0:00

And now they're having to become AI experts and follow every new release every week. Meanwhile, the executive teams are pushing them to enable and open up to stay competitive. They have disabled full auto mode for most agents, and they require engineers and developers to basically manually review and approve every action. People will find ways around the controls if they don't enable them to get the job done. So completely agree. If you block them, you push them to do things that are definitely unsafe. So do you know what they did to handle that full auto ban? They put a permanent tape on the Enter key. This false sense of security is worse than no security, because when you don't have security, you know that you don't have security. When you believe you have security, but it has been bypassed and you have no idea how many thousand ways it has been bypassed. It is basically an unmanaged risk. An agent is really being anything that can autonomously call a model, then takes an action. Right. Uses a tool, accesses some data, it does something. OpenAI's own agents quietly just hijacked the German wiki, which is a dormant German-language programming wiki. Nobody was watching. The challenge is these agents are, by and large, acting as the employee, and it's very difficult to distinguish what's the employee and what is the agent acting as the employee at this point. I see when an AI agent spawns multiple sub-agents, I've seen real examples when a sub-agent is trying to hide something from me and tells the agent to not tell me. You can't ask an AI agent,"Give me your reasoning," and just trust it. Hey everybody, welcome to another episode of Monica Talks Cyber. With me today, I have actually a very dear friend from my industry. We have been talking for a while and I not only know him, I know a lot of people that he works with at one of the up- and-coming companies within AI. And as you know, I work so much with AI security and AI governance. So it was so natural to have this person on the podcast with me. Today we want to talk all about agentic security. We want to talk all about agentic AI governance. We want to talk about real challenges and problems that we're seeing in enterprises, and what you can actually do about it. So without further ado, let's bring him on board. Hey, Alastair, how are you? Welcome to the show. Hey, Monica. Great to be here. And real pleasure to talk to you today. Lovely. Can you share a few words about yourself to the audience and just share a little bit of, like, what you're doing and why are you doing it? Yeah. Quick background on me. So I'm CEO, co-founder here at Harmonic Security, which is focused entirely on how do we enable the workforce with AI at this next phase of working life we're experiencing right now. But prior to that, I was the CEO, co-founder at Digital Shadows, which is, I think, where we first met back in the threat intelligence industry. And I started that company in London in '11, way back when, we scaled up and I came to the US when we did the Series A and scaled the company from there, and then got acquired in '22. And then I set up Harmonic in '23, again to try and help accelerate safe AI adoption in the enterprise. And so I guess the sort of "why" for me, I mean, having been through one startup journey, I was kind of ready for some time out, to be honest. It's a pretty grueling endeavor, building your own thing, as you know yourself, Monica, but it just so happened that, you know, we exited in July. In November, ChatGPT came out and everything changed pretty dramatically. So I just became obsessed with the technology pretty much immediately. Like you, I'm running a bunch of my own agents at home. I've been building with my own AI setup from day one, really, and so I couldn't sit this one out, and I just realized that

