Announcer 1: This is The ERP Advisor.
Announcer 2: Today's episode “Managing the Cybersecurity Risks of Bringing AI into Your Organization.”
Rebekah: Hello everyone. Thank you for joining us for today's webinar “Managing the Cybersecurity Risks of Bringing AI Into Your Organization.” Shawn Windle is one of our speakers for today. Shawn, as he introduced himself, is the founder and managing principal of.
Shawn: The Real Shawn.
Rebekah: Yes, we have the real Shawn. He is the founder and managing principal of ERP Advisors group based in Denver, Colorado. Shawn has over 25 years of experience in the enterprise software industry, helping hundreds of clients across many industries with selecting and implementing a wide variety of enterprise solutions. His podcast, The ERP Advisor, has dozens of episodes with thousands of downloads and is featured on prominent podcast platforms such as Apple and Spotify.
And then we have James. James McQuiggan is our special guest joining us today. James is a 20-year security veteran and security awareness advocate for KnowBe4, as well as a part-time faculty professor at Valencia College. James has achieved many certifications identifying him as an expert in the fields of cybersecurity and security awareness. James has previously worked as a product and solution security officer, information security analyst and network security engineer for Siemens, where he consulted and supported various corporate divisions on cybersecurity standards, information security awareness and securing product networks. James, this is the fifth year you're going to be joining us.
Which is incredible.
James: The set of steak knives are coming. They're on their way. Is that how it works?
Rebekah: You're gonna get a gift, and on today's call, as you've already kind of seen, we're gonna be exploring the cyber security risks of AI while helping viewers understand the real benefits of implementing AI tools throughout your organization. And this is all in celebration of Cyber Security Awareness Month, so thank you so much again for joining us, James and welcome, Shawn. Super excited. Just even with that kickoff to see how things go.
Shawn: Thank you, Rebekah. As always, I don't know. James threw me off my game. I just, I do think he's wonderful and I should have asked him for a dad joke, but that'll come in a bit here. So, looking forward to the discussion. Thanks again, James, for joining us. Although is this the real James?
James: Maybe, Maybe, not.
Shawn: We'll find out.
James: The trick to that is, you know, you ask some really weird questions to see if I'll answer or you ask me to do something and then if I do it, then you know it's really me.
Shawn: That makes sense. Yeah, James, you better tell us a dad joke just to get things rolling then.
James: Well, seeing as tomorrow is Halloween. You know, we're all going to be putting out our Jack-o'-lanterns tonight. But you know what you need to do when you have a broken Jack-o'-lantern?
You apply a pumpkin patch.
Shawn: It's the real James. AI would probably come up with a better one, I'm just kidding.
James: Oh, AI is horrible at trading dad jokes. I've been asking it. Yeah, I've been asking it for the last 18 months and every time it's just Nope, nope. Just doesn't hit the mark. Yeah, no, it's not good.
Shawn: Oh, is that right? Well, I know we're talking about more serious stuff today, but this is great. Thank you again for being here. And Rebekah, thank you for hosting and get everything together. We should just jump into it when you guys are ready.
Rebekah: Wonderful. All right, so just kicking this off. AI is such a buzzword. I know people are probably getting sick of hearing it, but for the sake of today's call, what is AI really and what type of tools are we discussing today?
James: What is AI really? You know that that is a really fun question because you could kind of say what's the Internet really? What is any. No, no, no. I mean in the sense of AI encompasses so much that a lot of people don't really realize or aware of it. You know, you could, you could say what a computer encompasses. What does, you know, like I said, the Internet and not any kind of technology. So, when we're talking about artificial intelligence, AI, it's important to remember that we've been working with it already, for almost the last 10 years.
And folks are probably working with it now. You know if you think about it, on your smartphone, when you’re going in and you're typing a text message to somebody and you get the auto correct, that's predictive analysis, that's it. The phone going through and realizing, Oh, no, you didn't mean to say that. I mean, that's why we always get duck off, you know. But anyway, but also at the same time you're Grammarly. You know, when you're writing a report in Word and it's coming up with the grammar corrections again, that is artificial intelligence that's in work.
And AI, the concepts been around since the late 1940s, with Alan Turing wanting to have machines, think like a human. The 50s, we get the Dartmouth College Conference, and they come up with the term artificial intelligence. But then we hit a winter of AI for the next number of years because we just don't have the technology, the concepts, the theories are all there. We get into the late 90s we have Deep Blue playing chess against Gary Kasparov.
