Name: Designing Practical and Secure AI Solutions for Your Business
Uploaded: 2026-11-03T16:31:23.724Z
Duration: 1 h 11 min 40 s
Description: Designing Practical and Secure AI Solutions for Your Business

Transcript for "Designing Practical and Secure AI Solutions for Your Business": Hello, everybody. I will give everyone about ten more seconds, and then I will welcome you all to our event until countdown. Okay. Thank you so much for coming to our virtual event today, designing practical and secure AI solutions for your business. I'm actually pretty stoked about this one. This is a little bit of a different format, than previous webinars that we've done here at Thrive. This is an extended version. We actually have three topics that we're going to cover. One is over why AI projects fail and what can make them succeed. I will be presenting that. The next one will be AI adoption and practice. It will look at how to create an effective AI workflow for a specific use case that will be presented by our AI solutions developer, Emily Steen. And, the last section will be over AI and how it's affecting infrastructure security that will be presented by our, VP of product for cybersecurity, Kevin Land. As always, this will be available in the recording and each of the presentations after. With your registration, you'll be able to click and follow-up. Any questions, I will try to skim through anything that is brief or highly relevant to the topic. We will address at the end of each of these sections. But in general, most of the q and a will be held for the end. If we run out of time and are unable to get to your questions, your AM or another person from Thrive will follow-up, so hopefully no one won't be left hanging at the end of the week. With that, I actually want to start this off with a poll question. So first... Let's see if I can share. Everybody, please answer. Jump on and fill in. How confident are you in your current AI strategy, where you are today? Are you very, mostly, in neutral, not very, or just totally emotionally discouraged? Let's see if we have anything coming in. Oh, okay. Emotionally, super happy to see that we have a relatively small small percentage, if not at alls. The neutrals, you guys fascinate me. I really want more detail around that one. So someone drop in a question or a comment so I can follow-up on that. Okay. I'm going to close that question. It it it is interesting. The clear winner was neutral and then a little bit on the negative side. So, hopefully, you guys will learn and move into the future. Our next question is, what is your top AIKPI or metric? So, this one, I literally mean the number one thing that you're looking for. Realistically, we're probably looking at all of these. But what are you going for? Is it cost savings? Are you trying to control project spend or AI spend? Are you measuring revenue potential, productivity? Are you looking at changes in hiring, either hiring patterns, more or less, different, or something else? You do not expect to be this one-sided. Okay. Follow-up question, and please leave a comment. If you're measuring productivity gains but neutral or negative on your AI strategy, do you think you're measuring the right thing? I'd love your opinion. Okay. Another second for that to close out. Okay. That was very exciting. And I actually definitely wanna follow-up with you guys later, so I hope we have more to share on that one. Now what I wanna look at right now is why ninety five percent of AI projects fail. What's fascinating to me about that statistic is if you Google it, that is from multiple different surveys measuring multiple different things. McKinsey has one. It's 94%, but 94% of businesses are not making a dime of revenue off of their AI projects. MIT, Harvard, and Gartner have all had failures either, from AI projects not reaching production or being pulled from production for missing targets or for other related issues. So failure can mean a lot of different things, but it is pretty consistent that people are not seeing from AI what they want to. I wanted to call this out. This is a really famous picture from World War two. They were trying to figure out how to make planes safer for fighter pilots. So the first thing they started looking at was mapping the damage that planes had taken from fighting over Germany and coming back to The UK. And the first instinct was to start plugging those holes, putting in more protection on the wings or in the middle of the fuselage, and someone very wisely pointed out those weren't the problems. Those were the ones that, came home safely. The problem areas were the ones where planes couldn't make it home with the damage, so they started focusing and set on the engines, the nose, and the tail in the center there. That's what we need to do with AI is we kinda start need to looking at not the obvious technical flaws because those are easy and those are easy to fix. It... We need to look at the back end of why it's not working out the way people want. I absolutely love this quote, from Robert Solow. He was a a Nobel laureate in economics. In 1987, he said, you can see the computer age everywhere except the productivity statistics. This was made even more famous in his editorial in a 1993 paper from MIT over the productivity paradox. Individually, it looked like computers, mainly mainframes at the time, should have had a huge impact across The US economy. And instead, there was virtually no impact. There was no difference between the seventies and the eighties in overall productivity, for revenue and employee time. And there's a real question of why. If it... In the micro, it seems so effective, why weren't we seeing it in the macro? And I saw a follow-up to this from a really great... The Cloud Computing Insider podcast by a great guy named Dave Lythicom. Definitely check it out on YouTube. He had this fantastic proposition that digital transformation has failed, and he used Robert Solow's framework. He looked at productivity gains since 2011, which was really the strong kickoff for digital transformation right after the start of of the cloud computing era. And we've seen virtually no productivity growth in the last sixteen years in The US. For a solid decade, it was less than 1% just like in the eighties. In the past few years, it's picked up to barely over 1%. But all of our transfer... Transformation efforts for productivity, for innovation, analytics, it has not worked. The real question is why. If we're looking at the red dots, what were organizations trying to do? According to Accenture, they were trying to do cost savings, speed of production, data analytics, that's the insights and innovation, and business continuity and resilience. They were trying to use the cloud to do things faster, to do more, and it didn't work. Even for the most successful cloud projects, the best case, they're hitting any of these metrics less than half the time. The vast majority of cloud projects are facing overruns, failures, budget delays, but most of it is hidden. People aren't tracking. They're not paying attention, and they don't realize it until they get asked by Accenture or someone else. So Accenture looked at what went wrong. They looked at the red dots. It was overconsumption, inherent complexity in in distributed computing that didn't exist in previous environments. There were misaligned business and tech priorities, and the biggest elephant in the room, technical debt. Over half of IT spending, about 57% is spent on technical debt and legacy systems. So they obviously would be like, oh, we'll just do better monitoring. We'll just do better price tracking. And, yes, yes, we absolutely should do that. But the question is what what really went wrong. The red dot is technical debt or the red dot is complexity. Those are the things that we can see. But what really has gone