SMBs are embracing Microsoft Copilot, but are they doing so securely? And what do rising AI costs mean for SMBs and their newfound tech deployments? Well, to get into that topic, I spoke with Bruno Lac, the founder, CEO, and CISO at Beimo, a Microsoft focused compliance and security firm servicing SMBs and defense contractors here in the US. We had a wide-ranging conversation about both those SMB clients and what Beimo has done internally in terms of AI deployments, how to govern those deployments at scale, what small business leaders need to know when it comes to everything from training their employees to budgeting for rising AI costs, and what ultimately AI security is going to shape into in the future.
And spoiler alert for that, it's pretty similar to all of the other security waves we've seen in the past. So, let's get into the conversation and thank you as always for watching. Well, Bruno, thank you so much for joining me today and taking some time to talk. >> Thank you for having me. >> Sure. To kick things off before we dive into I know a couple of topics we'll hit on today in the AI security world. Could you tell me a little bit more about yourself and then a little bit more about Beimo as well? >> Yeah, so I'm B I am the CO and CEO at BIMO.
So, BIMO, we are an MSSP uh specializ into security, compliance and AI governance for SMBs. So, between 10 user to a,000 users running on Microsoft. >> Well, I know when I have conversations with MSPs, MSSPs in the space, it it's becoming I think impossible to have an AI conversation without security and vice versa. So when you think about what you've seen just in your customer base and in the industry broadly kind of in that SMB world, what are you seeing in terms of AI adoption done right and maybe AI adoption that isn't quite as secure or as governed as would maybe make you feel more comfortable?
What I find interesting, what I see very often is, you know, customers will say, "Oh, we don't use AI in my company. We don't, oh, I'm say I can bet you my paycheck, you do." Well, you may say, "Give me 10 minutes and I will show you." And you know, when we show them like, "Wow, these are all either application that you use don't know you have AI turned on or all the different AI that your employees are using on your system and you are just not even aware of." And it's always the conversation of people say okay let's block it >> and me my perspective is always yes it's an option but if you block it your employee are going to do it anyway using their phone using their personal devices so it I think for me I'm more believer about having a conversation internally you check what you want to allow and not allow and you make it clear to the company >> you said in your opening that you're heavily focused kind of in the the Microsoft ecosystem system in the Microsoft environment.
Obviously, C-pilot has been a pretty significant push from Microsoft's perspective and getting more users adopted across that stack as they roll C-pilot out into more features and functionalities. Are you still running into a lot of SMBs who maybe don't even know that Copilot is a thing or how is that conversation begun to evolve? I feel like you see less I think many of our client will see copilot as a I would say an advanc Google search you know it's kind of they see it as you know people don't always realize what can be done many people are very curious because again it's the buzz everywhere on the news if you follow so it's more like can you tell me more about AI I know I need to use it but I don't know how I don't know what to think about it so I think it's from an SMB perspective this part and And the toughest part that I see and we feel it the same as us as a company is the cost. >> How do you manage cost?
How do you forecast? How do you know? So it's everything around that. >> When you think about kind of those two ends of a spectrum, so to speak of organizations who go just block everything. We don't think anybody's using it. Everything's fine. We just won't worry about it. To that more conscientious, we don't have it yet, but we know we want it. Can you help me get it there? How do you have conversations with customers in such a wide range of maturity and adoption cycles and do you see that kind of evolving over the next few months? >> It goes back to the maturity of every single company.
So it depends who you talk to. So you have some CEO that are technical and again they read the news and they know they want copilot, they want to create agent, they want all that and you have the one that just like you know you talk to them do you want us to enable copy is like what is this? So the so the range is very you know broad but I feel like on average now if I compare to a year ago everyone has heard about AI everyone has heard about copilot and I think the problem now in Microsoft is there so many flavor of copilot and even Microsoft is trying to rebrand so it's more like okay which copilot are we talking copilot for M365 copilot co-work and it goes you know he could go to copilot co you know so cloud studio so just you I want to have a conversation too because you're such a security focused provider and and you have such expertise in the space around the governance and the security controls that make AI secure and make AI in many ways useful for companies as they're deploying it.
So could you walk me through maybe what you see in terms of those key pain points or challenges when it comes to securing AI adoption that you help companies work through? So as just from from your for your audience what I want to say again from a be from BIMO perspective by default we are so ISO 2701 EA and we are also CMMC level two compliant so we are very compliant policentric and because we are part of 50 plus MSP that can do business with the department of defense or department of war.
So we have a lot of compliance and we have to make sure when we deploy AI even at demo that we are very compliant and we are right now going through our ISO 420 once again compliance for AI. So now the way we deploy it at BIMO so my HR person now so director of of people is now director of people as well as digital worker. So we have decided that again she's in charge of both. When I give you an orc chart of BIMO, you will have people that manage people, people manager, but you will have people that manage agent.