2011, one of my favorite episodes of Jeopardy, where IBM's Watson played jeopardy against the two champions, Ken Jennings, Brad Rutter, and literally wiped the floor with them. But that was a huge step because you had a computer system that was listening to a question, waiting for the time to respond, processing a response and then delivering it verbally with audio. So that was a huge undertaking towards that. And then we had the revolutionary change. Google comes out with a paper in 2016, with a totally different way to handle large language models, LLM's, with generative pre trained transformers on how it goes through and processes the human language, whether English, French, German, Italian, whatever it may be, being able to process that and then give a response back
And so now, since November of 2022, the generative AI era literally exploded. We had 100 million users on that, quicker than any other service, any other product that's ever been out there better than Facebook, TikTok and all that. I mean, it took the television 40 years or something to get 100 million people on there and you know or however many.
So now we're dealing with AI. We're looking at how cyber criminals are using it. We're looking at how organizations are leveraging AI, not only like artificial intelligence, deep learning, machine learning, predictive analysis, but also from a generative standpoint as well as we start seeing with social engineering, attacks with deep fakes, audio, video, phishing, and all of that has leveled up the game for cyber criminals for going down the road.
Rebekah: Right. Is there anything that you'd like to add to that, Shawn, for today's discussion?
Shawn: I mean I think that's great. I would say you know, as we look at sort of the enterprise software perspective, we kind of think of it like the next generation of enterprise software that organizations people will use to automate their digital tasks, right? It's not like you know. Can AI tie my shoes? It can't. It just can't. Now if you have an AI driven robot and it learns and can have the ability to be able to tie your shoes with its digital fingers than it can, right, so we kind of look at digital tasks and we sort of talk also about computing that represents human intelligence and evaluation.
So the ability to evaluate logic and I think, James, what you know what in recent times what we're kind of like, being confronted with is the computing capability that's required for AI, and we actually have a lot of clients that are in or related to the data center industry.
And I mean, I feel like that industry's just starting like and I can't believe that because I mean, for years on different calls and stuff, I would say to analysts like investment banker analysts who made a lot of money off of our insights, which we don't do, that we don't trade by the way. But we're like, you know, buy go with the hyper convergence companies because the hyperscalers, because we're only just beginning with the need for data storage.
And for computing power, so of course NVIDIA and then on the storage side, some you know all the other companies that are doing Sans and everything, right. So, you know zettabytes, the amount of data required to program those large language models and even using like the graphics, these systems, these AI models looking at graphics and making decisions based off how you know -
I mean, I don't know about you guys, but, you know, my phone knows who my kids are. And I said it once, but now it's like holy moly, how does it do that? And like Apple just came out with their AI strategy. Like literally today. I think it was just announced. So anyway, I mean it's pretty wild. And there's definitely a lot of hype. And there's, like, hype about the hype, everybody talks about AI. And I'm like, I don't know if we're talking about it enough, because it does have the ability to and is going to change things radically, like the cloud, and it's happening and it's happened and it's almost like the infrastructure required to make it really go right, the gazillions of dollars, that's a technical term, they're there, you know. The billionaires of our planet are putting in the investment to make sure that this really happens. So that's the other piece I would say, but I think you nailed it with kind of the history of it that this has been around for a long time, right?
James: Yeah, and it's interesting because I'm just going to add to that. You're talking about power. Yeah, a lot of the tech companies that are out there need power. You look at the tech giants, the Metas, the Microsofts, the Googles. They're buying up power plants. There is discussion of nuclear plants that they will utilize to power their data centers to do AI, so the amount of energy that's going to be required, and now we're looking at spinning up the nuclear. And I know there's...
There's all that fun discussion that goes on with it, but the ability to be able to leverage those to generate the amount of power that's needed to power all these systems to grade the AI is just yeah, it's incredible, yeah.
Shawn: I know mind blowing.
Rebekah: Yeah, there's lots of information out there about that and the vendors are definitely taking steps towards figuring out what their strategies are, right, we're still in the early days of AI, and as much as it's going to Change things radically. There are people that need to look at what their strategies are and that kind of leads us into our next question is for both of you, James. From your perspective in cybersecurity, what role is AI currently play?
James: Yeah. So, we've, you know, it's funny because a lot of it for the last number of years prior to generative AI coming on the scene, we were seeing a lot of our security products, endpoint detection firewalls, e-mail, secure e-mail gateways, identity access systems.
Everywhere I would go on the vendor floor of a cybersecurity conference was the word AI enabled or AI capable or you're leveraging AI for XYZ?
So, we've been working already with the machine, learning the deep, learning, the automation, the predictive analysis that we've seen in cybersecurity. It's already been there, and it's been happening. With generative AI, now it's opening up some new doors. Now we have the ability where we can have first level technicians.
