Industrial AI Security: Deals, Report Overload and Agent Controls

Hello everybody. Happy Tuesday and welcome to Techstrong Canyon. We're going to cover a broad spectrum of things today, so stay tuned, but there's just a lot going on in the world, and we're going to also branch into some new areas that we don't normally touch on, but we have Kate and Chris Blask with us who are experts in some of these areas.

So we're going to have a deep conversation. So welcome, Kate. Welcome, Chris, and welcome, Sid.

How you guys doing? Good. Yeah.

How are you? Morning. All right.

So the entire world of manufacturing was kind of shocked this week when out of nowhere it seems that Schneider Electric turned around and acquired PTC. If you are not familiar with either of these companies, I will get into what they both do a little bit. Schneider Electric is best known for creating a lot of the racks and a lot of the hardware that goes into various data centers, and also they have their hands in automation that goes all the way into manufacturing.

They are roughly 10 times the size, I think, of PTC. PTC, meanwhile, is used for everything from CAD/CAM to creating the, I guess I'll call it the product lifecycle management software that's called Windchill. It's used widely by manufacturing companies for managing their workflows and their processes.

And the two of these things are coming together at a time when, well, AI is everywhere and we're starting to change the way we think about how industrial systems might be built and how our manufacturing processes might be built. So Chris, I'm going to turn to you first in this space, but the thing that leapt out at me immediately was I have all these manufacturing workflows that are almost deterministic by definition, and now we're trying to insert probabilistic AI into these workflows, and I think Schneider and PTC will be at the forefront of that now. But as you look at this deal for $22 billion, which I think is how much Schneider makes in a year, what's your sense of what's going on here, and how will the way we manufacture things ultimately change in the AI era?

I've always loved the operational technology, critical infrastructure, cyber physical stuff. In 1989 in Greenville, South Carolina, I was hired as a Kelly temporary employee to manage the shop floor at a GE plant. And ever since then, every time working in the IT world, OT comes up.

We're starting talking about critical infrastructure, water, power, people's lives, physical things moving around. It's always a different world. It's always a healthy parallax because you talk to someone who's worked 37 years as a linesman in the power grid and you say, "Hey, we're really exciting.

" The look you get makes all our IT conversations have a little perspective. But we're at this point where these systems, these language systems, these fast big processor GPU things, provide value in operating these systems. So what do we do?

And yes, so Schneider Electric, we're talking in the green rooms. Schneider is a fascinating company. I've worked with them for many years.

Shout out to Cassie Crossley who's in the supply chain world, has made Schneider one of the best out there, which plays directly into this. I think this is a good match to the point of the pieces that brings us here. But we'll see these vendors going down this path, and these are serious folks who provide serious systems that go out to sea, with hundreds of people on them and oil rigs and so forth, and they don't take compliance instead of security because now we're talking compliance instead of safety.

So without taking the entire time we have here, I think this is the beginning of a path we can watch. Come back three years later and watch what Schneider does in this space and take lessons from them. Kate, I know you're active in this space as well, and one of the things that does occur to me here is that there is this security aspect of this thing, and to Chris's point, these companies are not idle in this space.

They're not hobbyists. They are professionals. So as we look at this whole space and how it evolves, where do you think this is going to change the way we think about industrial systems using AI in this space?

Because, well, historically it has required a lot of people with OT expertise, and maybe that's going to change, and how does it all play out in your mind? So first, I think we should all be holding our breath waiting for something to happen, oh my goodness. AI does not have a great track record of doing things right.

It exploits the bad. And so I think that there's a lot to be concerned about personally, like when you talk about something that's deterministic, and now we're putting in AI and hoping. So, first it should be noted that it's not like this is coming out of the blue, right?

And Chris, I'm sure you know that one of the problems that we've had in this industry is that we've had an older generation that has been retiring and trying to bring in a new generation. They have brought in these augmented reality goggles basically to go work on pipelines as a way to basically ramp up a younger generation as they deal with these systems, and I mean the entire system from the actual plumbing. At the end of the day, I think the potential is there to make some decisions, but I think right now it's like a 50/50, meaning that there's real challenges that as a person who has gone in to talk about from a cybersecurity perspective, and Chris brought up safety, we have always come in from confidentiality, integrity, and availability.

