S1: Unsupervised Learning is a podcast about trends and ideas in cybersecurity,
S1: national security, AI, technology and society, and how best to
S1: upgrade ourselves to be ready for what's coming. All right. Well, Alastair,
S1: welcome to Unsupervised Learning.
S2: Yeah, thanks for having me, Daniel. Long time fan of
S2: yourself in the show. So good to be on here.
S1: Awesome. Yeah. So can you tell me about yourself and and, uh,
S1: harmonic security?
S2: Yeah. Quick bit of bit of background, as you can
S2: tell from the accent. Originally from the UK here. So my,
S2: my previous company to harmonic was Digital Shadows which I
S2: set up in London and the threat Intel space and
S2: we were we were really good at spotting all the
S2: sensitive data that had already leaked out of businesses across
S2: the open, deep and dark web. I did the series
S2: A in Silicon Valley, moved here in 2015, so I'm
S2: now ten years into the US in a dual national
S2: and so on. So pretty bedded into the the. Bay
S2: Area digital shadows was acquired in July of 22 and
S2: as you'll remember well November of 22 ChatGPT comes out
S2: and you know the world changes and I you know,
S2: I started just, you know, exploring that and talking to
S2: a lot of smart people in the space and seeing
S2: what I could learn. And, and actually, you were one
S2: of the first people who was writing a lot about it.
S2: I started, you know, picking up your, your newsletter, I
S2: think in, um, early 23 as you were really getting
S2: going on the topic. And so that's ultimately led to
S2: me founding Harmonic Security in August of 23. So about
S2: 18 months old now. Um, we are we're really building
S2: a new data protection technology. We're calling what we're doing
S2: zero touch data protection. And we're harnessing the power of
S2: generative AI to build this. It's it's it's our own
S2: set of specially trained small language models that we're using
S2: for data protection. That allows us to do some very
S2: different things that I'll talk about. But use case one
S2: for us is very much, ironically enough, it's generative AI
S2: adoption from the enterprise. Right. And the challenges, particularly in
S2: sensitive data leaking into these different AI applications and models.
S2: We see that as like the number one barrier to
S2: to adoption in the enterprise, and we're helping them with that.
S2: And so that's really what harmonics about today is we're
S2: building out a pretty unique approach here to data protection.
S1: Okay. Interesting. So there's like an old space I don't
S1: know if it's been renamed, but it used to be DLP. Yeah.
S1: For like for like outbound, you know, sensitive data going out. Um,
S1: it sounds like it's something like that. But at the
S1: same time it's like AI readiness. Um, and then like
S1: the leakage issue. So, like, how do you see those
S1: and differentiate them?
S2: Yeah. It's a great point. I think there's there's been
S2: as you mentioned, there's a few categories that we, we
S2: can collide with a little bit, and we're trying to
S2: not think so much about the existing categories, is just
S2: focusing on what the problem is that the enterprise is
S2: trying to solve today. And that naturally leads us to
S2: overlap into into some of these categories, for sure. I mean,
S2: I think if you think about, as I'm doing about
S2: the problem space today around AI, that's it's kind of
S2: a top three for everybody we talk to is, okay,
S2: you've got you're in a position of having to go
S2: and try and adopt this technology. Um, the business is
S2: pushing for it in most cases. Right. We don't want
S2: to be left behind. We need to go and get
S2: on this. Um, but the obviously, there's, uh, there's a
S2: bunch of people that are worrying about the risks attached
S2: to that. Principally, where does the sensitive data go? And
S2: the start of that journey is visibility, where you need
S2: to understand effectively what's going on today in the enterprise,
S2: because whether you like it or not, employees have already
S2: jumped in and have started using a bunch of these
S2: tools and technologies. And, and so, so you sort of
S2: look at what enterprises have have to deal with their
S2: and often the the approach has been, well, um, let's
S2: just sit, block and wait. Right. Try and block all
S2: this stuff. Pretend it's not happening. Put a policy in place.
S2: You know, maybe we'll start to build, you know, by
S2: one of the an enterprise version of something, right? It's
S2: co-pilot or it's it's ChatGPT. And we'll try to point
S2: everybody at that. Um, but inevitably, you know, there's this,
S2: this sort of Cambrian explosion of other AI applications and
S2: uses out of the core apps that often get blocked.
