Responsible AI Adoption Strategy with Barracuda Networks CIO Siroui Mushegian

Progressive CIOs are looking to help their organizations roll out AI in a responsible way to enhance productivity. With so many AI powered tools available and changing every day, it can be challenging for technology leaders to decide which to deploy. But the real issue is socializing this change with the people that will use the tools.

In this episode of utilizing AI from the Futuring Group, Siri Mache from, uh, Barracuda Networks joins Olivier Blanchard, John Schwartz, and myself, to discuss how this well-known cybersecurity vendor has adopted ai. Welcome to utilizing ai, the podcast focused on practical applications of artificial intelligence from the RUM group. Every Wednesday, we explore news and use cases of the ways in which AI is transforming enterprise IT and the industries it serves.

I'm your host, Stephen Foskett, president of the Tech Field, a business unit here at the Futurum Group. Before we dive into this discussion, let's meet who's on the panel today. Yes, good morning.

Thank you for having me. I'm Sir mha, I'm the CIO at Barracuda. And what I'm seeing across the enterprise is that the conversations moving from which AI tools should we try to, how do we run AI every day?

So that's securely, responsibly and at scale. And for us at Barracuda, the unlock is combining experimentation with the right kind of guardrails, governance. And that's so, it doesn't slow down innovation, but it makes it safe for everybody to operationalize the use of ai.

Um, and because Barracuda obviously lives in cybersecurity, we're specifically focused on how AI changes both the threat landscape and the way that we defend, uh, while also reshaping how people work day to day. Hey, I'm John Swartz. I'm with, uh, Textron Group, although technically now as of March 1st, I'm with the Futurum Group.

We merged with them. I'm the, uh, senior content writer. I write a lot about ai.

I also write for a section on it and DevOps. And I'm occasionally security. I'm based in the Bay Area area, and I'm happy to be here.

And I'm Olivia Blanchard, research director with the Futurum Group and Futurum Research. Uh, and my focus is intelligent devices. So it's, it's kind of like the edge side of the AI equation where AI plugs into all the devices that are around us, uh, and how AI spreads to the edge and, and, and populates the world around us, as opposed to just being in the data center.

So I'm happy to be here and talk about this. Great. And, uh, thank you so much for joining us through.

Now you're somebody who I have seen, um, you, you speak, you do podcasts and so on, and you are very much on the, uh, operational side of things in terms of helping your company, but also other people in the industry learn how to use AI to be productive, but also in a responsible way. And I think that that's really where we should start this conversation. Um, you know, so how are you thinking about this whole idea of transitioning from AI as more of an experiment to something that is part of everyday operations?

Yeah, so it's, it's definitely interesting taking it from being what has been an experimental state to, um, running it day to day. Um, so we, uh, you know, initially rolled out AI sort of, you know, gently and slowly, we rolled out some chatbot, um, infrastructure. We helped people get comfortable with the concepts.

We wanted to meet people where we, where they were. Um, Barracuda is a company that produces software. Um, so we have people that are in product and engineering.

Those folks are very comfortable with concepts of ai, but we also have employees who are not comfortable at all with those concepts, and it's important for us to recognize that. So we started off, um, as I said, meeting people where they were. So we, um, decided that we wanted to instill a, a program where employees were encouraged to get educational training.

So we offered that to everybody, no matter who they were. We had, um, personas of types of training for them. Uh, so operationalizing it meant first kind of getting people comfortable with those concepts and then deciding how we were gonna roll it out.

So we've got, obviously chatbots for people who are more comfortable with that, but then we've got ideas where we're building out agents, and then looking at how we're building that portfolio. So it becomes, um, a way that we are structured and moving through, uh, all of the projects that we have. And in terms of that, we, uh, we're not just building things because people are interested in it.

We wanna make sure that we are very, um, thoughtful in the approach. And if we have to hit the quit button because something's not getting to production fast enough, we're doing that. Uh, but we're also making sure that we have guardrails for people to test all of the AI technology that we think is important for them.

And then, you know, an undertone to that is also cost. So we wanna make sure that we're being careful about how much we're spending on it. Um, while that isn't something that we want people to be very focused on, I myself am.

