Stopping Shadow AI Without Slowing Employees With Liminal

[00:00:00] Are you still dealing with agentic AI semantic confusion? Well, Denodo keeps your business harmonised. And by positioning your data platform into a universal semantic layer, everybody can be on the same page. So get back to scaling your business and trusting your AI agents to create proper business decisions. And you can do that by visiting denodo.com to see how. But now, back to today's guest.

[00:00:32] Can an AI security policy create additional risk by driving employees towards tools that the company just cannot see? Well, my guest today is the co-founder and CEO of Liminal. And he's going to talk about how AI, enterprise governance, and why blocking generative AI rarely stops people from using it. Why? Because employees want technology that helps them work faster. And security teams,

[00:00:59] they just need visibility into company data, model access, and regulatory exposure. But as I guess you all know already, all these priorities often collide. So Stephen will draw a fascinating comparison today between AI adoption and the early days of cloud computing when employees reached for credit cards long before finance and IT understood what was

[00:01:24] happening. And we'll also discuss why this pattern is repeating again, what CIOs are getting wrong, and how companies can protect their data without making employees feel that security is standing between them and their work. What I'm trying to say is we've got a lot to get through. So enough from me. Let me introduce you to him now. So thanks for joining me on the podcast today. Can you tell everyone listening a little about who you are

[00:01:53] and what you do? Yeah, sure. My name is Steve Walczek. I am the co-founder and CEO of Liminal. I've been at this since, I'd say since the dawn of the AI revolution, right about the end of 2022 is when we started to figure out what idea we wanted to pursue. And then we made a little bit of a prototype and we launched it in early 23 and it's been a journey ever since. I'm also a father of three and I play guitar. Actually, if you can,

[00:02:21] it's shocking to believe that. Yeah. Generally just a guy doing a thing. Love it, man. And before we started recording today, I was asking about the guitars in the background, got a few origin stories out of you. So you probably guessed, I do love a good origin story. So take me back to that moment when you first realized that most companies didn't have enough visibility into how their AI tools were spreading across their entire business. It feels like there was a story there. Was there like a moment or something?

[00:02:50] Man, I wish there was like one moment. I think it was, there was a, the way that this whole thing was founded was, you know, my co-founder Aaron and I, we'd come out of FIS and financial services and my whole job there, I was their chief innovation officer and it was a giant fintech company. And we, we tried to, we ran a venture builder actually. So we tried to launch a bunch of different companies in there. And every time I would go up against our, our chief information security officer, because he'd want to make sure that everything was tightened up and met compliance and regulatory

[00:03:18] and mental regulatory considerations, because of course, anything that we sold was used by people that were subject to substantial regulatory consequence if they somehow violated those. And so we, we, you know, we're looking at what was happening with AI and thought, my goodness, here comes a whole new lane of compliance that we don't have. And no one's ever thought about, uh, is that the place that we want to go solve for? And actually what we did is we teamed up with

[00:03:43] another venture studio called high alpha. And we spent a bunch of time just digging into what customers were looking for. And I think the, the goal was to talk to a hundred customers in 90 days. And so we did, we talked to, let me say customers, prospects in 90 days. And we spoke to a hundred prospects in 90 days called everyone, big companies, small companies, and all of them kept saying, Hey, I am really concerned about how my data is going to be treated with these downstream model providers.

[00:04:09] Uh, and it's going to cause me some friction. And so we, we thought about a few different ways to solve for that, but my goodness, the, the feedback on that was unanimous from day one is that, and, and that is only grown in, in both pitch and volume in terms of how concerned people are about their data usage. And if you, if you look at the way that these model providers behaving, you should be concerned. And I'm not saying that they're necessarily nefarious, but there's a

[00:04:37] tremendous incentive for them right now to not treat your data or your company data with respect the reality. And by the way, we've seen time and time again, when the incentive is as big as it is, they're willing to shirk boundaries in order to achieve the outcome that they're looking for. And I, you know, you only need to look at Google and what they've been saying to the Android users for the last 20 years, we weren't using their data. And last year they lost a class action lawsuit where all of their, all those 20, you know, there's, there's millions and millions and millions