First level Security Operations Center SoC analysts handling a lot of the actual work and getting a processor generated AI and then spitting out a report. There was a presentation done at DEFCON, one of the big hacker conference that happens in Vegas every August back in 2017, where a guy created a program to go through the initial phases of doing a pen test against a system or an organization, and usually you have to go through and scan, you do your recon, you do a scan, you find the open ports, you figure out what vulnerabilities, what weaknesses it has, and then you launch an exploit to try to gain access and get in.
The system and that can take anywhere from, oh I don't know, an hour to hours, maybe days depending on the length of the system. He developed a system that automated all that would go through and do all that from beginning to end and then did the really incredible thing that I'm sure a lot of people got a kick out of.
It generated the report at the end because that's the one thing pen testers hate.
Having to write reports, it's what I have to tell my students all the time. When they go. I want to be a pen tester and it's like, do you like to write reports? And so, he created that automated tool already. So, within cybersecurity, we've been leveraging it already a lot. Now we're starting to try to leverage it with copilot from Microsoft. Other large language models as well, to do a lot of the writing, the conversations, password resets, you know that first level communication for a help desk, because then because there's software that goes through and allows you to talk to it, it processes and then gives a response back based off of what knowledge base you give it. So, there's a lot of capabilities that cybersecurity along with, you know, antivirus and threat detection and you know firewalls and all that other good stuff.
Rebekah: Right. And that's really real for us. Like we see that as people who are looking at the vendors constantly and are talking to clients. But Shawn, from your perspective, what's real for our clients right now like what are they seeing and what are their concerns as it pertains to adding AI to their organizations?
Shawn: Yeah, it's interesting. It's still early. You know every year we kind of do an update for the financial executives international and last year I touched on AI and said oh, it's happening. Just be aware. This year was like, you need to find somebody in your group that's pretty tech savvy to start playing with this stuff just a little bit. Not a lot.
But start getting to know what's what is going on with the Facebook AI technology, Grok, from X, like just some of these different things, right? Like even Grok... just basically set up an integration that's pretty inexpensive. So how do you leverage that, right? Microsoft, of course, with the copilot stuff, a lot of the vendors we work with Rebekah, as you know from the conferences are talking about their partnerships with Microsoft or even their own copilot, Co-branded copilot. Even though it's called copilot, still figuring that one out from some of the vendors. But that's ok.
I won't mention any names, but all of the vendors that we work with, all the enterprise software vendors, the big the big ones, they all have not just powered by, but also like these are the solutions that are AI based and how they're different from what we do today.
But the interesting thing is, you do have a lot of sort of emerging solutions across a lot of the, you know, blocking and tackling business processes of a company like AP, right or AR and collections and dunning and all these things that somebody's got to sit around and do this stuff and the AI based tools are from the bottom up, built around OK for dunning, let's you know. Go through a tutorial. Tell me about your collections process. Do you want to send an e-mail or a or a text? Right. When do you want that to happen? Based on this amount and you're sort of interacting with what feels almost like a little agent, right? And then the app gets set up and then it just works right?
There’s maybe a little bit more to it, but you know, if you're not aware, especially of your major enterprise software vendors, like you have a major investment in them, you need to find out what they're doing for AI for sure. Go to a conference.
You know, they all put on webinars on stuff like “I don't want to be sold anything”. I got it, but you definitely want to be knowing what's happening because it will start to happen, and you should have a heads up on that.
I will say one last thing too, Late, late, late, late last week, actually, it was on Friday. We got a call, unfortunately from a client that is in the process, we've selected a cloud-based system, and they called and said we got hit with a cyber-attack.
Like, Oh my gosh. And you know all on Prem stuff for now. So that's one of the risks and, then interestingly enough, we got some fake ACH deductions on our account.
And I was like, wow, I wonder where that came from. I bet, cause this other company's client has our ACH information for them sending us checks.
So ,you know, if you're not thinking about cybersecurity and you just have to look at AI as just another tool, right, it's another methodology for solving these kinds of problems, that really affect enterprise software, the world we live in, and I mean almost all of our clients have your products, James, with the KnowBe4 solutions because they're very focused on the people. But you know, knowing what you guys are even doing around AI and your models, like it all needs to come together.
And I think the last thing I'd say here is that, you know, it's so easy to like, buy something and then it runs well, and you just take your attention off of it and you don't worry about it, right? Like a car, right? A car works but it tells you. “Hey, come get a service.”
