Agent Security Gaps, DXC’s AI IT Platform and NVIDIA’s Backyard Data Centers

Hey everybody, happy Friday and welcome to the latest edition of the Techstrong Gang. As usual, we're going to talk about, well, a few things, but a lot of them probably have something to do with AI, but that's just the nature of the gig these days. Want to introduce our guests, Tracy Ragan joins us once again.

I believe she's home in New Mexico. Tracy, how you doing? Hello.

Good to be here. Excellent. Good to see you as always.

Guy Currier is with us. Guy, I think you're in Texas, is that fair? I am, and it is.

Awesome. Jack Palmer is with us too. I think Jack's hiding out in, is it North Carolina?

North Carolina, that's right. The north of the south. And then finally we have Wiki.

Wiki Wang, I'm not sure where you are, Wiki. Where are you these days? Oh, I'm in Silicon Valley.

All right, in the valley. All right. We got representations from everywhere, and of course I am in New York, and I have been all week, so it's an amazing thing.

And you know what? I'm going to be here all next week too, so that's two weeks in a row and that doesn't happen very often. All right.

I want to jump into a couple of topics though, and Jack has a great article that I would recommend to anybody, but it's on Security Boulevard, and it's talking about, well, AI agents and the things that we don't know about them, because those are the things that are part of the attack surface. And it has to do with how they reason and how they come up with various, at least their understanding of the world. And it turns out that if I read this correctly, that that whole thought process is vulnerable and represents a new attack surface.

But I'm going to let Jack explain. Jack, jump in. Oh, well, this is a little complicated, so I'm going to try to make it as simple as possible.

Let's start with Meta, which has been doing a lot of work in this area. Came out with sort of a rule of thumb that they called the agent's rule of two when you think about an AI agent. And they basically said that you can have...

An agent can sort of do three things. It can process untrustworthy inputs, can have access to sensitive systems for data, or it can change state or communicate externally. And Meta's claim was that if you only did any two of those three things, you were in a much safer state, not necessarily safe or secure, but much better off.

If you did three of those things, you were in a very bad area and could have a lot of prompt injection or other issues. And I think the problem that we've learned that that's broken, that assumption of only two of the three is broken in a couple of ways. One is because just about any agent processes all of its data that it gets access to as trustworthy, even if it's not trustworthy.

So it trusts everything. So that condition is almost always satisfied, and agents almost always have access to sensitive data, and they almost assuredly have to communicate externally and change state in order to do something of value. So basically what we're learning is that agents are a lot more insecure than we thought.

And then the other problem we have is we don't really understand and know all of the agents in our environment. So we now are introducing a huge attack surface in our environment. We don't control them, we don't know where they are, and we don't really understand identities within agents.

And that's the other thing we're looking at is agents have to have an identity, but agents don't act on their own. They typically act for the benefit of or on behalf of another person. And in fact, an agent can work on behalf of somebody for the benefit of another person simultaneously.

So an easy example for people to understand, to think about that is, let's say here's an agent that's going to book airline flights. So I'm going to build an agent that can book airline flights. Mike is going to say, we were talking about this earlier, Mike's going to a conference next week in Minneapolis, and so is Tracy, and so is Guy.

So Mike's going to fire off the agent to go book tickets, but the tickets are going to be booked for the benefit of Tracy and Guy. He's making reservations for both of those. So you now have three identities involved in the conversation, and you have to have a lot of understanding and governance and security policy to figure out what the agents are allowed to do.

The agent needs an identity to say, is it allowed to connect to and book airline tickets? Then is Mike allowed to do it for their behalf? And then what are the policies we apply to Guy and Tracy?

Guy may be allowed to fly first class, but Tracy may not. So if the agent then books a first class ticket, how did it decide to book a first class ticket for Tracy and violate policy? Did it hallucinate that?

Did Tracy decide to-- Was there prompt injection? There's all sorts of things that can go wrong in this environment. So what we're now discovering is basically- Except for me flying first class.

Well, yeah. Sorry, Tracy. Guy sort of gave me a little money here, so he gets to fly first class.