[00:05:05] of Android users for 20 years, they were swearing up and down that they weren't using. And here we are, they lost a class action lawsuit last year, $440 million, I think was the fine, something like that. That's a drop in the bucket for what they achieved with, with the data that they were able to gain from, from leveraging that when they, again, they swear that they weren't doing it. So when, when the, the pot of gold at the end of that rainbow is as big as it is now, and we're talking trillions of dollars at this juncture, and the need to stay competitive is as big as it is now when the three core elements that make up these next-gen models are data,

[00:05:36] because recursive self-improvement is not yet as viable, it's getting there, but it's not as viable as it wasn't should be right now. And so the, the notion that models can train other models, they still need a new data source. And we tap the available data available through the web. So at that juncture, where do they go? Well, they got to go to user data. And, and we know that they're, you know, you've got ChatGPT and Anthropic giving away their product for free in a lot of circumstances. And, you know, a lot of them have been super upfront about it. Anthropic

[00:06:03] certainly has been saying, Hey, we're using your data to retain, we're retaining your data for three to five years. And we are using it to train our models if you're under specific licensing agreements with them. And open AI even was required by the U S government to save that data and retain it on premise. So you've got incentive where they're totally overtly with it. You got it covertly. We have a third party requiring it. And then you've got downright nefarious where they're saying we're not doing it, but they have to in order to remain competitive. And so I, I think there was no like aha moment,

[00:06:29] like, Oh, this is the way we're going to go do this. I think the market just said, Hey, we've been around the block long enough to realize that, Hey, this is an entirely new technology. And anytime there is data is always a concern and how that concern continues to grow because people are becoming more aware of how these model providers are engaging with it. Does that make sense? It really does. And I think it's a great lesson for founders listening there. A hundred prospects, 90 days. What is the market saying? It's invaluable work. The answers that you get from that as well.

[00:06:59] And this year, of course, we're hearing a lot around a tool sprawl and shadow AI. And for anybody listening, what would you say the earliest signs that their employees are using unsupported AI tools? And you have to ask yourself this. Yeah. If you're a CIO, you're typically in one of two camps. And if you're a CIO, that's subject to any regulatory compliance, you fall into these two

[00:07:21] camps, especially camp a is I am going to just have an open license policy. I will allow my employees to use whatever they want. If you're saying, if you're hearing that and you're going, I'm one of those CIOs, I can alert you to about a hundred dangers inherent with that particular posture because of the things I just told you about the different licensing and the restrictions, how data is being used and that your corporate data is probably being exfiltrated and leveraged

[00:07:48] and used for training. There are 1.2 billion users of these tools right now. And this is going to cut both ways on both camps, by the way, 1.2 billion users of common AI tools, things like chat, GPT and, and Claude and et cetera. What's the likelihood that your employee is one of those users, just one of your employees, let alone 60, 80, 90, a hundred percent of your employees are using those. So if you have an open license posture and you're not taking control of that,

[00:08:13] that's a major problem and a major issue from a security standpoint for you and a compliance standpoint as well. The can't be of these CIOs are I'm going to just bury my head in the sand and bully, I'm going to write a policy that says you're not allowed to use AI at all. And there are plenty in camp B. In fact, I'd say we see equal weight between camp A and camp B from the CIOs that we speak with. And, uh, that posture is obviously dangerous too. Same thing,

[00:08:40] 1.2 billion users out there. What's the likelihood that just one of your employees is using that tool? Because if you're not providing them something, they are absolutely using outside of work. And I can guarantee you, if you've centralized your strategy on co-pilot, they're using another tool outside of work as well. Yeah. And so that's the, that's what we see. We see 10 and then, you know, you've got CIOs who are kind of moving and shifting into this third camp, which is how do I safely deploy these at scale in my

[00:09:06] organization? What tooling do I need to be able to do that where I can effectively have the data privacy that I'm required, the governance and administration tooling that I need, and certainly the observability and the audit trail that I need to be able to understand how people are using these tools and what they're using, what they're saying to them. And how do I make sure my data is protected across every vector possible when it comes to deploying these? And that's when they tend to come to us when we, uh, or when we encounter them and talk to them about our product, that's when they go, okay, cool.