You know these enterprise softwares, they kind of don't do that, right? They do, they are getting upgraded automatically, hopefully doesn't screw up your customizations. You'll know about that if it does cause your system won’t work. But I would just ask people to just raise their awareness just to the next level here to just say OK around AI, what are we really doing and how can I leverage that, a little. Not a lot. Not yet, but a little bit so that your mindset starts getting into this so that you don't have problems in the future.
James: Yeah, when you're talking about keeping up to date, there are several newsletters that come into my inbox every day. When we think about older technologies, hardware, servers, widget A, B, C, or D, you know you might get updates on those maybe once a month. You might hear some stuff about it, or a couple of times a year. With AI, this isn't a monthly thing. This isn't even weekly. It's not even daily. It's hourly.
There are new updates coming out every hour now. I'm fine with keeping my AI updates daily, so I have like 3 or 4 newsletters that come in and then I review those and when there's a common story across all of them, it's like OK, let's focus on what.
That is, and so that is kind of that is one of my ways that I keep up to date and even I struggle. Ally Kay Miller, who is one of the industry leaders, consultants when it comes to AI. I did a course with her earlier this year, a business course with her with regards to AI, just for my own understanding.
She tells me she tries to keep up with it hourly, and even that is a is a big challenge for her. I'm just happy getting it daily and going from there, but that those newsletters are a great tool to be able to get the information in for the different organizations so they can keep up to date, because that's one of the things I promote when I do my AI presentations is you've got to stay current. This isn't something that you can wait six months and come back to it, because probably a lot of it will have changed. It's changed a lot in the last 18 months already. So, and there's podcasts out there too.
Rebekah: There are lots of things to keep up with what's going on, fortunately, and even for.
I mean, even I've been playing around at the most basic level with the Gemini integration through Google Workspace and it's incredible what they've even been able to do for that. It's very basic. It's something that I can kind of dip my toes into. The AI and Shawn and I can experiment with that a little bit without it feeling as dangerous as some of these other threats, but that's not always necessarily the case. James, I saw you nod your head right there.
So that leads us into our next question for you is, what are some of the biggest threats that you have recently seen AI pose on businesses, especially as so many are adopting the technology?
James: Well, I kind of demonstrated at the beginning I had this wonderful little video of Shawn that I basically created in less than 10 minutes.
The majority of the time took me to download the YouTube video of him from like 2020. There was a video... It was like a 4-minute video of Shawn talking. I only needed one minute, 30 seconds to a minute, and I was able to create that deep fake. I could then turn around.
And leverage that to be in a zoom call where I call you Rebekah or somebody in accounting and finance.
To say “hey, we need to transfer money,” and we've already seen that happen. It happened in Hong Kong, where you had the cyber criminals, the scammers reach out to the CFO pretending to be the CEO through text message saying they lost his phone, or I got a new phone, this is my new number but basically built rapport with the CFO.
Through a series of text messages, they said, hey, we have to talk really quick. We have to transfer money to this vendor. He got on with the CEO and several other people of higher ups, board or other executives, and was only on for a short period of time where just to give that sense of. “Oh OK, this is the CEO telling me to do this” and then complained that the connection was bad or whatever and they dropped and then he transferred the 25,000,000 to a vendor and out the door it went.
That's kind of been the big one and that's that woke up everybody. Now, there is plenty of software on the dark web, out in GitHub open-source software that allows you to leverage something like zoom and have a virtual camera where I would be looking through here. And then the software in the computer would translate my face, face swap it essentially with the target face. If I wanted to be you, Shawn, I could. I could do it that way and go. I got a new haircut or I, you know, dropped, I dropped, you know, a few years. No, no. Probably gained a few years. But anyway.
Shawn: I know exactly.
James: But that was kind of like a huge eye opening because prior to that we've already been dealing with audio phone calls where again similar to what I did already with Sean to take his voice, put it into a text to speech service.
I uploaded 30 seconds, or I uploaded 2 minutes’ worth of audio. It was able to take that and then anything I type, in it generates it very very quickly and so I could have a whole series, like in seconds. I could have a whole series of prepped messages and then call somebody call, A loved one, Call Mrs. Windle, and kind of go, you know, and, you know, strike up that conversation. I've been tempted to do with my own wife, but I like everybody else. You know, I'm sure they all love their wives, and she'd kill me. But exactly don't do it. But I've joked with her about it, and she's like, yeah no, no, but.