I built the agent, so no matter what happens, Guy's always going to fly first class, which is the other part of the problem here. Well, it's okay, I poisoned the memory. So as you can see, there's a lot of different ways we can game this system, and the upshot is we have a whole lot of agents being deployed in our enterprise environments right now, and we really don't know what's going on.

We really don't understand this. So there's a huge attack surface. Part of my article talks about some research from Noma Security that basically said that there's 75% of the agents out there have risky behavior, and so this is sort of the description of what's going on is basically a whole lot's happening.

We don't understand, we don't know what to do with it, and how we secure these things is very much up in the air today. All right. So we're channeling double agents and we're channeling Tom Cruise in Risky Business here.

I get that. But Wiki, are the compliance people and the auditors kind of like rubbing their hands with glee here saying, "We got work for the rest of our lives because all these AI agents are being deployed. We don't know how they work, and I'm sure they're violating one or two mandates along the way"?

Well, I shouldn't say it's a violation, but this is an evolving area. A lot of people try to explore more. I also serve ISACA as the emergent tech advisor.

From ISACA 2026 AI pulse poll, 32% of organizations have no AI disclosure requirements whatsoever, which is a good number here to share. And also, if you see the Armorcode, they have one research, 90% claim the AI visibility and only 59% simultaneously admit shadow AI operation outside the governance process. So the number tells things, right?

From reality perspective, SafelyAI, we also did some research earlier this year. A lot of new company like startup, they work on this area. They work mainly on the observability, identity, runtime, and governance, which tell the truth as well, right?

Because for those areas, there's still a lot of gap need to fill in. That's why the startup involving in this area. Also, if you see the RSA first place for the sandbox, they are in this area as well, so.

All right. Guy, do you think that we're just waiting for a couple of catastrophic events before we get serious about looking into this stuff? Or do we think that we're just going to continue to ignore this stuff and when bad things happen, they just happen?

Yes to both questions. Okay. Look, we have been dealing...

Jack knows this better than, and Wiki as well. We all know this. What is it?

Twenty, 30 years now that folks like us have been saying, "Do your annualized loss expectancy. " It's not just a bad insurance. We thought the insurance companies would do this.

The fact that it's a low probability occurrence means that it is going to affect you eventually. The opacity of the systems, I think, is Jack's point, but frankly, that didn't start with AI. The difference is now it's essentially impossible.

It's not really impossible, because I seem to remember the days of explainability three years ago in AI, and then I haven't heard that word used very much. So essentially, yeah, we have been dealing with horrible news about millions of dollars or millions of names or whatever breaches for decades, and the market shrugs to a certain degree, unless it's federal or governmental sovereign, those sorts of things where there is a lot of scrutiny and a lot of concern about compliance and so forth. So yeah, Mike, some other disaster is going to come, and then a raft of folks are going to yell about it, and some people are going to do something about it.

I don't know. Are you talking about becoming apocalyptic Armageddon, what have you, where it's something- I'm- ... just so truly horrible that it finally penetrates the common person's brain?

Yeah. Maybe. I'm kind of talking about maybe some just good old-fashioned fire codes.

When we used to think about this back in the day, there'd be like... And it wasn't too long ago, maybe 50 to 100 years ago. Every now and again, there'd be a fire and half the town would burn down, and this was a bigger problem probably in the medieval ages.

But eventually, we got fire codes and now there are still fires, but they don't take down the entire town and they don't destroy everything in their wake, and we manage to actually, I don't know, have a cup of coffee in the morning without burning down the entire house. So can we get to the same thing with AI agents? Can we essentially build what looks like a decent set of fire codes for AI agents so that when something does go wrong, it doesn't take down the entire IT environment and the business with it?

Is that not unreasonable? It's not unreasonable. This is a great question.

It's not whether we can, it's if we will do so in time. But I love the analogy because the way we ended up with fire codes was we had municipal fire departments, and the municipalities and governments realized that they needed to put some of the burden of fires on the individuals like doing, and businesses especially, doing things that were risky. And the whole reason that municipalities were running fire departments was because the original system, which was private fire departments that only put out your fire if you paid them, was unsustainable.