wrong at a metaphysical level with digital transformation? Change became cheap. If you look at mainframes, they were exceedingly expensive. We look at the... That's why it didn't really affect productivity that much. The effort to get things up and running limited the scope of what people could do in the seventies and eighties. What they could do was amazing. They couldn't do that much of it. We look at the nineties and through about 2010, and what was amazing about that is access to information was incredibly easy. It was the cost of a dial up modem and a phone line. But on the back end, what businesses had to put in was still really expensive. It took a lot of time. It took a lot of effort. It took discipline and control. Bad ideas, half baked ideas, ideas that didn't deliver on ROI, they were dropped because people couldn't afford the lift of doing them. That completely changed when you went cloud. Something became really easy to innovate, to fail fast for incremental improvement, and those are all great ideas. But the problem is we lost the discipline and the experience that had gone into web one point o. This is my opinion, by the way, but, of course, I'm right. So what we see is that AI is speed running this DXit failures because it should... It still took some skill to spin up an AWS cluster. Even I can use chat GPT. So it has become so much easier for people to put out Vibe based product. And it looks really great on the surface, but you start encountering problems on the back end. And this is not something that is only happening to small businesses or in certain areas. This is my hall of fame, and there were actually many more, I just ran out of space on the slide, of really famous AI failures in the last eighteen months. Some of them are hilarious, like Taco Bell trying to give someone 18,000 water cuts. Some of it were kind of predictable, but experimentation, like Uber burning through all of their quad tokens in less than four months of this year. But some of them should have been foreseeable and are really a little less amusing to me. One of them is Ford. Ford fired several 100 senior engineers with the idea that they could just take their working product designs, feed it into AI, and get great cars. And what they started getting were production failures, recalls, overruns, and consumer complaints. What they didn't realize is the production designs were the final step. They were not the process of designing a car. Everything that those senior engineers knew came down to feedback that they had gotten from suppliers, problems in production, consumer complaints, things that didn't quite work right. You know, this part worked great, but it didn't work well with this other part, so the performance wasn't where they wanted it to be. Every failure that had gone into developing the working products was not captured in the data. So what AI did was put out things that didn't really work. They were technically feasible, but they did not properly meet the consumer need or quality. Starbucks did something similar. They decided that they could cut back on staffing for doing inventory by using an AI based inventory system, but they only tested it in a greenfield. They only tested it in a lab where every bottle was clean and facing forward and full, and the labels were consistent. If anybody has ever been in in anywhere like my kitchen, that is not how the real world world operates. They get dirty. They get torn. Manufacturers change the bottle shape or the label. There are seasonal colors or flavors that only come out at certain times of year. Bottles look similar. In the real world, they ended up losing millions of dollars both in staffing and in either wasted or missed product because it didn't understand how the real world operates. That wasn't the fault of the AI. That was not a technical failure. That was a testing failure. That was a process failure. That was something that should have been caught and wasn't because it was so easy and so fast to put out the AI, and and there was an assumption it would be fine. It would work out. And that's what I wanna call out here. Even the most successful AI projects, according to McKinsey, have less than a 5% increase in overall corporate revenue. And that's the 5% of projects that are considered wildly successful. Nobody in the McKinsey survey had more than 6% impact on revenue. So the amount of investment that people like Ford or Klarna or Uber were putting in are not seeing the payoff. So So the question is why. Is it the fault of this technology? Is it the red dot, or is it something else? It... It's something else. Just spoiler. It's not the red dot. So what went wrong? Okay. Again, like the Accenture list, what went wrong? Too much hype. People really, particularly some executives, had this idea that AI was a god in a bottle. You didn't need to do testing any... Anymore because you could just say, Claude, make no mistakes. Who needs testing after that? Everybody. Everybody needs testing after that. But a lot of it was... A lot of people brought into the idea that this time, it's different. And, again, spoiler, for now and the future, it's never different. It's always the same. You need the basics. A lot of it also comes comes back to poor data and assumptions, like Ford not understanding that the right design is not actually the only important design. The failures are just as important. That institutional knowledge is just as important. But on a smaller scale, even one thing... And I... It's not in her scope, but Emily could testify to this. It's just, not in her presentation. A lot of times, we simply have people with incomplete data. They don't know that something is really important is missing, or they don't realize that there are conflicting, files saying the same thing but differently. Things get outdated. Things are not properly integrated. If you have bad data or gaps in your data and don't realize it, there are going to be gaps in your AI, and that's not really the tech problem. You do wanna have miscalculated budgets. Uber's the poster child for this one. But, again, what we have seen in real life is that people work out a plan. They love their plan. Their plan is great, and they did not expect how much it was gonna cost. Something that you run once in testing is not the same as something you run 10 times a day in real life. Gartner has said that a lot of AI projects are failing because of budget overruns of any core from 500 to 1000%, which is insane. And then the normal things, anytime you're dealing with human beings or technology, there's no clear goal or goals are misaligned between business and tech. Goals change. Priorities change. Or there's no considerations of internal constraints. And by that, I mean, the way that teams operate, the way that users want to interact with with an app or with their company. A lot of people, for example, they want... If they have a a customer service problem, they might wanna call somebody and not use a chatbot. Just just want someone to know they're mad. And there are things like that where if you don't understand the expectations that people have going in, what you create may be misaligned that needs to come out. But, again, these are all red dots. This, I think, is closer to it. In a cab we had this year, one of our clients, who was actually not using our AI platform, they were using something else. But they said so many people had just started going off and doing things, things that he, as an IT leader, could not secure and could not track, that he didn't know what's happening until something went wrong and he couldn't maintain it. His term was chaos without standards, and that has really stuck with me because the enthusiasm, the hype that people have is carrying over not into creating, but just into chaos. On a micro scale, it looks okay. On the macro scale, it's working against each other. I wanna call this out too, because this misalignment, I think, is... It's emotional. It is organizational. It is not technological. Upwork, if you guys don't know, it's a really great place for, finding freelancers or contract help. They did a study of executives of businesses that work with them to ask, how do you expect AI to affect the work that you receive? And virtually all of them said they expected AI to boost productivity. That was not the case for the people who actually did the work. 77% reported the AI made them less productive and added more work, and nearly half of individual contributors said they had absolutely no idea how they were supposed to achieve the productivity gains that they were being told to achieve. That is not an AI problem. That is a human problem. Then this year... So that was from 2024. 