So that's how we're thinking about it. Hey, can I ask a a just kinda a basic question. I get a lot of, uh, email studies and there's a common refrain or a common, uh, narrative that that's been emerging or has been in effect for a couple of, a couple of months.

And I think Olivia and I come across this a lot, and it's yes, this idea of AI pilots, uh, rarely scaling or trying to gain traction. I'm wondering, sir, what are the most significant challenges organizations face now? Is it the technology itself or, or something else that, that crops up?

I think it used to be a technology. It's no longer that the, the challenge I'm seeing is in the operating model around it. So data governance, the risk controls, the decision rights, preventing shadow ai.

I was gonna say a shadow it because that rolls off my tongue so much easier. We've been saying that for so many years, but shadow AI is the name of the game. We more recently, um, shadow AI from showing up faster than organizations like ours can see it and manage it.

So because AI is running on your most valuable asset, your data, um, the question becomes how do you protect that sensitive data and the flows without freezing innovation? Um, that balance is the harder part. Not spinning up the model, not finding the tool, because the tools are falling o out of the sky left and right.

That's no longer the issue. Um, it's, it's not buying the tool, it's trying to figure out the operation of it and using it within safeguard rails. Yeah.

So on that, um, this is, this is not gonna be a conversation about technology. It's, it's really a conversation about change management, right? That's right.

Yeah. And so having, having been part of, of many efforts, uh, that, that touchstone change management from digital transformation, you know, one to digital transformation two, digital transformation three, which I feel like this is part of, um, how do you develop, first of all, how do you develop best practices in, in your organization? And with a technology that moves so quickly, and again, with this sort of like waterfall of potential products and solutions that you could, you could insert into your organization, all of the, uh, testing that has to be done, all of the, the, the fireproofing, all the training.

How do you build a, a comprehensive living, breathing, uh, practice of change management that is focused on AI integration? That's a big question. Um, There are a lot of themes to that.

Building a change management focus around ai, it's, it's probably the most important function that you could have. So a change management practice that we have going on, um, kind of has started with an AI council that we, uh, we built from a very small state about a year and a half ago or more. It started off with just a small group of people myself.

Uh, it, it had legal and compliance, so just a handful of people. We were really focused on some of the, the, um, the compliance aspects of ai. First, we weren't really focused on much more than that.

Uh, that, and having an AI policy that we wanted to, uh, instill in our environment and make sure that that was a living, breathing document that we could socialize easily. And well, what's happened since then is that group of people has grown substantially. Not to the point that we can't manage it well, but it's grown in a structure where we have a couple of important subcommittees.

We've got a go-to-market subcommittee. We also have a product and engineering subcommittee, two really important areas that deserve a time of their own. And then we've got a core group that has representation from every executive pillar in the company.

And so change management is rooted there. That's where we're talking about not only the compliance policies that we need to be mindful of, but we're also talking about the policies of how we roll out AI in general. How is it that we're going to make it more, uh, frictionless for people to look at tools?

How is it that we're gonna protect our data and keep that more for ourselves to manage rather than kind of, uh, uh, you know, exacting that force on people who we're trying to create experimental vibes and fun for? Uh, so that's, that's more about how we're thinking about change management, but we're sharing it amongst everyone. The, the idea of changing AI and having that be a paradigm shift within our culture is something that is not just simply an IT experiment.

It's not up to me alone. Sure, I can be, uh, an ambassador of it, but I am not the one responsible. It's me who is sharing the concepts with other executives that work at Barracuda and helping us all make sure that from the top down and the bottom up, the message is shared and that we're all ensuring that our culture is one of people focused first, empowered by ai, and that people feel comfortable and confident about using the tools and the methodologies that are available to them.

You know, um, I think STEAM is gonna ask you about people and about upskilling, but before, before we get to that, I wanted to ask you what you've done, and, uh, you mentioned it earlier at the organizational level to ensure AI isn't just being used, but being used efficiently and safely. And ultimately there's a certain responsibility. I guess ultimately, I think you're part of that, of who's responsible for the success or failure of the initiatives at the company.

But can you mention some of the things internally at Barracuda, and then maybe if you even wanna expand on that, what other companies are doing or what you're seeing other companies are doing to, to ensure AI is being used efficiently and safely? Yeah, so the AI Council is, is the most important structure that we have to ensure that AI is being used safely and effectively. Making sure that our AI policy is socialized, is something that is another aspect of it.