And so we are currently in, I think, the situation largely of private security. It's a business, and it should never stop being a business, I'm not saying otherwise. That will help you detect and mitigate if you pay them.

Mm-hmm. And you're describing the two stages from now. Yeah, Guy, I agree with you.

And you can see historically, right, for those emerging, evolving area, actually if you see a broader picture, the regulatory part always behind because they need to understand the situation first and the impact first, right? I've see like NAS, currently they just work on some AI-related guidance-And I think like early May, they have one version just out, and pretty much the high-level information people can leverage, and a lot of non-profit organizations also work on those framework and guidance. All those compliance need to follow the regulation and guidance, and then they will have clear picture.

Definitely. Yeah. We're just not-- I don't think we're prepared.

If we think about how we do cybersecurity right now, it's really around deterministic systems, where you can inspect code that executed, you can look at network traffic and identities. But it's not the same with agents and agentic processing. It really isn't.

So it's like we're saying... We used to say what code ran and what was in it. And now we're asking why did the agent give Tracy a first-class seat?

Right? And that's- Well, I'm asking that anyway, because you know I am in the back. That's really incredibly difficult to audit and to govern at scale.

Which is- And everybody knows I have complained about agents for such a long time because of the agent sprawl. Right? And we have thousands of semi-autonomous agents now that's operating across environments with, as Jack pointed out, unclear ownership, persistent memory.

And the industry right now is just overly focused on copilots and under-focused on governance and policy enforcement and runtime visibility and operational control. So we still think old time cybersecurity, and we haven't achieved that yet. Come on.

We're still trying to get teams to generate an SBOM so we can see what open source packages are in there, much less trying to take two LLMs and try to compare them and see what changed. Here's my concern. So we're just not ready.

Here's the concern I have in my head, though. It's like, so these AI agents, they take actions, and their actions may not be confined to even your organization, right? So you're assuming a level of risk now for everybody who probably is connected to you in some fashion or another, and next thing you know, that AI agent reaches out beyond the four walls of your little enterprise and does something interesting like, I don't know, deletes a database here or there or whatever it winds up doing.

I'm reminded like when the fire marshal comes around to the local businesses, and if you're in violation, they shut you down. So will there be like an AI marshal that comes around and checks out how everybody's using their AI agents, and if it's deemed to be too risky, we're going to have to, I don't know, shut down the business for a while till they prove otherwise? Jack, is that unreasonable?

Probably, but is that where we're going? " Right? And so from the government regulation point of view, it's really much more of...

And this goes back to your question of when are we going to get serious about it, and I think we're going to only get serious about it when individual company directors are held personally liable for the failures of their agents. Right? But here's what's unstable about that, Jack, and this is why the fire analogy is so good.

The problem with fires was that they spread. Yes. And agentic AI damage spreads.

That's a good point. That's a very good point. And it's a very- Yeah, and I- ...

scary point, too. And I think we, as consumers, are going to eventually push them to do more about governance. Yeah.

Right? So the AI companies, the companies that really succeed with AI won't just be the ones with the best models, but the ones that can figure out how to securely govern this autonomous behavior. They're going to have to take that on.

Otherwise, we already have a trust issue with AI, and it's going to continue and be worse. And we probably will have a few fires along the way, and it'll make it even more unlikely for people to want to really dive into it. Or literally, consumers won't trust products that are using AI.

Hmm. Yeah, I feel like this area, even though it's evolving, eventually will come to some kind of model layer, like what SAS do, right? Like, the responsible layer.

Some piece should be responsible by the model layer, some piece should responsible by the agent layer, and some piece should manage, like, company internally. And then some portion need to be managed personally. This model currently, I think is still evolving.

I hope some organization will take care of that, and eventually we'll have something similar like a SOC 2, and then have clear responsibility who's managing what. Right. My hope is that the runtimes will get stronger in these environments so that we can contain those AI agents or at least limit the spread of the fire, and maybe we'll even use something like, I don't know, micro-segmentation.