2026, the same AI report found a 70% year over year increase in AI remediation work being posted to Upwork to find cost... Contractors to fix things that had gotten broken and couldn't be maintained internally. I feel like those two things have a certain continuity to them. When McKinsey looked at how organizations were using AI, successful organizations, the small percentage that were making revenue off of their AI projects, if you'll see this, less than half are actually trying to work with AI as a technology where it is. So as we all know, l... The way LLMs work, they are nondeterministic. They are probabilistic, which means you can get slightly different answers if you put the same prompt in. It's just the nature of of how it works. It's actually really great for creative fields, but that does introduce a certain degree of uncertainty. So like any technology, it needs to be maintained with guardrails. You need to check, are people uploading unauthorized data? If you have agentic workflows, are they doing what you expect them to do in the places you expect them to do them? Is the output good quality? Is it accurate? How are you mitigating inaccuracies? And the problem is most people, even the successful ones, these are the successful ones. They aren't. Half of the time, they aren't checking to see if what they're doing is accurate. They're not checking to see if it's doing what it's supposed to do, and nobody is reviewing the output that comes out. That is why the successes aren't quite as successful as they should be. My guess is it it could get worse for them. The problem is that a lot of AI initiatives are succeeding on the metrics that they have defined, but they didn't define the right metrics. So on paper, it looks successful, but in in practical terms, it is failing. Biggest example of this are efficiency experts from the eighties and nineties, the doorman fallacy. It's also, the post office fallacy. This idea that you can fire the doorman and everything's fine because what they look at is I fire the doorman, I save the the cost of the salary of the doorman. Success. We are more efficient. What they didn't look at is what the doorman actually contributed. They looked at him as a cost, but they didn't look at his benefit. Was there... He provided security. He would get packages for people, so he improved the user experience. He recognized people by name. He could run off transients or make sure to meet people. He could take care of kids or pets. He provided services that were not a parent but were real. And so if you only track salary but you don't track impact, you are tracking the wrong thing. So what we see in this is a lot of people have used AI to create things faster. If if less is more, just think how much more would be. So people are putting out more emails, more texts, more advertising, more digital ads, and they look at that side of the production. I did three times more ads this week. But what Powerreach dot AI saw is that there was a 100% increase in unsubscribes if the AI wrote the body of an email. There was a 16% reduction in the sales conversions with AI generated content. And this was... This one is from, Upwork. But despite the fact that there's 30% more lines of code lines of code being written, there has been a 0% increase in either future release frequency or new software releases overall. The reason is more is not better. It's just more. And this is probably the worst. This is from powerreach.ai. When people found out that the emails or text that they were receiving was AI generated, there was a 20% loss of consumer trust in the brand. Because some... If somebody says, hi, Janice. How are you doing today? And you find out that that person is a machine, you've lost trust. So those are all the failures. These are the combination of white dots... Red dots and white spaces. What is the key to success? Because it is hiding in there. There are two like this. Melania, two in here. Versus be human. Have a clear vision of what you're doing and who you're interacting with. And I don't mean the specifics. Emily will show you the specifics of how to do AI in a great way. Kevin will show you how to do it securely. What I'm saying is mentally. When you take a step back, when you look at your AI strategy and think I kinda hate where we are today, the AI strategy picture in your head should be human. You are a human person talking to another human person for them to do something in the physical world. Have that picture in your head so that everything that you create flows out of your voice and out of your intent. And what we see in that is that, again, from powerreach.ai, when there is human generated body content, and I am emphasizing the body content here, you drive a lot more traffic to your site and people stay on the site longer because people recognize that human voice even in subtle ways. And the other thing is to be disciplined. The the... This is this is the space where Emily and and, Kevin are gonna shine. Eat your vegetables. Make sure that you're using the right tool in the right way in a secure way for the right thing. It's just an IT tool. Use it like that so you can use it effectively. You can't skip the basics of QA, of good planning, of user experience. Remember the lessons that we learned. If you were around in the nineties, like some of us, that we learned in web.o, the first dawn of cloud, how important it was to find a way to connect. Use AI for tasks. Use humans for jobs. There are things, by the way, the AI is amazing at. It is really great at fast generations. Use it for your subject lines, your digital ads, your taglines. Do AB testing. Do 45 versions and see what performs best. Absolutely. Use it for that kind of thing. AI generated... I didn't put this in because it didn't fit my negative narrative, but AI generated subject lines have way higher open rates. People absolutely open something with a subject line or tagline or digital ad that is short, pissy, and compelling, and AI can really help you dig that out. Just after that, make sure a human voice is talking. The next part is research and pattern recognition. Areas where this really shines in a lot of ways are things like lead scoring, audience segmentation, next best product. There are things where AI can help you pick out patterns in your data in a very effective way, and it can do it in a way that will allow you to change very responsibly responsively as your audience changes or as competition emerges. Absolutely use it for things like that. If you need to move fast, use the AI. It's also good for reviews and summaries. Something I use it for is I, have to do analytics on on, competitors, and I will use AI to scan competitor websites. I will find out what the topics they've been talking about the most in the last three months have been. What's their page navigation structure? How are they hyperlinking? What are their messages based on what's on their site? Who's their audience, and what are their top pain points and