the key pain point was going to be: 3:36

enterprise needs to get this stuff rolled out, but there's going to be all kinds of legal, security, and compliance challenges with doing that. So how do you make that happen? And that's really been my sole focus ever since we founded Harmonic. Yeah. And it makes a lot of sense because just like you've been privileged, when I was working as a CISO in 2022, actually working with emerging tech at that time, because ChatGPT was not out, AI was still in the form of emerging tech at that time. It's 70 years old, but still, you know what I mean in enterprises. And we were actually having machine learning— we had like huge teams of data science and machine learning. And I still remember when ChatGPT broke, and I had been working before that with national AI for Norway. So I had some AI governance experience. And when that happened, just like you, AI, AI security, AI safety became like the first priority. And I think we are privileged in that sense to get to work directly hands-on with these things as the technology is evolving. I mean, we're still in very, very, very early stages of adoption and getting that experience and having that possibility to now— don't get me wrong, I loved all my CISO roles, but when you're in a big corporation that is very bureaucratic and you have to do things that you have to do, you don't really get the chance to actually really use a lot of your time to build things that you would actually want to do. So I think in that sense, I understand where you're coming from and when that happens, you can't be in the shadows. You just can't. You have to get your hands dirty, right? Oh yeah. Every technology wave has told us you can't sit on the sidelines and wait for it to blow over. It just won't. You've got to get in there and use it yourself and enable it where you can, I think, and I also feel that privilege of having set up a company in 2023. I think any company that was founded before 2023 was based on a different set of principles and assumptions about the world and had to build out functions for a different era, really. And so it's a great privilege to be in it right at the start of this wave and building for it directly. So a lot has happened, obviously in just the last 2 or 3 years. And I was just recently reading the report from IBM this year, so the 2026 Cost of a Data Breach Report that came out at the end of July. And they do a good job—like Verizon has it, IBM has it, different companies have it, right? And what was so interesting about the data that came out this year is two-thirds of organizations still have no formal process to govern any unsanctioned AI use at all, right? When a breach does happen and it does trace back to shadow AI, it now costs on average$5.4 million versus the previous year, which was about $4.5M. And what I found very interesting, which was very deep in the report, was that according to the report, 92% of organizations that had any AI-related security incident or an incident related to that, 92% had no access controls at all on the AI tool that was involved when that incident happened. So not weak controls, not some level of controls—like none. And that's the gap that I see between LinkedIn AI conversations that are happening on social media versus what's really happening on the ground inside real companies, real enterprises, as I also work with a lot of them. When you see all of this from where you sit today, or you have been sitting for the last 2 or 3 years, what is the reality you see on the ground— like the most common, how the tools are being used, what the use cases are, how they're being abused, and what is it that 99% of CISOs are not able to say with confidence? Yeah. No, it's a great question because we're operating in a rapidly changing world. And I think the security teams, like I feel very sorry for them actually, because it was a tough enough job anyway, right before this wave came along. And now they're having to become AI experts and follow every new release every week, and what the implications are for their security as a business, and it's just impossible to stay on top of this. And meanwhile, the executive teams are pushing them to enable and open up to stay competitive. And so I'm close with a bunch of CISOs. I think we have a lot of friends in common, and a common refrain is they're just having to live with some more risk in this era than previously because of all of this—there's no way to shut it out. I think there's a kind of marketing that gets around the industry, and then there's the reality of what's really going on in most companies that I talk to, because I spend a lot of time talking to enterprises about exactly this challenge. And I think really, if we step back for a minute and just think about the eras we've just gone through in rapid succession. So going back to late '22, early '23, most of the risk there was about browser-based web use of AI. And I'm talking mostly from an employee perspective. We can talk about the other pieces in a minute, but I think that evolves. So I mean, that was immediate. It started with ChatGPT, but it became like thousands of different applications popping up pretty quickly. You've got some hosted in parts of the world you don't want your data going to as well, of course, and some that will train on the data going in. And that is still a problem today. And it's a bigger problem actually, because of the memory in these solutions and the personal accounts. So if you've got sensitive data that's piling into personal ChatGPT accounts, even though you have an enterprise version of it, well, that data is going with the employee to the next employer and onwards from there, whether it's sales pipeline or customer or IP. And so that is still a problem. But I think it sort of evolved from there. Then engineers got in on the act with Devin originally, and then obviously we've got, you know, Codex and Claude Code and Cursor at this point. And then the workflows they're able to kick off over MCP and otherwise. So that was kind of the next frontier. And then as I look at this year, I think what's really interesting is the rise of the knowledge worker's use of AI, which has really come about— I mean, Claude Cowork and now ChatGPT Work, I think probably the greatest examples, but you've got even Grok is having a play, you know, Elon with his Grok bot for enterprise, which is—it's fantastic. I love using those tools. But the risk is sort of different because you've got non-technical people hooking up inboxes, CRM, and email and whatever else to fire data around, sometimes autonomously with scheduled tasks. So I think we have all been on that journey with our workforces over that period. And so I think in terms of where companies are today, I would say it's highly variable. But step one was put a policy in place. So pretty much everybody got that together after a while. If you don't have an AI policy in 2026, then that's probably a good place to start. But I think most people do. I think then where it went, there's really only two choices that most companies made: like big, highly regulated companies basically blocked as much as they could and pointed everybody at Microsoft Copilot and did some sort of rollout of that. And it kind of sucks, to be honest, and the employees didn't want to use it. That led to usage of various types of shadow AI, as people were just trying to get their jobs done, being hindered by adoption. And at some point that became so much on the company and the security team that they had to open it up a little bit and start to plug other tools in. So we now see, you know, rollouts of Claude and ChatGPT and others in even like pretty highly regulated FS and healthcare companies. That's sort of approach one. And we can talk about agentic risk within that in a minute. But then I think the other path was, you know, and I see this more in like private equity and tech companies and so on, was a more laissez-faire, Wild West approach, shall we say, where policy goes out, everything's wide open, trust the employees and see what happens. And in that one, the security team is kind of screaming a little bit because they would love to put some control around this stuff, but they culturally probably can't. So all kinds of stuff is going on, and it's basically an unmanaged risk. And so now what we're seeing in this year is those teams are getting stung, you know, with some of the incidents like the ones that you're talking about and so on. So the security teams I think are getting a little more buy-in to putting more governance and control around that. So I think that's sort of step two, and then where it's going next—and I see this already— but as these things get rolled out, these companies that are highly regulated and were locking it down and they're now rolling it out—once it's rolled out, the next question is usually the CFO saying, "Well, hey, what's the ROI on all this stuff? What are the use cases? Is anyone even using it? You know, we're paying for ChatGPT and Claude and we had Copilot last year. Like, where's the value, guys? Because the tokens are mounting up." And so I think the natural evolution of this market is going to be towards showing the value, the ROI, making sure that the spend is leading to results. And yeah, tons more we can talk about in that area. And that makes a lot of sense because we see this spectrum, right? We see companies still going into this direction of banning things and believing that's going to be the right answer. The other is, just as you said, opening entirely AI to like, "Whatever, we'll trust the gods of tech" or whatever, and things will be fine, mysteriously. And obviously, the question around what does it bring to the organization? Let's address all three of them one by one. Okay, so looking at the banning part, it's very interesting. I've been saying that for almost three years now because when November 2022 happened and it came out, as you said, March— I clearly remember, March 2023 was the point where we reached the top of the hype curve and the whole world was like,"Oh my God," and this was generative AI. This wasn't even agentic AI, right? And people were like, "Oh my God, AI is going to cure cancer," right? And there were tools popping up every single day, and people were just grabbing whatever they could, bringing them into the organization. And most companies went like, "Block it, block it right now." And we know this from our industry. We know this pre-AI as well. Users always have clever ways to bypass security if you add too much friction to their day-to-day. This is something we've known for decades. This is not AI-specific, right? And I've seen now with AI, I have seen really in organizations that I'm not going to name names, of course, but I've seen real examples, Alastair, where companies came out with this centralized policy and they have disabled full auto mode for most agents, right, especially for developers and engineers. And then they require— they've mandated because they've disabled that auto mode, and they require engineers and developers to basically manually review and approve every action.