These were the triad for cybersecurity. And when we went into the OT field, confidentiality is not as important as integrity, right? It's not as important as the safety and the integrity of the data that they're seeing, and we saw that with Stuxnet.

Where what was being displayed was not actually what was happening. And so I say that because I think and believe that AI is not controlled enough to be able to participate in our critical infrastructure. And talk about vulnerabilities.

We're running on Windows XP, folks, on some of these systems. Go ahead, Chris. Let me give you a live vulnerability.

So this weekend, I published an article in a long-form prose, Mike, for a Gilbert Cyber Sec publication. Because I discovered that OpenAI, if it sees too much cybersecurity talk in your conversations, will pop up a little banner. September 21st, it did it for me.

They said, "Hey, you've triggered some cybersecurity things. " As I'm going through using the platform to build things, over the weekend, I find that the system I had authorized won't perform the action, won't write the get, won't perform the function. So I've used the system itself to analyze all of the regulations this impacts and wrote the piece based on that, and it's fun, to our purposes as OT folks.

What I'm saying is, if I use this in the path of a critical process, like opening or closing a valve, it may or may not, based on some opaque rule, that to be clear, you can't see what the rule is. You don't know why it's tripping, you can't determine whether it's going to trip again or not, and you just basically have to write it out of the path. As a critical infrastructure engineer, I have no choice.

This is a undeterminable independency in a critical path, and that's just OpenAI as it sits today. And I'm not picking on them particularly. Anthropic and all the rest are just as good or bad.

Because we keep talking about, as we talk about on this show every week, trying to put AI guardrails in the wrong place. You can't get there from here, but we have to, and companies like Schneider Electric will. Believe me, their stakes are high enough that these sort of issues will get worked out in their context, or they'll never use AI.

Yeah. If something that gives me hope about the whole situation is always as I claim to be the Pollyanna of the group - And that is that Schneider Electric, at the end of the day, if there's anybody who is good to take this on, it would be a company like Schneider. And with that being said, as I was speaking and as Chris Blask speaking, a thought came into my head about BP Horizon and that whole, when they looked at what happened to that well in the Gulf.

And I wonder, it was actually humans that overrode the signals that were going off. And I wonder, when I think about this, if they had AI, if that would be a great test case to put that through and if it would shut down. If I were building this, and trying to get AI, I would take the disasters that we've had with our critical infrastructure and put AI as use cases of what they should do and should not do.

Yeah. Say, I'd love to get your opinion on this. There's an old saying in this industry that says, you date your hardware vendor and you marry your software vendor.

And I wonder, in the age of AI, if that's going to start to fall apart because, well, the line between hardware and software is going to blur in this agentic AI era, and I'm just going to have a bunch of AI agents that are going to execute things across software and hardware, and therefore, maybe we'll see more of these mergers between what are classically hardware companies and software companies. Yeah. I think you're going to see more and more.

You're absolutely right, and I agree with whatever Kate and Chris said so far. I mean, to build that sort of software intelligence substrate within the physical layer of these utility type of functionalities that serve data centers that are serving the creation of AI itself is going to be very interesting, right? And I think you'll see more and more the intelligence layer creep into the physical utility layer, right?

And there's no escaping that. I worry, though, because for AI, that influences physical equipment and customers should also demand, I think the others referred to this, additional clear boundaries between recommendations and autonomous actions, right? And there has to be a human intervention at some point, especially for critical things like utility and electricity and those kinds of things, right?

So I think that's something that worries me. But yeah, I mean, the software layer will hopefully build that intelligence and have the ability to fork off things when it detects a potential vulnerability or potential risk to a human so that you don't have rogue agents going nuts like we've seen in the world of AI in general. We can't afford to do that in the world of critical things like electricity and utilities and those kinds of things, right?

But the other thing that also sort of struck me as part of this deal is the value. 6 billion at a 42% premium. My concern is whether those returns come from better outcomes that is going to be delivered to customers, or are they going to pass the cost on to the buyers, their buyers in turn, into the higher licensing costs and tighter platform dependencies, right?

