00:29:30 · Hanah-Marie Darley
And so quite frequently, especially on the enterprise side, we'll talk about, oh, well, we have human in the loop governance in place. And okay, great. So what does that look like? We guarantee that there'll be a human user at all of these checkpoints. Okay, so you irreversibly slow down the system that is designed to speed you up. The second challenge is you don't specify who that human user needs to be. It has to be an expert. The person has to have context around what decisions are being made. So for example, you're gonna make a deal decision. You and maybe a few other people have all of the context around the market research that you've done, whether or not you think that the TAM is reasonable, whether or not you think the business model is reasonable, et cetera. What if you had someone who makes coffees down the road make that decision? Could they make a decision? Yeah, but they lack all the context. And so it's the same principle with human in the loop. Very few policies and very few operational mechanisms specify who that person should be, how much context they need to have, what credentials, if any, are required to make those decisions, and what oversight or recourse there is for wrong decisions made. Um, it's just human decision equals better than AI decision. And in a lot of research documentation, that's not necessarily true. Sometimes you gotta let it cook. The AI is actually better left to its own devices from just a statistical output than human decisions are, because the humans who are making the decisions lack context, have a high cognitive load, that they're tired, that we make worse decisions at 5 p.m. than we do at 9 a.m., etc., etc. So when it comes to both regulatory best practices, human in the loop was one of the first places and first principles that pretty much every regulating body went to to say, put people in it. It sounds great, but the practical implementation is a little bit more difficult than that. On the enterprise side, it was a stopgap and kind of a band-aid for we don't really have a specific plan. So what we're gonna do is try to gate this with people until we can operationalize the plan that we really think is gonna be functional.
00:31:24 · Hanah-Marie Darley
And so I think that has to it's already fading from an industry perspective as a good solution, but I think that has to make its way to both operational on the ground, how enterprises are implementing solutions, and also government in terms of how they're planning to regulate.
00:31:39 · James Wise
[00:31:39] S1: I think from a personal perspective at Balderton, you know, we're a small entity by by uh the standards of companies you normally work with. But the really interesting thing about adopting Geordie wasn't just as you know, it's a very powerful platform. It forced us to have some of those conversations. Which tools are we happy with, agents accessing, what kind of decisions need a human in that process, and what kind of decisions are we happy with agents doing certain amounts of the work from? Frankly, because of the sort of plain English way you can set security policies now, it's a lot more understandable to have that conversation with our head of security, with the head of finance, with myself as an investor, in a way where you know configuring the settings of some of the older cybersecurity tools, you know, having a debate about sophisticated pen testing wasn't really a everyman discussion. It's less accessible. It was far less accessible. Whereas I think Geordie, you know, by necessity has to bridge those conversations because security has now become the flip side of the coin to every single um ability you want the AIs to have, right? You can't take on these new abilities and use them unless you also consider security implications. And that means both parties have to be in the room, as it were. And I think Geordie does not just force that conversation but enable it going forward.
00:32:51 · Hanah-Marie Darley
[00:32:51] S0: And we're going even deeper than that. So we're talking a lot more now and next about not just how do agents operationalize within the business, what's secure and what's not secure, but along with security teams evolving roles, being asked to look at return on investment and to be look at value, how are agents actually being used within the business from a work product perspective? What is that behavior actually buying you? We launched cost intelligence to kind of start this work. But when we talk about the behavior and the importance of the behavioral understanding, it really is how is AI transforming your business and what is the practical returns on the investment and how do you evidence that over time rather than just saying, we use it for coding? Great. But which coding tasks are you actually using and how much are they costing you? And are you getting what you wanted to out of it from a work product perspective?
00:33:36 · James Wise
[00:33:36] S1: Yeah, and and actually once again, because of the Geordie um uh product launch around cost analysis, you know, we've we've got rid of a load of tools which we signed up to last year. We couldn't have signed up to those tools about Geordie because they needed to be within our structure, and now we've moved on from them because we found we weren't getting value for money. And we're using a whole host of new tools because now we're confident we can say, look, actually, for the next three months we're willing to spend a bit more to experiment, because we know in three months' time we'll have the data to say, yes, we can rationalize this or we do more of that, or you, or we cancel that, which I think is an incredibly powerful part of this ROI, which you know historically you didn't get from the security team. Um, but they're being asked about it now. Yeah, yeah. And they and it's a very hard time to be in the security world. I guess we see it as investors every day. Our job is to be at the frontier. Um, but if we miss the frontier, you know, it's a bad fund. If you miss the frontier, you know, it's a risk to Fortune 500 companies now and some really important institutions. So, how do you at Geordie and in your team stay at the frontier? And you know, what are the things coming down the pipeline that you're most excited about in terms of new AI capabilities, but which will also drive obviously the need for protection from Geordie?
00:34:46 · Hanah-Marie Darley
[00:34:46] S0: Yeah, you have to do your own homework. So you have to stay at the forefront of research. We both have to perform internal research, and I also do a a huge amount of reading of what's coming out of labs and and not just OpenAI and Anthropic, but what's coming out of universities and what's coming out of um think tanks and those kind of labs where AI testing is a little bit more old school, where we're still thinking about it in terms of peer-oriented reviews rather than just product launches. Um and I think the other thing that you have to do is um you have to plan to be flexible. Um and what I mean by that is if you really, really lock yourself into one mode of operations. And so a good example here might be vendor lock-in. Um, but another good example is actually uh the gateway that you brought up earlier. The only way that we can solve this challenge is a perimeter protection. That means that you necessitate not only how you're going to receive the information and how you're going to lock any bad operations down, but it also means that you're limiting the surface areas where agents can expand to within your business, whether or not you're calling that out. So a good example would be um we're just gonna have agents operate in the cloud where we can control them, or we're just gonna have agents operate on employee desktops. And then anything in the cloud we're gonna call workloads instead of agents because we have different control mechanisms for them. But we only have agents on the endpoints and we only have gateways on the endpoints to control those agents. Well, you know, agents are gonna be operating from a commerce perspective in browsers even more than they already are now. Um the forecast looks like, uh especially with the work that Google's doing around payment work and some of that has already been released with OpenAI and Stripe in the US. Um, it's expected to come here uh in force very soon. Um, I think the the EU is hoping to kind of pause that a little bit and get some more data around it before they say yes. But agents are not just going to operate within tiny little boundaries that we've drawn out for them. They're gonna be operating across your business as well as inside your business. And so again, you have to plan to be flexible. How do you expect the unexpected?