So it's not something that we rolled out a couple of years ago, and we expect people to understand. It's something that we remind our employees of as regularly as we think it's important without being a big drag. So there's that.

Um, we also have policies to make sure that we, uh, explain how it is that we will use tools efficiently and the way that we'll be able to experiment with them. So, you know, we have intake systems for the way that we, we want to initiate new, uh, new tools and SaaS and all of that. But AI kind of gets, uh, ahead of the pack and the way that we investigate and look at, um, you know, proofs of concept for those types of tools, because we know that they're important and we know that there are differentiating factor for a lot of the ways that we may work on things.

Um, so processes around all of that are important, making sure that they're documented and available for people to see. Ask you. Can I ask you a quick, uh, just to interject some, what's the re how receptive are your employees to using ai?

I know you're a tech company, so I'm, I'm, I'm assuming they're much more open to the idea, but there seems to be a broad kind of fear, dread, paranoia among the most of the workforce There. We have all walks of life at Barracuda, and, and I just came back from a Gartner conference, a CIO conference, and I validated the same, uh, with many of my peers. It doesn't matter if you are a tech company, you have employees that are working in core business units that may have been at your company, depending on its age for years, and they're doing things very manually, and AI seems like a foreign concept to them.

So I wanna focus on that group of employees for a moment. They're very AI averse, and they're very concerned about their jobs. They believe that using AI is something that will, uh, potentially replace their role.

And it's up to us to make sure that we show them that if we are using AI for their benefit, that we show them that, you know, we're not working to replace their role. We're looking to up level their skills, that we wanna make them more efficient, that we want them to stop doing things manually to think about a new way of working. Uh, so those are really important concepts to ensure that we've got filtered through the environment so people understand that we're not out there, just you, you know, trying to scrape, uh, through and to, and prune out certain rules.

That's not what we're up to. Uh, and then we've got more, uh, you know, precocious smarter with AI employees who, um, are out there looking for the latest and greatest tool. And they're not afraid.

They, they're excited about it. They're the ones who are the ambassadors, uh, of use. But we also have, uh, and what I'm trying to lead into is this concept of AI champion, where we have people sprinkled through the environment that, uh, in, in these groups where you have employees that are more concerned about ai, people who have a, a stronger vision that can help them grow comfort.

And then we've got, uh, all kinds of activities like AI hackathons that are available for every single type of employee. It doesn't matter if the employee works in product and engineering, or if they work in finance or analytics or hr. They're all invited to participate.

And, uh, just so you know, the winners of some of those AI hackathons happen to be, not from product and engineering, but from some of the other business groups. And it's very exciting to see what some of the, their ideas are. Yeah, this is a really interesting approach.

Um, and well, first off, I mean, you really sound like a, like a CIO here in terms of having this be about technology, but also about people. And this is really an exciting and interesting approach because, you know, on the one hand you are, uh, talking about a progressive vision of ai, of adopting AI tools, but on the other hand, you're aware of the fact that not everyone is necessarily on board with that. And you have to, uh, you know, your job is also to help them move forward and help them adopt the technology to be more productive.

Uh, when you're doing this, when you're out there with the people, is, is the major challenge for the company about trying to help upskill existing workers? Or is it a bigger challenge to find people who have these skills and bring them into the organization? You know, it's, it's interesting to think about the assets that you have in your company today.

They're the ones that have the tribal knowledge of what's been happening. Again, depending on how old your company is, what the vintage is of it, you may have employees that have been there a very long time, they know where all the things are, the way things operate. They're oftentimes the, the ones that are working in the core business units that are doing things manually just talked about those folks.

The ones that are more concerned about ai, those are the ones that I want to learn about the concepts of AI and how it can work for them the most. I I definitely wanna create a strong core team of AI adopting engineers who can help get people over the hurdle and get them comfortable, but never looking to bring too many people in from the outside to replace all the people who have the heart and soul of Barracuda. Uh, because that's what's made us so great.

Like I said earlier, you know, we're people powered and we're enhanced and approved by ai. And I fully believe that to be true. So what we've been very focused on is making sure the people we have in our company have easy access to the tools that are familiar, that are, you know, the ones off the shelf they see talked about on commercials every day, available to them to try.

