The Silence of the LAMs: Detecting Rogue Language Models - Tasha Armstrong-Godwin

Hi everyone, thanks for coming. Um, I just want to say thank you to Pete. This is his first Bides ever and I was telling him what an awesome community. [applause] That's cuz I was telling him what an awesome community besides Bristol is. I said how everyone's really friendly and he just proved it. So, thank you so much for the warm welcome for him. [snorts] So, we're going to be talking today about Silence of the Lambs. We're going to be looking at the risk profile. Who's using it and why? How we going to detect it? And once we've detected it, what are we going to do about it? So, who's using it? Looking at you guys,

anyone want to admit using some shadow AI at all? Yeah. >> Anyone brave enough to tell me why you've been using it? >> Because we can. >> Cuz you can. [snorts] >> Force multiplier work. speeds up work. Yeah. Um I'd also like to get to know you guys a bit better. Have we got any execs managers here? Yeah. Have we got any blue teamers here? Cool. Have we got any um engineers here? >> And have we got any like developers and things? >> So, we're all like really technical and we're all really geeky and we're all aware of the risks, right? But some of us kind of using our own anyway because of all the valid reasons that you

stated. So the main point with that is um people are using it. But I want to know I want to play a game actually. Do you guys want to stand up real quick? [laughter] >> Cool. Right. See if you can guess these stats. So the first stat is going to be the UK employees who have used unapproved AI in their workplace. So hands oh hands up if you think it's over 50%. Have used it. Right. If you've got your hands up, stay standing. If you haven't, sit down, please. Cool. Right. [snorts] So from 2023 until 2025, we're going to look at what do you think the growth is of using shadow AI its adoption in the workplace according to

Gartner research. So who thinks it's going to be over 200% for using it?

Sorry, the first one was 68%. Sorry. All right. is 156. So, if you've got your hands up, do you want to sit down, please? Oh, two people left. I like it. Well done. Right, out of you two then. How many developers do you think you just use general AI? So, it can be approved or unapproved. How many do you think are using AI in their developmental work? Do you want to shout out a percentage? >> 90%. >> 90. Oh, >> well, you know what? You guys are really close. Well done. It's 82%. Right. It's tiebreaker then. Oh, [screaming] NO. We're doing a lot. Well done. Shadow of the lambs. You get lambs. [laughter] >> Can you cut? Oh,

>> sorry. >> I'm not doing that again. You want to come down and win a stress prize?

>> Thank you guys. [applause] [snorts] >> But yeah, so I kind of gave it away there. Sorry. It was 91% um are using it. And the reason they say they're using it is because the tools that they've been given access to just aren't good enough. So things like you want to be quicker. AI is making our workforce really quick now and suddenly the pace is on. I want to get this job done. Something that used to take 6 months. Can I take six weeks? So you're just like little bit here, a little bit there. Sometimes the tools that you're using like I use it cuz I'm techy. I am not good at making things pretty. So I

use AI in my presentations to make it look a bit more appealing cuz no one wants to see balls of text. You know, there's loads and multitudes of reasons why you will be using AI in your workplace and why people are looking at it. So, in summary, the dangerous thing about using shadow AI is that technical people can be using it. Think about your privileges. Developers, think about like the admin rights that you may just log on and use your AI. you can be pulling things in that you have not given AI access to your permissions is it can be risky there and you're already pre-authenticated onto the network. So that's the kind of slightly more

dangerous aspect of shadow AI is compared to SAS, you guys are the techy ones. You guys have got the access. You guys can do more with it. So what's the risks again in using it? It's the data that you could be connecting it to. So a lot of people are comparing Shadow AI with Shadow SAS. And in a way it's right because it is a service um that's being accessed, but it's people that are ingesting things into it. They're using it in a different and weird way. So people may be putting credentials in like if they have a sample of code that's not working, they may be putting in tokens, keys, and they're giving that to the AI system. Do

you really think that system needs to have that code or that access, that token? You can just be using the samples, but because people are now vibe coding and they're doing things that they've not done before, they may not be aware of the detrimental impact that that can have to it. Because people are vibe coding and they're making these really awesome applications on the front of it, have they considered the backend security? Have you considered what it's doing, who it's calling to? What the stack is like in the back end? They're just seeing, I've made a program and it does what I want. They're not seeing what we can see is like testers and blue

