The AI Control Loop: The Enterprise AI Accountability Moment – with Shayne Higdon of Wallarm

0:01 [SPEAKER_01]: Hello listeners, today we are dropping the final episode in our series entitled the AI Control Loop.

0:08 [SPEAKER_01]: How Enterprise is govern the AI they've already deployed, sponsored by our friends at Wallarm.

0:13 [SPEAKER_01]: Wallarm is the AI Control Platform for Enterprise AI, protecting every AI workload, API, and application in production, giving CSOs the governance they need and CIOs the speed they demand.

0:26 [SPEAKER_01]: Organizations choose Wallarm for a complete inventory of APIs, AI agents, and AI apps using patented AI ML-based threat detection, and blocking the operates at production speeds.

0:40 [SPEAKER_01]: In our final episode, we are joined by Shane Higden, while I'm CEO, who closes the series by examining what the accountability moment demands from enterprise leaders.

0:50 [SPEAKER_01]: What a mature AI governance model needs to prove, rather than promise, and what the next 12 to 24 months look like for organizations that get this right.

1:01 [SPEAKER_01]: Shane, thanks for being on the show today.

1:03 [SPEAKER_01]: Thank you for being on code story.

1:05 [SPEAKER_01]: Thanks a lot.

1:06 [SPEAKER_01]: No, I really appreciate you having me.

1:07 [SPEAKER_01]: I'm looking forward to it.

1:08 [SPEAKER_01]: Absolutely.

1:09 [SPEAKER_01]: Me as well.

1:10 [SPEAKER_01]: Really excited to dive into our topic for today, which we'll get in just a second.

1:15 [SPEAKER_01]: But before we do, tell me in my audience a little bit about you.

1:19 [SPEAKER_00]: Yeah, so I'd been an enterprise software for about 25, 26 years.

1:24 [SPEAKER_00]: I started my career as a pre-sales consultant many years ago at a company called BMC Software.

1:30 [SPEAKER_00]: Largely grew up at Quest Software, where I did a lot of different things there.

1:35 [SPEAKER_00]: Ran merges and acquisitions created a corporate venture arm.

1:39 [SPEAKER_00]: Ran a couple of business units in the application performance management space, the desktop management space,

1:45 [SPEAKER_00]: And then went back to BMC between there I ultimately ran an identity and access management company that we sold to RSA.

1:54 [SPEAKER_00]: And then I went back to the MC software where it was president of the division focused on performance and analytics.

2:03 [SPEAKER_00]: And then left after the exit to KKR.

2:07 [SPEAKER_00]: And I had just played around in the market leveraging new technologies, looking at new technologies like blockchain and other things.

2:13 [SPEAKER_00]: and then found myself here trying to help out Waller.

2:17 [SPEAKER_01]: Fantastic, it sounds like you've had an epic career and done some amazing things.

2:21 [SPEAKER_01]: It sounds like it's been an interesting path you've walked.

2:24 [SPEAKER_01]: Let's dive into the meat of the today, then.

2:25 [SPEAKER_01]: So a title for the episode today is the Enterprise AI Accountability Moment.

2:30 [SPEAKER_01]: Before we go too far, why is now the Accountability Moment for Enterprise AI?

2:36 [SPEAKER_00]: AI really stopped being a side project.

2:39 [SPEAKER_00]: I think as individuals leveraging things like chat, GPT or GROC or other models that were assistive in nature, it was a neat thing, however about 18 months ago, most of what

2:56 [SPEAKER_00]: I saw inside the enterprise was a chatbot bolted on to support Q trying to do things something a few power users might have played with on their own laptops but now you've got so many organizations that are allowing it to touch production data.

3:13 [SPEAKER_00]: They're calling APIs, they're making calls that affect

3:18 [SPEAKER_00]: A customer before a human can ever take a look at it.

3:21 [SPEAKER_00]: And this whole idea of human in the loop is still important.

3:25 [SPEAKER_00]: But when I talk to CSOS now, the question has changed.

3:30 [SPEAKER_00]: It used to be, are you using AI?

3:33 [SPEAKER_00]: Now, it's what did your AI do last week?

3:36 [SPEAKER_00]: Or, and can you prove it?