So if I was a buyer of Schneider Energy, then I would really evaluate things that reduce downtime, lower energy consumption, faster engineering cycles, and those kinds of things, right? And then sort of evaluate that against integration costs. So, I mean, you're going to see this trend of software being injected into the layer, but it's also going to drive the cost up, and who's going to absorb that cost becomes an interesting conversation.

Hmm. Well, yeah, so the cost part of it, right? And I'll give you an example.

We can play it out live. So the first Tuesday in October of 2027, you can remind me of this one, right? Because John Deere now had more software than hardware engineers in the last year or so.

They crossed that boundary. I think we've talked about it on the show. But there's a full-size John Deere excavator diesel track thing about 50 yards that way, and it just finished digging a 700-yard trench for the fiber and stuff going in.

And over the next year, I'm going to get that AI controlled. Get that individual excavator AI controlled and the other equipment, MAC trucks and so forth here on the property. And I know how to do that, and I know on a small scale we've done that already.

So I think that's ... Look, I'm concerned about the same things, like I literally live here. I'm going to take MAC trucks and automate them so they can drive around on this property where I'm watching you right now.

I'd rather they didn't drive through the wall or kill any of the pets or anybody. And I will stop getting- ... before we get there, but I think it's obvious.

And companies like Schneider do not mess around, right? I've had multi-decade experience with them as an individual company and their peers, and they can make the wrong or right choice, but three years from now, they or their competitors will be getting the benefit out of doing this, or there's no benefit to be had. And their stock went down, but I mean, it dipped, but I think that's going to turn around.

I think you'll see that turn around. And, I do have to add something. Mike, where in the world do you guys come up with these sayings?

I haven't heard that one before about marrying or dating- ... your software. Where?

Where does it come from? Because I haven't heard it. I think you're making it up.

I think I heard that when I first started in this racket some 30 years ago. So it's been around forever and a day. But here's the part I like and here's the part I get concerned about.

" And hopefully, manufacturing companies will have more control over what they're doing and better outcomes. The part that I am a little concerned about is, to Kate's point, right, AI is far from infallible. " That's going to be a problem, and this is going to be an issue for manufacturing companies across the board because the only thing worse than a shortage is an excess of something.

And I don't know, Kate, can we strike a balance here between these probabilistic and deterministic workflows? Or, is this going to be roughly the AI equivalent of me still sticking my finger up in the wind and trying to make a best guess? Honestly, I think it's going to be making the best guess.

And when you were speaking, I'm like, I feel bad for the insurance companies. Who would have ever thought I would feel bad for them? I mean, how in the world are they going to write up these policies?

Because the loss can go either way. That's going to be, I'll tell you, I feel bad for the insurance companies out there. But yeah, I don't think we're there yet.

And we do. We have to go in that direction, though. And if somebody's going to take it on, that's a good company to take it on.

Yeah, I think the other thing that bothers me is, I don't know much about the space, but I know utilities, in general, have a monopoly in an operating area, right? So from a consumer consumption perspective, I know in my town I can't buy electricity from a different utility provider. I have to buy from the only one that is allowed to operate here.

So in the world of commercial utility suppliers, is it a monopoly? If that's the case, then what sort of regulation should be put in place? Again, we get back to the regulation conversation from the last few shows.

When you're supplying a critical resource like electricity to data centers, right? What sort of regulatory governance should be applied as a consequence of putting these software agents, if you will, and AI layers building into the physical substrate? What are the concerns that will arise from that, right?

Well, yeah, the New York SEP regulations, and they're out there right now being cybersecurity, not just in North America, but they're the template for all the cybersecurity electoral roles in the world, right? And again, credit where due, Tim Roxy, the father of all that, and he's publishing exactly down this path today. And again, the short answer is OpenAI as it's offered out there as an example, cannot be used in the grid.

Look up that article of mine over the weekend. " And the regulators came back and said, "That was cute. NERC CIP 2.