teamers is the cross- site scripting that might be available. It's the um open tables in the back end that aren't locked down and haven't got that input validation. And above all, do you even know how it's being used? Who's accessing it? Is there an audit trail available? Have you got a log entry of what's being done? It's we're we're having this access to these AI tools, but we're not monitoring it. We don't know where it is, which is why I guess you're here is like how do we find that? Going back to the stack of the AI, even if it is a pre-approved model, have you considered what it's like in the back end? Sorry. So, um, I did some research

online in the cloud and I found loads of buckets that had AI configuration tools that were accessible. And these are used by some of these companies. Sometimes you can even have um, guys like us who are like, I can build an AI model. I can do that. I'll host it on Amazon. And they forgot to lock it in the back end. So, you can still access the config files. You can poison some of that data. You can extract some of that table feeds and get into the database and find out what commands were run, find those API keys. People get so entrenched in the rushing of the job, they forget to step back and do the basics of locking things down,

[clears throat] of auditing, of making sure that everything's set up correctly with the security stack. An example also of being aware of the security stack was this week. Did you guys read this? Yeah. So if you're not aware, light LLM is like a middle management platform. If you have an AI system and it wants to be enriched and talks to different AI data sets, you can use a middle manager that goes out and talks to the different um models like you can have claw chatg various others exist and it all brings into the same interface and it looks really pretty makes everything easy. It's like a management thing. Unfortunately, light LLM got breached. Because it got

breached, attackers could then access loads of different keys, loads of different um like SSH, loads of different data and lots of big names were using it and so lots of big names were inadvertently exposed and all the news came about it this week. Even though the attack actually happened in March, we're just beginning to get that data set now. So, if you are interested, I do recommend you researching online and reading the article. So basically we have a really high-risk profile. Attackers are going to love the data that some of these users are putting into the data set which makes it not just a new shiny but a really nice new tasty shiny. Um because you can get

those creds, the high privilege creds. You can do lots of data poisoning. You can um really cause a lot of impact and damage to a business. So say I used to work for Electronic Arts. I know bit hit and miss. Some people like it, some people don't. But what if someone got into our chatbot and started making our chatbot racist or transphobic and it was coming out to all of our customers coming out with really horrible derogatory comments that would have had a huge impact on a company and it could have been really easily done if they'd managed to access our config files. So again, it's something that you may think it's not just internal, but it's

external facing. How that data could impact you. So how are we going to find it? AI is in basically everything though. It is the new buzzword. Even if you've got typical software that you use in your everyday systems, have you looked at is there now a new agent plugin? Is there a new AI backend to it? Is there um a new feature that's being enrolled with AI capabilities? Are you happy with those AI capabilities? Um so, for example, Copilot can now help you with your workforce, but did you know it can actually access all of your files, all of your emails, everything on SharePoint? It's like it sees everything, even your dirty underwear. You happy with that?

It does it by default as far as I'm aware. So, have we even considered locking it down? Now, this is part of Microsoft. We trust Microsoft been using it for years. Did we consider these new feature aspects of like what it can do? Um, some things I wanted to pull out as the unapproved AI tools. So, again, some of you guys said, I want it faster. I want it better. The AI wasn't doing what I needed it to do, so I've gone elsewhere. Have we checked that AI stack? Are we are we happy with where that data is going? China are building really nice and glossy AI looks amazing. Cyber Dazzle. Yes, that interface is

exactly what I want. It makes it easy. I don't care if this code is top secret. I don't care if it accesses my IP. It gets my job done and my boss is going to be happy. Is that really what we want? Do we want China seeing all of our IP? Um, some of you may already know me and you know I harp on all the time about browser extensions. They are so risky. And what's the main attack vector now with browser extensions? It's through AI because it's glitzy and glamorous and makes it all [clears throat] easy. Yes, you want that API, that extension to read my web page and be able to like drag and paste things into it and I get

an output and it's really easy, really fast, also really dangerous depending on who that extensions with. So [clears throat] again, this isn't something that's new. Even though AI itself is new, it's still just tech. It's still just software as a service. We can still do basic principles And in this case though, the call is coming from in the house because it's our own staff that are using it and it's our own staff that we really need to protect. But because it's our own staff, kind of makes it a little bit easier because we have access to that data, right? Hopefully you guys have EDRs and you've got security stacks on your on your laptops and your machines and