S2: And and you don't want to frustrate that either. You
S2: want you want to be adopting the majority of the
S2: the technology where you can. So the question comes back to,
S2: you know, how do you do that safely? And and
S2: I think getting getting visibility into it is the first part.
S2: And then the second part is, well what about the controls.
S2: And you mentioned DLP, I think that's kind of the
S2: classic one where where organizations start to look at their existing, uh, options,
S2: whether it's DLP or trying to label all the data
S2: in it in a company. Right. Those have been the
S2: two things we've tried to do for 20 years. Uh,
S2: hasn't really worked that well over the last 20 years.
S2: I mean, it's it's just such a challenge for most
S2: security teams, right?
S1: Yeah, it sounds great, but when you try to implement it,
S1: it turns to garbage really quickly.
S2: Yeah. I mean, it really does. I'm yet to find
S2: somebody who who loves their, their DLP or really enjoyed
S2: the process of trying to label all the data in
S2: the business. Um, you know, and usually it's, it's often
S2: just a compliance tick box. Right. It's kind of there
S2: if the regulator asks, but is it really doing anything
S2: very useful for you? Well, probably not right. It's right.
S2: It's like a yeah, yeah.
S1: So so let me let's do this. This should be fun.
S1: So I'm just going to give you a scenario that
S1: I think is happening quite a bit. And then let's
S1: talk about where harmonic security would fit into this. So
S1: a big part of the use case is simply the
S1: business says, Holy crap, we need to have AI immediately, right?
S1: We need marketing to be moving on this. We need
S1: some sort of product that says something about AI. So
S1: we were thinking it would be something related to like, um,
S1: our CRM lookup. Uh, you can ask questions about your
S1: current account or whatever. So obviously we want to hit
S1: that API. Here's the API internally for that. Um, also
S1: we want to do some external lookups, uh, to combine
S1: it with some web search or whatever. So I guess
S1: we'll need that API. And then like the business kind
S1: of sends over this hunk of garbage over to like
S1: the product team which has like three or 4 or
S1: 10 internal APIs plus some other agent functionality or whatever.
S1: And then you have like this, uh, combiner, uh, sort
S1: of agent that actually formulates this stuff from the API's
S1: and hands it back to the user through this chatbot.
S1: And that's like 20 different nightmares combined. So where is
S1: harmonic security on this?
S2: Yeah, I, I think for, for the reasons that you
S2: just outlined really we're not trying to solve that problem today. Uh,
S2: and I'll talk about why I think. I think the, uh. Yeah.
S2: November 22nd, ChatGPT comes out. I think 2023 and into
S2: 24 companies were were having to say that they were
S2: AI forward. And, you know, every CEO is talking about
S2: AI and telling the board and the market about it.
S2: And and what happened in reality was, I think a
S2: lot of people, you know, spun up some sandboxes in
S2: usually open AI related. They tested out some use cases,
S2: mostly around, as you say, you know, sales or customer
S2: success activities. Very few of those have entered production. And
S2: I think what's happened and continues to happen is that
S2: the the percentage of companies that are really trying to
S2: build out their own AI to solve these problems, particularly
S2: the common business problems, is just going away. It's diminishing
S2: to to be the really sophisticated orgs only. And what
S2: the vast majority of companies are doing is ending up
S2: adopting third party SaaS that has already thought about this.
S2: It's what they do as their bread and butter. So
S2: are you going to build a better CRM than Salesforce
S2: and and all the other players? Probably not. Right? Salesforce
S2: is busy spending all day long figuring that that scenario out.
S2: And I think that's true for most of the common
S2: business use cases right around stuff like customer success, technical support,
S2: the way you're going about your marketing, it's going to
S2: be more, you know, are you going to you're going
S2: to be using the latest tools, though, whether it's, let's
S2: say like gamma for writing presentations now or, you know,
S2: granola for your note taking and all these types of things. Right.