Guess what? " So now you cannot implement anything, different alloys of copper or AI in the North American grid without NERC CIP telling you whether it's allowed or not. And I'll tell you right now, OpenAI as it's delivered cannot be used in the grid at all, ever.

They have to change the model. We got to shift the gear here. Uh-huh.

But I'll just point out one thing that said, hey, if you think you're some AI company that's going to show up at a manufacturing plant and starts founding things like, "Let's go fast and break things," you will be labeled a menace, and deservedly so. Yeah. Good point.

Let's go shift the gear here now to some other fun things that are going on. GitHub has put the brakes on vulnerability disclosures. And Kate, I'm going to toss this to you because I can't make up my mind if this is the responsible thing to do, or is this the equivalent of Trump saying we should just stop counting COVID cases, and then that way the numbers will go down.

That's funny. You're funny. Yeah.

So, summarizing how this responding to a real capacity problem. So every report requires time to assess, and the low-quality submissions can bury findings that need attention, and this is really happening. And so by putting a daily cap slows the intake, but the negative of that, it does improve our ability to validate or fix vulnerabilities.

And that's the problem, and that's what we're getting to. So while I think it's a good idea, and lately I've really gotten into GitHub. I like them more and more.

I know that sounds like a silly thing to say, but, I was more of a network person than an application, and I have this whole chicken and egg thing, like who came first, network or application? And I haven't decided. But now with this GitHub thing, I think it's going to be a mistake, at the end of the day, to the latter point that you made, about Trump, because at the end of the day, what does a cap actually do?

We have had problems forever trying to quantify and qualify whether vulnerability's high, medium, and low. Oh my goodness, since cybersecurity has started, this has actually been an issue on the criticalness of the vulnerability. " And who cares?

We can have 100,000 low vulnerabilities, but one high critical vulnerability that's extremely serious and that's going to be buried now. So, yeah, no, this wasn't a good idea. I'm going to go with the latter.

That's my vote. And yet, to be fair, GitHub seems to be rallying to the defense of the open source maintainers, or so they claim here, because those folks are not getting paid largely to go and fix all these vulnerabilities that enterprises are now worried about because they have embedded open source software into their operations. And of course, nobody asked the open source maintainer if that was a good idea or not.

" So- Yeah ... Sid, have we come up with some sort of problem here where we are dependent upon essentially a coalition of the willing who are volunteers and are looking at this going, "This is not really my problem. I'm just trying to be helpful here," but ultimately, if you went out and built some software and deployed it on my open source code, well, buyer beware, and the buyer paid zero.

So are we good? Yeah. I'm on the fence on this one.

I think what Kate said is interesting. We don't want to have oversight that results in vulnerabilities that creep through the cracks. I think that's your point, right, Kate?

Essentially like- Yeah ... don't put a structure around the process that actually creates more headaches than the problem that you're trying to solve in the first place. But, there is a case to be made where if you have too many of these vulnerability instances, and you get inundated with these reports, then you're probably going to miss some of the more critical ones.

So the real question I think here is how can you sort of rank order these vulnerabilities cleverly and then address those- Yeah ... that you need to be addressed first rather than information overload. I think that's the essence of this problem, is what I'm understanding it to be.

So I think- Yeah ... reporting limits need to be paired with technical evidence. You can't just say it's a problem.

And then protecting maintenance must preserve access for, to the earlier point Kate made, for legitimate researchers. If a person is researching area that is resulting in these sort of problems or these vulnerabilities, then it has to be addressed in that fashion. So again, I think it's a balance.

It's about more information versus less information. But if you couple the bearing down of the critical vulnerabilities with technical evidence, that is a key, I think. But the other thought that crosses my mind is how are these things being done today?

If it's largely addressed by humans, then what's the role of AI in the process? Can we use AI intelligently to do the work of humans? Now, that introduces a whole new level of problems.

But anyway, those are the things that cross my mind. Yeah. Well, right now, they're really good at showing us our vulnerabilities within GitHub, so thank you.

Well, interestingly, you think about it as an architectural scale, like when you first sat down on an Apple IIc or something and made some basic program, you'll print this, if that, then there. Yeah. And you start thinking about, okay, I found that problem with that.