you're aware of all the permissions that are right there that um on your data sets. So on the network layer we can look at DNS calls right see where our staff are going. Is that an AI approved service? Not just looking at web content filtering as well, but looking at the API calls that are being done. Are we happy with those API calls? Is it where we want it to go? When we're seeing this traffic go into these AI domains, there are things that we can look for as well, like post requests. Okay, so we may have a network call going to open AI. It's great. We don't mind them having open AI access. Are you

happy with them uploading to open AAI? Is it our open AI instance or is it someone else's open AAI instance? And then on our endpoints as well, we can look at what agents are running. Are we happy with those AI agents? Are they running in the right place? Could it be malicious AI agent or is it a legitimate AI agent? Again, through there, we can look at the uploads. So, we may be happy with someone going, "Yeah, sure. Go to that website and and generate pictures. That's fine, but don't upload data or I don't actually want you to go to that website." They shouldn't really be doing that. But right now, we can be doing the audits. We can see where

they're going. And then again, extensions, cuz they are the bane of my life sometimes. Are we really happy with that extension? Is that extension having the right permissions? Is it doing what it should be doing? And then of course, we shouldn't forget our data sources. So, did you guys see the clawed instance that accidentally deleted someone's customer database? Yeah. What was really interesting about that case, Claude [clears throat] itself wasn't given permission to do that in the settings. It shouldn't have been able to have done that. Yet, we're at that stage now where AI is so powerful and so good at finding a solution to a problem it's been given, it's going to do it anyway. We've all

seen the news, right, about how AI or um yeah, an AI agent attacks hugging face, for example. It's almost too powerful now. So, we've kind of lost control. And I think from a defensive perspective, always put yourself in the defendable position, right? If we've lost control of AI, we can still do things on our end. Look at where the data is. Are we happy with access to our data? Yes, an AI agent may be able to access it, but have we within our own data set said it can read, but it can't delete? Or maybe it can read these tables and it can delete little rows, but we don't want it to be able to

delete the tables. You can still control that permission within your own data set, not just trusting AI's configuration. Does that make sense? I think sometimes we overlook that and we trust the AI settings too much and actually we can do stuff inhouse with our own data and say back off. You can look but don't touch. There [clears throat] are other ways that we can find it but I'm hogging you all because you're such a lovely audience. So I'm going to pass you on to lovely Pete. >> You're too kind. [clears throat] Yeah. So, um, one of the big things with, um, with discovering these AI tools, identity is a really powerful tool. I'm sure you kind of realize this,

but, you know, there's some real good benefits you can get from keeping a close eye on your identity, your identity usage. So, um, if you're using modern, I guess a mod kind of managed identity framework like, you know, like Microsoft Entro or like Google Workspace provided within that, users can be given consent to allow access to um, AI tools. Um, in some ways, you know, that's a good thing because you can see what they're up to. So, you know, you can look through those where users have granted access to and log into a particular system with their corporate credentials. It's a really good way of finding those tools and finding um what's being used. Um, and also you can

potentially manage the data that's going into those those tools by doing that as well because those those kind of, you know, traditional SAS connections give you the ability not to just monitor where they're being used, but also to look at the data that's transferring between those tools as well. So you have the ability to surface some information through that. Some organizations turn off the ability for users to be able to log into their own um or yeah login using their own corporate credentials. The challenge with that is you're then pushing around the outbound side. So you need to be careful with that. So it's a bit of a balance. You know you can look to enable that thing and monitor the

access but if you if you make it something that has to come through say your service desk for example you have to make sure that there's a good process around that to to manage those things quickly. because if if someone has to like submit a request and it takes two weeks I'll go no and they'll just do something else. So working with the users is a really key part of it to you know to once you found it do something about it. [snorts] Um but also looking at those um systems that are accessed outside of your corporate credentials. So the service services that are accessed directly it might be they're logging in with kind of you know

consumer credentials um or or login in with just kind of system level credentials on that particular application. It's unlikely these days most SAS applications require some level of kind of modern authentication but sometimes you know there's just like some basic authentication regarding that. So there's ways and means of actually servicing that information to ensure you can find that um those those login and use of those different systems. Um and also some of the applica some of the identity systems you have can look for anomous access. So sometimes some users doing something, they might have an agent going out of hours or something and so you might find a credential that's doing something out of normal kind of core hours that can be