It's being used for malicious reasons to scam out older people, family members. You had an attack from Palo Alto. Yeah. Palo Alto. Where the phone rang, number he didn't recognize. He answered it and they were saying they had kidnapped his daughter, and they had her crying, screaming in the background, whether that was really her. But then when she came on the phone, it sounded like her. Lo and behold, he kind of freaked out, but then reached out to his wife and the wife was like, no, she's here at home. So, but that's kind of what needs to happen is, you know, if these calls are happening to you or you're getting these calls coming into your organization wanting to transfer money or whatever, it may be, there has to be a little level of skepticism.
Be politely paranoid and verify, you know. Go through and OK, if this is somebody in the office. OK, I can get the money transferred. Let me call you right back. I have to do something. I have to go to the bathroom. So, you know, I'll call you right back. You know something where you have to go and then you reach out to the real person and go. Hey, I just, you know, did you want me to send this money, did you need me to take this action, did you reach out to me to deny my expense report?
You know, whatever that social engineering, that type of scam is going to be.
We're seeing other things with regards to malware where cyber criminals are trying to leverage that.
They're tracking trying to do data poisoning on a lot of the models. You know, if they can try to gain access, they'll do that. But the other big one for us with KnowBe4 the big step up and for a lot of.
Organizations is for years and folks, you'll probably remember the fact that when it came to security, awareness, training and emails and phishing, it was always checking the spelling. Have a look at the grammar cause the people from Russia and North Korea and wherever else their English isn't so good and so there will be spelling mistakes or it won't read right, or it'll be really bad. You know it's a phishing e-mail.
Well, that goes out the window. Because now they can use ChatGPT, Gemini copilot, Grok. You know, insert large language model here.
And they can do it in any language. For years, Japan was never really attacked with phishing attacks because they couldn't figure out the language. They don't need to worry about that anymore, because now you just get ChatGPT to write it. I've done demo videos where I deep fake myself and then I translate whatever I said into Spanish, Danish, Estonian whatever. And it then it generates the video of me talking with the proper pronunciation and language. So not only can I create a phishing e-mail with all the grammar and spelling, right, but I can also create me speaking, saying it correctly and with captions. So that's where the big threats are.
So, they're the cyber criminals have leveled up their game tremendously. So now we have to make sure we're stepping up our game with a lot more awareness. They're coming in with a whole new set of tools and an arsenal and weapons, so we need to make sure that we're educating our teams about deep fakes, about how they're leveraging AI with the recorded calls and with the phishing as well.
Rebekah: And it's so funny that you said that about the last part. I mean, it's all terrifying, but just to think about it, I came in this morning and I do use Grammarly. I'm pretty careful about what I do put through the system. They just came out with a new tool where I could literally...
If I'm speaking Mandarin, I could type in all the characters, and it would translate that e-mail directly into English so that business professionals could be translating it. And it's not just conversational anymore. It's very deep, very...
James:
Oh yeah, yep, yeah.
Rebekah:
Technical language models that are going to be translating over and so it's just even...
What I have access to is somebody who's not browsing the deep web. As someone who's not setting up malware. I can do that.
James: Right. Well, it won't be. It won't be long before we have our universal translators in our ears.
Rebekah: Right
James: You know, being able to listen and automatically get it live as it's streaming it from the person you know, start another thing from Star Trek is coming true.
Shawn: I'm telling you, just insert the cartridge into your neural link and WOOOOOOOP.
James: Like the matrix.
Shawn: Yeah, exactly. You said...what was it? Politely terrified?
James: Politely paranoid.
Shawn: Paranoid. That's - I love that
James: Yes. So having a little having a little healthy level of skepticism. Politely paranoid comes from a friend of mine in the social engineering space, Rachel Toback, fun story about her. She goes around and does social engineering where she is able to do their voice of whoever she wants to target, in real time over the phone, and there's a video of her out in 60 minutes and... CNN did it as well, where she deep faked, called up the guys, the journalist’s hotel and transferred hotel points from his account to hers, and then changed them from an aisle seat in row 5 to row 34, Seat B, which was a middle seat.
For a flight back to the UK, sadly enough, they couldn't change the seat, even though they changed the points back, they were able to give him back the points, but he was stuck in that seat. They couldn't change the seat. Yeah, but Rachel Toback, a social engineer. It's her. Not that she's trademarked it, but she has the phrase politely paranoid. And so I told her I'm stealing it. She goes. No, no, please do. So. Yeah.
Shawn: Oh that's funny.
Rebekah: Yeah, it's. And the scary thing is too, it's not just those that can be taken advantage of that are being taken advantage of anymore, right, it's everybody.
It's not just - As we saw with your video, there are plenty of people that would believe that if they didn't know that there was the technology out there for that. And so, it's not just people calling up grandma and getting her to hand over her bank account information anymore.