challenges? I will absolutely do it for that. It's so fast and pull the information out that I can then read and analyze. Incredibly helpful. And remember, as you go into a project, ask questions. Can I clearly define what I am trying to do here? If the answer is no, AI is not gonna help you. It is not God. It can only do what you tell it to do. It cannot tell you what to think. Next part, is AI the right tool for this? One other problem that people have had is trying to use AI to plug gaps where they lack experience or insight or they simply have too much work. That can help with very senior people, but you you actually just may need something in conjunction with the AI. Do not overburden your excellent people by having them try to do more with AI that... Just hire somebody else. Then the next is, what are my current costs? And this is a really important one to avoid those budget overruns. How much can you spend on AI and then design it so that it fits within its constraints sustainably? You can run it every day. You can go forward. Make sure that it fits so that your solution can work long term. And the last is who has the experience to check this both at every stage, planning, development, launch. Have someone review output. Do spot checks. Build it in. Make sure that humans are interacting with your AI so they can make sure that it is performing in the way that you want it to. And the last thing is gonna be remember the basics. Set and track KPIs. This is something we've all failed to do starting with cloud, but set and track your KPIs and your budgets and track it by quality, not quantity. Conversion rates, great metric. Lines of code or number of words, terrible metric. Don't just look at the volume. Look at its effectiveness. Develop experience with your people, not reliance. AI should be driven and defined by your seniors, not your juniors. Have the senior people put experience in. Do not have juniors use it as a crutch. It's incredibly important for the... For your AI and your people to remain effective. And the last part is to create communication paths. Make sure that you are listening to your people if something is or isn't working. Maybe if something new is coming out that they wanna try, also listen to your clients. Make sure that what you're doing is effective, clear, and beneficial. And if it's not, have a way to pivot and change. And with that, I'm going to launch one more poll question. And, let me open and share as we transition into Emily. So have you or anyone in your organization tried creating a multistep AI workflow? So not just, you know, chat TPT, write me a sales email, which I've never done. I have done this. Okay. We all have. But have you tried anything multistep? Have you tried creating workflow maybe for generating report, doing some sort of analytics? Oh, okay. You guys have continued to surprise me at every point today. Over half of you have. Hats off to you guys. Nose. I'm I'm with you there. I have not tried multistep, actually. And so with that insight, Emily, I think we're ready to hand off to you. I think people are gonna look forward to what you have to say. Great. Thank you. Okay. Well, I'll jump right in then. Thank you, Ella. Thanks for the intro. So hi, everyone. My name is Emily Steen. I'm the AI solutions developer here at Thryv. And so I'm mainly responsible for developing our complex and multi agentic AI solutions. So today, I'm gonna show you a bit about that, but also a bit about Thryv's approach to AI adoption in general and just some other examples of things that we've built. At Thrive, we have a crawl, walk, run approach to AI adoption. In that crawl stage, we focus on widespread adoption. This is where we host training sessions that help with adoption such as prompt engineering and AI best practices. Then we move to that walk phase. This is where we start to build solutions that are accustomed to you and then automate some of your operations. Then we evaluate. We check your progress and discuss next steps. And some of our clients, not all, but but some move to that run stage. This is where we focus on automating your entire... Or some of your entire business processes from end to end. And this is where I spend most of my time as the solutions developer. So unfortunately, your employees are already using AI. This is something that's widely talked about, so I'm sure this is a familiar concept at this point. But this is called shadow AI, which is where employees use AI or public AI tools without any oversight or governance. The main risk here is a data exposure risk, which is when employees put sensitive company information into their prompts and then send them off to those LLMs, which then can train on that data. So at Thryv, we offer an AI workspace platform that solves that shadow AI problem. It's a secure AI platform that connects to basically every single large language model that you can think of across every single provider, both closed source and open source. We have many connectors. I put 70 plus on the slide, but it's probably more since I created this slide. Everything you could think of here, the main one would be like Outlook, or Microsoft in general, Salesforce, ServiceNow, etcetera. There are a ton of them. And it also offers governance and security as well. There are also zero data retention agreements with all the model providers. The platform is built with governance and security at the forefront, and being the main considerations. With that said, I'm going to go through each stage of our adoption journey and talk about things that we would either build or host training sessions on at each of these stages. We'll start with crawl. Again, this is where we focus on widespread adoption, which we do with a safe start and quick wins. So this is just a screenshot from the platform. At this point, it should look pretty similar to other AI platforms or what you would expect of an AI platform at this point. You have the prompt window there on the screen. You can select your large language model. Again, you're not limited to one provider. It shows Claude on the screen, but you can use basically any provider, Gemini, OpenAI, DeepSeek, etcetera. And then you can also select tools and data connections as well. So here's just another screenshot of those models that you can select. As you can see, you can select basically any model. So here's a video. So just before I play it, just as a summary, this is kind of what we would show at the very early stage of an adoption journey, for clients who are meeting us at that stage. Sometimes we have clients who are more advanced and we move forward a little bit faster. But at the very beginning, we're just showing how to how to prompt, what you can get out of AI, and those really, really quick wins that we can help facilitate. Okay. Great. So what we saw in that video was just a very, very simple use case of asking AI. I... I'm saying I have a meeting with Tory. You can see some of the output there was actually about this webinar today, but I have a meeting with Tory. What are the key items that we should talk about? And it fed... It went to my Outlook, it went to my Teams, it consolidated all that information. It used that logic and reasoning to infer what those action items would be, and then it showed it to me on the screen. Extremely easy. Very much like stage one in AI, but but just something that we help clients with at that early stage just to get them using AI in their day to day lives and focus again on those really quick wins. So then we move to that walk stage, and this is where we start to build more custom solutions for specific organizations and specific teams. I'm just gonna give an example of something that I really like to build in this stage, which is a client persona. So a client persona is an AI representation of a client or really just a person