And we also have tools that are much more advanced for those people who feel very comfortable and confident with those. And then we have these AI champions to help the ones that are feeling more, um, you know, like AI is more risky for them. So we have AI champions, we have the core team of engineers who are there to help get them over this concern, and that's how we're trying to approach the workforce, who some of whom are, you know, like lower adopters, and then some of whom are much stronger.

So about that, um, that, those are really good answers. I'm, I'm kind of, um, always focused on ROI, uh, just because obviously with ai we're talking about efficiency, operational and otherwise, but there's also a cost associated with that. And then the fact that you have to sort of relearn or like learn how to do things differently, even if at the end you're gonna be more efficient with your work and you're going to be able to do more things with agents, um, initially there's, there's a little bit of friction, there's a little bit of cost there.

So I'm wondering, the broad question is how do you measure, uh, success? But the, the more specific question is how do you measure success now versus how do you think you'll be measuring success six months to 12 months from now with regards to your, your AI practice? I love that question.

So today, we, we run ai, we product like a program. It's really important to me that we do that. That it's not just sort of splattered around all over the place that, you know, this group has some AI requests that they have that we're kind of helping around with.

And then another group the same, I have a full organized portfolio of AI initiatives that's organized by executive pillar. And, and I have in there metrics of success. So I can see exactly what it is that we're working on and how it is that it's gonna benefit either that group, our company, um, will it be time savings, will it, you know, like what exactly will the benefit be?

And then, as I said earlier, if we need to pull the plug on that because we've invested a little bit too much time, or it's not taking us over the horizon, we can't get it to full production, it's not really proving out its point the way we thought it was gonna, there's no harm in saying, now's the time to stop doing that, because we prefer to do something else. We can't do all of it. Our portfolio is very large.

We've had many success stories, we're doing many cool things, but we also have a lot of backlog, and I wanna make sure that we're choosing the right items to focus on that are going to have the biggest impact. So what's going to make the biggest difference now? And then Olivier, to your question about how we're measuring today versus how we'll measure tomorrow, I'd only like to say that we'll take the framework that we're building today and further improve that.

So we'll iterate on it. So we are gathering better dimensions of information so that we can make better decisions and cut bait earlier. Maybe we can, you know, like figure out earlier on in the process of something that we're working on that may not be the right idea, and we'll be able to change tack much quicker.

And, and that's my savings right there, because you're right, it's an expensive endeavor. So we, we do wanna ensure that we're focused on the right things. And and when you say expense, it's not just the tool itself, it's not just the cycles, it's, uh, it's people that are involved.

It's the humans that have to avail themselves to tell you what their processes are. If you're not process mining on their machine, uh, it could be because the processes happens outside of their machine. You can't actually process mine on it.

You can't do desktop procedural mapping because everything happens, like they're walking down the hallway, you know, like sometimes you can't do that, you know, so it's, it's a very interesting journey to see how it all kind of plays out. But to your question, I would like to say that we get even better at figuring out how to map all of this and to capture the success. So I'm, I'm gonna ask you about, uh, governance frameworks and, and how do they stay flexible enough to handle different international regulations or executive mandates.

I know the State Department came out with a memo that was leaked around resistance to GDPR and other things in Europe, but I'm wondering if you can maybe, uh, answer that, uh, this, this, this handling of governance frameworks and, and navigating them. Yeah, so that's excellent question because AI is something that needs governance, and it's not just something that we can figure out for ourselves. We should all have the DNA to want to protect what, you know, our data and, and also want to figure out how it is that we ensure that AI is, is not going to do things that wind up being harmful.

But, but we do need to rely on, you know, structures that are larger than ours. And oftentimes that winds up being govern, uh, you know, the, the governments that are going to be, uh, initiating some of these frameworks that are going to help us keep AI safe. But how do we, you know, to your question, the way that I see it is that I'm a big fan of kind of principle based governance, uh, with these region specific controls.

So meaning that every area of the world is going to have some sort of different flavor of AI governance. Um, so it's, you know, principle-based governance kind of, you know, like the way that you would think about the, it principally across everything. And then, you know, regionally how you'd wanna think about your controls.