S2: And then some of those get built in ultimately to
S2: Microsoft and Google suites, like big announcements this week from
S2: Microsoft and Google. And so if you've got a bunch
S2: of employees, maybe you're on the Microsoft Suite. Sure. But
S2: your employees want to use notebook LM, right. They want
S2: to be there's that Project Mariner spinning up about how
S2: do you get agents in the browser through Google. But
S2: I think that that's really the direction that most enterprises
S2: end up in. And then there's a bunch that have
S2: failed projects around trying to build their own. There's a
S2: bunch that will have successful projects building their own. But
S2: I think that's for me, that's got a lot of
S2: the attention right now. And, you know, obviously this stuff
S2: like we talk about the, um, you've got the, um,
S2: the top ten, the OWASp top ten, and uh, which
S2: is smart. Like, I think it's a good set if
S2: you're building your own. But I don't see I don't
S2: see these types of, of issues as the ones that
S2: almost the majority of CSO that we talk to are
S2: struggling with. Right? It's it's more, hey, we need a
S2: business wants to use all these tools. We don't know
S2: what we're using today. Who knows what's going on in
S2: marketing right now? Because these people are adopting these tools.
S2: They're firing our corporate data in because they want to
S2: get productivity out. I think that's going to be step
S2: one for the vast majority of companies. And that's our
S2: immediate focus.
S1: You're right. You're right. And that started first. It started immediately.
S1: It started in basically November of 22. Yeah. Because people
S1: were like just dragging and dropping like everything into their
S1: um okay. So what does that look like? What does
S1: that look like in terms of like bringing over sensitive documentation? Um,
S1: PRD documents, like all sorts of stuff that's like, should
S1: not be shared. What does the interface look like for
S1: harmonic security to be able to see it. And is
S1: it monitoring. Is it monitoring and blocking or some combination thereof.
S2: Yeah. No. Great. Great question. So yeah harmonic. What we
S2: are at the core is a browser extension that we
S2: can roll out in 30 minutes across all of the
S2: enterprise browsers. At that point, within the 30 minutes, we're
S2: starting to get visibility into all of the AI adoption
S2: of all of these third party tools and services across
S2: the company. And we can start to show show businesses, right.
S2: These are the ones that you know, that shadow AI
S2: challenge effectively. But the sanction versus unsanctioned as well. So
S2: you may know that you've approved certain coding assistance, but
S2: it turns out your engineering team is pumping your IP
S2: into a bunch of others. It may be that you've
S2: approved an enterprise version of Copilot, and yes, your employees
S2: are adopting that, but they're also creating spreadsheets in, you know, CSV,
S2: for example. They're putting data into that, which is a,
S2: you know, a free tool that is not absolutely not
S2: covered by your enterprise agreements. And, you know, the question
S2: marks around where the data is hosted, how is it
S2: being stored and secured? Um, you know, maybe it's gamma,
S2: which is an awesome product, but you probably if your
S2: employees are firing your data and generating presentations in it,
S2: you probably want to know that you've got the enterprise
S2: plan right and you want to standardize on these things.
S2: So so I think that's the those are the challenges
S2: that we solve very quickly. We give you that visibility
S2: part one. But the visibility is kind of the the
S2: easy bit. And we give you the risk as well.
S2: So which ones are training on your data. Which ones
S2: are hosted in geographies you don't want your customer data
S2: going into. But the the bigger bit though. So that's
S2: the kind of the governance, the visibility and often the
S2: step one. But then we come to the controls. Right.
S2: Because it's it's great. We can see some of this stuff,
S2: but what do we do about it. And that's really
S2: our differentiator. So so harmonica at the core I mentioned
S2: my last company, Digital Shadows, was looking at sensitive data
S2: that had already leaked out with harmonic. We're using knowledge
S2: of that to build small language models that understand sensitive
S2: data really well. Much like a human would. And that
S2: means that instead of just doing PII and PCI badly,
S2: which is effectively what the rest of the industry does today, one,
S2: we could do those things really well. But more importantly,
S2: we can also spot things like architectural diagrams or legal correspondence,
S2: or employee financial information, or corporate spreadsheets, insurance claims data,
S2: things like that you could never spot before because the
S2: the technology was just doing a regex or some sort
S2: of basic rule based. Totally. It doesn't work. We know
S2: it doesn't work, but but we do it because it's
S2: all we've had and the regulator asks us to. But
S2: now there's a better way because we can, you know,
S2: we've got these smart models that have incredibly high accuracy rates,
S2: takes the load off the security team. So this is
S2: where the zero touch data protection comes in, because we're
S2: accurate enough that we're not noisy and annoying for the employees.