in general, And it's built by connecting to... By connecting a large language model to all of the data that you have on a client. So all of the Teams messages, emails, meeting transcripts, etcetera. Meeting transcripts are probably the most valuable thing here, and then consolidating that into an AI representation of that person. I use this a lot for feedback and also prioritization. So as a developer, when I'm building a solution for a client, I love to send the output of that solution to the AI persona of the client and then get feedback, then continue that development loop until the AI persona approves of that final output. So if the... If I'm building, AI tool that generates a report, I'll send the report to the AI persona continuously until the AI persona approves it, and then I'll send it to the client themselves. So it's had multiple rounds of vetting based on all the data of the client, before it ever gets sent to the client. It's also super helpful for prioritization. So instead of, you know, I'm creating, like, to do lists or action items, on my desk for every client. When I'm working for a client, I just ask the persona what are the important things to work on right now, and it'll give me a list kind of similar to what you saw before. And this is super important because it's actually live. So we'll look at for any updated meetings or updated emails or or Teams messages. So you're always getting an up to date to do list. So I mentioned as a developer, this is how I use it. You can kind of think about how this is applicable company wide, for anyone client facing or working for clients, marketing, sales, etcetera. So here's an example. Not to be confused with Ella on the screen. This is a mock version of a different Ella. I should have chosen a different name for this presentation. But, anyway, this is a persona of, Ella who's, in this case, the owner of a restaurant. And I, for this example, am a designer of matchboxes. They're the little boxes with matches that people used to hand out, I think, like, older, but now they've resurfaced in New York. And I I love matchboxes. I collect them, so that's kind of where the example came from. But for this example, Ella is my client, and I have connected a large language model to all the information I have on Ella. So all the meetings and emails and Teams messages, etcetera. And And I've connected it to a large language model, in in our AI workspace platform as you can see on the right. And on the left, I can ask Ella persona to tell me about herself and she would respond in a very similar way to what the real Ella would respond. So then I, as a Matchbox designer, have designed these 10 matchboxes or really AI has, but let's just say I did. And I can ask the Ella persona what she thinks of these designs, and the persona will respond. So in this situation, what the Ella persona responded was that she really liked that navy blue one towards the right. She likes the race crest. She, and then she said it looked like it could be something that could be tucked into a back pocket, which was the aesthetic that she was going for. She said that the one on the far right looks like it's from a farm to table brunch spot in Brooklyn, which is not the vibe of the restaurant. So you can see here a real example of how you can use this persona to get really good feedback that is representative of what the client would actually say. And so then after I get this feedback from Ella persona, I would send to the real Ella those matchboxes that had been approved. Now we get to what in my opinion is the best stage in the process. This is where I spend most of my time as the solutions developer, which is the run stage. This is where we focus again on automating entire business processes, typically using multi agentic workflows. The example I'm gonna show here is we had an asset management firm come to us and they wanted to analyze a entire data room for... Of a loan portfolio. This loan portfolio contained about 5,000 mortgages. There were, like, 10 to 15 excels as well as 10 to 15 PDFs and thousands and thousands of data points. On the top in the yellow is the process that this firm would go through manually to run this analysis. You can see it's a seven stage analysis that takes multiple days, if not weeks usually, to complete. What we did is we actually took each one of those stages and converted it into its own agent. The reason for this is that it heavily mimics the manual process that they go through because we don't want to lose any of their... Any of the process that they go through manually when we're automating it. So it takes all of those manual steps, creates an agent for each one, and then automatically at the click of a button creates that investment report. So you can see here, it might be small but hopefully not. So this is the report that it creates. It's a 20 page or 23 page report. It shows the target purchase price, the investment recommendation on the top there, and then the results of that entire seven stage analysis. The objective when building this report was to mimic as closely as possible the reports that they would create manually and the formatting and content of those. One of the benefits of this platform is you can actually choose a model provider that's best at what you want to do. So when I created this, this was actually a while ago, but at the time, Gemini was best for document creation. I'm just gonna go back aside. Document creation that you saw here, but Claude was the best at PowerPoint. And so I could use Gemini to create the Word document or PDF, and then I could switch over to a Claude model and use essentially the same agents, just a different agent at the end, and then create a PowerPoint. So that's one of the main benefits of having all the model providers is when model... New models come out that are better at specific tasks, you can take advantage of that new capability. So you can see here, I can just quickly switch it to that cloud model and create a PowerPoint. So overall, the organizations winning with AI aren't the ones deploying the fastest, They are the ones deploying the smartest. Thank you. There was one question that came in. I think you can tell me if it's gonna take too too too long to answer, but that I think we can get to. Where does the data go? So I'm gonna say specifically for hats, which is our managed AI workspace. And how can we delete the data? This is why I wanted to bring it up. How can we delete the data entered in the AI prompt? Yeah. So the... One of the main benefits of the AI workspace platform has, as you said, is that you actually have a layer between the front end of the platform and the actual model itself. So basically, it... The the data is stored, within the secure architecture that has created, and then only the inference data is actually sent to the large language model. So only... It only pulls a small tidbits of information that are actually relevant to the output. And then you have a no data retention, no data training agreement, with the model provider itself. You actually don't even... You don't need to delete the data from the model provider because it's actually never stored. See, that's a good answer. In that case, thank you so much, Emily. There is one more question, but it is multipart, so I'm gonna save that for the the q and a at at the end. So grab a coffee and come back hydrated. And with that, I'm going to, introduce Kevin Lant and open up with his, with his poll question. The pop up would not block me. Okay. So what is your top AI security concern for everybody here? Again, just top. I'm sure it's everything. Is it protecting from AI threats? Is it data security and privacy with tooling? Is it using AI to detect vulnerabilities, managing vendors and supply chains, or something else entirely? It is a changing world. Oh, okay. I am, again, shocked. I