Who knows? But Tracy, let me ask you this. In the absence of any kind of best practices or awareness, are we essentially turning a bunch of developers loose in the same way we might see a bunch of 10-year-olds playing with matches, and we don't know what's going to happen?

Well, we've done that. That's how we operate. We're developers.

We like to play with matches before we're ready. That's how we operate. That is our culture.

Mm-hmm. And we've done that from the very beginning. This is not new.

This is not some change in the way developers adopt new technology. We've always focused on the copilots instead of the governance first. That's just how we operate.

But over time, you would think that we would get better, andAnd industry does step up to try to solve the problem, but developers themselves, they're going to push the envelope as far as they can go, and it will not be their problem to solve. It will not. They will not think about solving it.

It will have to come from the models themselves, I believe. All right. Jack, last word on this since you wrote the article.

What's your best advice to folks? Be prepared for the conflagration, the fires that Guy is talking about, man. This is dangerous.

Go in with both eyes open and run around carrying... Don't carry scissors, carry fire extinguishers because- ... you were asking about the big events.

We've already seen AI agent deleted my email. We see AI deleted my database. We just saw yesterday, I can't find the article, but yesterday or the day before, an AI agent deleted all my source code for an entire company.

So these things are happening. It hasn't reached the level of public consciousness the way the Capital One breach did or typical ransomware events do, but it's happening already. So run around with a fire extinguisher.

You're going to need it. All right. Back in the day, people used to keep pails of water and sand in their houses just in case there was a fire.

So maybe we got to have the equivalent of that for the AI agentic era. We'll see. I'm going to shift a little bit of a gear here, though, because we're going to talk a little bit more about AI, but its impact on this whole category of IT services is not one that we've spent a lot of time thinking about or talking about on this show.

Some of the service providers are now getting ready to try to reinvent themselves to provide orchestration layers for AI agents, and that's going to be how they provide a service. But there's a question. If the service itself or the technology support is being performed by AI and it's automated, do I need the service provider in the first place, or am I just going to automate that with my own AI agent, and maybe I'll have some orchestration capability?

And the whole definition of how IT services that are delivered may be changing. Guy, what do you think? I don't think so.

I think that we say constantly here and in other forums that the AI is only as good as the expert guiding it, some form of that. Human in the loop is the phrase of the moment. But when Amazon did their big test this past year of building a new service using just some programmers and a bunch of AI, and they did it in five weeks instead of five months, whatever it was, you had to notice that the developers guiding it and guiding the AI were senior developers.

In other words, they knew well enough, and the success of that depended well enough on deep expertise and experience and dirty fingers knowledge of how the code should look and how the service should perform. And the same thing applies in the managed services area or in service provider area. So I don't think that anytime soon, an organization using an MSP like DXC to manage infrastructure, devices, services, and so forth, can be sold a bunch of agents or a bunch of agent services and manage and run them themselves, because the whole point is for them not to have that expertise.

So it's foundational to their business model. Now, is DXC's delivery model going to change? To be honest, I actually don't think it changes all that much.

But this does touch on the whole licensing and payment and revenue and profit model for these companies because they tend to use a mix of per seat and per device pricing, the equivalent of subscriptions in the SaaS world. And in SaaS, the incorporation and use of AI has suddenly become a huge cost issue where they're dealing with fixed revenue, so to speak, per person or per device or per seat or per whatever, and yet highly variable costs, especially because of agentic. I think those are a little bit more controlled in the MSP world, but nonetheless, I think the kind of transformation and change that is coming to software and SaaS is likely to come there, too, meaning customers are going to demand this kind of automation, actually, so that they get faster response, more automated response, better outcomes, but they're not going to want to pay more, or particularly, they're not going to want to pay per token for it.

They might even pay less. Let me give you an example of somebody who's talking about this exact same thing. It's HPE, and they're out talking about what they're describing as self-driving networks.

And when you get into it, they are using AI agents to automatically tune the wireless network in real time. So when people move around the building, the amount of bandwidth shifts, and when they encounter issues around the performance with a particular application, it will automatically tune the network. That used to be something you would hire a managed service provider to come in and do and kind of monitor for you, but that's all going to be built into the network.