And if in the future from the '80s, we end up in a world where we are now, where there's literally trillions, it must be trillions, of chunks of code. They're way bigger than those little basic programs. Each one may have a vulnerability.

How do you even manage that at all? And Sid, to your point, how are we doing it now? The last couple decades, we've come up with systems where humans, when they would run into one, would contact other humans and talk about it.

But we're faced with the point right now where this is so large, and it's not about whether there's a print error. It's that if I take this piece of code, and this piece of code, and this piece of code, and this piece of code in this particular use case, does it actually cause a risk? And how are we going to handle on that?

I will say one thing. So I volunteer for the CD Foundation in pipeline security, DevOps. So I would make a call-out for anybody who would like to join our group, actually, on Tuesdays before this call, every other week.

And seriously, we are actually trying to address some of these issues that we are finding, vulnerabilities, pipeline security, all very important topics for today, and that we absolutely need more people. At the end of the day, actually Alan has spoken about Jen Easterly, software bloating, reachability. These are all cases like Chris, you just brought up, something from the '80s.

We are sitting on code that really needs to go bye-bye, and we need help with having that code go bye-bye. But we also- Yeah. But we're also generating, sorry, I was going to go, also creating new code that's being done by AI, right?

Yeah. How do we sort of address that problem? Well, it's challenging on multiple fronts because the AI is good at finding vulnerabilities, but it's also mistaken, and it identifies vulnerabilities in what is perfectly legitimate code.

And so it increases- Yeah ... the false positives and then overwhelms the humans who are supposed to sort all this out at the end of the day. Yeah.

And I think that the people who are Theoretically using the information of the vulnerabilities to go create a patch or using AI tools to create the patch. But then they've got to test and validate that as well, and I don't think the DevOps pipelines are fully automated for that workflow either. So I guess I come back to this, and I'll throw it to Chris, and I'm like, I think everybody's asking the same question, how long is this vulnerability deluge going to last, and will we eventually get to some better state, or is this the new permanent state of affairs and we're just going to have vulnerabilities score, and this is our life from here on out?

" And anything that causes enough pressure will find any possible solution. And to any challenge, maybe there is no solution, who knows? That's always the risk.

But I don't see anything in this one that says, this is the 20 years from now, we're still sitting here saying nobody has any idea what's vulnerable anywhere ever again. That can't happen. And I think that there are...

We touched on so many parts of it, so it's hard to do it in a soundbite, which maybe gives an indication of maybe a space, but it's about delegating authority and keeping records and so forth, so the next action is based on something that locally makes sense. So vulnerabilities are part of that. Right?

How do I not- Yeah ... if we look at the human processes we've used so far, I think they're basically right. We just need to fill in some of the gaps, do some things that have been proposed and written up and so forth, never really done.

Get rid, like compliance instead of security. I think you can build systems right now that if they're compliant, they are by the definition of whatever they're being compliant with secure. That are actually have all those controls in them, not just somebody signed off on there who's pretty sure they can figure things right.

And I think- But there has to be an end ... to Chris's point about AI, and yes, and there does have to be an end. We should be asking AI to help prove the findings and fix it.

That's the key. That'd be everything. Yeah.

Seriously, we have the ability to do this, and I think one of the most frustrating things that I'm finding today in the cybersecurity community, and within our community as a whole, we know better. And we continue to go forward, not putting in the things that we know better are doing, and that's one thing where we know better. AI, help prove these findings and support this fix.

So, I think those two are important, but if you believe all the AI experts today, there's going to be more code generated by AI than humans. So when AI generates the code, they have to- Mm-hmm ... has to make sure that those vulnerabilities are prevented at the code generation phase itself.

Right? And doesn't that go to your plane idea that you've talked about? This...

Exactly. Yeah. Right?

Yeah. Having a plane, an AI plane, basically, that can control that. And then the challenge is for every one step forward, we make one step back.

So there's probably fewer, maybe two steps or more back, to Kate's point. But, there's generally SQL injection attacks are lesser in the age of AI, but at the other end of it, we are discovering more vulnerabilities because, well, there's these people called the adversaries who are also using AI tools and models to discover vulnerabilities and generate exploits now in less than a day, a few hours. So the pace of this whole thing is changing dramatically, and so how are we going to cope with that, Kate?