3:38 [SPEAKER_00]: For importantly, that shift really has less to do with, I think, the underlying risk.

3:45 [SPEAKER_00]: Being new and more to do with the exposure, getting concrete enough to really be focusing at a board level.

3:54 [SPEAKER_00]: What are we doing?

3:55 [SPEAKER_00]: How are we making sure that our agents, the way we're deploying AI is not giving hackers keys to the kingdom?

4:05 [SPEAKER_00]: Are we aligned with regulatory deadlines and requirements?

4:09 [SPEAKER_00]: I think that's the accountability moment and it's less a slogan today and really more of a problem to get our arms around, right?

4:19 [SPEAKER_00]: The three different audiences are asking the same question.

4:22 [SPEAKER_00]: It's the management team, the board, and customers at the same time.

4:26 [SPEAKER_00]: Companies want to make sure that if I'm going to do business with you, a year leveraging AI, that you're protecting the assets of the company, which has a customer includes my data,

4:39 [SPEAKER_00]: you've got to do the right thing to be accountable to have transparency and to be audible.

4:44 [SPEAKER_01]: I really like how you put that, especially the part we said AI is no longer a side project.

4:49 [SPEAKER_01]: Become a foundational element that is expected.

4:52 [SPEAKER_01]: But what is changed between the early days of AI experimentation, right?

4:56 [SPEAKER_01]: Maybe that's the side project era.

4:58 [SPEAKER_01]: And today's enterprise AI deployment that makes accountability such a pressing issue right now.

5:03 [SPEAKER_00]: Like I said, when early on, it was just you and I leveraging chat, GPT.

5:07 [SPEAKER_00]: It was really individualistic.

5:09 [SPEAKER_00]: It might have been assistive.

5:11 [SPEAKER_00]: It was I stopped going to Google to do a search.

5:15 [SPEAKER_00]: Instead, I would choose one of these interfaces.

5:19 [SPEAKER_00]: to be able to ask a question.

5:21 [SPEAKER_00]: Someone may have had a chat GPT tab open or something like Microsoft Co-Pilot helping them write code.

5:28 [SPEAKER_00]: If that person left the company, the whole pad of how a particular thing was getting written left with them.

5:36 [SPEAKER_00]: What's that?

5:36 [SPEAKER_00]: What mini-call tribal knowledge?

5:39 [SPEAKER_00]: It was contained by default, right?

5:41 [SPEAKER_00]: It was in, if you were writing code, it was in a repository.

5:45 [SPEAKER_00]: It was, you had a backup from a developer perspective, so someone could take over.

5:50 [SPEAKER_00]: I think what's different now, though, is that AI is starting to be wired into the systems and they're rethinking the workflows.

6:02 [SPEAKER_00]: How can I take a workflow?

6:04 [SPEAKER_00]: And first of all, can I make it agetic?

6:06 [SPEAKER_00]: But then, there's just completely different workflows that simply weren't possible because of machine speed where humans couldn't have done them in the past, right?

6:17 [SPEAKER_00]: So now, an agent has access and context and in a growing number of cases, it can act on its own.

6:25 [SPEAKER_00]: And honestly, I can call an API, I can trigger an integration without anyone signing off on it.

6:31 [SPEAKER_00]: I think that's, it's connected to customer data internal systems that the risk, the profile and risk associated to it just gets bigger.

6:42 [SPEAKER_00]: We call it in cybersecurity if something goes wrong.

6:44 [SPEAKER_00]: The blast radius, it just turns into a different problem entirely and I put it this way.

6:54 [SPEAKER_00]: to AI actually being one of the things doing the job, right?

6:59 [SPEAKER_00]: And it's what we're calling a Gentic operators.

7:02 [SPEAKER_00]: So how can a company, whether you're a vendor like Walmart, or whether you're a retail company, or whether you're a manufacturing company, how do you leverage the proprietary things that you do?

7:16 [SPEAKER_00]: and create agentic operators on top of that to help automate and make your workflows and make your business much more optimal and efficient.

7:26 [SPEAKER_01]: That makes so much sense the way that you put that and the agents are essentially going and doing the work of a person and you would

7:35 [SPEAKER_01]: hold that person accountable to do those actions, but now we need to be able to hold AI accountable.

