're gonna lose anyway. You may as well, uh, look at efficiently using those resources that you acquire. Well, there's competition for the resources.

There's also time to market. So if you're using massive resort costly, uh, resources and training a model, you have to build this Mongo data center and everything just to get rolling, that's a long lead time. And so anything you can do to make it lighter weight, it affects, uh, improves your time to market, Right.

I, and you know, I, I think one of the other places where we could potentially see some efficiency is, uh, being able to filter out AI generated content when we're actually building our models. Uh, it's one of the things that that's, uh, we, I mean, we, we end up with, uh, hallucination amplification when we do that. And it's, uh, it also means that we're, we, we end up with AI that's seeded with a imaginary information to begin with.

And that's, that was one of the terrifying things about Deep Seek was, was when they built deep seek, one of the things they did was use a lot of AI generated content to teach the ai. And yeah, that does seem like fantasy land being used to build another fantasy land. And that doesn't translate well to being useful in the real world generally.

I think one of the other struggles is right, you know, of course I'm a marketer. I use, I use, um, Microsoft, and, um, one of the things that's gotten way better is their copilot, especially if your documents are on the platform, that's gotten way better. But you talk about, um, the BLO is there and the bloat is there because the system's underneath of Office Doc, you know, online office are not all the same.

They've come from mismatches of what they have and put up on, you know, the different, different sites and we use them, but you can see it when you try to start to run this whole pipeline, you know, writing and producing and editing and adding things and that kind of thing, because you can't do it all in one place. So I think that that's a problem too, is like your businesses are going into AI and they might be going out and buying whatever they can to be the most powerful and the fastest and blah, blah, blah, but they're reaching data that they're using data, they're organizational data that's on all sorts of stuff, maybe even on tape. There's a lot, that whole piece they're saying.

That's what I've heard is that whole piece of preparing the data to actually be used by a model and to be used to make some business model that take value, that takes a lot of time and a lot of doing. And you think about rehydrating things from tape and getting things into an object ready, if that's the way you built things, how, how that looks for everything to be consumable by the model. So it's, it's, we we're gonna have a lot more bloat before we can get to the trim down thing, even if we're trying to, so like, we've got this problem of not being able to get the components, this whole problem with getting the data ready, you know, and then making it, um, palatable for the business users to use.

So it's a, there's a lot to be done. Did You just say garbage in, garbage out? Yeah, that's what I said.

I think that that idea of bringing data together from different sources leads to a, a sort of disconnect where, as you say, it's not all the same format or naming of things. And this is the semantic layer that Brad Shiman from Future On Research has been writing about recently. I'll be presenting a a little bit of his research at our infrastructure field day tomorrow.

And so I think there's gonna be a continuing conversation at our infrastructure field day about how you build this infrastructure, how you make it valuable, and we're probably gonna come in with a lens of how you make it efficient. Andy, join Gina, uh, here in, in, uh, Santa Clara with us and I have a, a collection more awesome delegates. Uh, so before we fill out hours and hours of this conversation, I think I'm gonna put a line under it here.

And thank you all for joining us today at the Tech Field Day podcast. So before we close out this podcast, where can people connect with each of you and maybe continue this conversation or maybe decide they wanna buy you a beer at your local, uh, bar? I can be found on LinkedIn.

Um, my initials PJ Welcher, she'd find me. You can find me on LinkedIn too. And I am so excited that my podcast partner will be with me at Tech Field at AI Field Day, and you can find us at tech aunties com.

Okay. And you can find me on LinkedIn as well, Andy Banter, uh, as well as on Blue Sky Social, and I, uh, my, my occasional, um, blog posting on andy ban substack com. And of course you could find me, Alistair on LinkedIn and all of your favorite social media, as well as at AI Infrastructure Field Day this week.

Looking forward to having some great, uh, conversations with people there. So thank you so much for listening to this episode of the Tech Field Day podcast. And of course, if you enjoyed this discussion, subscribe on whatever your favorite podcast application is or on YouTube so you don't miss a single episode.

Uh, give us a nice review as well, and a, a high rating because you love coming and listening to the Tech Field Day podcast, particularly when we have such entertaining delegates joining us that will help other people to find the awesome contact. This podcast is brought to you by Tech Field Day, the home of IT experts from across the enterprise and a part of the Events More Episode podcast or us on. Thanks.

Listen, see on podcast.