And I've been saying this a lot: 13:53

human-in-the-loop is not freaking scalable. We talk about human-in-the-loop, but you can't scale human-in-the-loop. So do you know what they did to handle that full auto ban? What did they do? They put a permanent tape on the Enter key. The tape. That's it. Just like a Scotch tape Yeah. is all that they needed to bypass in a clever way. So obviously the full auto ban is still in there. A human is in the loop through the Scotch tape, and it's just approving. Right. And I can see the visible frustration because in our industry we are like,"Oh my God, this is what happens."

Like, and I talk about it quite a lot: 14:37

this false sense of security is worse than no security. Because when you don't have security, you know that you don't have security. When you believe you have security, but it has been bypassed and you have no idea how many thousand ways it has been bypassed, now you have worse security. So what do you tell these organizations? Like, how do you help them? Yeah, I mean, what a great point. Maybe I'll just drop an anecdote of my own around this as well. So there's a healthcare insurance company that we're working with. And early on I met the Head of AI. So outside the security function is, okay, here's the Head of AI. And so I got to know him pretty well. And so I'm on a Zoom call with him and he says, "I'm the Head of AI, but I don't have access to ChatGPT." And so I said, "Well, what do you do?" And he said, "Well, I use this laptop." And he showed me on the screen his personal laptop that he uses for ChatGPT. And he said, "And so does my team." And I was like, "Wow. Well, one, I'm surprised that you're telling me this because, you know, but also, I mean, just what a great example of what you're saying, right?" People will find ways around the controls if they don't enable them to get the job done. So completely agree. I mean, I think I was almost making fun earlier of the Wild West scenario in a lot of companies. In some ways it's more rational than the blocking option because as you say, if you block them, you push them to do things that are definitely unsafe. Whereas if you provide safe ways for people to do things and you enable them, well, there's a good chance they'll use the safe way and not use a very unsafe way that happens to be outside your strict monitoring as well, so you don't even see it. So I think the happy path is obviously a middle ground of managed governance that I think has to start with visibility. I think you need to understand what the ground truth is today on what the employees are doing with all the tools, and you've got to meet the business where it is. Like, I think this is a bit of a choose- a-path moment for CISOs where they can either continue to be more of the gatekeeper blocker and be perceived as that internally, or become a partner to the business where you become this strategic enabler of AI,