a sign of something odd happening on your estate that you can look into as well. So there's there's some good benefits and some good hooks to bring into your identity side to make sure you're kind of surfacing those things and using that as a way to kind of broaden your reach and understand more about what's happening um in your environment. And as mentioned, you know, we have some of this already in your stack. So if you are fortunate enough to have a CASBY or an SSD solution and your users are hooked into that across the board then obviously that gives you that visibility of all their cloud services they use including the AI services if they're

using kind of AI SAS solutions. So they give the ability to track um all the tools that are being used across your estate ideally and also again looking at the actual data being used within those um systems if your data is well um I guess you know tracked and managed and labeled etc. Um you also got vendor specific tools. So u Microsoft defend for cloud apps is a wide range of different applications identified. They've done lots of good work in that to actually look at the the types of applications they are their risk profile you know so some of them you know they'll they'll kind of mark them out of certain file given like you know red and

green status and they'll tell you what kind of services they are how they're being used what data they have access to. So again this is all about being kind of permissive in your environment and therefore kind of maintaining visibility of what's happening. You know, you can take the positional IT perspective of trying to kind of lock everything down, but by doing that, you're just forced to use that outside. So using tools like trend for cloud apps gives you that ability to be able to see what's happening on the estate and have that monitoring going on. And similar with with Google Workspace, similar tools and that they can you can monitor that stash usage across your estate. Um,

and also looking at what's happening within your your browsers browsers too, monitoring the access within that and um and having that visibility. Um, and then yeah, I mentioned the identity threat detection response. So Microsoft have a tool um the um defender for identity which can look through like I said look for those odd patterns of behavior and help you then to understand if that's something you need to be worried about um or just something you need to monitor. So those things can kind of sit in the background they'll they'll baseline your usual user behaviors and user activities and then if they doing something a bit odd out of hours out of kind of like you know normal time trying

to access this and they don't normally those things can flag can flag up and you can you can actually do um proactive activities with that. Sometimes it's just a case of if someone wants to do something out of hours, you might kind of prompt them for additional credential potentially, you might restrict that access. You might kind of raise a case. So there are kind of ways and means of doing things with that to be kind of proactive and maintain that visibility of what's happening in your environment as well. >> I think are you coming this? >> Okay. [clears throat] So putting this all together, we've audited all of our activity. We've sent where our data is. We've seen what users

are using and now we can start to fine-tune our alerts and put it all together. So we can look for example the DNS queries. We can see is it part of our approved software that we're really happy for them to use or are we like triaging it. So yes, they can have access but we're really not happy with them uploading there to absolutely not. That's really bad. We don't want them touching that thing. So we can write these rules taking that all into account and really get some high fidelity alerts through through that.

>> You can't just have a detection though. You really need policies to support that. So I'm going to have to repeat [laughter] again. >> Thank [snorts] you. >> Yeah. So as I' as I've touched on, blocking doesn't always work. I mean, um, there's [clears throat] a temptation when something new and emerging is is, you know, is appearing on the estate, sometimes it's a case of, well, we'll just switch it off, right? You know, that's too risky. We can't use that anymore. Um, and of course, you will just sit there politely on their hands and they'll wait patiently until you sort yourself out and open it off for them again. Obviously, they'll just go off and do something [snorts] else. You

know, nature finds a way traditionally. You know, you're you don't want to be that gate in an open field. You know, people just walk around. You don't want to be that rock in the river. The river water just goes around. It's it's just um it's a it's a thankless task. Um we we've had some experience at work, you know, recently where where people have have looked into say, well, we'll just we'll just kind of look to restrict the the common >> [snorts] >> um AI tools, you know, so we have an approved tool, it's this, we'll block everything else. Problem with that is you're only blocking what you know about. Um you're in danger of basically

pushing people away from I guess well-known, well-managed tools into, as you know, Tasha mentioned like, you know, Chinese AI tools for example. If you're looking down and blocking all the ones that you know about, who knows what else is out there that you're not seeing. So that'll just force them into the arms of something else, it could be even worse potentially. So blocking is something it has its place, but it has to be in conjunction with other things, too. It can't just be a case of like we'll just block this because users will always tend to find a way around these things. You got to come and work with them, not, you know, against them. It's