am just gonna live shocked today, people. So pulling out strongly ahead is data security and privacy with AI tools. Honestly, given all the headlines, I was I was expecting more about protecting from AI threats, but, data security is by far the winner. I mean, I'll I'll give it another second so everyone can have their voice, but, three, two, one. More interesting results. Okay. And stop sharing the poll. Kevin, I will hand it off to you. Alright. Thanks, Ella. So we'll talk a bit about, how AI is changing the the threat landscape. And so I wanted to highlight, three numbers here that are that are interesting. One is what I'll say, AI threats from your users or how they're using AI. And this came from from Gartner. It was a prediction they made that 40% of organizations will have security breaches or compliance risks because of shadow AI by 2030. The second category we'll talk about here is how threat actors are using AI that that might change the threat landscape. And here I wanted to highlight what Ella had in the poll there, around vulnerabilities. We've seen, an eight x increase in successful vulnerability exploits against edge devices and publicly facing systems. So AI is really changing how effective... Just like it's it's changing how effective your employees are, it's changing how effective threat actors are. But it's not all bad news. We can also use AI, on the defensive side, for our cybersecurity program. I'll talk a little bit about how Thrive is using AI in in our services. This one's another Gartner prediction here about AI, 40% faster incident response because we'll be able to unify platforms and get better visibility. So AI risks from your users, Emily started talking about this a bit. Shadow AI is a big concern because, users could paste sensitive information into a public model. Those models then train on that data. That data can then be revealed to other users of the model, and it kinda goes back to that old saying, if you're not paying for the product, then then you are the product. And so you've gotta be careful about using these, free tools, public tools, and what you put into that. Where it affects you as an organization is around that loss of visibility about what people are doing with the data. It's really hard to run a governance program, if you don't know, whether people are using sanctioned, tools and what type of data they're loading into those. One way that data comes out of these models is through, prompt injection attacks. There's a couple different types to know about. Direct prompt injection is when you give a command directly to the to the chat, say, forget your previous instructions and do this other thing that maybe there should be guardrails around. It's trying to get the the model to do something it's not supposed to do, like give you certain information, maybe go connect to a server it shouldn't connect to. Those are prompt injections because the the AI can't always distinguish between a a question you're asking it and instructions you're telling it to do. One of the the bigger threats, though, is indirect prompt injection. That's where a threat actor could hide those types of instructions, and not type them directly into the chat, but maybe put them in a file that gets uploaded, maybe hides them on a website that Ella goes and craws as part of her market research. So we have to be careful, about going... I'm sure those sites are fine, but there are people setting up fake sites. Right? So we have to be careful about what the model can go do, what the agents can do, and make sure you're safe from those types of attacks. And then we talked about vulnerabilities and how that's changing the the landscape. Threat actors can move much faster, in discovering new types of weaknesses, building exploit code to take advantage of those weaknesses, things that used to take months for an attacker to do now take seconds. And they can also use the AI to string together different exploits in a chain to form a more sophisticated attack. That used to be the realm of your really experienced, high end threat actor. Now that's available to to everybody. So it's it's really changing how fast we need to find those weaknesses in our own environments, make sure we're we're remediating those, mitigating those, before they can be exploited. So first, I'll talk about some things you can do, and then I'll talk about what what what Thryv is doing. Like Ella said, eat your vegetables. It's kinda going back to basics. The first thing you can do is come up with an AI governance policy. So you can't really hold people accountable if you haven't told them what the rules are. So you'll want, a written document that specifies which AI tools are are approved, who's who's allowed to use them, what type of data can go into them. Make sure management is on board and agrees to help you enforce those, and make sure you train your staff so they understand exactly what is expected of them. And then looking at some of the the security controls you can put in place, these aren't new controls. These are part of the CIS security framework. We're a big fan of this at Thrive, because they aren't just applicable to old fashioned networks. They're also applicable in the AI age, and we can really... If we redouble down on these, really put in some strong security controls that limit the risks around AI usage. First one I highlighted here is CIS number three around data protection. So what data do you have? Do you know what data is stored in your your organization? Who has access to those? Really documenting your data before, creating that policy about how it can be used. CIS controls five and six is around account management and access control. So making sure there's MFA on on all the identity accounts, making sure people only have limited access, and and that agents only have limited access. That limits the the blast radius if something were to go wrong. We've segmented people down to data that that they need. CIS seven is is around continuous vulnerability management. Many of you, I'm I'm sure, are are doing that today, but we need to look at, you know, how quickly we're we're running those cycles. Are they continuous? Do we have, automated patching, those types of things to stay on top of things? And then CIS 14 is really important. One of the other ways attackers are using AI is to really improve those phishing emails. They used to be obvious. They'd have typos, and misspellings and bad grammar, and you could spot it. It was a phishing email, but now they're they're much better. They're more targeted. They're higher quality. So we need to to make sure we're doing skills training for our end users so they understand how to detect, social engineering, attacks and and make sure everyone, knows how to spot those and report those. So, I'll talk about a a few ways that, Thryv is using AI in our cybersecurity services. One of those is through email filtering and and DNS filtering. So we've got AI built into the tools that we use to protect our clients' email. I just mentioned that that phishing is becoming much more sophisticated. You can't just look at who the sender is and and and block it. We use AI to actually understand what's in the email, how it's written, what the sentiment is. Is it trying to create urgency? Is it trying to get you to click somewhere outside the email? There's some some red flags that we can throw up for the users to make them stop, think before they go act and respond on that email because it it it recognizes techniques that attackers use. And we use that in in our DNS filtering as well. So as I mentioned, a malicious website could be hiding prompt injection, directions on them. When these new domains come online, the AI in our in our DNS filter, will analyze those new sites, classify them, categorize them. If they're a threat, we block