where you're getting with your peers in the business: 16:38

"Right, what tools does marketing need? Like why is someone in marketing using this niche tool on a personal account? What use case are we not meeting with our existing toolset? Is it an education problem? They didn't even know that we can meet that use case via one of the tools that we have already bought? Or maybe we need to buy another tool and put some proper control and governance and an enterprise agreement around it?" I think doing that bottom-up— so understanding what the employees are doing, talking to the business peers— is the route to the happy path, and then putting like appropriate governance and control around it and making sure that, you know, customer data is not going to China or you've got, you know, you're in breach of HIPAA or whatever it might be. But I think just starting with a blanket ban doesn't make sense to me. And then I think keeping the Wild West and hoping the policy is going to fix it is just never going to cover it either. No, policies are just paperwork unless you actually implement them, right? So one of the pillars that I talk about when it comes to the AI governance programs that I have implemented for organizations and that I teach in my accelerator programs is controls and engineering. So, right, you can have all the data governance, you can have all the policies, but if you are not actually implementing them— so like just this example of what you're saying with data governance is so interesting because you can tell employees and educate them to not put sensitive data, especially into the public version of ChatGPT or even your own licensed version, especially depending on the sensitivity of the data. But then if you don't have classification happening in the organization, the data is not being classified and that control is not there, and then you don't have actual policies that prevent a paste or actually a block, a hook, or whatever it is to have some necessary controls and guardrails in place to actually prevent that action or prevent the leakage of it, at least in a good way, then you can do all the education and awareness in the world, but you're not putting the controls in place. So this is something I really want to go deep in with you about this governance and the things that you're saying. But before we do that, let's just take a step back, because we talked a lot about the two sides of the spectrum that we are seeing, right? And we talked about how the world has evolved in the last three years. And so what does agentic mean—like, everybody talks about agents, right? And then obviously you're talking about coding agents. You're talking about orchestrators. You're talking about workflows. You're talking about all different sorts of—like what does an agent mean? And especially like if you think about all the examples that have happened just in running risks, right? So we saw the OpenAI agents attacking Hugging Face's production infrastructure. This was the first publicly known fully autonomous AI attack. Anthropic talked about it earlier— they had talked about like AI-orchestrated attacks with China as a nation-state and so on. But it was orchestrated. And if you read the reports properly, they were not fully autonomous. So like if you talk about a really fully autonomous AI agent hack publicly known—doesn't mean that it hasn't happened before, it's just that we know that is the first example of something happening at that scale. Right. And then as if that was not enough, we just also recently read about, again, OpenAI's own agents quietly just hijacked the German wiki, which is a dormant German-language programming wiki. Nobody was watching. The agents made around 15,000 edits and used that private message board to swap tactics for cheating on evaluation tasks and hide their behavior. So this whole thing about like how they're seeking to game evaluation and assessment, and people talk about like alignment and misalignment, I'm like, look, we have never aligned AI agents—like they don't have ethics. So obviously there is naturally—we call it misalignment, but we don't really have alignment to begin with. But I've seen that with my own AI agents as well. Like I see when an AI agent spawns multiple sub-agents, I've seen real examples when a sub-agent is trying to hide something from me and tells the agent to not tell me. Like I have actually seen that in agents. So how do you first define "agent"? Because if you talk about governance, we need visibility, but we also need to understand what agents really are. How do you define that? And does that distinction matter when you talk about security? Yeah, I think as an industry we tend to get a little wrapped up in the semantics of all these things. And so I tend to try to think about it just in kind of the broadest terms, because "agent" just gets thrown around and it means all kinds of different things. So I bucket it out. First of all, I'm mostly ignoring the "threats from AI" piece, like the external attacks on you. So I'm talking about your usage and deployment of agents. That's my frame for this, and so I think about an agent as really being anything that can autonomously call a model that then takes an action. Right. Uses a tool, accesses some data, it does something. And that sort of broad definition allows me to think about kind of three buckets of these types of agents. So I think the first bucket, I think of the agents that are being consciously built by your engineering team in-house. So there's a set that you might be building— maybe it's for your own product, maybe it's for internal projects— but those are consciously being developed. They're going through a software development lifecycle. You're going to be putting controls around them. You should be red-teaming them and testing them in different ways. There's a bunch of specialists that help with that. I feel like those are obviously high risk, but the good thing is, I mean, you understand what's going on, right? They're your agents, they're in your control. You're managing and monitoring them within your program. I actually feel that's probably the lower risk for a lot of companies, because at least they're managing it, however they feel it. I think then there's a bucket, which is essentially agents are getting built into every product you already have. So they're getting in your enterprise whether you like it or not, via every SaaS vendor that you've got. And so, you know, whether it's Salesforce or another, there's plenty of agents that are popping up in those environments and there's definitely some risk around that, right? I mean, I think you have to configure packages appropriately. Everyone's rushing to bake AI into their product. And so you get some overzealous permissioning in there.