And they're flat out saying the goal is not human in the middle here. The goal is to take the humans out of the middle because they're getting in the way. So if that's kind of the model for how those services get delivered in the future, I think others will follow suit as well, and maybe a lot of that level one technology services that we've been counting on all these years for humans becomes something that is just fundamentally embedded into a product where AI agents are reasoning as they look at their environment and make adjustments accordingly.

But I don't know, Jack, does that sound reasonable? I think you're missing the part about who pays for it. That's the key here is MSPs are...

You're trading off two or three things. You're trading off, do you want to hire and manage a team to do a specific function, or do you want to pay somebody else to do it? So it's a people and dollar equation, right?

Now, if AI is in the middle, AI's going to help both you, if you decide to own that particular service, or if you outsource it to a service provider, it's going to help either you or the service provider. Now, the HP case, does that come bundled in with the HP software, or does that tuning over time, is that another service which you're paying HP for? So now your choice is do you own the service outright?

Do you own the people to do it for you, or do you pay HP for the computer technology to do it, or do you pay a managed service provider? And in fact, in HP's case, you may very well be paying HP's MSP team to run the AI tools to do this, right? So it's a dollar equation fundamentally more than anything else.

Now, from the MSP side of the world, they're fundamentally body shops of another form. So they're very human resource intensive. So anything they can do to drive efficiencies into their business means they can serve more customers with the same amount of people, which makes their economics more better and means they can drive cheaper prices for customers to continue using the service.

And just to add to that, MSPs have been on an automation and human productivity mission since the beginning. Since day zero- So this is- ... because they have to.

Yeah. So this is a continuation of the same. I feel a lot better about MSPs incorporating agentic than I do about software.

Not because I don't think software and SaaS needs it or doesn't know how to do it, it's the whole cost and revenue model problem. Right. MSPs have been working on this for forever.

I think Jack touched on it, but here's the math. If you're a vendor and you look at this whole space, you're like, "All right. Let me get this straight.

'" And so I think it is a math equation, but I think they're looking at it differently than the way Jack's looking at it. I think the vendors are sitting here going, "We can expand our revenue base and the amount of revenue we generate per unit sold much more aggressively if we lean in an agentic AI," but we'll see. This really feels like we had this conversation before, during the early days of Kubernetes, right?

Where there was this like... It feels exactly like having- Still having it ... I'm having a deja vu because there was all this initial excitement around containers, but the real battle became orchestration and control plane, right?

Mm-hmm. Yep. It feels exactly the same to me.

But there is something that that article did highlight that you guys haven't spoken about, and that it said that a primary pain point for organizations were that they were overwhelmed by these fragmented tooling and this siloed telemetry, and that these orchestration platforms as sort of emerging as a solution to that. And that's similar to what we saw with Kubernetes as well. I feel like we're having the exact same conversation.

I also want to add two cents here. I feel like this area is very interesting. Internally, if you're in a company, everything will fall into the ROI, right?

How do you want to choose it? Who can save me more? Something like that.

What's the best way I can manage it, manage the result, and see how we govern it, right? But externally, I felt this market is getting more competitive. So many people try to get into here, try to get a bite of the cake.

You can see Astropic, they start with a service area recently, like last week or something. And also SAP, they start to companion with some AI company, try to work on those as well. It's kind of interesting to see who will be the winner at the end.

Mm-hmm. And I think Guy touched on this too, but the pricing model in a lot of these places, at least historically, was per seat, per user, per device, or something that was more tangible. " But I don't know how to negotiate that contract if I'm the end customer.

What am I going to base that on? I'm going to pay you extra because the, I don't know, availability of the software is 99%? Or am I going to look at that and say, "That's what I paid for in the first place.

I thought you were going to promise me that this software would be up and available, and I'm not going to pay you extra for the privilege of the fact that you're going to actually deliver something that works. " So- This is happening across the whole industry. We had tokens.

Yeah. We had talked about tokens. I've heard people complaining about the price of having to pay for scanning for vulnerabilities based on a container because there's so many containers now.