It's large businesses that are falling victim. And so, Shawn, then from that perspective, how have you seen AI and security play into enterprise software? Specifically, you did allude to it a little bit earlier, but-
Shawn: Yeah, I think a lot of the actual physical implementation of it right now, AI related to cybersecurity with enterprise apps, we don't actually see it, but you go to the conferences and you listen to the CTO's or like in the case of Oracle, right, to Larry Ellison and others, and they talk about how they're leveraging AI to protect their enterprise apps.
Right. Like wouldn't that be the coolest thing to take down? You know, Microsoft Azure like, let's go do that and let's get known for that, right? Or you know, I mean, if you add some kind of ransom against one of these large enterprise software vendors, they're not going to not pay like, I mean, they would be bad, right? Really bad.
So you know that the risks are severe, not to mention that we have, you know, proprietary data in every single one of these enterprise apps across their 10s of thousands of customers.
So that's, I think that's probably the biggest implementation that we've been hearing about, which is, you know, bots fighting bots, basically. So, these AI driven well robotic, you know, programs fighting all these different kinds of threats coming from all over the world against these physical servers, right. And so, it's- It's a whole- It totally reminds me of the matrix like you said James.
But it's this whole sub universe that for now, that's where the that's where the ROI has been for AI, with enterprise apps. Now it's nice that all the software conferences that Intacct did a really good job of showing some of their AI solutions at their conference recently summit on, I think it was the AP approval process and just even AP in general, right, you're saving peoples time. You're making better decisions. So, I think we're going to see more and more of those kinds of things.
But I still think it's going to get bigger. I think, I think when we go into a client, and we look at what the value of just ERP in general is or price resource planning is there's a lot of automation. But to get that like next level of automation and every single client we work with, we're not talking about like eliminating people like that's that is not going to happen. At least with the folks that we work with they're -
They need 10 times the amount of people that they have. Maybe not that many, but they need more. They need more value-added work, right? So, the human work gets higher and higher value, right. And that's -
I think that's happened from going from, you know, paper Ledger sheets to Lotus 123 to, you know, QuickBooks to, you know, SAP, right. But I do think that especially you know it's an election year, we're going to get through that here pretty soon. We're counting down the days and then it's like OK, now we just got to go forward.
Guys, whatever the answer is, and let's survive at new levels. I think the productivity is going to go up. I think there's going to be I think a lot of things have come up through this whole season of some changes that are going to occur that are only going to be great for I think, all of us, I really think. Either way, I really, I truly hope that.
So then OK, how does a $500 million, you know wood, lumber, distributor automate their processes so that they can be more effective? It's going to be AI driven, even if it's as simple as tell me which customers are likely to not pay my bills. So, I can start working on them sooner to you know, just create this report. I just want to report that looks like this.
Then there's the report, right? Those tools are there. But like I said, I think a lot of the current implementation of AI is at that technical level infrastructure level. Most of the configuration companies that we work with, they're using AI to drive code to put into the ERP's, the HCMS, and all the enterprise applications to sort of do some of that configuration versus just actually having to write it out themselves so you know it's funny, because, but even a year or two ago, I was like, no AI tools at ERP advisors because we got like client data going to like God knows where, right?
And that's like you can't - Even if we record a, you know, an interview and we're talking to a company about their whatever payroll process, that's like proprietary information. Right. So, we turned the, we turned those apps off. But there are other AI tools that we're starting to really look at, like for real, like, how can we generate report faster? How can we just like you said earlier on the pen test, the penetration test, you know, nobody really likes to do the report.
So, what can we do to make that happen faster? I mean, it's even in our business we're seeing it. But again, that's why I say you really have to be like aware just it's a good time to not stick your head in the sand on enterprise software and cybersecurity and AI - don't do it - you know, read. I get those same-I don't know how I get these daily AI emails; I get a couple of them and I'm like, even today like Apple came out and announced we're ready here we go, you know, and I'm like, oh, my God. Here we go. How's that going to change my life? So, you know, just have the awareness and understand what's going on. And like I said, just like you said, Rebecca, you're playing around with some tools that I truly appreciate. You know, that's really what it takes.
James: Well, I mean, and it it's funny because as I I when I mentioned at the beginning, we've been using AI for a while, the predictive analysis, the word corrections, the grammar in Word and Grammarly, you know, all those were around before we were dealing with generative AI. And then like yourself, you're like, OK, no AI, but it's already it was already here.
What a lot of people were concerned about was, like the generative AI, the ChatGPT’s and having their employees upload sensitive information, data loss prevention, that's where the big concern was. Even though Microsoft and Google were already, they're already in your house with everything anyway. But it's interesting, you talk about jobs and needing jobs. AI, generated AI, and AI tools can help make us more efficient, make-or proficient?