[00:09:34] I can start to figure out a path forward here when I didn't have one before. And I speak to that particularly to regulated companies, because again, there's significant pecuniary punishment when it comes to any regulatory malfeasance and they, they may not do it intentionally, but it only takes one employee uploading a spreadsheet with a thousand names and socials in it. And you've got yourself a

[00:09:57] a 10,000 or a hundred thousand dollar fine on your hands from HIPAA. So it doesn't take a lot to violate these things. Uh, and so that's why we hear that's why we created the companies to help CIOs venture into that third camp. Yeah. And it feels like we're in somewhat of a paradox here. Companies want to move quickly with AI, but they also want oversight. So how can they just create those useful guard rails that we're talking about without turning governance into like an immediate break on the

[00:10:27] experimentation? Well, Neil, I'd ask, let me throw the question back to you. How would you feel as being an employee, someone came in, what, what would you want your employee to say to you? What would you, your ideal circumstance? You want a tool, right? I would assume. I want to give me what I need to get the job done. Yeah. Of course you do. Yeah. A lot of employees probably aren't as advanced as you, but they certainly do want something, right? They need, they need a thing. And they recognizing now that the, the productivity benefits are so high, so extraordinary that they're willing to violate policy. They're

[00:10:56] willing to go against that because Hey, all of it's in the, in the right light. Everyone is trying to do their job better, faster, higher quality, and they got to keep pace with their peers. And so if you're the, even a modicum of adventurous, it's pretty easy to go and take a snapshot of something on your screen and have that go up top new to chat GPT and say, what can you do with this? And as, so the, the question I posed to you is what do you want as an employee? And you said, I want tools. Yeah,

[00:11:22] that's exactly right. I need tools. I need something that can allow me to get my job that can keep me competitive. That allows me to engage in the AI space right now. Uh, and if you're in camp a of that scenario, then you might feel lucky, but you're going to get smoked by a CISO at some point, you're going to stick your company straight into a bad posture, which is going to help you lose clients or can be of this CIO where they're saying, Hey, we're not, we're just gonna bury your head in the sand and say no one's allowed to use these tools. Yeah. Then you just same risk applies.

[00:11:52] You can't be either, or you have to be intelligent about this. And, and all employees want to do is do their job. People are not, not in as no, not never as an employee that's kind of on the front lines gone. Hey, you know what I really care about is governance. You know what I really care about is, is data privacy. They're like, no, I'm just trying to move the needle here in my own world right now. What can you give me that can help me do that? Uh, and that's the, that's what companies are looking for. So I, you know, Neil, I think you are the example for how employees are going to give me tools,

[00:12:20] please. I don't know if they're saying tools, plural, but give me something. Yeah. I kind of saw something very similar, what, 20 years ago when I was in an IT department and guy, where is it? Dropbox came out, Google drive came out and people just want that seamless sharing of their files. So when they go into the boardroom to do a presentation, they can just get their file easier without carrying a flash drive around or relying on a shared drive somewhere.

[00:12:45] And yes, as an IT guy, I know all the problems that go with that. Very similar to the AI issue now that you don't want to be putting your files in those kinds of places, but you just want to get your work done. And it just feels like, I don't know, it's everything's locked down some of the times, but things have improved, haven't they? Over the last 20 years. Yeah. No, I love that you stretch back to that particular time when, when drive came out, I would even like, if you go back maybe 15 years and you say, what was it like when cloud was first

[00:13:13] introduced? Do you remember that? What a nightmare would have been for you as an IT guy? Like, yeah. Oh my God, I've got, I'm used to filling out an order form for the next, you know, rack that I've got to get by and fill to, to, you know, suit whatever my developers are telling me they need. And I don't know if I'm going to over provision or under provision. And here comes AWS saying, just swipe a card, just swipe a card. It's all good. And you're like, please don't swipe a card. Like we don't know where our data is. We don't know if this meets compliance. We don't know what's

[00:13:39] happening here. It's really similar right now, right? It's not, it's actually like a, the comparison to historical it cycles, particularly, I think I'm listen, I was around for the major cloud revolution and I was actually engaged in the workforce at that point. So I like watched what happened. I mean, we were my first company. We ran a server rack out of our office. Like we had several of them and that's how we ran our application. And I remember how annoying it was to have to buy more hardware. You just, oh, we're, we're scaling up. More users are coming. I guess we