just one of these things where um, you know, modern users are used to be being empowered and and feeling like, you know, we we we are kind of, you know, we we we have to get work done. Yeah, I mean as as people have mentioned you know these tools help to speed up your work and help to accelerate what what you're doing. So [snorts] you can't really get in the way of that. You've got to kind of work with those users. You can try to get in the way of it but you know as I say it's a bit of a thankless task and you you won't necessarily succeed [snorts] unfortunately because you know users are

are smart and and getting smarter. So there's some key things on this. I mean it's um it's looking at how you kind of respond to um an instance you know. So if if if you if you have a data exposure, you have to treat it like you treat any other kind of um instinct. You have to kind of manage the instinct. You got to understand the data that's left the organization. You got to look to contain the blast radius. if anything's happened in that space and and make sure that you know it doesn't kind of continue happening and then understand what's happened um why it happened and you know classic stuff like you know lessons learned [snorts] but it's like

in any itself but the one of the challenges there is sometimes if that data has leaked where's it gone to within AI is it then kind of within a um a tool that could use that for you know other players potentially so [snorts] the blast radius of AI is obviously much bigger so you have to be be aware of that um so you're better off um kind of again working with the user So having that governance and those policies is really important. Um working with your users again, you know, understanding what they're trying to achieve. Um and you know, and what tools they need and that's an ongoing thing. You know, Tasha mentioned how things like Copilot is

constantly evolving. We're in this position now where um users want access to agents. Um so we give access to one tool, then a new tool pops up and that that tool is now accessing through additional services. Also another kind of thing to consider is a lot of these tools now are moving towards um consumption based as well. So it's not just thinking about the effort exposed, but also about the cost to your company as well when these tools are being used. So [snorts] there's considerations around that, but yeah, it's it's working with your your users, understanding what they need, um, and making sure they have the tools they need. It's harder for them to kind of push back and say, well,

I I don't want to use that. I want to use this. Because if you're given a tool that does something that matches their needs, it then comes down to personal preferences, and that's harder for them to kind of justify, I prefer this one. Well, you do, but everything you want to do is available in this tool here, so you should be using this one. Um it's a case of kind of yeah the classic kind of being inside the 10 is better than being outside the tent. Um you know so understanding building that community working with those users um something I do a lot within my work is creating guidelines. So it's a case of um you

can't just assume everyone knows everything as well you know. So write the obvious things down. Some some things that might seem obvious to you but not obvious to everyone else. So write good guidelines to help and support your users. Give them the details of the what why and how. Don't just say do this thing, but actually say do this thing because of this because it it's you know might be a security risk. It might be a risk to the organization, but you actually explain the the the why. You're not just saying do this thing because you know we're in in it and we tell you what to do. You just do it. It's a case of informing the users

because then again they're less likely to kind of go against it because they understand the rational behind something you're trying to do and why you're doing it. And also looking to providing lay approach in your guidelines. something you tend to see in some kind of guidelines and policies you apply to um organizations. It's everything all at once. So taking a kind of a now next later approach is really important. What are the things you need to do right now in a guideline to say you know support good AI usage to make sure that things aren't um you know being exposed or you know data isn't going where it should do. Once they've done that, what comes

next? What else can they do? And your now next level things are also things like you now things are the kind of free and easy things, the cheap things people can just do very easily and just turn things on, do things to how to, you [snorts] know, manage their environments and then what comes next. And then the latest stuff is think about if you're looking at a strategic road map across your tooling um what tools do you need to include on that in the future? So, you know, some some of these things you might need to to manage your environment. You know, we mentioned things like CASBY. CASBY are expensive. So it may be that right now you're

looking at using your policies and your guidelines to kind of manage things on a on a kind of you know kind of I guess human basis but then you might some technical controls and those things take time. So your later bits in your guideline can refer to actually if you're going to put things on your um plan for the future these are the kind of things you want to put on to ensure you can kind of track and manage and govern the estate successfully. And it's all about that building those communities is really important and having that kind of the the guidelines and policies in place because if you're close to your users and you know you get

to know them and you're kind of you know working closer with them you hope hopefully they're less likely to think well stop that I'll just work around here because they know you and they know who you are they know you're trying to do the right thing right so they'll want to kind of support you and work with you and also more like to talk to you about things you know if they've seen something new that's come out of woodwork they're interested in they could hopefully raise that with you and have an open discussion about it you know be that kind of open receptive person who they can come and talk to and and work with and you know collaborate