7:41 [SPEAKER_01]: And when we talk about AI accountability, what does that actually mean in practical terms, right?

7:46 [SPEAKER_01]: So we can eat, touch, I think you can touch around or dance around this a bit, but when we're talking about, are we talking about visibility, auditability, enforcement, ownership, or all of things?

7:57 [SPEAKER_00]: It's really all of it, right?

7:58 [SPEAKER_00]: So I personally try to resist the temptation to just pick one because I think most vendors while I'm included, if we're not careful, we're going to just pitch whatever piece we're the strongest at, right, many times.

8:11 [SPEAKER_00]: So it starts with knowing, I think, what AI exists in your company.

8:15 [SPEAKER_00]: So can you do an inventory of where things running and who own them, but you'd be surprised at how often the first question doesn't really have a clear answer.

8:25 [SPEAKER_00]: Right?

8:25 [SPEAKER_00]: From where you need to know what it can touch and reach to what it's actually doing at runtime, not just what it was designed to do, right?

8:33 [SPEAKER_00]: So auditability really, really matters, but evidence, you assemble after something has already happened.

8:40 [SPEAKER_00]: It's a record, right?

8:41 [SPEAKER_00]: I want to record what happened, but it does not allow you to control what's going to happen.

8:47 [SPEAKER_00]: Right?

8:47 [SPEAKER_00]: So the piece that I think people underestimate is the enforcement.

8:52 [SPEAKER_00]: The ability to stop something before the risk turns into a real incident, not just right it up afterwards, right?

8:59 [SPEAKER_00]: So when I think about a lot of our customers for Ballar, we've been in line enforcement of transactions for about 12, 15 years.

9:09 [SPEAKER_00]: Many of our customers like to hear that, hey, if something goes wrong, you can block.

9:15 [SPEAKER_00]: You can enforce, you can do something.

9:18 [SPEAKER_00]: And in that scenario, that's great to hear, but many of our customers are also afraid that if I do block something, if I do stop something, I'm going to break the application or the workflow, and I don't want to do that because maybe it's a part of my supply chain.

9:32 [SPEAKER_00]: In a world where agents are actually doing something and agents may not be able to reason their way out of a problem.

9:41 [SPEAKER_00]: We think I think that there is going to be a real interest in being able to enforce to block in real time agents, in particular, non-human identities, right?

9:53 [SPEAKER_00]: Where agent goes rogue, no questions ask, we just shut it down.

9:58 [SPEAKER_00]: We block it in real time.

9:59 [SPEAKER_00]: I think we're going to see that more and more than we have in the past.

10:04 [SPEAKER_01]: Yeah, certainly.

10:05 [SPEAKER_01]: I think that's going to have to be a requirement and just it's clicking with where things are going as organizations race to deploy AI because as we talked about, it's not a side project anymore.

10:16 [SPEAKER_01]: It's the real deal.

10:17 [SPEAKER_01]: It's foundational.

10:18 [SPEAKER_01]: How should CIOs balance the speed of transformation with the responsibility to govern it effectively?

10:24 [SPEAKER_01]: This is an age-old question of

10:26 [SPEAKER_01]: how fast you move and break stuff versus how much you provide the right governance and boundaries in my right places.

10:34 [SPEAKER_00]: I don't think speed and governance are actually opposed to one another.

10:39 [SPEAKER_00]: I do crossfit and in that I've had my coach tell me before slow is smooth as fast.

10:48 [SPEAKER_00]: And it's a similar concept right here that I think a false choice that gets repeated a lot, good governance is what lets AI scale really past the pile of stage without someone in security or legal for that matter hitting the brakes and saying six months and stop you're done.

11:06 [SPEAKER_00]: And I've seen that happen, right?

11:07 [SPEAKER_00]: A team ships fast, gets traction,

11:10 [SPEAKER_00]: And then runs to a strict security review or a compliance question that nobody thought about at the start, right?

11:17 [SPEAKER_00]: And the whole thing stalls when it should actually be accelerating.