S2: so we can jump in with the employee and resolve
S2: issues straight away at the end. The end point with
S2: the end user. And then this load doesn't fall on
S2: the security team. Now we have the data, the audit.
S2: They can go and see what who's been doing what
S2: and what. We've been able to stop getting out. And
S2: they configure it and manage it. But ultimately we're solving
S2: the data protection challenge without the load on the security team.
S2: So why would you go about, you know, rolling out
S2: classic DLP technology or trying to label all the data or,
S2: you know, worry about the the types of casb style
S2: solutions that are that are giving you some sort of
S2: insight into what's going on, but not fixing the problem. Right.
S2: We can fix the problem. We can do it in
S2: 30 minutes with this browser based rollout.
S1: Interesting. And this data could actually be used to power
S1: a labeling project because you'd be seeing the real stuff.
S2: That's right. You actually get a real insight into what's
S2: going on. We released a report earlier this week that
S2: you can you can download and and so on to
S2: look at what what is leaking out. And because we've
S2: gone we've obviously got great visibility now into this, this
S2: type of data across our client base. And the the
S2: interesting thing is it's it's 8.5% of the prompt data
S2: that we see has some sort of sensitive information in
S2: and of that sensitive information, about half of it is
S2: customer data related. But there's a significant minority. It's I
S2: think it's about 15% that is things like legal and
S2: financial information. And then you have obviously IP and employee
S2: data and all kinds of things like that. But it's
S2: not really been possible to have that visibility before. We
S2: sort of kidded ourselves by putting some sort of DLP
S2: that was tuned to spot PII. We've got data protections
S2: covered and things like that, or the labeling, like the
S2: sort of myth of labeling all the data when when
S2: we know the reality is that most, most of that
S2: is inaccurate and you don't find all the data anyway. So,
S2: so this we've been able to show what's really happening
S2: and then put controls around it.
S1: So do you have um, is there any way you
S1: can pull up the interface. Do you want to show
S1: any part of part of it, or do you want
S1: to just talk through it?
S2: Yeah. I mean, we absolutely can. Actually, let me just
S2: check if I can log in. Totally. So. So I've
S2: just got an example here of, um, we're running Gemini.
S2: And so you've got an employee coming along. We're imagining
S2: in this instance we're an insurance company because we're working
S2: with a few of these. So these are things that
S2: that we've seen before. Um, I'm putting in some, some
S2: data here that in this instance is is something we
S2: don't the company doesn't want getting into something like Gemini. Right.
S2: It's actual customer claims data that's going in. We have
S2: seen this. I think it's probably pretty tempting if you
S2: work in claims right now to be getting something like
S2: a ChatGPT or Gemini to start automating aspects of your job.
S2: So we've got an employee saying, hey, you know, can
S2: you review the following claim, propose next steps to determine
S2: if it's legitimate or not. And they've punched.
S1: All this data in. This is worth calling out. You
S1: are on the actual Gemini site. You are actually connected
S1: directly to Google and they're just doing their normal thing
S1: with whatever endpoint. And as long as they're using the
S1: approved enterprise browser because you're an extension, you can see.
S2: Exactly, exactly. And we can. We work with all the
S2: browser types we can install in, in, you know, very
S2: secure ways such that we appear everywhere and see, see
S2: everything that's going on, you know, no matter what browser
S2: is being used, even if the employees are installing their own. Um,
S2: so so that's that's the start point for us, is
S2: you've got an employee that's doing something like this. How
S2: would you spot this with existing technology? You probably wouldn't.
S2: You could argue you can match on the policy number.
S2: So I'll even take that out. Right. But from context,
S2: you and I can see that this is still customer
S2: insurance claims data. Right. Um, but historically, we'd never be
S2: able to stop this if I try to submit this
S2: and I'm running harmonic. We do know that this is
S2: sensitive data. So we've come up, we see we can
S2: see this is insurance claims data here. And the reason
S2: is that this has bounced off our language models. where
S2: we have a small language model that's been trained just
S2: to look at insurance claims data, understands it very well,
S2: doesn't matter to us if it's data from Chubb or
S2: Beazley or Hiscox or whoever, right. Because because the model
S2: understands generically what insurance claim data is, just like you
S2: do and I do. Right. We could recognize claims from
S2: all those companies because we know what one is. Right.