So I think this is a common... I think the industry's having a common pricing kind of collapse here. How do we start pricing this?

I've written and commented a lot lately on software and SaaS in particular, describing theThe revenue and situation they're in, and profit situation they're in, in very extreme terms. I think it's an extreme problem there. They are implementing AI and agents as fast as they can.

They have to, and the costs of using them on a per-token basis, as well as just how well agentic AI can expand by spawning other agents, all that other stuff. So it's a real problem, a severe one in software and SaaS. It seems to me that, it's shaped my view really, that it can similarly be a problem in the MSP world.

It's just that a lot of the MSP model has been outcomes-based already. That's new in software. It's not new at all in MSP.

So I think it may have a way to solve the issue, but it's still an issue. Mm-hmm. Software vendors have been trying to put their hands in people's pockets for years, though, with no success.

" Exactly. Yeah, exactly. I mean- It's not going to work ...

the fact that you wrote a bunch of software doesn't mean you drove my business in any meaningful way. So I fail to see how that conversation's going to change. Most executives are going to go, "Get out of here.

" You would say that, Mike, except for we went through a revolution over the past 15, 20 years, where software vendors have gone from seat-based or one-time pricing license where to- Perpetual licenses, yeah ... perpetual licenses to monthly costs and subscription-based. And everybody went to subscription-based on the vendor side because they love the concept of recurring revenue, which gives them a very predictable understanding of what's going on versus a lumpy, "Did I sell a license this month or next month or next year?

" And all of those types of issues. So the vendors already forced the consumers to change the buying behavior, and in fact, in your example from HPE, that's part of the motivation there, is a hardware sale is a one-time sale and lasts for eight years, 10 years. What's a refresh cycle on a piece of networking equipment, right?

Mm-hmm. But if you can then go and tack on top of that a recurring revenue charge for the AI agents to manage this thing, wow, that's very interesting from the vendor side finance team. I see- That makes their eyes up, it makes them happy.

It's very hard to predict. Well, and also then what does the MSP do? Do they say, "Oh, we lost.

" No. " No, they don't. And by the way, on the customer side, Mike, come on.

They don't want to stop working with the MSP. The whole reason they hired... They'll come to the MSP and ask for a better deal.

But what you just described about some... Certainly. Yeah.

Absolutely. " And all of IT will roll their eyes extremely. And six to 18 months later, the new CTO that came in and said, "We're going to do this for you" is gone, and they're back to going back to the MSP.

I- I mean, it's churn, but it doesn't, I don't think it changes that relationship. I'm going to fundamentally disagree on this point. I think that when I get a subscription revenue, I'm sort of okay with that because it's predictable at least, and maybe that I have some interest in that.

But I also notice that, like Netflix, my subscription rates seem to keep going up and up and up, and eventually I get pretty annoyed. But more importantly, very, very few CEOs and CFOs are going to sit down with any software vendor and say, "Sure. Let me give you a percentage of my net profit because you're a software company, because you-" Oh, yeah, I agree.

That's a dead letter. Yeah. That's dead.

That's right. It's a dead letter. So, and then if that's the dead letter, then I don't know how all these other service providers are going to evolve as we go forward around pricing, because I don't think we've solved the problem.

And it's much like our first block. It's another example of something we haven't solved yet. So we'll see.

But I'm going to shift the gear because we are running out of time, and there's this interesting new development, or at least it's interesting to me. But NVIDIA's teamed up with a startup, and they're talking about, well, putting data centers in your backyard. You remember those folks, NIMBY folks?

Not in my backyard. But here they are. They want to actually try to set up a data center in your backyard because, well, we're running so much of this code, I guess, as AI, and it's latency sensitive, and it needs to be as close as possible to the source of the people who are consuming it, and I don't know.

Tracy, are you ready to set up some data centers in your backyard, and will all the neighbors do that, and do I need to call the HOA to have this conversation? Yeah. It was funny, I was sitting with my coffee this morning.