11:22 [SPEAKER_00]: So I think good governance upfront, the organizations that actually move the fastest over the

11:29 [SPEAKER_00]: I don't know, I'd say a couple of years of time horizon or the ones that actually build a trusted controlled path for AI adoption so that they're not relocating and trying to help convince everyone to trust every time they want to expand the footprint of AI in the enterprise.

11:46 [SPEAKER_00]: So I think the CIOs job in this new world and this is many see this as an extension of AI

11:57 [SPEAKER_00]: The Seattle's job, I don't think it's to slow down to make it safe.

12:00 [SPEAKER_00]: It's to make it safe enough so that speed doesn't really hurt.

12:04 [SPEAKER_00]: It doesn't really matter, right?

12:06 [SPEAKER_00]: And I think that's what's really important.

12:08 [SPEAKER_00]: This idea of slow is smooth as fast.

12:11 [SPEAKER_00]: And so if you do the right diligence, it's up front to really document.

12:15 [SPEAKER_00]: And

12:16 [SPEAKER_00]: have a pretty good understanding as to what you're doing, how you're going to be compliant, how you're going to audit, who's going to touch what, then you can begin to accelerate, you've got the proper security measures in place.

12:28 [SPEAKER_00]: So the by the time, the application, the agents or in production, the models that you're using, you're pretty confident that you've provided the necessary guardrails to be safe.

12:40 [SPEAKER_01]: Certainly, and I really like the line you said there from CrossFit.

12:44 [SPEAKER_01]: I think that illustrates the way to go forward here and where compliance and governance and innovation and speed shouldn't be mutually exclusive.

12:55 [SPEAKER_01]: But why are traditional governance and security models struggling to keep pace with the way that AI is being adopted across the

13:03 [SPEAKER_00]: They were simply built for a slower, more predictable world when I think about machine speed and when in attack occurs, you've got seconds before things are beginning to be exfiltrated.

13:16 [SPEAKER_00]: I think most governments today still runs on these kind of static inventories of systems and data and accordingly access review with who had access to what and what's yet to station.

13:29 [SPEAKER_00]: I think someone on the compliance team reading through logs after the fact is just simply it's antiquated.

13:35 [SPEAKER_00]: It's just simply too slow.

13:37 [SPEAKER_00]: And I think the model assumes the thing that you're governing does it change much between reviews, right?

13:44 [SPEAKER_00]: But that's not the case anymore, right?

13:46 [SPEAKER_00]: AI doesn't hold still.

13:48 [SPEAKER_00]: It doesn't stop.

13:49 [SPEAKER_00]: It doesn't wait for things to happen, right?

13:51 [SPEAKER_00]: It can call a different

13:53 [SPEAKER_00]: application, it can call a different API tomorrow that it did yesterday so the patterns are not the same.

13:59 [SPEAKER_00]: You can't govern something I think that operates continuously at machine speed with a process that simply checks things what's the coolest, just not going to happen.

14:09 [SPEAKER_00]: There's a real mismatch and a tools gap.

14:12 [SPEAKER_00]: when you try to do that.

14:13 [SPEAKER_00]: And so, static governance was really never built for a system that does a wait for you to look at.

14:18 [SPEAKER_00]: Right, and I think that's important.

14:21 [SPEAKER_00]: So you're going to have to, if it always on approach to the governance model and then being able to flag things that are outside the bounds of normal.

14:28 [SPEAKER_01]: Right on, that's totally clear.

14:29 [SPEAKER_01]: It was not what it was built for.

14:31 [SPEAKER_01]: And given those challenges, how should boards and executive teams evaluate whether their organizations are truly ready to scale AI safely and responsibly?

14:40 [SPEAKER_00]: I think they should really start with, can you tell me what AI is running across the company right now?

14:48 [SPEAKER_00]: And who owns it?

14:49 [SPEAKER_00]: It's a simple question, but today it's hard in many ways to figure that out.

14:54 [SPEAKER_00]: I've had CEOs tell me, I've got an AI first agenda and I told the company that we're going to be AI first and I've let people from various departments go roll your own model,

15:10 [SPEAKER_00]: And I think that's been in some cases from S, because you lose sight of who's doing what, right?

15:16 [SPEAKER_00]: And so if that takes three weeks or six people to assemble, I think that's your answer right there is that it's fairly difficult.