with as well. So it gives you that ability to kind of keep your ears to the ground and understand the user demands now rather than later you know so trying to be a little bit proactive. It's hard to be productive in the in the AI space because it's so fast moving but keeping close to your users and having that voice helps you to kind of keep on top of those things as well which is really important. [snorts] So [clears throat] on the enforcement page I mentioned you know so looking at some different areas you know so allow is like I say you know ensuring you have sanction tools they're integrated into your seam platforms so the tools you

have you're monitoring them you're aware of them and you can track how they're being used effectively as well so you're looking at the identity the data the users who are using them how they're using them but again you warning working with your users communicating with them so using data loss prevention tools that can pop up um not just blocking but actually when they do something you know it's a classic thing where um if a user is sending out a large email, it pops up and says, "Oh, this is going to 200 people." You can have a similar thing with with your AI tools where when they pop up their AI tool, it then says you

do realize this should only be used with this type of data. It's kind of having those inline tools that keep pushing that message through about how they should be used. Um that piece around consenting to you using new tools again, it's a bit of a balance around that. If if you are looking to kind of put a gau on that and and manage that access and make it like an admin content required solution, ensure that your policies and your procedures around that are reactive and can go quickly because someone finds a new tool, they told their management about it, they're really interested to use it, they can see some benefits. If they then got to wait in a queue for

two, three, four weeks for it to get enabled, again, they're going to work around it. So, it's fine [snorts] having gates as long as you have the procedures that are reactive and can work quickly in line with your users's demands. Um, and then yeah, block still has a place. You know, there's certain types of data which just aren't suitable for AI. If you're working in kind of like, you know, defense or this kind of, you know, certain other kind of restricted areas, some types of data just aren't suitable depending on where the models are located. Um, we work with with models and solutions that are based in the UK, but we're hearing from the vendors that

it's harder and harder to kind of hold the line on having local um AI platforms and solutions because there's so much demand on compute. So you're starting to see that actually models are being, you know, kind of hosted first in the US and then come to the EU and then eventually might come to the UK. So some data types just aren't suitable for that necessarily depend where the models are located. So you have to consider that when you're thinking about it and and and block that activity if needed. But again, explain why you're doing that. You know, it's something that's like the company's IP. If that gets out, then you know, we're toast. It's something that's

a regulatory thing. If that happens, it's unlimited fines. Just making sure the users are well aware of why you're doing these things. Keep, you know, keep that conversation going. explain why that particular block is in place. It's up to you to finish it.

>> So, in summary, if you're interested in this and you really want to start locking down, there are a couple of steps you can do on Monday. And just to echo Pete's point is you really need to start working with your users. Do information captures with them. So, why are you using this? Why? Um, [clears throat] excuse me. Why are they going someplace else? Is it because their tooling is not quite what they need? Is it because they're finding these blocks? So, all the leaders that are in the room, you can start to identify that maybe you guys need to look at other AI models. I know some of you are really good at embracing um as

much as you can. Some of you are a bit hesitant and just saying, "No, I just want you to use this one tool." But now hopefully you can see the risks about just having that one tool and that your users are going to go other places because they're they're clever, they're smart, they want to get stuff done. So having a look at how you can support the workforce and your IT department is maybe digging into that budget strings because it's not going to be as expensive as having a data leak later on with as Pete says unlimited fines. Um starting off like baby steps as Pete was saying having an audit. what's being used, where is it being used? Now you've

got the why is it being used setting out the alerts um for your IT department to say people are still using this. People are like are adopting the policies that you're putting in place or are not adopting the policies. Again, you can finetune find out why is there a problem there? [clears throat] Is there an access issue? And then as you start to see more of adoption in your workforce to using the recommended tools, then you can start putting more and more blocks in place doing that stage progression. So you're not seen as a fun police, but you've built that customer engagement almost and you've got that understanding. You've got that education piece about the risks and the workforce

can then start to adopt and know why they're adopting these safety measures and you can work together as opposed to against each other and not go, "Well, I'm going to do it anyway cuz [laughter] I think that's kind of what's going on now." So thank you. I hope you find this talk useful. If we've got any questions. >> Thank you very much. [applause]

[applause] >> Any questions? Mic. There you go.