Yeah. Well, thanks for throwing that back to me. But seriously, it's going to have to be with AI, because humanly, we can't do it.

Humanly, we just can't keep up. 0, we're here. Let's start to use the machines the way they're supposed to be used.

All right. So let's hope for the AI best, but by all means, I think we should prepare for the worst, at least for the next year or so. Hey, I was reading an article about how OpenAI, I think it was OpenAI or Anthropic, I think, invited one of these leaders of a Vedantic society to this retreat to understand the importance of ethics in AI, right?

So- That's rich ... that's pretty rich. If that's the direction we're going- That's rich ...

it'll be interesting how that plays out in code generation and ethical code generation. Maybe they should just give that ethics test to all those new employees that they're going to hire at OpenAI. I thought that was funny.

So I will say, going into our next topic, that the nature of what we do on this show is there's always negatives and positives, but the news of the day tends to focus a little more on the negatives, but this next story maybe shift that a bit, and we'll see what happens. But there is concern about all these AI agents that we are building and deploying, and rightfully so, and some of them go rogue. But in the last three weeks alone, I've been inundated with multiple new product announcements from folks talking about how they can apply controls and governance to AI agents.

At least three of them involve AI gateways. There's other folks, whether I think it's AWS is talking about implementing policy as code for AI agents, and there's folks also talking about secure run times for AI agents, and we're also finding ways to maybe get in front of the AI agent so that we can head it off before it does something bad. So Sid, when you look at all this stuff, is there hope for us when it comes to AI agents, and are we about to get our arms around this thing?

And I know that everybody's focused on the rogue AI agents, but is this problem solvable? I don't know if the problem is solvable, but I know the one thing that we are increasingly handing over our day-to-day lives to these agents, right? I don't know.

Every day I hear about a new agent-based decision maker for your life. Right? Whether it's Muse from Meta.

I came across something called Instinct AI recently, which is a text-based agent. We've heard of Amazon releasing Quick and then Agentic Core for the developer community. So I think I'm seeing more and more of this in the industry and in our lives.

So it's going to be a reality. I don't know if you escape that, but my concern is that giving these agents broad access to files, messages, browsing history, all of this, building the knowledge graphs, it just creates substantial, and again, Chris and Kate can talk to this, substantial privacy and security risks, right? And agents need task-specific information, so permissions, right?

Not information, permissions. And maybe temporary credentials, not a carte blanche credential, right? So you spin up credentials on the fly and give that agent that ability to do certain things, and then pull it back, right?

And then, you also need controls to evaluate tools against explicit roles and including things like sequencing and timing of previous actions. So this is a very complex scenario. My worry is that we're just handing over our day-to-day existence to these agents.

So from my perspective, governance must be built into the agent execution architecture, right? And whether it's a consumer, whether it's an enterprise, we need enforceable permissions, consistent policies across infrastructure, and clear accountability for the actions of these agents. Otherwise, we're going to see a chaotic society, essentially.

That's my concern. Chris, is the glass half full or half empty here? What do you say?

So, sit down and have a coffee, right? Because this is why I started this company. My initial premise before I started the company was that we're going to get to the place where AI is authoring at scale, words and code and so forth.

So since we are going to be there, let's assume we're there now and see if it's possible to build something that works that way right now. And slash bias alert, but the Quietwire Mesh, our system, is physical and virtual machines that we control with LMS and so forth, that we control. And I use it every day.

Sid, you mentioned coding. My co-founder, Ashraf, is busy doing business development. He's the actual CTO.

It's a bit of an inside joke, Ashraf, because I've been doing DevSec stuff for the last six weeks like crazy. I generate Hundreds of thousands of lines of code every day, constantly, and deploy them in our own live environment, including on, again, on a small scale, physical devices that are being controlled by AI systems right now. And the whole idea was that we have to have governance.

We have to build it in all the way. It has to work for me, or I'm not going to use it, or we're all going to have ants, and we're not going to have nice things ever again. And I'm part of a number of standards organizations like the United Nations and the Standards Council of Canada, where we're working through AI governance and systems, AI systems.