users from going to them. Another way that we're using AI, at Thryv is through our autonomous penetration testing service, and this is where we take, we sit in the the seat of the attacker. From their perspective, we use AI to try to find weaknesses in the environment, try to exploit those weaknesses. The tool can chain them together in a sophisticated attack just like the the most advanced, AI models can do. And we do that proactively so we can go find those and fix those, and make sure we're constantly hardening, the environment. So that's another way we've used, AI to good effect here at at Thryv. A third way we're we're using it is through, network analysis in our in our network detection and response service. So, we've seen an increase in exploits, we've seen an increase in successful exploits, so, you know, we may not be able to stop everything, but we need to detect it quickly, We need to contain it, and that's where this service comes in. It's looking at traffic back and forth, on your on your network. It's using AI to, to analyze that traffic, and look for techniques that attackers use for lateral movement, for privilege escalation, for data exfiltration, and try to spot that faster, respond faster, and lower the risk of a of a major incident. And then last but not least, we are very excited about this one. This is a service we've been working on that we will be, launching, quite soon, in the next few weeks. This is AI governance and security. So this is an automated platform that can discover what AI is being used in your your company, who's using it, what type of data is going into that, and and giving you that visibility that you might not have had before just so you know what's going on as a starting point. Then we can take your your AI governance policy, and we can build policy rules into the platform. So if we see certain types of data being transferred to a model, we can block that. If we see people using the free version of the tool, we can block that and allow the enterprise version that you've you've secured and that that you allow them to use. And we can tune that and alert you, to those things so you can correct that behavior. So, this is coming soon. It... And in some ways, this service will only be as good as the AI policy that you've developed. So I'd say if anybody's interested in that, that's your homework. Make sure you've got a good AI policy, and then we can turn that into policy rules in the service, and we'll have more news, to come as as we get this ready for launch. And I think that is... Well, I'll I'll summarize. So, to, to bring it back, the landscape is changing. We talked about how it's shadow AI, the risk of data leakage, it's vulnerabilities being exploited faster than ever, it's more sophisticated phishing. It's a long list, but you can do your part, by refocusing on those security controls that I mentioned. The CIS framework is a good resource for that, but it's not the only one. And if you need any assistance with that, we do have a virtual CISO program that helps you build that cybersecurity program using those best practices. And then we're doing our part. We're constantly evaluating new ways to use AI within the tools we have today. Or going out and looking at new tools, to make sure we're meeting the new threat landscape. So I will turn it back to Ella. We do have some questions in chat. And just to everybody who has, stayed through to the end, we will try to get to all of your questions. If for some reason, we aren't able to because we run out of time, your AM, your CDM, or someone else from Thryv will reach out to answer to you within the next couple of days. So we won't leave you hanging. And as always, you can feel free to reach out to me or Kevin or Emily, on LinkedIn or email. Glad to help. Yes. I just saw this one come in. I will answer it. Bernadette, you will get a copy of the presentation. There will be a thank you for attending, link that goes out. It will include a link to the recording and, to the deck itself. Let's see. Okay. So running back over, Kevin. Tell me if this is is too much. Indirect prompt injection shows that external content can become an instruction. Beyond limiting what an agent can do, how can we control what has the authority to tell the agent what to do? Yeah. There's... One one way you can do that is is set up, a bit of a a gateway, I'll call it, so that the agent isn't going out and directly interacting with external things, but going through a gateway where you can, the platform can see the instructions that it's receiving and analyze whether those are legitimate instructions that that are being given to the agent and potentially blocking, the agent from connecting to that site. So that's something we can do. We can also use some DNS filtering, to to restrict it from going to those malicious sites in the first place, But a few different strategies there that we could we could talk about more, if you wanna get into into depth on that. Quick question. I think it's for you, Kevin, but Emily can jump in. Does the the new governance tool integrate with hats? it does. So that was one of the requirements we had when we were evaluating different governance tools that are out there. We wanted to make sure it would fit with, you know, one of the the major platforms that, our clients are using. It also meets, it also works with Cloud, OpenAI, Gemini, Copilot. All the big models, are are covered there as well, but we did make sure it would work with that. Okay. This is the big one that came in for, Emily. Let me make sure I... Oh, let's scroll past it. Here we go. Read more. As you move from AI personas into multi agent workflows and end to end business processes, where do you draw the boundary between AI representing human context and AI exercising exercising delegated decision authority, and who remains the named owner of that context when the agent starts acting on it? Yeah. That's a good question. Oh, thank you for putting it up. I'll put that on screen just in case you needed to refer to it. Yeah. I guess there are kind of two ways we look at this. The first is kind of having physical barriers and the second would be training. So for physical barriers, having an actual boundary between the information you're getting from the agent and the action that can be taken is super important. And that's something that we highly consider when we're using AI products. So for example, in the demo that I showed, the interface is intentionally a chatbot with that. So you're interacting with it like a chat. And then if you wanna take any actions, you have to, number one, intentionally ask for that action to be taken. And then number two, there are those physical boundaries. So in terms of creating an email, for example, it will create a draft of the email and then you have to go and send it. So we do consider those actual physical boundaries when we're creating these tools. The second. is training that I mentioned, and that's what we include. Well, that's something that that is very important when we're building these solutions. Training on AI in general as well as training on the specific solutions. So that's something that it would be included as we're building in those training sessions on what that boundary should be, how you should think about that boundary, and the best ways to be interacting with the tool. Okay. Perfect. Okay. Let me see if I can figure out how to stop sharing. I know there's a button for this. Somewhere. Okay. That's a... There we go. Stop share. Okay. We had another one come in. It... Little little simpler than that, but it was, how can you control cost and token usage? So, again, I I think I'm gonna split up the same way for that question. So on the hats platform, there actually are a lot of different levers that you can pull for controlling cost. You can pull for controlling