So the core doesn't change. Uh, you, you've got your, your risk-based controls and your, your core principles that are protecting the way that you operate, especially if you're a cybersecurity company. And that, that is, you know, no holds barr, that's exactly how you're gonna, you're gonna operate and then you adapt your implementation details, uh, by jurisdiction and by mandate.

Um, and that's why we anchor on these internationally recognized approaches. So, um, you know, like NIST AI and, and things like that so that we, you know, we can apply this differently. And, and because governments are rolling out AI mandates very frequently, we do need to be very flexible in the way that we can approach all of these and, and make sure that we aren't doing, uh, you know, that we can maintain this flexibility as we see things, uh, change across the world.

Yeah. So, um, follow up to that, what are your currently, what are your two or three biggest friction points? Is it the adoption?

Is it the resistance? Is it the selection of the tools? Is it the governance?

Is it just a, you know, internally socializing this, uh, is it a cultural friction? What's, what's stopping you from going faster or scaling faster? I guess The friction points for me, I would say the speed with which technology is coming at us, it, it, and I don't see that as a friction point as more, uh, may I, I mean, yes, you could see it as friction, but I see that more of, uh, an opportunity for us to adapt the way that we try to view the full spectrum of what is before us.

And, um, I always go back to the, to the CIO summit a couple of years ago, the Microsoft CIO summit, and somebody flashed up on the screen a slide that had a logo for every AI company in Silicon Valley. And it looks like dots, like literal tiny little dots on this PowerPoint slide because, and I can't imagine what that slide slide looks like two years later, probably, you know, constellation, I don't know, like, you can't even see, see, it's probably just all dark because there are so many companies. My point being that people have a lot of ideas, people at Barracuda, people everywhere, uh, because they're, they're seeing a lot of opportunity and I wanna be able to be the, uh, you know, the facilitator of their hopes and dreams to use AI for whatever they want, but I also need to keep it safe and secure, and I need to keep cost consciousness in mind.

So there's a balance that we have to strike. So I would say it's the speed with which these companies are coming into existence, the offerings they have, making sure that I understand, uh, you know, like what it is that I may wanna make trade-offs about because I, I don't have a portfolio that I can't maintain. And then ensuring that I'm choosing, you know, that I'm keeping cost consciousness in check, all of those are areas of opportunity and potentially friction.

Hey, you know, um, one, one last question I had was, uh, about where we are in this journey specifically. We heard so much about this would be the year of AI agents, although I suspect next year really is, or 2025 is supposed to be now, I suspect 2026 is, and it, I keep coming across the reports, and I, you don't have to comment on this, but there was a Goldman Sachs analysis that despite the massive investment in boardroom hype, AI didn't add much to the overall US GDP last year. So I'm wondering, is we, are we in a kind of a early stage and about to take off in, in terms of use and in terms of terms implementation of things like agents?

I think so. I think we're really in our infancy. We don't know what the future, well, we, we have a sense of what the future holds.

Mm-hmm. But to your point, John, there is, you know, there is a lot of media hype about what AI is doing for our workforce and our companies. So if you, if you take what you said and kind of transverse it into the media hype about, you know, like companies that have, uh, touted layoffs related to ai, and you look at some studies that have recently been released, there are many studies that are rooted in real detail, in fact, that are showing that there is less than 1% of layoffs from 2025 that are attributable to ai.

And companies that have said that they are laying off due to AI are slowly hiring people back, um, sometimes at higher salaries. So that's something for us all to keep in mind, uh, where they thought they could kind of lower their, uh, you know, their employee count based on what they think AI can do today. And if you take all of that into consideration, and you answer your question, John, I believe we still have so much to learn about the way AI will operate in our environment.

We, uh, there are agents upon agents that can do things for us. There are ways that we can create agents and have them be part of our organizational structures, actually, you know, that can do things, that can actually provide, uh, you know, contextual answers to questions that we have today. We're not there, and I'm not comfortable with do, you know, allowing that to happen.

But that would be the next level up for us, is to have that be part of our, uh, our environment. So we're right at the beginning of all of it, and I think we're about to come into, uh, a new stage of bloom with related, uh, related to ai. You know, that's a really, uh, great way, I think to end this conversation.