15:25 [SPEAKER_00]: The hard to follow up I think is what data it can touch, what systems it can reach, and then whether or not you can detect and stop that risky behavior.

15:33 [SPEAKER_00]: The other thing that we're seeing is that how do you, when you start moving towards an AI first approach, how do you look at token spend?

15:43 [SPEAKER_00]: How do you allocate token spend to various departments?

15:47 [SPEAKER_00]: You're going to get one bill from anthropic or you're going to get a bunch of different bills, right?

15:51 [SPEAKER_00]: You may get a

15:52 [SPEAKER_00]: When AWS build using bedrock, which has all the front-tier models, and at some level, as the CFO, you're seeing these bills that you're having to pay for in tokens, but how are you then breaking that down and understanding that Noah, who's developing an application, is spending this amount of tokens on a monthly basis to write that, and how productive is he.

16:15 [SPEAKER_00]: chains in the sales organization and he's spending to write an agent or skill to do a bunch of things to prep for various sales calls.

16:24 [SPEAKER_00]: And so getting your arms around that I think is more difficult.

16:27 [SPEAKER_00]: And so I think the real board level question is pretty simple.

16:32 [SPEAKER_00]: Even if the answer usually isn't, can you prove your AI's operating inside the boundaries you intended right now, but it can't be last quarter's audit is the way to look at it.

16:43 [SPEAKER_00]: So how do you have this real-time dashboard that at any moment, if as a CEO, you're asked that you can generate a point in time, but just in time inventory for all things AI across your enterprise.

16:58 [SPEAKER_00]: It's going to be hard to get there.

17:00 [SPEAKER_00]: It's going to take a lot of planning up front, but I think that is the next step that a lot of boards are going to expect good stuff.

17:07 [SPEAKER_01]: Okay.

17:08 [SPEAKER_01]: You said something there that I think my aunt just wanted to dive into a little bit more about what does an enterprise need to prove, right?

17:15 [SPEAKER_01]: You said it prove that it can run within the boundaries.

17:17 [SPEAKER_01]: What is the mature AI governance model actually need to prove in doing that?

17:22 [SPEAKER_01]: Not just promise.

17:23 [SPEAKER_00]: Yeah, so it needs to show that it's actually working continuously.

17:27 [SPEAKER_00]: Just not producing a good story once a year.

17:30 [SPEAKER_00]: Hey, we've adopted AI.

17:31 [SPEAKER_00]: This is what we've done.

17:33 [SPEAKER_00]: It needs to specifically and concretely show that AI assets across the company.

17:39 [SPEAKER_00]: are being discovered on an ongoing basis, not just inventoryed once and then thrown away for gotten that each one has an owner, I believe that we're going to see more and more organizations having an agentic manager, right, a person that is going to manage, and I don't know what the ratio is, one person to 50 agents or 80 agents or 100, I don't know what that percentage is going to be.

18:05 [SPEAKER_00]: But I think we're going to see that more and more because it needs to show that those systems what they did, what policies were applied, it needs to create a clean record of where something violated that policy and then what did the organization do about it?

18:20 [SPEAKER_00]: Right?

18:20 [SPEAKER_00]: So I think that's the real dividing line is whether that evidence gets generated as a byproduct of a system running.

18:29 [SPEAKER_00]: or whether someone has to go build it for scratch the week before and audit.

18:34 [SPEAKER_00]: Honestly, I've seen both, and you can tell within the first five minutes of a meeting, which one the company's doing.

18:41 [SPEAKER_00]: So I think that's a real test of maturity for organizations, a running record of control that exists, or not, right?

18:49 [SPEAKER_00]: And then if anyone asks for it that week, not a policy statement, somebody wrote down just once and said, hey, this is what we do,

18:56 [SPEAKER_00]: But actually, proving, showing the report, the evidence, like I said, I call it just in time, I inventory, almost like just in time, supply chain.

19:07 [SPEAKER_00]: We're going to have to do the same thing, because if you allow your organization.

19:12 [SPEAKER_00]: the freedom to decide what they want to use for whatever their business case, their workflow, their function, then you're going to have to give them, you're going to have to have some way of casting a wide net to always be understanding.