You know, I think that's sort of case-by-case: 22:34

look at the config in those apps. But again, I kind of don't feel like it's the biggest risk because again, there's some level of sort of sensible governance around it going on from the company that's deploying that software, or they're not going to be in business for very long. So there's definitely risk. Don't get me wrong, it could be enabling employees to take actions autonomously in ways that we don't want. So we should get on top of it, and take a conservative approach initially to enabling that until you really understand it. But I think probably the third one and the biggest one is really when the employees are kind of building their own or enabling their own in different ways, and that can take like a range of forms. But I think, you know, you've got engineers that are building things out for their own purposes, potentially in-house. But again, going back to the knowledge worker,

that's the one that I think about kind of the most: 23:18

who is deploying— I think of the scheduled tasks in stuff like Claude Cowork as potentially like incredibly valuable, but very high risk depending on what data you've enabled access to. So there's a ton in the config you can do. We have a guide on harmonic.security that explains how to sort of tweak the knobs and dials on stuff like Cowork and Codex, or ChatGPT Work, as it's now called. But the vanilla configuration of those things is like very risky to the enterprise. People just have full connector access; they're hooking up all these different, highly sensitive sources. They're well-meaning, right? But they're just blasting data around in all kinds of places. So that I think of as agents that are pretty high risk, and some of the agent-builder software that goes along with it. So I think that's probably where I see, like personally, I think from a workforce perspective there's tons of risk. And so I think again the key is like start with visibility rather than just, you know— there's clearly a posture and config piece that you need to apply, right? But assuming that you've got that ongoing or in progress, I think the next bit is understanding

what is actually going on right now: 24:17

what are the risks, what is running in my environment, who's spinning it up and what is it doing, and then what is the sensible set of governance to put on top of that? So whether you're governing the actions it can take—you mentioned identity and access, which is kind of obvious. I think with identity and access, the challenge is that these agents are, by and large, acting as the employee. And it's very difficult to distinguish what's the employee and what is the agent acting as the employee at this point. So you just need to get your arms around what they're able to do, I think on the device, and that's beyond what your EDR can tell you, which is basically what's running and what's its posture. Right. You've got to look at, well, sure, but what are the agents actually doing, right? What are the use cases that the employees have and what are the use cases the agents have, frankly? And then you can govern it. So I think what you were saying, it gets harder with like, you know, agents are non-human identities. Right. So I worked as Head of IAM for Central Bank before I did all my CISO roles and stuff, and I built like an entire IAM program, and IAM and IGA for just the human employees is hard enough. It's hard enough, right, to get that right. I see companies struggle with it; I still see a lot of companies do not have that level of control. But now you bring the agents into the picture because agents are non-human identities, but they still require that onboarding, offboarding— just to talk about the scheduled tasks. Imagine an agent itself, not just an employee, but an agent also spinning up a scheduled task because we gave an agent a goal or a couple of tasks to do. And in order to do those goals, the best way the agent decided is to build a couple of scheduled tasks. And they were built and they were just activated because of course, you have either the auto mode on or you have that Scotch tape that I was telling you about, whatever the reason, right? And now the employee leaves, the agent is still running, the scheduled tasks are still running. And the governing part of AI is you can't just do it with traditional cybersecurity and EDR. It's not going to get it. Like one of the things that I talk about a lot is when we talk about visibility, you can't ask an AI agent,"Give me your reasoning," and just trust it, right? So what I teach is, when I work with companies, but also what I teach in my accelerator, is how do you build that traceability and observability at OS level, at network level, and at agentic level? Because once you have all three,

you can corroborate that story that the AI agent is saying: 26:39

"Okay, now it makes sense." So what I'm trying to say with that is definitely we can't just rely on our tools. What do we need to do differently when we think about governing AI agents from what we know so far? And I understand that this is evolving so much, so tomorrow it's probably not going to be enough. But what do you think are the key things that every organization should be thinking about? Yeah, I think you're absolutely right that you cannot solve this just by being sat in one place— for example, EDR on the endpoint with the limited visibility you get. These AI operations, the agents that are running, they're taking action in a variety of planes. They're being created in a variety of planes. And tying it all together isn't possible from just one vantage point. And I think the companies that claim that they can or that they're bolting together various bits and pieces to try to do it, the reality is it's just not there today. And then the second piece I think you said is absolutely right, is that it's moving so fast that whatever the solution may be today is not the solution tomorrow. So whatever you're doing has to move at the speed that the wave's moving at in order to keep pace. I think, you know, the traditional vendors are just not in a position to do that. And that's becoming more obvious every day that they're, I think, falling further behind the curve. I think to more directly