Um, you know, it's been, it's been really interesting. And as I said earlier, uh, I think that the thing that sticks out to me is the nuance of all of this. It's not, you know, let's, you know, run forward full speed.

It's not let's run away and hide. It's, let's figure out what makes sense. Let's figure out how we can work with people, how we can work with tools, how we can work with technology and make this thing useful to us.

And I, I, I think that many of our listeners were probably nodding along as you were saying, many of those things because we're all seeing it right now. We all are under, uh, uh, AI mandates and conflicting AI warnings from everyone around us, and we're all trying to navigate through it. Uh, John, yes, I absolutely think that, uh, this may not be the year of AI agents.

Maybe that'll be next year, maybe it'll be the year after or maybe we just won't notice and it'll just be how things are done. I think that's the right answer. So thank you.

Yes. Thank you so much for joining us, um, joining us today. Uh, it's been, it's been great having you.

Uh, Siri, um, before we go, uh, I know that some folks are gonna wanna continue this conversation and, uh, contact you. Where can people find you and what do you have going on right now? Yeah, thank you for that.

So, um, a couple things before I let you know where you can find me, um, I'd just like to close out by saying to all of my CIO compatriots out there, I invite you to consider a, a, a governance structure that could be of any size. Make sure that you consider one, uh, so that you could have review mechanisms, because that is really going to create some safeguard rails for you and allow you to feel like you can kind of take off. So, uh, that would be my, my final word.

And then in terms of where you can find me, uh, on LinkedIn, that's a very great place to find me. Please do engage with me there. And if you happen to be in Las Vegas, I'll be speaking, uh, on April 8th at the ISA group meeting.

Outstanding. I might, I might try to, to attend that if I can. If I can sneak in, great.

Um, I will be difficult to find in the real world, uh, in the next few weeks. The events that I'm going to are client events, so they're not really super public, uh, so they're a little bit top secret. So I can't tell you what, um, however, you always find me on that on X and on LinkedIn.

And I would also suggest that you pay attention to some of the, um, studies and reports that I'll be putting out in the next couple of months. There's a, there's a big one on robotics tam, so, uh, total addressable markets. We're doing a, a 10 year study on that that we're gonna be releasing soon.

Uh, there's more stuff about PCs and we have a forecast coming in the next couple of months for all AI devices, including AI PCs, which is gonna be interesting because there's a concern that, um, rising prices of certain components might act as a break against, um, PC sales and A IPC adoption. Uh, and so I won't tell you what, what I think, what my assumptions are, but we'll have some results and some data to show you or share with you, uh, very, very soon. So stay tuned for that.

Hey, so Olivier, by the way, I, I'm really interested in the robotics and the AI device report, so please reach out to me on Slack. Um, so I'm alright. Mainly available on, on, thank you.

I'm mainly available on LinkedIn and John Swartz, one word. And, um, I'm on the text strong websites. They're very, there are a lot of 'em in terms of content.

Um, briefly the next couple of weeks I'm gonna be here in the Bay Area, going from show to show. Uh, there's a GTC Nvidia Show in Santa Clara, Java one is the week after in, in, uh, across, literally we live next to the Oracle campus in Belmont Redwood Shores. And then I'm gonna go to RSA in San Francisco.

And then we spend a lot of time in Las Vegas in April and May. Yep. We've got a bunch of people going to RSAC, I know about that.

I also wanna put a little plug in here for AI Field Day, which is the organiz, uh, the, the event that I organize, uh, that is gonna be May 13th, uh, through 15th. Um, and we are gonna have a really packed agenda, uh, very excited to be, uh, discussing AI with a bunch of companies. com to learn a little bit more about that.

And of course, you'll find, uh, the AI Field Day sessions on the Tech Field Day YouTube channel, as well as right here on Textron AI and the techron TV app. So thank you everyone for listening to this episode of the Utilizing AI podcast. Uh, if you enjoyed it, please do subscribe on YouTube or in your favorite podcast application and consider maybe giving us a rating or a review.

This podcast was brought to you by the analysts and experts from the RUM Group, where insights meet ai. For show notes and more episodes, head over to text ai, the utilizing AI YouTube channel or the text TV app. Thanks for listening and we'll catch you next Wednesday.