[00:14:07] got to buy a whole new rack here and we've got to fill that rack with servers, you know? And then we migrate everything over to AWS and it was like, oh, this is, oh, this is good. I wouldn't join the AWS actually after that, not too long after that, because it's like, I got to go work for these guys. They've got, they're onto something here. But like it was an, I, we used to talk to, I mean, I was, I'll tell you the AWS initial strategy for their salespeople was to tell you that they would tell them you need to, uh, to target these, these people, so I can't, they will scale up. And then what

[00:14:35] would happen is, uh, and you'll, you'll recall this, the CIA, the CFO would get a bill for a hundred grand for me to say, who the hell is AWS? Amazon sells computers. Like what? So it's, it's very similar right now, right? Like you start to think about, especially with modern coding tools now, oh my God. And you're not thinking about tokenomics or anything related to that. Very similar work, we're organizations going like, okay, if I'm an engineer and I can go five X, my horsepower right out of the gate. Yeah. I'll go swipe the card and get cloud code in here. I get codex in here.

[00:15:05] Uh, so it's, it's actually a really great parallel. And you know, I love that you brought that up. It's one of my favorites because we are in a very similar it cycle right now where first it was shadow it. That's when we saw what we saw rise with cloud. And now we're talking about shadow AI. Yeah. A hundred percent. And so much of what we're talking about here will resonate with people listening around the world. And I'm curious from everything you're seeing and hearing, what do organizations most get wrong when they introduce AI governance? And what have you seen

[00:15:33] a good example of something that works the right way? I will do my best not to plug my company. I will at the end here with the good example. I have watched a lot of bad examples. A bad example would be starting with policy of shutting everything down. We're not allowing these tools in. And like, that's a horrific example of how to absolutely have your data exfiltrate in ways that you won't even be able to track. The second one is we've watched organizations implement tools at the network layer

[00:16:01] that will block exfiltration specific data. But the way that these tools do that at the user level is it beat them up for doing it. Hey, you put in a bunch of PII scary message. And then the user's like, I didn't mean sorry, excuse my language. Sorry, Neil. Sorry, listeners. I apologize for that. But that's, you know, the user reaction when they see this is complete and total shock. They're scared because they put something in and the machines freaking out on them and telling, please don't

[00:16:27] do that. That's not a good position to be in. And what it does is actually it's weird. It's paradoxical. While you're protecting the company at the network layer, it actually creates incentive for people to go off network and go the opposite direction. Okay, well, great. I will just snap a photo of that with my mobile phone or my iPad. And, and while I'm doing my work and look at that, my boss is so happy with the output. They had no idea that I was using this tool on the side here to

[00:16:51] get that done. That's the danger, right? It's, uh, that's the worst. So that's, that's kind of the, the kind of next level of, okay, we've implemented security controls and governance and elements in place, but my God, the way it's beating up end users for trying to do their job is chasing them away from the tools that we've given them. Or if you centralize it on tool that people don't like, don't feel like allows them to get the job done. We've seen that where companies go, well, this is just

[00:17:16] a, it's an easy upgrade on my E5 license to chop and co-pilot. Let's just do that and come, you know, employees go, yeah, this is not what I can get out of a different platform here. Yeah. Oh, sure. It's integrated across the Microsoft stack, but it kind of, kind of sucks. I don't like this. What am I going to do about this? So they end up going, of course, to tools that they love. The good example, uh, is I think what we, and we listen, we didn't start the company this way. We, we had our own little journey

[00:17:47] customer conversations and you know, more little pivots along the way. Uh, but about two years ago, we really started to get this right. And this was this notion that we wanted to include security tooling alongside end user tooling where the two worked in perfect harmony were I'm not beating up an end user. I'm just letting the end user, Hey, we detected something. We don't even tell them. We just underline words. We underline data types that they, and we just let them engage with different models of their choice that they've given access to. And the whole, the whole system on the

[00:18:14] back end actually allows for that governance. It allows for all that data privacy. It allows for complete and total administration of which models, and we give them unlimited usage of the best models from now the top six providers. So we added meta last week in there with their new spark models, which is really cool. So they can use those as many. They're not thinking about tokens. They're paying $20 a user month. They've got complete and total data privacy tooling, governance administration, crucially observability built in. And then it's alongside that the end users are feeling