cost. As part of that, you know, keeping governance, to the forefront of the platform, as part of that equation. So you can control token usage per user, per team. You can set max amounts for each person. You can control the models that people have access to. So for example, if you want your more technical team to have access to the top frontier models, but you want, maybe other teams who have access to the cheaper models, you can control that as well. So that's a really important lever that you can pull. Then the other thing again goes back to that training. Training people on how they should be using AI in a way that optimizes for tokens, training on different models to use or we also have an auto auto model feature to use as well that, optimizes for token consumption. So those are, I guess, I guess, the two ways of looking at controlling cost. Okay. This one is for Kevin. Do you defend against chained zero days or only chained CVEs? Came from Matt Moldofsky. I'm sorry if I butchered your name, Matthew. Okay. Audio. So I'm gonna kick over... Ponder that one while I figure out the audio. Oh, there we go. Sorry. Oh, okay. You would not let me come off mute. So the question was, do we do we defend against chain zero days or chain CVEs? So so it's it's it's different in in the different tool sets that I that I talked about. In the autonomous penetration testing, that tool is using, known weaknesses, to build exploits. So it wouldn't necessarily, defend you against zero days specifically, but what it can do is help you break the chain. So, if it analyzes, if I compromise this endpoint, then I can move to this server, and then I can move to this domain controller. If we can break that chain by by detecting how it moves, then it... Then if they use a zero day to infect that original starting point, they won't be able to move through the environment. So we are... Even even without detecting, zero days, we're able to strengthen our environment by making it harder to move through it. The other thing I'll I'll highlight is we don't just use CVEs. The platform can also use, take advantage of weak passwords. So it can crack them. It can guess them. You'll be surprised how many people are using the default admin password on some of their equipment, Yeah. and and we can feed it some some guesses as well based on, you know, the name of the company. So that's another way. Now, that doesn't stop someone from using a zero day. Zero day is something that we don't have a patch for yet, but that's why we also, use additional layers like the network detection and response. What that's looking for is not specifically how how the attacker exploited the the device and got in. It's looking at a pattern of behavior. So even if we've never seen that vulnerability before, it's a it's a genuine zero day, we can recognize the behavior of a threat actor in our environment and catch it that way. So that's why we use different layers to make sure. we've got defense in-depth. And it goes back to the eat your vegetables if you have proper isolation, domain setup, privileges that that can help mitigate even if it... If you can't stop everything. Okay. This is another one for Kevin, I think. But, Emily, if you have opinions, love to hear them. With, with it being the case in terms of agentic attack systems being more dangerous, wouldn't it be true that you could have a more sophisticated agentic defense I I would say yes. So there there are other ways, system? to do agentic security that that, we're we're starting to implement in Vybe as well, and that's around using agent, technology to triage faster, to investigate, to take action. Now we're taking a a crawl, walk, run approach, Emily would be proud of, right, because we don't want agents taking automatic response on things until we are confident that, those are the right things for the the agent to do. We don't wanna cause downtime for a client or, you know, jeopardize their data. So, yes, it's gonna be... This is gonna be a cat and mouse game for years to come as the attackers use AI, develop new tools. Defenders will be developing new tools as well to combat those, so we just have to to move fast. Okay. And we just have a couple more of... One person said that the fishing example that you had showed Mimecast specifically, which is not something that they have. So would they still be covered with fishing, or is... Do they need Mimecast or something similar? No. That's a it's a good question. Each of the the platforms that we leverage at Thryv for email security, and we do have a few different partners, with different strengths and weakness. All of those have that type of functionality now where they're doing AI analysis of of the content. So we've got you covered. Okay. Perfect. So mark that answered. Okay. This is... I'm gonna share. It is another long one. Multipart question here. Can the Shadow AI Defense detect if users are using cloud.ai or ChatCPT personal accounts through their respective web apps, not through thriveai.net? And can we, as administrators, control costs by limiting permissions and models the way we currently can with ChatGPT roles and groups? Or... And is there a solution for users who prefer using Claude or Codex as a CLI or a desktop app? I'm going to share that through the screen. Scroll away chat. K. I can take the first first part. So they... For... So the AI governance service that that we'll be launching soon, it will be able to detect, the difference between a personal account, in a web app and an approved, account. So that's one of the the key use cases for it. We're able to do that, make sure that they're using the version of chat p b... GPT that you have authorized. And we can do that whether it's through the browser, through a web app, through a desktop, through the CLI. It supports policy enforcement through all of those different channels, if you will. The part about limiting permissions, maybe I'll turn that one over to Emily on that. Yeah. So, kinda similar to the last question that I answered, you can definitely control the permissions for both token consumption and the models, by teams, users, or an organization. So there are lots of means of control there. So for example, we have some clients who prefer not to use DeepSeek even though it is, hosted in The US open source, but then we turn that off for the broader organization. So you definitely have that control there. Is there a solution for users who prefer using cloud slash codecs, CLI, or desktop app? So, actually, the platform just came out with a desktop app last week, which is super exciting. In terms of Cloud Code or Codex, it doesn't offer the, development environment similar to, like, Cloud or Codex, or Cloud Code, sorry, or Codex. So for those solutions, you would definitely have to stick with the Cloud Code or Codex. But we do... We can help you with consulting on those permissions, development or training as well. Okay. I think this is gonna be the last one unless someone else types super duper fast. One of the key concerns around data privacy and compliance is data residency and localization. This is coming from a client out of Canada. Could you please clarify where our organization's data will be hosted and physically stored? Will the data reside within Canada, or will any data be hosted or processed outside Canada? Turkey one. right now for the HOTS platform, it is hosted in AWS in US regions. So I think we would have to really look into if that can be switched, but we haven't. Right now, it's all hosted within The US regions. Okay. So that was our last question. Just as a reminder, you guys will get a thank you for attending email that will include links to the presentation and, to the recording. Recording. And I wanna thank you so much for spending your morning with us, and I hope you have a wonderful rest of your day. Bye. Thank you.