S2: So you don't need to do the old world of
S2: exact matching rejecting on on things goes away. And instead
S2: we can have these, you know, much more higher order
S2: approaches to stopping our sensitive data leaking out. So this
S2: this is completely.
S1: This this is the real experience here. This is not
S1: like a demo. Like you actually press enter and then
S1: this popped up.
S2: Yeah. And so right now this has not gone to Google.
S2: This data is is still with us in the browser.
S2: But I've given in our example here we have the
S2: option to ignore harmonics. I'm going to ignore. And now
S2: the data is gone. Right. We've let it go out
S2: of the door and it's it's sat with Google. Gemini
S2: is going to do its thing and start to start
S2: to give us a response here. But if I come
S2: to the harmonic portal now, and we'll walk through a
S2: little bit more of this in a minute, but we
S2: have logged and audited this. So you can see that,
S2: you know, just a minute ago this was me into Gemini,
S2: which we consider a high risk the public edition. And
S2: I ignored the intervention. And you can go and see
S2: the actual prompt data that was put in in this case.
S2: And there's a lot more we can we can dig into.
S2: But that that's like the if you want to like
S2: the flow is, is is that is the core flow.
S2: But as I mentioned, the kind of the starting point
S2: for most organizations, even before they get to that is
S2: really just trying to understand, you know, what is going
S2: on in the business today because most of them don't
S2: have that visibility. And so we start with that. And
S2: so you've got usage and adoption here where we can
S2: start to show, you know, the number of apps and
S2: the categories that they exist in.
S1: And the apps would be things like Gemini, ChatGPT anthropic
S1: or what? How do you differentiate an app?
S2: Yeah. So so we started out at harmonic just looking
S2: at JNI specific apps, right. Like ChatGPT and Gemini. I
S2: think very quickly that distinction goes away. Right. Because pretty
S2: much all SaaS is wrapping JNI features into itself at
S2: the moment.
S1: Yes.
S2: So we're essentially expanding and have expanded harmonic to look
S2: across the whole stack of your enterprise apps because and
S2: so all of these are AI enabled apps. On the
S2: right hand side that we see is is being active here.
S2: And then you've got newly discovered, we can start to
S2: show outliers, break it out by the category of application
S2: that we're seeing. So this is broader than just the
S2: core apps.
S1: That makes more sense right. Like you said AI is
S1: just an instance. Yeah. It's like it's like saying, hey, um,
S1: are you a database company? Right. Um, and it's like, uh,
S1: what do you mean? We use a database? It doesn't
S1: mean doesn't mean we are a database company. So I
S1: just blends into everything it does. So at that point
S1: it's not it's it's protection from I if you're using
S1: an AI app specifically, but really it's all the same stuff.
S1: You're pasting something that shouldn't be going into a form.
S2: Yes. Exactly. Right. And so for us, ultimately, the difference
S2: between this data going into a Dropbox public folder or
S2: going into Gemini is like, what's the difference really? There is,
S2: there is I think there is a little bit of
S2: a difference because some of these there's something a little,
S2: little insidious about how some of them are collecting and
S2: training on the data that's going in. And there's obviously
S2: this explosion in AI apps that wasn't like no one
S2: was campaigning to get workday installed as an employee. But
S2: but they are campaigning to jump into tools that automate
S2: bits of their job. Right. So I think I think
S2: there is a distinction in kind of in one aspect,
S2: but but for the most part, it's all the same, right?
S2: It's data leaking out of the business and whether it's
S2: going into AI or elsewhere, then harmonics going to help.
S2: But our focus for use case one has been all
S2: about AI adoption. And and so it's sort of giving
S2: that visibility and then allowing you to put the right
S2: controls in place. And and just to show you one
S2: more kind of cool thing that, you know, we have
S2: this whole detection catalog, we're continuing to expand, but you
S2: can see the types of things we can spot, right.
S2: M&A data is obviously absolutely critical. How would you spot
S2: that leaking out historically really difficult. But we've got models
S2: that understand what that looks like. And so instead of
S2: it being a rules based approach, we have these human
S2: readable data definitions that explain to the model like what
S2: is what is that right? What is M&A data? Why
S2: is it important. So we can interact with the end
S2: user and coach them and nudge them appropriately.