19:29 [SPEAKER_00]: We call it shadow AI, so as companies are leveraging this and developer going directly to an external model that's sharing a

19:39 [SPEAKER_00]: You probably don't want that to happen.

19:41 [SPEAKER_00]: How do you stop it and make sure that doesn't occur?

19:43 [SPEAKER_01]: Good stuff.

19:44 [SPEAKER_01]: I love that you said from five minutes into the meeting, you can really see the folks that are actually accomplishing this sort of thing and holding their AI accountability.

19:55 [SPEAKER_01]: And that's evidence that operationally, you know, they can support this in real-time.

20:02 [SPEAKER_01]: On that operational standpoint,

20:04 [SPEAKER_01]: how do these capabilities like discovery, run time monitoring, enforcement, et cetera come together to create that closed loop approach for AI accountability.

20:12 [SPEAKER_00]: You have to think of it as I think a couple of questions at one of which I just talked about getting continuous answers, not just once.

20:20 [SPEAKER_00]: Discovery is considered that map, right?

20:25 [SPEAKER_00]: What AI exists, where it's running on what infrastructure, what's it connected to?

20:30 [SPEAKER_00]: That gives you that disability that you may or may not have had,

20:34 [SPEAKER_00]: Then runtime monitoring is going to tell you what it's actually doing once it's in motion.

20:39 [SPEAKER_00]: I think which is often not the same thing as what it was designed to do.

20:43 [SPEAKER_00]: Enforcement though is what really closes the loop.

20:46 [SPEAKER_00]: You discovered something, you're monitoring it in runtime.

20:50 [SPEAKER_00]: At what point do you decide that you need to enforce a policy?

20:55 [SPEAKER_00]: Which is the ability to actually stop something before the consequence compounds.

20:59 [SPEAKER_00]: And that's where I was talking about earlier.

21:02 [SPEAKER_00]: I think that's going to be really important with not human identities.

21:06 [SPEAKER_00]: You're going to see an agent do something or go rogue or make a decision based on its context that you may not want it to make and you're going to want to enforce a policy.

21:16 [SPEAKER_00]: You're going to want to shut it down right now so that the blast radius is small.

21:20 [SPEAKER_00]: And then you're going to want to record of all of that.

21:22 [SPEAKER_00]: Now you're back to governance's documentation.

21:25 [SPEAKER_01]: right on.

21:26 [SPEAKER_01]: Okay.

21:27 [SPEAKER_01]: So stepping back and looking across our entire conversation, which has been really illuminating on how to hold AI accountable and what businesses need to actually do, what's the one mindset shift?

21:40 [SPEAKER_01]: Every enterprise leader needs to make.

21:42 [SPEAKER_01]: When it comes to AI security and accountability, what mindset shift do they need to make?

21:47 [SPEAKER_00]: It's a good question.

21:48 [SPEAKER_00]: I think an operating environment, it's AI is that operating environment.

21:53 [SPEAKER_00]: Now, it's not a single component that you ultimately just have a litmus test to say, I've got AI now.

22:00 [SPEAKER_00]: I've got models, or I've got APIs, or I've got identities, data, agents, workloads,

22:05 [SPEAKER_00]: So I think companies have to stop treating this as, oh, do I have the best model?

22:09 [SPEAKER_00]: It's a model problem that I've got, or I've got a prompt problem.

22:14 [SPEAKER_00]: I think the real challenge is governing what the whole connected system does.

22:19 [SPEAKER_00]: Right, when is it actually allowed to act on its own?

22:23 [SPEAKER_00]: Not protecting each of the pieces separately, right?

22:26 [SPEAKER_00]: You deploy an MCP server to connect to external services.

22:29 [SPEAKER_00]: When I look at all admit, I think this is the harder version of the problem for most tooling, but still built around the easier component level one systems.

22:40 [SPEAKER_00]: Pulling it all together, I think it's going to be really important because I don't think AI security is about locking down a model.

22:48 [SPEAKER_00]: It's about governing behavior across a system and a complex system at that that that doesn't respect the expectations that we have drawn for the organization, right?

23:00 [SPEAKER_00]: The AI agents oftentimes have if you've given them a lot of context they have a boundless way of being able to act as so how do you bound them without limiting their ability to be productive and efficient?