When you've got people that can handle, you know when you can have - if you've got a help desk, you can put, you know, a generative AI on that first level, answer the easy questions, pull from a knowledge base, talk people through it, and then when there's really a problem, then you get it to the second level because even though we have AI, we still need a pilot. There still has to be the human being. When I get on the plane, and I've been flying a lot lately.
When I get on the airplane, I always look to the left when I board and there's two people sitting in the cockpit. Why? Because you still need a pilot to fly the plane, even though it can take off, fly, and land all by itself. And then you still need another pilot, just in case something happens to the first pilot, so, you know, contingent business contingency. So, yeah, AI won't take away jobs. It'll take tasks, but then that frees us up to do more work and do more projects and other things that, you know that we wouldn't have time to do because we're too busy doing the other tasks.
Shawn: I'm really really, really hopeful exactly on that James that even like in our business if we can automate some of the basic things that we're doing and then we just have the time and the head space to just sit down with a client and say OK. You know we got your ERP in place. Boom, done successful. That's a miracle, right? Then what you really wanted was the automation and the reporting and the analytics and this and that. Let's go. You know, we have a client, great client in Louisiana. Awesome family business, big company, lots of different types of organizations that that kind of brought together kind of adjacent businesses. And Zach, who's on my team, he and I were just chatting about these guys the other day with Aidan. We're just like, there's so much we could do for these guys, but it takes so dang long now to get everything in place so the stuff they really want, it's out there a couple of years, you know?
Wouldn't it be great if we could, like, spin up the ERP very quickly and that's happening.
There are a lot of very rapid implementations, it's a little bit scary, but you know, but if we can use these tools, just even across the implementation of enterprise software, ensuring the security is in place so that we don't do wonky stuff because there's some bad actor out there and then get to that next level and the next level. Like, that's my hope. That's phenomenal. That's what I do this for, that’s what our business is all about.
Rebekah: Right. And there's lots of. There are lots of things in beta, Sean. Like you were even referring to, with the vendors that they're talking about at their conferences that aren't readily available.
But there are going to be things coming and they're going to be companies that are opting into those things like, oh, yeah, I'll be an early adopter. I'll test this out for you, and you can use the data, we don't recommend that, but you if you would like to. Those options are available.
But that being said, to just kind of wrap up this call, I know we're coming to the end of our time here, what factors should businesses consider when determining whether or not to deploy an AI strategy?
James: Don't do it, no I’m kidding.
So, for me, the first question is always what's the problem you're trying to solve?
You know, are you looking to do AI cause it's AI and ooo we can say we're doing AI? Have a look at what the problem is that you're trying to solve and then see where AI can fit in there but determine what you want to use you know and then looking at the various risk frameworks.
Because you've got NIST that's got one, there's an ISO standard that's out there, Cloud Security Alliance has created one they've come out with all these different frameworks guidelines for when you're utilizing AI, whether you're creating it, whether you're looking to opt in to use it, and then of course, having the policy, you know, what's that - what's your policy going to look like? And you can get Chat GPT to write you a rough draft. I've used it several times for that.
But it you know utilizing, you know, having your policy figuring out what your risks are evaluating those. And then once you've got it, make sure that you're accountable to it, and you're transparent about it.
There was a large air travel company out of Canada that launched a chat bot on its website, and somebody used it to find out about a bereavement policy and the chat bot said “Oh no, we'll - full refund. Just take your flight, come back and see us after you're done.”
They come back, and the company basically goes, “Oh no, that was a that was just an experiment. What it said wasn't right. That's not, you know, that's not a policy. Sorry.”
I mean, the guy probably spent 1000 bucks on a plane ticket, if that, and they wouldn't give him the money because they wouldn't stand by their chatbot. Anyways, he takes them to court. He gets half of his money back, but the time and effort that was spent, they got to pay him 1000 bucks or whatever their ticket was brushed under the rug and kept going. Right. It's important that organizations stand and be accountable of where you're using AI as if it's one of your own employees. If it hallucinates and says the wrong thing, then you haven't tested it.
You haven't done enough analysis, enough red teaming, pen testing with it to run it through all the different scenarios to you know, to put it out there.
So, you know, understand your problem, do your risk management that's associated with it, there's plenty of framework, go through, assess the vulnerabilities, have an opt out capability if it's a large language model so that folks can, you know, not have their data trained or stored. But yeah, that's kind of that's your jumping off point, that's where you - the first couple things you want to be looking at.