answer your question around what can you do: 27:56

I mean, I think you have to plug in for sure on the endpoint as part of it. You have to understand which apps are running and what they're doing. You also need to be in the browser to see the actions that are happening through the browser, and which agents have been kicked off in that plane, and doing that natively across all of the browsers the employees are using, I think is a key part of it. You also need to understand what's going over MCP. So what the engineers are running locally and the processes being kicked off by them, but also the connector infrastructure that sits around things like Claude and ChatGPT. So if you've got your knowledge workers plugging in all kinds of different data sources through those connectors, remote MCP has to be covered as well. And then finally, even if you did all of that, you're still missing a ton of context around the agents, which you can only get out of, like, partly the APIs that the companies expose themselves that are changing, you know, on a weekly basis— you have to have the ability to plug into the latest APIs— but also you need to do your own custom hooks to actually insert yourself in the right bit of the workflow to be able to intercept actions before they take place. So you kind of need all of this. And I think, you know, there's no way that you can just do this from the EDR perspective or the SASE perspective. They just have the wrong mindset for this. EDR still thinks this is detection and response for AI. It's not, right? The SASE companies still think everything's about the network, and it's not. And it doesn't matter if you built a browser protection engine on top of that, it just still doesn't do it. So yeah, going back to your point about the CISO who thinks all AI governance is BS— I mean, well, maybe that's true of the Black Hat show floor, because if you walked around there for five minutes, suddenly every company was an AI governance company, right? It was like, you know, whatever protection companies and management companies are now AI governance companies, or GRC companies were badging as AI governance, or DSPM is now AI governance. It's like, no, you're not. Like, I just kind of wish everyone got back in their boxes and stopped pretending they were something else. It's just too confusing now for the buyers. But yeah, I think it is absolutely a new area and it's going to keep moving so fast, that delta between where it is and where all the legacy controls are is just going to be more obvious over time. Yeah, I think it makes a lot of sense because, like, not everything was SASE even before AI, like we already moved so much into like browsers and plugins being used as attack vectors. Right. And distinguishing— you talked about the second, so like you mentioned the three broad categories. And I think both the second and third categories are fascinating because obviously the third category is what the employees are building, bringing in, which you have absolutely no visibility over. And you must have that visibility at all these levels, because there's

also something very important: 30:32

like, there is no 100% security, it just doesn't exist, which means some hooks will actually defend you, and some hooks won't. People come with these like very broad, definite statements like, "Oh, do you not know that agents can bypass hooks?" I'm like, "Yeah, it's possible, but will every agent bypass a hook? No. Should you not have hooks in place? No, you should still have hooks in place because the whole idea is defense in depth, right?" Like if one control fails, another control—like you think practically, right? You have to think. And then talking about the second category, which is also very fascinating because we're 100% going to see— and okay, I say 100% just talking about how there is no 100%, let's say 99.9%— but I believe very soon we're going to see a large-scale SolarWinds-type cyber hack happening through the AI supply chain. I mean, this is not new, right? We have already seen Axios. We've already seen PyPI, like all these different Vercel incidents. Obviously they've been happening through AI supply chain attacks, but they have not been major. But imagine, like vendor management again is hard enough. I've done that in my CISO roles. And you know, like giving just a vendor a 100-question questionnaire is not security. It's not helping you, whatever answers you get. Maybe it's just a checkbox in your compliance list, but really having that understanding and visibility across the supply chain is just so crucial. You can't just look at one place. You've got to build defense in depth. And I keep on saying, exactly to your point, like, we are not doing this because we want to build 100% security. We're doing this to help you get visibility for building resilience when things do go wrong, because they will go wrong, right?