23:14 [SPEAKER_01]: awesome.

23:14 [SPEAKER_01]: I appreciate you walking through all that.

23:16 [SPEAKER_01]: I got one more question, Shane, so as listeners think about what's ahead.

23:20 [SPEAKER_01]: Where the industry is going and how fast it's moving.

23:24 [SPEAKER_01]: What should they expect the future of AI security and per our topic, the accountability to look like over the next 6, 12 or even 24 months?

23:32 [SPEAKER_00]: I think we're seeing now, and I'm not really good at predictions, but I think a few months, we're seeing it now, but I think we're going to continue to see most companies move from this enthusiasmistic.

23:45 [SPEAKER_00]: I'm using AI into check a box.

23:47 [SPEAKER_00]: to actual control requirements, they're going to need to make sure that they are boxing in and guard railing exactly how they're using AI because I think boards and regulators are going to keep asking questions and CEOs are going to say, and CIOs are going to say, we have a policy, I just think that's not going to be enough.

24:08 [SPEAKER_00]: I think a year from now, maybe less, I think runtime visibility and enforcement is simply going to be table stakes.

24:18 [SPEAKER_00]: where for any AI program, the pilot stage is over.

24:22 [SPEAKER_00]: It's not something a security team is going to ask for later, right?

24:26 [SPEAKER_00]: The timeline itself, I think, gets less interesting than really how it shakes.

24:30 [SPEAKER_00]: I think the gap widens between companies producing continuous evidence of how the AI is governed.

24:37 [SPEAKER_00]: and company still assembling their evidence by hand before review right I don't think it closes gradually I think it's I think it's gonna feel like to ventures like us it's gonna feel like a big bang it's gonna show up all it wants usually the first time one of the companies has an incident

24:54 [SPEAKER_00]: and the other doesn't or has one and has an incident and can explain exactly what happened within the hour.

25:00 [SPEAKER_00]: I think that's going to be the expectation of expectation about partners, customers, is that happened?

25:05 [SPEAKER_00]: So what actually changes over the stretch is proof, real time control with evidence attached to it, not a better written policy sitting in some shared drive somewhere inside the enterprise.

25:19 [SPEAKER_00]: And I think that's going to be the testament to organizations that are governing AI in those that are not.

25:26 [SPEAKER_00]: Poor those that are just earlier on their journey and are less mature.

25:29 [SPEAKER_01]: I think that's couldn't agree more Shane.

25:32 [SPEAKER_01]: I really appreciate being on the show today.

25:34 [SPEAKER_01]: It's very clear.

25:34 [SPEAKER_01]: And so you said in the beginning, which I really liked, AI is no longer a side project.

25:39 [SPEAKER_01]: Agents are doing the work of people.

25:41 [SPEAKER_01]: And as such, they need to be held accountable.

25:44 [SPEAKER_01]: Enterprises need to understand where and how AI is being used in the organization.

25:49 [SPEAKER_01]: Without the just-and-time AI capabilities that key reference, businesses won't be able to achieve AI accountable.

25:55 [SPEAKER_01]: Enterprises need to change the way they think change their mindset and understand the whole connected system.

26:00 [SPEAKER_01]: Understanding when the system is allowed to function on its own and when it needs to be restricted.

26:04 [SPEAKER_01]: As you said, as we talked, it's a hard problem to solve, but the time is now to start addressing it.

26:09 [SPEAKER_01]: So, really appreciate you being on the Shio Shainer's great conversation.

26:12 [SPEAKER_00]: Likewise, Noah, thank you for the questions, really appreciate it, and look forward to being here again soon.

26:19 [SPEAKER_01]: As evident from Shane's answers, the time is now for enterprises to address AI accountability.

26:24 [SPEAKER_01]: Without it, they'll be behind the curve in terms of security and proof to customers, investors, and the market at large.

26:33 [SPEAKER_01]: We hope you've enjoyed our series, the AI Control Loops, sponsored by our friends at Wal-R.

26:44 [SPEAKER_01]: If you'd like to learn more about the company, you can visit Wal-RRM.com.

26:48 [SPEAKER_01]: That's W-A-L-L-A-R-M.com.

26:53 [SPEAKER_00]: And thanks again for listening.