I was turned on the news, and one of the first pieces that they had was this county in Utah that's pushing back really hard against these enormous hyperscale AI centers. This one was about roughly 40,000 acres dedicated to AI infrastructure in a very beautiful place, very rural, which would've only brought in about 2,000 jobs, of which nobody in that area probably wanted. And I thought AI is just getting such a bad rap.

They've got to figure out a way to fix it. And then I looked at my emails and here's this story. So yeah, the idea of having...

Now, Span says that what they'll do is you put a server next to your air conditioning unit. They'll pay for your electricity, and give you really good internet access. So it's shifting, if that could be true, it does shift the story.

Because now, instead of having this massive data center taking over this beautiful horizon that you are used to seeing and bringing in a bunch of jobs that you have no interest in having in your communityInstead, you're going to have a server in your yard that you're basically getting really cheap electricity and internet access for. So I think this distributed model is a really interesting conversation to be having right now. Is it possible?

I don't know. Who would manage those servers, and do you want somebody coming in on your yard? Do they have access to it all the time?

Do they have to purchase the square of property that they're going to put it on? All the legal aspects I can't really understand right now. And can they increase the charge of your electricity, and say we're going from 150 to 200 now?

There's a lot to be answered. Mm-hmm. But at the same time, the case in Utah is very valid.

Those folks, it's a rural area. They're out there because they love their vistas. I live in New Mexico.

I totally understand that. But, if I had a really big solar array, I'd be selling electricity back to PNM, and that's not a bad idea either. And this kind of follows that same logic, and it brings the revenue to the individuals living in that community because they're going to potentially get a better deal on their electricity and internet access.

So it's a good way to get the community involved in that, in answering the question of how do we have a hyperscale AI environment in the United States without taking over all of our beautiful vistas and bringing in jobs that we don't necessarily care about in these rural areas. And that's where these centers are going. They're putting a big one in Albuquerque.

But now Albuquerque has enough people there that they would want those kinds of... Those extra 2,000 jobs is pretty exciting. But in a small rural area like the case in Utah, not so much.

Oh. A couple of things came to mind for me. One is I like my yard, so I'm like, "What the hell?

" And then I also thought about it and I'm like, it gets hot here in New York in the summer, and it snows in the winter, and there's usually a fair amount of rain. So this server that is allegedly going in my yard is probably going in my basement somewhere, and so what I'm really talking about maybe is building a server room in every house in America. Is that what we're really going to go to?

I don't know. Jack, what do you think? Well, I read the article, and they talked about, and I'm going to twist just a little bit because one of the things they talked about was making this a fanless server, because fan noise is a problem.

Right? And that's actually one of the big objections to the big data centers. And my parents live outside of Manassas, Virginia, and I've visited them very often, and there's just been a huge explosion in the past five years in data centers, and there's 25 or 30 within five miles of them.

And you drive by, and the hum from the transformers and the noise from the fans is amazing. It's really, really annoying over time. It's not white noise.

It's very weird noise, and it's very annoying. And the people who live in the communities next to them do get bothered by it and complain about it. Now, if you were there before the data center moved in, that's one thing.

If the data center's first and you move there, that's another thing. Right? But then if it's a fanless server or a six-foot rack or an outdoor box that looks like an air conditioner, a six-foot-tall air conditioner, I'm all for that.

I would love to have a $150 electric bill versus what I pay to air condition my house in North Carolina summers, which are hotter and more humid than you are. Guy would be in the same position probably in Texas summers. I don't know how they'll be able to keep the thing cool in our heat, though.

That's the key. But if they could do it, it would shrink my electricity bill and my internet bill, and I'm all for it if it's quiet. Absolutely.

So I don't know. Guy, what do you think? Are we going to trade watts for AI tokens?

Is that the math here? I debated with myself whether to come in hot on this, skeptical and cynical, which is always entertaining, or if I should come in with it enthusiastic and positive, which is boring but equally plausible here. I'm literally of two minds.

Essentially, I think I'm kind of with Tracy. This is a great idea. Let's do it.