And I talk about this quite a lot: 32:20

we're living in the world of agents of chaos. There is no chaos going to zero. You can only bring some level of resilience to it. But when we're doing that, because there is no 100%, we still have to think about business. Like, I totally do not understand this behavior of some CISOs that security is the goal. Security is not the goal, right? Like, you have a mission and you want to promote that mission, whatever that is, right? Your company's mission could be healthcare. Your company's mission could be stability. Your company's mission could be whatever, right? You want to help your organization carry on that mission safely, securely, reliably. Right. That's what resilience is about, because resilience is built in peacetime so that you have it in wartime—like it's in place, like you need it in wartime. It's tested in wartime. So talking about all these things that you believe are necessary for governing agents, how does that connect to that business problem, that investment problem that we are still not really talking about? Because we have done that with cybersecurity, like we have seen the evolution of CISO leadership going to like, "Hey, security is not the goal, security is an enabler. We've got to think about the mission." I think we are still behind on that when it comes to AI governance and agentic security. How do we do that? Why is that important? Yeah, I think that's such an excellent point. Again, I think it's almost a defining moment for the security teams right now. Are they going to be that partner to the business that will enable the business objectives, or is it purely a gatekeeper function? And I meet people that have both perspectives, right? I had a conversation with a CISO literally last week, and I know him and like him, but we started talking more about the business aspect of,"Hey, what's the upside for the company in enabling this stuff?" And his attitude was like, "Not my problem, right? That's someone else's problem." And I was like, "Oh wow, that's interesting." That's how you don't belong in the C-suite, if that's what—I'm sorry. I was a little surprised because, you know, he's a very competent individual, where do you see your role stopping and like, what's the business—he might be, don't get me wrong, you have very technically competent and even security-competent people as CISOs who just have no understanding of how to drive a business. But, I mean, it strikes me that, you know, if you walked in three years ago and you're like, "Oh, here's my data labeling program and my..." you know, no one cares, right? They want you to tick the box and go away, to some extent. They care on some level, right? But now there's a huge opportunity, which is the board, the CEO, the CIO, the CFO— they all want to enable AI, right? It's conversation one, two, and three. And so like, how can you get in the middle of that, provide some value, be the smart enabler that's got the back of it? I think that's a huge career opportunity. And so to your point about it being an investment conversation more than a governance one, I think it comes down to the outcomes from AI that you can see. We have a huge focus at the moment on showing the use cases that are at play in the enterprise, so not just who's using which application and so on, and where's sensitive data going, but also like what's the positive upside of the AI adoption? So within, you know, like private equity, who's using AI for deal due diligence and data room analysis? Right. That's a pretty cool use case. There's ROI attached to doing that in an automated way with AI. And we can actually show that. And so then the payoff becomes more obvious than you've just got an intern burning a million tokens on GPT- 5.1 and the bill's gone through the roof. And I think there's a bit of a naive response at the moment, which is to try to just cap people's token use or just force them to use cheaper models. And I think our kind of whole thing is saying, well, look, let's look at the outputs. You probably want to have uncapped use by your top AI employee because they're just driving tons of value. But yes, you probably don't want the intern burning millions of tokens. And so the way to distinguish that, I think, rather than the sort of crude approaches that are there today, is to say: what are the use cases? Who's using AI for what purpose, who's enabled and who isn't, and where's the ROI coming from and where is it not coming from? So if for our core marketing use cases, 90% of them are being met by Claude, well, why have we still got a ChatGPT license that only 10% of use cases are getting into? Is that, like, really a thing or, like, can you turn some of them off? And then why is the team in London super AI-enabled, and the team in New York is like not as AI-enabled on this set of use cases? Okay, can we get an evangelist to come and talk to them about it from that team? Can we line it up? What are the common use cases we've got where everyone's building their own version of it, right? Everyone's got an agent running that's doing the same analysis that's burning all these tokens. Can't we do that in one place? I think you sort of— so that doesn't all naturally sit with the CISO. Alongside that there's all the risky use cases, but we can provide both. And when the CISO is coming armed with more of the business use cases as well as just the security ones, they become that enabler. And I see in the AI steering committees often the CISO's got, you know, can be the chair of that committee, or at least is a very loud voice in that room. And so our goal with Harmonic's really to make them the strategic enablers of AI in their peer group and become career-enhancing as a result. Yeah. And I think that's going to happen or going to need to happen, because if you think about it, in all my roles, I went to the board and I did bring them the risks, but I also brought them the opportunities. Like, you know, like you are not talking about just the world falling apart. You are talking about, "Okay, these things can go wrong."