S1: That makes sense. Prompts rule the world. I mean ultimately
S1: those are prompts. And prompts are the intelligence.
S2: That's right. And then but then to back it up,
S2: you need a model that's got the right set of
S2: training data and is fast enough to sit in line. Right.
S2: And that's kind of the core of our tech is
S2: is having built that, that data set, train these specific
S2: models and made them really fast. Um, so yeah, that's um,
S2: that's what harmonics doing essentially. So, so the goal with,
S2: with this of course, is you can, you can much
S2: more safely adopt generative AI. You've got some nice reporting
S2: that you can show your AI committee about who's doing
S2: what with the data, the fact that we're able to
S2: protect and intervene and coach the, the employees. Um, but
S2: but then, of course, the beauty is that we don't
S2: need to load up the security team with a bunch
S2: more work here because we're handling this automatically with the
S2: end users.
S1: Yeah, it's being outsourced to the user directly.
S2: Yeah, but at low enough volume and friction that they
S2: don't they don't feel it, which is. Yeah. You know,
S2: we only get in the way when they're going to
S2: expose the company to real risk. It's not just pinging
S2: on a, on a regex match. That's innocuous because they're
S2: doing something. That's fine. Right.
S1: This is really wonderful. I wonder, um, you're probably already
S1: thinking of this, but in the insights tab, do you
S1: have anything around known providers that they've just clearly said
S1: that they train on the data? So it's like an
S1: even higher risk.
S2: Absolutely. Yeah. I mean, and we can do the breakdown
S2: here between the public editions, the free editions and the
S2: ones you have an enterprise license for. So just because
S2: you have an enterprise license from ChatGPT doesn't mean that
S2: people are using that versus their home edition. Right. And
S2: they're logging in with their personal account. So we have a,
S2: you know, we consider the free edition higher risk precisely
S2: because of the training declaration that it that it has.
S2: And we can we can start.
S1: There you go. Training declaration. Hi.
S2: Yeah. So if we want to drill into that, uh,
S2: you know, here's where we've picked it up from. Um,
S2: and yeah, so, so OpenAI state that, uh, they may
S2: use your data to train and improve their models in
S2: that free edition. So, yeah, that's the visibility that we're
S2: giving the enterprise. And then you can put appropriate controls
S2: around it.
S1: Yeah. That's wonderful. And then you define a policy somewhere
S1: I imagine. Um, and that's what gets implemented.
S2: Yeah, exactly. There's a ton of, um, a ton of
S2: things that you can do to configure this, but we
S2: have a have a whole config designer we've taken instead
S2: of just having these these horrendously complex screens with 1000 controls,
S2: we've taken a more visual approach to building the config
S2: out and inspired by some of the great work that
S2: companies like Tynes and others have done recently, to make
S2: things much more user friendly in how you set this
S2: stuff up. And so there's there's a range of ways
S2: you can set up and configure it. And beyond that,
S2: you can also do a massive amount of customization around
S2: the intervention itself. So maybe you want your own logo
S2: and color scheme. You want to put your own security
S2: policy here. You've got an AI policy. You can link
S2: to it in in here and apply, you know, different
S2: controls to redirect employees to secure secure options and things
S2: like that. So depending on how you want to set
S2: it up, some some companies are much more draconian than others,
S2: of course, because they, you know, they're dealing with very
S2: sensitive data or they're highly regulated. Others are a little more, hey,
S2: we want to want to just trust the employees, but
S2: we are auditing and logging this stuff, so if they're
S2: really starting to push our data places, it shouldn't go.
S2: We can we can see that.
S1: Sure. And it allows for both of those situations. It's
S1: more strict or more open.
S2: Yeah that's right. Yeah.
S1: Yeah. This is really great. Um, what what are you
S1: working on next that you can talk about? Like, what
S1: are you excited about? Uh, new threats or new situations
S1: you're trying to address?
S2: Yeah, we're continuing to build out our coverage to, you know, cover.
S2: You know, as I mentioned, beyond the kind of core
S2: gen AI sites and gen AI enabled SAS, we're going
S2: to build harmonic out over time to cover essentially everything
S2: going through the browser. Uh, so it's, you know, you
S2: can see the movement of the enterprise towards browser based
S2: access to most of their services and applications, and we
S2: want to be the essentially the data protection layer for
S2: everything that goes through there. Uh, so that's that's kind
S2: of directionally where we're headed and we're busy building out
S2: a out a bunch of integrations as well at the moment. We.