>> Um give me these questions. There's two. First one is you said using local UK models. what you could what you can using that deep as a software model and how does it compare to your AI model space that's out there and the second question is how much are you practicing what you preaching and how close to the actual patch life cycle of the organization you integrated into because that's Google integrated model that awaits any of us didn't know they go oh it's there I must be able to use it notepad recently and how much did you do wrong recently? >> I mean that's it. The first one regarding um the the types of I guess

we're not looking at [clears throat] as personally you know we're not looking at kind of necessarily sovereign models. What we're looking at is the data processing and data storage locations. So we within our organization is focusing on the models that are kind of I mean the data toast in in in the UK. So the tenants we use are already in the UK but the data processing is also currently in the UK and that's using the GPC models within copilot for example. Um but we're seeing that more and more become an anomaly. Um a lot of the models now are kind of you know I say all the frontier models US first obviously and then eventually work way

into into EU but even when they're in the EU because of Brexit we can't guarantee we can get the same access to the EU models as others do. So the organizations have have that challenge too. So there there's a general kind of like well it's in the EU right so we can use it. It's a bit yeah not not an easy question because yeah because again the classic stuff. So um that's what we're we're prioritizing but the challenge we're seeing now we're getting this directly from from the vendors is saying we're in danger of get I guess getting a disadvantage because we're not having access to those frontier tools unless we can look at there might be certain use

cases where we can start using tools in the um EU and US but again it's it's informing users about that. So it might be that actually you do some of that kind of functional testing with the pioneering mod and then you're preparing that for when they kind of become in a more kind of compliant location in the future. >> Answering your question about are we practicing what we preach in our company we are quite fortunate that yes we do purely [clears throat] because of the type of work that we do. Um but we appreciate it's also an ongoing issue elsewhere. um we're really heavily relying on cases on say um you really need to have that insight and that

visibility to be able to do this successfully. Um so yes they are expensive as we've mentioned but they really are proving more and more well they're worth of weight and gold. So I know it's an uphill struggle. It's an organically uphill struggle. It's not something that's just like we we haven't faced this kind of issue before have we? So as it's becoming more engrossed in our workforce, so it's [clears throat] becoming more of an issue. So we need to slowly adapt. So it is a big problem in industry as a whole and I know that there's a lot of catch up work that needs be done. But that's it and cyber security isn't everything's catch up cuz

there's always something new, something exciting or scary around the corner, but that's why we're in it, right? Because it's a fresh challenge every day. question. Question you say we talk about catch up, right? How are you finding the BS that's coming from the vendors that aren't catching up and their marketing team is selling rubbish before their products ready? I mean, I've gone through this process. I hired some at the beginning of the year. I actually now feel sorry for them because the crap they have to deal with in the summer pure and I'm like this wasn't stuff I done in the workshop is not actually released yet >> and the shadow AI they think they're

telling me I know there's other things out there and that's what some very very big vendors as well. How are you finding that? >> I have so totally found that. Um, bake offs absolutely are a necessity because I've seen some big names um that say, "Oh yeah, we we've got this data set. It it's all sorted. You don't need to look into it." But you don't need to look into it because you don't want to see how much it's not doing. It's really scary. So absolutely yes, you need to do bake costs. You need to verify all of the data that comes out. The security you trust but verify. And there is no product that straight out of the shelf

it can do what you want it to do. There is that element of fine-tuning. There is that element of um checking everything through and making sure it can do what you want it to do and you shape it that way. So trust but verify with everything. >> Yeah. I think it's like say having that healthy cynicism isn't with all these things. Um I don't know if any vendors but the thing as well is like we find when we have these strategic relationships with vendors and people get really cozy with their vendors but the vendors aren't your friends. events are here to sell things. Even the people who sell you, they're not sales people. They're sales people. And so they're

always trying to kind of push you a certain thing with you. And like I say, the I guess the modern world like when Microsoft got this kind of life around products being refreshed on the regular basis, you just get the opportunity to kind of put bits of code out in the public. Oh, that didn't work. All right. Okay. And they do that all the time. And AI is no different. You know, when Windows 10 turned out green, that was constantly shipping with dodgy bits that weren't quite ready, but they were just trying on public. And they continue to do that with AI as well. So yeah, just part of it my team that that we use been trying the SPM of

all tools and I hate to say it from a Microsoft perspective, it's not bad. Not great. It's not that bad. Dirty. Sorry, it's not that bad. Yeah. Any more questions? [snorts] Have another round of applause. [applause]