Rebekah: Cool, anything that you'd like to add to that, Shawn?
Shawn: The only other thing I would say is you know, the people that listen to this podcast are in different roles, right? We have accounting senior leadership. We have IT. We've got operations, we've got CEO's, we've got private equity, a lot of different folks listen to this, and I would say really for all of you, this is, again, it's political season.
This is an issue that you should really learn! But it kind of is, right? This is a topic, AI cybersecurity enterprise apps, that is worth that second view of.
I'm thinking of a private equity partner that - principal and one of the private equity firms that we work with that's actually working with an AI company and they just sent out a request recently to have, like some testing done with this AI solution from other people.
I like that. I think that's the best way to really learn and understand this stuff is to start working with it, right. I wouldn't necessarily just say, you know, my Chief Information Security officer, the Cisos got this. Of course they do, right? Some organizations, they don't have that individual. They might just have a director of it, right, or a CIO. Those people, of course, need to be informed and understanding, but so does the office of the CFO, right?
So does the VPS of manufacturing, so does even some of our services firms, our government and nonprofit organizations that there's leaders that are looking at technology already. And we have some of our clients, the founder who is, you know, worth billions of dollars, right? Is the reason why they're changing their ERPs. Right. If that's you, good.
You got to understand this stuff. Don't go past a misunderstanding in this area - and it's very easy, too, right? There's a ton of materials like James talked about that you can just take on a gradient. Just start reading it. “Oh, I don't understand it.” Look it up.
Like, this is the perfect story. Then I'm going to stop. I had a very, very good friend of mine who was in his 70s. He and his wife, and we were chatting, and he found out what I did. And he said “Ohh, we are really worried about AI. We think AI's going to take over and it's going to be the end of the world.” Now. There's a great podcast on sort of where that kind of concept came from that's out there. You can do like “AI take over the world origins” and see that there was some there was a group of people in sort of the Silicon Valley that kind of originated those concepts.
But I said, that's ridiculous. Like now it's like anything else, “is a car dangerous?” No. Well, it is if it runs over you. OK, so it's the person behind this, right? But it's also the person standing in front of the car watching it come at them. So, the more you know and the more you're doing the research, you look at the mainstream articles on AI, you know, read those right, see what's going on with that. We'll be fine. And I, I mean, I literally believe that this, whatever the revolutions and all those kinds of things you hear about different kinds of 4th revolutions in that manufacturing and stuff like that.
But I really do think we are on the precipice of just mass expansion orders of magnitude behind anything this planet has ever seen, and I truly can say and beyond.
And a lot of that is going to be driven on AI. If we can catch a rocket with chopsticks, right, what's the next thing that can happen? And so that's - And as we get those models understood and patterns understood, and we can build these into computing systems.
I mean, it's not the sky that's the limit, so I'll leave you with the hope on this Christmas - on this Halloween Eve where James freaked me out at the beginning of the call because he basically, although I do love you. But you know, you really do have to be aware because the deep fake stuff is real too. You got to make sure you remember the other side of it.
James: And I put that together in less than 10 minutes.
If I spent some significant time like a couple of hours on it. I can make it even more believable.
Rebekah: Yeah, yeah, yeah. It's scary for sure. But like Shawn said, there is hope for that. And really throughout the whole theme of this call is education, right? If you know what to expect, if you know what to look out for, you substantially increase your chances of succeeding and effectively adopting the technology.
So, thank you both for joining us today. I think this was a great call and thank you everyone for joining us for the call today. Please let us know if we can answer any questions. We have lots of information available online. You can always reach out to Shawn or myself and or James.
I did tag him as well, so anybody who has questions needs more information, please let us know and be sure to join us for our next webinar, which is scheduled for Thursday, November 21st. “Why you'll be thankful for your client-side implementation consultant” where we will teach viewers how they can leverage a client-side implementation consultant to ensure their projects get on track and stay on track until you successfully go live.
We also have a really incredible AI call that is up on the website. If you want to sign up for December. This was something that Shawn did for FEI Colorado. And so it's going to be a lot of really great content that we're going to revamp and really dive into some major topics and what the vendors are doing. Please go to our website erpadvisorsgroup.com for more details and to register.
ERP advisors group post one of the country's top independent Enterprise software advisory firms ERP Advisors Group advises mid to large size businesses on selecting and implementing business applications from enterprise planning, customer, relationship management, human capital management, business intelligence and other enterprise applications, which equates to millions of dollars in software deals each year across many industries. This has been the ERP advisor. Thank you again for joining us.
Shawn: Thanks James. Thanks, Rebecca. Bye, everybody. Take care.