Let's try it. Then the cynical side of me immediately reacts and says, yeah, if the rural communities are saying no, the suburban folks are really likely to say yay. That doesn't make sense.

I think that what I'm really trying to dig into is to figure out where there could be intractable problems with this. And I think the main one is the network. I think that it's a great idea to distribute physically, including physical conditions, which that's a problem that could be addressed, okay, if not sooner, then later.

Missing nodes, fragile nodes, cloud's been dealing with that forever. But in the end, aren't these data centers supposed to work on super-duper high speed GPU to CPU to XPU to blah, blah, blah, high bandwidth, et cetera, et cetera, basis? And how are you going to ensure service when you've got these things all over the place?

How are they connecting? It took Google Fiber five years or something to get through enough of Austin that they could start providing reliable service. And look, five years is fine.

However long it takes. That said, shoot, yeah, let's go for it. Let's do it.

Let's bury them. I don't think we can put them in space. With a lot of respect to my horrific colleague, Brendan Burke, who wrote a great report on data centers in space.

I think that's a real long-tail effort, but we got to try everything, and I think this is one of the ways that may succeedin addressing the power and resource issues that we have to meet demand for this really terrific new tool that we criticize all the time, AI. Wiki- And the industry itself has to understand, the AI infrastructure has become a societal problem, and they're so focused on the race to deploy more GPUs faster than competitors, that they're not thinking about the societal issues. And that is a problem.

That's a really good point, yeah. Wiki, I once tried to put a shed in my backyard. I spent an inordinate amount of time visiting the local zoning people, and all kinds of folks, and filling out all kinds of massive amounts of paperwork.

What do you think those people are going to think about mini data centers in your backyard? Well, personally, I feel like from the business model perspective, Airbnb type can largely reduce the shortage of the data center problem theoretically, right? And I can see that if I'm the person who should decide, I will consider from a two type.

One is, okay, I have the yard, but I don't have enough income. Maybe I should have that extra income, right, and help the society. The other one, if you see NVIDIA in the GTC conference this year, they start to have that kind of physical machine which link the edge and the cloud and help the open cloud to make the security way to use it, right?

If the people happen to have that kind of machine, have the edge and cloud capacity, I feel like if they want to have their own data center, it makes sense. Yeah. But clearly, I still try to understand how that back-end SaaS solution or system works.

Because this is kind of like a decentralized system to the point to point, right? Which is very hard to manage and design and develop. Sure.

This is an area cannot be my interesting area. " I mean, is that how this plays out? Because they'll handle all the paperwork.

Yep. All right. It becomes a utility.

It's possible. It's a possible solution, it really is. I don't know how all the details are going to work out, but it is something that we should try.

I really do believe that. Yeah. But personally, I'm still thinking from compliance and security perspective, right?

Like traditional data center, you have that SOC 2 there, and you have the physical access to manage it. If you put it to people's backyard, how do you manage that part? And do you count it as a business solution or personal solution?

Yeah, I don't know the details. There's so many details to sort out on this. Get another lock from the hardware store.

What are you talking about? I think that there are just so many questions. Wiki, those are great questions.

My question I think is a good question. How do these connect to each other? How long is this going to take to roll out?

" Yeah. Let's see where... But we're going to work those out.

The hardest question I'm seeing is the network question to answer, but it still seems to be one that can be answered. So... All right.

Well, then- At least they're acknowledging, right, that a centralized hyperscale alone may not sustain us long term, and it does introduce new challenges around cybersecurity, governance, how to maintain these, but at least they're acknowledging there may be a different way to do it. And on-orbit is a long way away, but that is a possibility, too. All right.

Folks, I think we- And how do you cool it, Tracy? How do you cool it? We have firmly established that there's probably more unknown than known when it comes to AI, and it's just going to keep playing out.

But the possibilities are endless. I want to thank our panelists for sharing their thoughts and insights as usual. Guy, Tracy, Wiki, Jack, we'll see you probably next week at some point.

I want to thank you all for watching the latest episode. Please stay tuned for the replay of the Techstrong TV lineup. There's some awesome content there as usual.

And have a great weekend, and we'll see you all Monday.