[00:18:42] like they're using a tool. They're familiar with it. Looks, feels, tastes like complexity, chat GPT. And we've actually kind of stolen the best from not stolen. We've just ideated a best from all of them and said, Hey, how do we wrap that into a really delightful end user experience? That to us is the best possible user implementation because your security teams are happy, but your end users are happy. So they're not motivated to go elsewhere. And your security teams are feeling like, Hey, we've got a W on the board here because we're able to provide the tooling our users want

[00:19:07] that actually keeps them in network and gives them the ability to engage with these models that doesn't punish them for trying to do their job. And that's, that's where we've, we've, I think we've really gotten it right. Like I said, it took a couple of times in trials to figure that out. And you know, we, we went down the wrong direction at the beginning in terms of how we wanted to do that. But I think we've definitely gotten it right over the last two years. It's really cool. Yeah. Users will always follow that least path of resistance. And if they've got a tool, they know that works, we'll get the job done. They're going to go that way all the time. And

[00:19:37] some people listening might argue that centralized control does push employees towards shadow AI. But from what you're saying here, you really seem to have mastered it. So what is it you think you've got so right here that is changing that and ensuring that they don't go off on their own, going down various rabbit holes. And let me pose a question back to you, Neil. If I were to put a tool in front of you that felt like it was making your job harder, what does that make you want to do? I'm out of there. I'm straight on.

[00:20:06] Yeah. Exactly. See ya. And as the IT guy too, you're especially capable of getting out of there and figuring out what's, what's the ability. Uh, what can I go use on the side? That's, I mean, everybody sits in that camp. I'm the same way. If you put a tool in front of me and you're like, no, I'm going to make it hard for you to do your job. Uh, I'm thinking, oh, cool. I'm going to go find the thing that makes it easy for me to do my job. Thanks for that. I always remember that they, uh, we used to, I remember this company I, I, uh, was working with when I was much younger. I'm very,

[00:20:35] very young, like 18 years old. And they had put in a, they put in a firewall that block you from using like YouTube and, and a bunch of other things. And I just installed a proxy server on my machine. I'm like, you know what? Uh, and a VPN. I'm like, I'll just go around you guys. I'll break through your firewall and I'm going to go. Cause I want to go watch YouTube videos at work. And you know, that was the, that was the solution. So you'll get clever. People will get clever or they'll just not write violate policy and again, just use their own devices. Uh, yeah, I mean, well,

[00:21:03] I'm just to interrupt slightly. Users are so innovative. They're so innovative. You remember when everyone was working from home at scale and hybrid working and then the employer straight away said, we're going to lock down these machines. We're going to count keystrokes. We're going to see how often your mouse moves, how much work you're doing. People were attaching their mouse to a a moving fan just to keep that mask. They would always love that. Oh, that's a great, totally. And you force people into that. Yeah.

[00:21:33] People want to show up and they, I had found this universally for the most part, if you're at a good company where your culture is healthy, people want to show up and do their job. Well, they don't, they're not showing up to just throw their mouse on a fan. So it moves. But if you create an environment where people don't want that or that it feels like they have to do that, then they'll go do that. And you're, you're creating that incentive structure. The way that we think we've gotten it right is that we've just created a frictionless experience for end users and for CISOs. So security teams get what they want and users get what they want.

[00:22:03] No, no complication there. Right. And you know, it's, it's not like we've had to reinvent anything. Like we've just given end users what they're using. People like using chat GPT. They like using perplexity. They like using Grok and these other tools. So let's make it so they can do that at the workplace. We don't have to reinvent everything. We just have to make it so it's secure and safe for the, that, that makes the security team get what they need to, to cover that without punishing

[00:22:29] people, just create a frictionless experience for end users. So that was a huge focus for us is like, we needed to get that part. Right. And I think what we've done so well is even when we've gotten it wrong, which we have a couple of times, we're so fast to respond. This is why I love the culture of our team here is like, I remember we had a customer say, Hey, I really don't think you guys implemented this particular feature with spreadsheets correctly. We would love to do it like this. And we thought, you know what, actually they're right. They, we should go do it like that. And we fixed it in 24

[00:22:57] hours and updated. And that is not an infrequent story. We heard customers talk about things that our dev team does like that all the time. We're not always going to be perfect. You know, that you're, you're an IT, like you want to try, you want to try and be great. But the more we, the more of those experiences we have, the more customers are endeared. Oh my God, they're listening to me. They're hearing me, they're doing and responding. And I know it's like, Oh, that's not rocket science. And I'm not blowing anything revelatory at you right now. But at

[00:23:23] the end of the day, if you can remove friction for end users, they're going to stick around. And if you can do that for end users and security team, they're going to live in harmony. And we've been able to capably do that. And I'm curious, do you get any feedback stories of, I don't know, AI governance and what it felt like for the person doing the work or the leader and how they were able to build trust doing it? Do you get any feedback stories around that stuff?

