Scouting for Growth
00:25:02 · Bastiaan de Goei
[00:25:02] S2: Well, I mean, I think that as with any transformation or automation, ROI needs to be very, very important and front and center for an organisation. Most of the customers that we work with, they are commercial organisations. And so they make decisions on that basis. And when a... When an organization does not see value, to me that is a failure of a process rather than a failure of the product. Okay. And so, I'm gonna say failure of the process is that I frequently think that if a test doesn't work out, it could say something about a product, totally. But it can also say something about maybe we took on too much, tried to do too many things at the same time. I've seen organizations being most successful who start small. And earlier in the conversation, I talked about efficiency by a thousand cuts. And so if every person in your organization is 15% more efficient than with the help of a dot, then you've achieved a massive gain as an organization. And so one of the ways in which we do this ourselves is what we call our friction list. And so everyone is encouraged to list frictions. This... Like even like when it comes to like internal processes as I need to submit... We need to do a lot of interviewing, for example, because OpenAI grows very fast. So we are hiring a lot and it means that you have to interview even more candidates. Now, listening to the interview, recording them, evaluating the candidate, all of that takes a lot of effort and a lot of time. And so we've developed our own in house tools in order to analyze these very, quickly and to submit them. So like there are tons of little things like that that are individual frictions and we invest in order to make them go away. And so ultimately over time, every time that you solve a friction, you become more efficient step by step by step. Efficiency by a thousand cuts. Yeah. And I think that is, how I would encourage anyone to to look at this. Like, it is probably it is probably very, very challenging to say like, hey, I'm going to bring in new technology to address my core systems on my most of workflows. I would not expect most organizations to start there, but you could achieve a lot already by just saying like, Hey, let's prioritize the submissions from my email inbox. Even the triage process alone can actually generate like real efficiency.
00:27:30 · Bastiaan de Goei, Sabine VanderLinden
And this is also like where these types of... If you do this well, it can actually start paying for itself. Yeah. So because if you're looking at triage earlier, we were mentioning that underwriters routinely ignore up to 50% of of incoming submissions. Now, if I'm able to identify two or three submissions that would otherwise have been ignored, I can now use my extra capacity to underwrite them. I have just paid for myself. And so I think that the best types of digital transformations have that type of nature. [00:28:02] S1: Yeah. Probably when we know we have a capacity gap. So let's talk about risk futures now. We know we need to evaluate our defenses continuously and what the leader needs to do right now. So here's an uncomfortable truth, would say. You know, the same capability making insurers faster, better, more competitive, is also available to whoever wants to attack them. And that's not just insurance companies, it's any company around this globe. And those attacker can also attack in our industry, the insured also. So how does the risk landscape is evolving for you? How does this capability advances to actually protect us to do the right thing? And why do you argue that cyber defense has to become continuous rather than periodic?
00:28:59 · Bastiaan de Goei
[00:28:59] S2: Right. I think it's the question of this year. And you see me say this year. Yeah. And I say that for a reason. Earlier this year, we we talked, Greg Brockman, president of OpenAI, released a blog that was, titled The Defender's Window. You mentioned open source models earlier, and so the reality is is that AI, like any other technology tool, is a two sided sword or two edge sword, which means to your point, you can use it for benefit and you can use it for adversarial purposes. The goal here is that we will never be able to get rid of all risk in the same way that a knife is a fantastic tool in the kitchen, but you can also use it as a weapon. We try to make sure that the latter doesn't happen. And, it is the same thing with any other tool that you can think of, like a... Even a hammer is the same thing, can be used as a weapon. Right? So the core goal here is that the net benefit is high enough. So for being able to abstract away all risk, the... As long as the net benefit is high enough, then it may be worth to have like an acceptable level of risk. Now, the way that we do that is by combination of different things, guardrails inside of the models. You will not be able to use a commonly accessed model to... For nefarious purposes. It will simply not comply. It will it will say like, I'm not able to do this. And even for more nefarious things are ways in which this actually gets reported to law enforcement.
00:30:38 · Sabine VanderLinden
[00:30:38] S1: That's fascinating. So part of the discussion I had yesterday, actually, Bast, was talking about bad actors and people using voice printing and falsifying invoices and all those things. So what you are saying is we would be able at some point to not be able to do that with those capabilities. To
00:31:00 · Bastiaan de Goei
[00:31:00] S2: a very large degree, that is already the case. So if you say, Hey, identify vulnerabilities in, the following, software and then derive a path to exploit them, the common, mainline model accessible to anyone will not be... Will not comply with that instruction. Now, at the same time, we want to make those types of tools available to legitimate defenders. So that's why we have access processes and we have different levels of access. So if we, we put all of those under the umbrella that we get a brand of Daybreak. And so Daybreak refers to our cyber capability as a company. And so Daybreak Blue, Blue refers to defenders and will be... Has a higher level of permissions in inside of the model that allows it to scan for vulnerabilities, for example. Then you have... So that is 80 to 90% of like what a insurance company or any other financial services company needs in terms of cyber defense will be accessible by Daybreak Blue, and any company can apply for access for that. If they are verified and validated as legitimate defenders, then they will have access to this tooling. They also have something called Daybreak Red. So red has like an even higher level of permissions that can also be used for legitimate actions such as pen testing, for example, or red theming for that matter, hence the the color. For obvious reasons, the threshold, to get access to that is even higher, so that only really the most sensitive infrastructure and the most capable defenders, have access to this type of tooling. So that as a society we gained a net benefit from it.
00:32:47 · Sabine VanderLinden, Bastiaan de Goei
[00:32:47] S1: So let's give people a playbook, right? Something they can use. Picture an insurance leader who is walking out of ITC Vegas on Thursday evening with a notebook, with a lot of ideas and, you know, things they want to show their board when they have the next meeting, hopefully, next week. [00:33:05] S2: Yes. [00:33:05] S1: What should they do in the next ninety days, step by step, Bastiaan?