So I understand, and with you folks, and all the other stuff that us crazy bandicoots get to be involved with every day. So I know where the conversation is, and I try to be really clear and caveat because both, I've got a commercial interest, and I could just be wrong. But we're running systems that do this now.

Every AI system, there's all sorts of LLMs and systems talking back and forth right now and running and checking and configuring and doing things, and by the end of this month, maybe autonomously moving things physically around the campus here. And in a year, I expect to be able to have diesel-powered stuff autonomously operating and not killing anybody. And- I think that- We'll see.

Yeah. I think in an ideal world, that's all fine and dandy. My real concern is organizations haven't really defined a clear authority, right?

Who owns, who really owns the prevention, detection, and responses from these agents when an agent exceeds its authority, right? What are the issues associated with liability, right? If I'm using Muse or I'm using Instinct AI, and it suggests an action for me and I go ahead and just do it in a dummy-like fashion, right?

Who's responsible here, right? Am I responsible for taking the wrong action because ultimately it's on me, or is it the agent that told me to take that action? And are all humans smart enough to discern the difference?

That's so many quite open questions around this, right? And I support, Chris, what you're doing, and I believe in it. But I will say too, to Sid's point, think about how many people just check the box without reading the EULA.

And that's the problem where you, who are developing this, have to think about the millions that check that box without reading the EULA. And how many... And I don't know how we do that.

Just, it makes me go back to a plane, this AI type of plane. " And they didn't care. " And so there's so many of us on so many sides of this that, from those who know better and just like the shiny new things and let it run, to those of us who just check the EULA and don't read it, the end user license agreement.

That's what I mean by the EULA for- So will we do the right thing eventually? Because none of this stuff is free, right? I got to have somebody who's going to write the policies and put the coding in, and I got to make the effort, and I got to add that in.

And we live in an age where people are like, "I'm just going to run an AI agent because it came with a software that I just deployed, and away it goes. " But Chris, at the end of the day, everything that you're doing there requires time and effort and expertise that most people don't have. So how are we going to wrap our arms around this thing?

Well, I think if we can find any solace in this, right, cybersecurity gives us good lessons as well because the failings, our inabilities in the last 30, 40 years in cybersecurity have come at a cost. They cost people money, they've cost people lives, right? And that's awful.

But we have the right kind of structures in place, right? We've limited the damage. We're in this spot right now.

People will do this poorly. It will continue to cost money. And as we were talking about at the beginning of this, we've already seen automated cars have killed people.

They're not perfect. They're not going to be perfect, right? And these systems are going to be done really poorly, and they're going to cause, I don't know.

I mean, look, we have active war going on right now. We're seeing some of the cyber attacks on infrastructure that we've talked about for decades actually happening, right? And what is possible to do for today, I don't know if it was possible to do in that space anyways already.

It's causing real damage. But AI do it poorly, have AI implemented really, really badly at scale by somebody with good intentions and the fund to do it, and they don't address the kind of things we're talking about here. We're looking at sad news stories and real people hurt.

So I think that that's probably going to happen to some extent, but it's not a permanent state. The incentives on every level to not do that are so high that I think we may more quickly than we historically have start not screwing up all the time. I think we have to get to a point where we're using AI with the caveat that it comes with risks, right?

It's like- Yeah ... getting on a plane, right? You know that a plane can crash, but the probability of a plane crashing is so little that you take a chance and you go on the plane, right?

So I think it's going to get to that point. We're going to use AI and fully aware of the risks that it comes with. So the question is, how do we constantly work towards minimizing that risk to a degree that people are comfortable using it without worrying about it, right?

All right. " It's that simple. All right.

Hey, I want to thank everybody for sharing their knowledge and insights as always. Chris, Sid, Kate, have a great day. I want to thank you all for watching the latest episode of the "Techstrong" gang.

Please stay tuned for the rest of the Techstrong TV lineup replay, and stay tuned for this little message from our quote-unquote sponsor, which in this case is always us. Hey, we'll see you guys next time.