[00:23:48] Yeah. You know, our sales guys always say, let's, let's give our, our CIOs and CISOs a big win. Let's make this a career defining decision for them where they can come in and deploy a tool that they feel services everyone equally in terms of health and capability in terms of quality and outcome. And we've been able to do that time and time again, where people feel like, Hey, we, we made a decision to go with liminal. And, uh, and it was a career defining decision. I was able to

[00:24:17] achieve a chief AI officer role because I came in and saw the part of our AI strategy with liminal. And now I've been able to kind of lever that. So that's, uh, we've had several stories like that. And, and the, I think the cool thing is that our team goes in feeling like, Hey, we can make this a career defining decision for you because this is a major, it is, it's an investment for people to go and take on a tool at scale. And, you know, we are, we consider ourselves relevant to 80 to 95% of an organization. So it's not a small investment for that organization. And while we are super

[00:24:46] cost-effective to scale, it still is money that they need to spend. And we have to earn every dollar that they choose to spend with us. And we believe that, and we want to make them happy genuinely. Like we wake up every day trying to figure that out. And I think the best way to do that is to continue to remove friction. And that, that includes in getting feedback and seeing that feedback realize it. So yeah, we, I think we've done a really good job about that. Awesome. And for anyone listening, wanting to find out more information, where can they find you

[00:25:14] online? Maybe see a demo, how long does it take them to get up and running, et cetera? What can they expect? Tell me where, where the standard is. This is the best plug. The company is called liminal. You can see it on the side of my hat here. Liminal as in liminal space, liminal.ai, L-I-M-I-N-A-L.ai. Go there. If you want to see a demo, you just enter your name into a form. We will be in touch with you same day and you can

[00:25:39] schedule time with us. We love talking AI. So if you're just wanting to get a feel for what the world looks like in AI right now, and you want to talk to and hear what other CIOs are doing, that's a great place to start with us too. We talked to 30 CIOs and CISOs a week, at least, if not more. So we have a really, really strongly baked opinion on what they're looking for. And if you're feeling like a little bit lost, that's also totally okay. Head over to liminal.ai and we'll, we'll get you sorted. Well, for everyone listening, I urge you to go over to

[00:26:09] techtalksnetwork.com, go to episodes. There will be a blog post associated with this episode. There'll be a useful link section. I'm going to fill that with everything you've mentioned. And also if there's any videos I can find, et cetera, I'll stick them in there. And also our sister show, AI at work, I believe you're going to be joining me on there in the next few months as well. And maybe we'll dig a little bit deeper on some of that stuff and find out what that AI looks like in the workplace. And I urge people to look out for that, but more than anything, my man,

[00:26:37] thank you for joining me today. I really appreciate your time. Neil, I appreciate you having me. Thank you so much. I think those comparisons between shadow AI and the early days of cloud computing really stood out. So much has changed and so much remains the same. Employees rarely bypass company systems because they wake up hoping to create a compliance problem. They usually want to finish a task, meet a deadline or keep pace with colleagues. And that doesn't remove the security risk,

[00:27:06] but it does change how a business should respond. A policy that says no without providing a useful alternative. It will push AI activity onto personal accounts and personal devices where visibility will disappear completely. So I think the practical lesson here is bring employee experience, model choice, data protection, and auditability all into one conversation.

[00:27:33] But over to you. Has your organization found that workable balance between AI access and oversight? Or is shadow AI already winning? Let me know. TechTalksNetwork.com. You can leave me an audio message. We have 4,000 interviews over there. I'd love to hear from you. But that's it for today. So thank you for listening as always. And I'll be back in your podcast feed bright and early tomorrow. Bye for now.