Scouting for Growth
00:27:30 · Bastiaan de Goei, Sabine VanderLinden
And this is also like where these types of... If you do this well, it can actually start paying for itself. Yeah. So because if you're looking at triage earlier, we were mentioning that underwriters routinely ignore up to 50% of of incoming submissions. Now, if I'm able to identify two or three submissions that would otherwise have been ignored, I can now use my extra capacity to underwrite them. I have just paid for myself. And so I think that the best types of digital transformations have that type of nature. [00:28:02] S1: Yeah. Probably when we know we have a capacity gap. So let's talk about risk futures now. We know we need to evaluate our defenses continuously and what the leader needs to do right now. So here's an uncomfortable truth, would say. You know, the same capability making insurers faster, better, more competitive, is also available to whoever wants to attack them. And that's not just insurance companies, it's any company around this globe. And those attacker can also attack in our industry, the insured also. So how does the risk landscape is evolving for you? How does this capability advances to actually protect us to do the right thing? And why do you argue that cyber defense has to become continuous rather than periodic?
00:28:59 · Bastiaan de Goei
[00:28:59] S2: Right. I think it's the question of this year. And you see me say this year. Yeah. And I say that for a reason. Earlier this year, we we talked, Greg Brockman, president of OpenAI, released a blog that was, titled The Defender's Window. You mentioned open source models earlier, and so the reality is is that AI, like any other technology tool, is a two sided sword or two edge sword, which means to your point, you can use it for benefit and you can use it for adversarial purposes. The goal here is that we will never be able to get rid of all risk in the same way that a knife is a fantastic tool in the kitchen, but you can also use it as a weapon. We try to make sure that the latter doesn't happen. And, it is the same thing with any other tool that you can think of, like a... Even a hammer is the same thing, can be used as a weapon. Right? So the core goal here is that the net benefit is high enough. So for being able to abstract away all risk, the... As long as the net benefit is high enough, then it may be worth to have like an acceptable level of risk. Now, the way that we do that is by combination of different things, guardrails inside of the models. You will not be able to use a commonly accessed model to... For nefarious purposes. It will simply not comply. It will it will say like, I'm not able to do this. And even for more nefarious things are ways in which this actually gets reported to law enforcement.
00:30:38 · Sabine VanderLinden
[00:30:38] S1: That's fascinating. So part of the discussion I had yesterday, actually, Bast, was talking about bad actors and people using voice printing and falsifying invoices and all those things. So what you are saying is we would be able at some point to not be able to do that with those capabilities. To
00:31:00 · Bastiaan de Goei
[00:31:00] S2: a very large degree, that is already the case. So if you say, Hey, identify vulnerabilities in, the following, software and then derive a path to exploit them, the common, mainline model accessible to anyone will not be... Will not comply with that instruction. Now, at the same time, we want to make those types of tools available to legitimate defenders. So that's why we have access processes and we have different levels of access. So if we, we put all of those under the umbrella that we get a brand of Daybreak. And so Daybreak refers to our cyber capability as a company. And so Daybreak Blue, Blue refers to defenders and will be... Has a higher level of permissions in inside of the model that allows it to scan for vulnerabilities, for example. Then you have... So that is 80 to 90% of like what a insurance company or any other financial services company needs in terms of cyber defense will be accessible by Daybreak Blue, and any company can apply for access for that. If they are verified and validated as legitimate defenders, then they will have access to this tooling. They also have something called Daybreak Red. So red has like an even higher level of permissions that can also be used for legitimate actions such as pen testing, for example, or red theming for that matter, hence the the color. For obvious reasons, the threshold, to get access to that is even higher, so that only really the most sensitive infrastructure and the most capable defenders, have access to this type of tooling. So that as a society we gained a net benefit from it.
00:32:47 · Sabine VanderLinden, Bastiaan de Goei
[00:32:47] S1: So let's give people a playbook, right? Something they can use. Picture an insurance leader who is walking out of ITC Vegas on Thursday evening with a notebook, with a lot of ideas and, you know, things they want to show their board when they have the next meeting, hopefully, next week. [00:33:05] S2: Yes. [00:33:05] S1: What should they do in the next ninety days, step by step, Bastiaan?
00:33:05 · Sabine VanderLinden, Bastiaan de Goei
[00:33:05] S1: What should they do in the next ninety days, step by step, Bastiaan? [00:33:10] S2: I personally believe hugely in personal experimentation. That's in my nature, probably also why I ended up at a technology company. But I think that at the end of the day, everyone has that inner child that likes to test things out and play to something. And in particular, when it comes to persistent agent technology like OpenAI's DOTS, the ability to test this out for yourself and see if it helps you in your daily workflow is very, very present. Dots are available in any pro license of ChatGPT and can immediately start being a benefit to you, helping you managing your calendar, helping managing your inbox. I was... For the first time this year, I got to, a zero email... Unread email inbox and zero, follow-up Slack messages, with the help of my dog. That's it. And, I think that if you're able to see this in your personal life, it becomes easier to see how this could apply to larger workflows inside of an organization. So it's earning trust step by step. If you can prove value in small steps, you earn the trust in order to prove value in larger processes. And so like as an insurance executive, what I would do is test this out for myself. Subsequently, as a professional, I should be able to see how that type of technology then applies to my claims processes, my underwriting processes, and you can start experimenting there as well. [00:34:43] S1: So let's talk to those leaders still. Is there anything you would deliberately tell them not to do?