S2: Next week we're rolling out Okta Integrations. We have entra
S2: ID as standard at the moment, so we're continuing to
S2: add to things like that and building out more insights
S2: is kind of next so that you can start to see, well,
S2: what are the types of prompts that are getting used
S2: by different teams in the company? You know what, what
S2: are our use cases as a business here and and
S2: where are the risks within that. But but the goal
S2: is that this is really more of an enablement tool for,
S2: for gen AI than, than just a data protection tool,
S2: because companies obviously want to be adopting this technology and
S2: we can let them do it safely instead of just
S2: blocking everything where a lot of them sit today.
S1: Yeah. Interesting. You mentioned about the use cases like that
S1: could be a really cool, like you said, a business insight.
S1: It's like everyone's trying to get help with these architecture
S1: diagrams or whatever. It's like, okay, well let's go solve that.
S2: Exactly.
S1: That's pressure that needs to be relieved.
S2: What we found in a couple of instances is the,
S2: you know, the CSO is part of the AI committee,
S2: and they get given kind of the the tools, responsibility
S2: to implement some controls around this, and we give them
S2: the ability to come back to the business and say, hey,
S2: did you know, here's the set of things that we're
S2: using today. What do we think about this? It's a
S2: good starting point for the conversation of which, you know,
S2: we've got obviously teams that want to use these types
S2: of tools in these use cases. Are we going to
S2: standardize on some of them. Are we going to block
S2: like what's our policy. Right. And and I think it's,
S2: it's I think where the security teams often go wrong
S2: historically has been, you know, we get seen as the
S2: Department of No. And it's it's kind of a blocker.
S2: And I think this is an opportunity to say, well, hey,
S2: look we understand you need to do A, B and
S2: C because we can see it. Here's a secure way
S2: to do that. Right. And you go and talk to
S2: your colleagues, talk to the departments and enable them to
S2: be successful. And I think those conversations go pretty well.
S1: Yeah. Well absolutely love it. It's the best implementation I've seen.
S1: I feel like you're really, really in touch with the problem. And, um. Yeah,
S1: I think your history with the previous company, uh, gives
S1: you a lot of, uh, advantage there.
S2: Yeah, yeah. No, it's. I learned a lot of lessons
S2: on that journey. And this time around, being based in
S2: the Bay area always helps when you get. You get
S2: started as well. It's just such a great place.
S1: Ground zero. When? When everything is blowing up. Right?
S2: Yeah. Yeah. Yeah. It does feel like a kind of
S2: a new industrial revolution. And this is the heart of it.
S2: So great to be here for it.
S1: Well, awesome. Well, how can people find more about the company?
S2: Yeah. I mean, harmonic security is is the starting point
S2: on the web.
S1: Great domain.
S2: Domain? Yeah. It's, uh, pretty pretty good for that. Um, but, yeah,
S2: I would say we we love jumping into demos straight away. Uh,
S2: we can roll out, as I said, in 30 minutes.
S2: So a pack is really easy for us to spin up,
S2: and we start to give you those insights in the pack,
S2: which then helps to inform what happens next. So if
S2: you've got companies that are starting to think about that
S2: as their step one inventorying what's happening with Gen I
S2: in the business and thoughts about UI act and things
S2: like that coming down the line. Right. We're a great
S2: first step for that. But then we also have the
S2: controls that come next. So if anyone's interested in that,
S2: we'd love to speak to them. Happy. Happy to jump
S2: on a call personally with anyone that's excited about what
S2: we're doing.
S1: Very cool. Well, thanks for the conversation. I really enjoyed it. And, um, yeah,
S1: I'm sure you're going to get some interest from this.
S2: Yeah. Thanks, Daniel. Been a been a pleasure, as always.
S1: All right. Take care. Thank you. Unsupervised learning is produced
S1: on Hindenburg Pro using an SM seven B microphone. A
S1: video version of the podcast is available on the Unsupervised
S1: Learning YouTube channel, and the text version with full links
S1: and notes is available at Daniel Miessler newsletter. We'll see
S1: you next time.