Think about this: 37:40

like, I used to manage enterprise risk for a big financial services company—enterprise risk, so not cyber risk, right? So financial, operational, cyber, project, you name it—like enterprise risk right across the board. And one of the things that I have learned through managing enterprise risk is that ultimately, at the end of the day, no matter what technical risk it is, it aggregates to business consequences. And when you talk about business consequences, you talk about what it's going to cost you financially, what it's going to cost you from a health and safety perspective, what it's going to cost you regulatorily, what it's going to cost you from an operational perspective, what it's going to cost you from fines, and what it's going to cost you from a reputational perspective. So there's like a bunch of these six, seven, handful of business consequences. Everything at the end of the day will boil down to them. And if you are a CISO today, or even were before, that just stopped at this level of tech risk and never reached business risk, then I'm just sorry, I believe you have just not reached your potential of what you can do for the business. Because don't get me wrong, I also am not supporting CFOs and CEOs just going blindly into like just putting AI in. And I think the moment we tell them, "No, no, no, no, no," we are making them do it even more. Like, there's also the psychology behind it, like a lot of security is also psychology. It's just so weird to say that sometimes when people just think security is just technical stuff. But there's a lot of psychology in it. Like you can make people do things safer if you help them and enable them to do things that will help them reach their goals in a safer way, because ultimately they don't care how they get there. What they care about is that they get there. That's right, that's right. Does that make sense? Does that resonate with what you see? Absolutely. Just to give you an example of the psychology and the framing almost of this, there's, yeah, there's a CISO in a company that wanted to roll out Harmonic. And they were trying to figure out how to get budget. And they had a line that was "AI Governance and Control," and they shifted it in their budgets to "AI Enablement and Rollout" and got it funded immediately because everybody wanted that—psychological, of course. Same program, right? Same Harmonic as a tool. But it's becoming that enabler because, as you say, I mean, we see it in the— we look at the S-1s of the major companies that we're obviously starting to partner with. And you can see the initiatives that they have at the CIO level. And we usually attach to those. It's like, you know, there's a business goal around enabling the workforce with AI that we can attach to. And I think that's the smart thing for the security teams to try to do. Obviously not always possible, but I think that's the way to get things done as fast as possible. Yeah. Okay. So we have discussed so much today, Alastair, I love that. I loved it, I love that we talked about everything from human-in-the-loop— it doesn't scale—and how people can bypass security no matter what if you're going to add too much friction. We talked about all the different categories of how you see agents. And obviously when we talk about agentic, we're talking about models that have a harness, that can now use the tools, call the tools to do all the things, right? So something that doesn't just tell you or say things, but does things. We talked about the usage, we talked about the investments, we talked about governance through all of this. Because obviously, like we said, this field is evolving so fast and I don't believe in either side of the spectrum— and we talked about that, I mean, blocking it or just blindly going into it. Neither of the extremes work. What is one key message you would love to give to CISOs and businesses? And they can be separate or they can be the same. What is the one key message that you would give to like CISOs and to businesses when they think of agentic AI governance and usage? Yeah, we covered a few good ones already. Like, you know, I think trying to block the employees versus enabling them is a mistake for all the reasons why people go around controls and so on. But one thing that we haven't really dug into that

I think is important: 41:41

I think a lot of companies right now think about AI rollout, governance, control, and usage as being a top-down initiative. Right.

The C-suite is pushing, CIO has an initiative: 41:52

"We're going to roll this stuff out, and here's what we're going to do, and we're going to enable the employees." And I think actually, the much better way to look at this is via a ground-up

set of initiatives: 42:01

like, what are your employees doing with AI today? They're the ones that are on the ground with the use cases that are innovative. And I think like crushing that innovation by forcing them to use, you know, one package without understanding what it is that they're doing already is a mistake that a lot of companies go down—this sort of top-down driven approach. And so I think the most valuable thing is to understand how and why the employees are adopting AI and agents today at that bottoms-up grassroots level. And then that gives you this picture, this really rich picture of like, "Oh wow, I didn't even know that this was possible, and this is what's going on. This is where the real problems that can be solved with AI live," right? I think the world is not about this sort of dystopian future where you're getting rid of the employees and everything gets automated, and it's this sort of top-down thing driven by the C-suite. I think it's going to be far more the employees get empowered with AI if you can enable them to be so. And so it's our job to make sure that they can maximize their potential via AI, right? They have the tools available and we're encouraging them and training them in the right direction. So my whole emphasis would be like, first of all, get ground truth on what the employees are doing today, whether it's with Harmonic or something else, understand the use cases, and then you can see, "Here's where my risk is, but here's where my business benefit is." Put the governance around the risk, enable the business benefit, and then maximize productivity, employee satisfaction, right, meet the business goals, right? That's the kind of holy grail that everyone, I think, should be striving towards. That's a very, very good point. And I think I can really say that actually from experience, because one of the things that I have noticed, having worked in different companies, different cultures—I've worked for European companies and I've worked for American companies in big positions— and I've seen just this cultural difference of like the European companies I was CISO for, I remember still when we were rolling out anytime a new technology, instead of going fully top-down, we would build something together with like employee representatives from different departments that were like representing, like championing their use cases or what they needed it for. And it would take us a little bit longer time because we were doing it together with like people who were representing the different departments and their use cases or their concerns or whatever that is, so bringing both the perspectives in. And I see that like most— it's nothing about American companies in general, but I see most companies do not have that patience to do that. But I think if you do that, you really get not only actual real- world insights of what is happening, as you say, on the ground, but you actually both enable them along the way and avoid miscommunications, misalignments, backfiring, employees being upset. At the end of the day, I feel like this approach sometimes that we have in security is like just push it on people—it just can backfire. And I think it's not one of the best approaches at least. So I totally agree with that. So thank you so much for sharing that. And it's such a pleasure to talk to you today and I'd love to continue our conversations again offline. Sure. I also want to hear about your own AI stack, and we can compare notes on the Mac mini and different bots that we're running, so we'll do that another time. 100%. I told you, like I bought the new Mac Studio, so I've been setting it up. I think I'm so thrilled to get all the things up and running. So yeah, that'll be for another time. Great chatting with you. Thank you for today.