And the way we do it is from a people perspective, you have 11 levels from level one as a traininee to level 11. And from an agent perspective, we have the same thing. We have level one to level nine. And so the way we do it is as when we create an agent, we look at, you know, what can the agent do? How do we make sure we test it that the agent doesn't go wrong? So we have all those process and we make sure that let's see an agent level four is not being managed by an employee level one. >> All right.
So again it's and we also make sure that an employee knows well you may not be managing people but if you're managing agent this is your responsibility. You are in charge of the agent. You're in charge of testing it. You're in charge of you know reporting monthly how the agent is doing. So it's kind of the the process that we have and you know we review them every quarter. So we have a quarterly for updates for you know so it's kind of very methodical. >> It's interesting that you frame it as that people and agents right as we talk about AI adoption.
I think the thing that doesn't always get talked about as much is that there are then just AI agents maybe not everywhere but for many of these organizations right working alongside people to some degree. I'll ask you first about Beimo and then I'll take it out to to your customer base as you rolled out this framework. How did you communicate it just to your team explaining what you keep with people versus what agents can perform? >> So what was interesting you know we started at BBO using AI so July last year.
So what we did as a company we did company training monthly. So the first month the entire company I remember we did the first you know training on Microsoft copilot month number two was training on prompt number three was creating agent. So we did the the whole company together and at the end of the month we were discussing what did we learn. So we took it and then now we took it to a level where again there's some people at Bimo that just use I would say the AI as a you know Google chatbot you know and you have some people that are creating agent you know so you have really the full thing and as being part of the again the sharing as part of the monthly business review we share the agent how they work we share training he has been very organic within the company and how do we make sure that people can follow at their speed and some care some don't you can say so this is how we have kind of deployed internally >> sure when you think about then taking that to your customers I know you said you focus on the SMB segment so we're talking you know some companies who probably have pretty robust tech awareness within the organization and maybe some who who don't have quite as much are you seeing that same kind of adoption in your customers as this digital workforce expands or or what are you really seeing in terms of how agents are being deployed. >> So I I feel like our most our most advanced I would say people have maybe 20 agents running >> and you know so this will be the most advanced one and I always want to be careful with the number because at one point at BIMO we had 46 agent and we just reduced it to 21.
M >> so again it goes back I know for me success is not number of agent is what do they do you know and even more now the cost from our perspective we look at every agent what they do and what is the ROI of an agent because I think we have learned at BIMO sometime is still cheaper and better to be given the role to human and some is better to be given to an agent managed by a human but I would say be honest most of my customer are on the learning you know they are creating so we have secured them they're using copilot no problem and now they are starting agent you know five here three here so they all you know and what we tell them is again go at your speed and make sure you think of as a governance it's not just creating agent for all the fun of it it's but even more now it will cost you money if I think a year ago you were paying your $40 per month and you were done or not anymore now you have to pay for consumption I'm glad you brought that up because I was going to ask too.
I know when we say governance, I think for a lot of partners in the channel space, that's still a very security focused conversation or that's at least what comes to mind first. But that cost governance piece is something that I'm hearing more and more across the board both at partners and obviously at at businesses. How do you see that conversation continuing to expand to your point? Not just building agents for agents sake. Is that the kind of next level of maturity?
I think it's a very interesting because this has a even an impact as a as a company again we gave copilot to everyone in a company and you people were developing at their speed they could do whatever they wanted you know so again we had the governance but cost was not there because it was a flat fee then Microsoft mid yeah remember it was mid first week of June said starting July 1 we are going to char and it was more like okay how much will it cost me we didn't even know it was hard to you know so what we know is between June and July our spend tripled. >> Wow. >> Okay.
So it tripled. So at least we had put because we based on the new Microsoft pricing is what we expected. So at least you know we we put the control behind it and we met the number then in August it went up an extra 10% compared to you know so at least now we have pretty good at managing. So which mean we have created layers based so we have five groups at beimo the every users and I will give you x amount of token per month and it's how we monitor it once once a month we get alert if you are close to reaching so you can have a conversation will you have to stop you know slow down an agent or so it's kind of a so the last two months have been very interesting even for us to see how we manage internally but this for sure changed how we think about it and I think it's why we went from 46 to 21 because you realize, oh, there's some agent.
Do I get my out of that? No. Okay, let's kill it. I didn't care before because I was not paying more. Do you see that conversation continuing to evolve within your customers that as well as >> is the number one now because and which is in the toughest to have because people will ask how much will it cost me and it's always it depends [clears throat] >> you know I so I can't tell you how you can control it how again be more based on you know an agent at level two that does that consumable X at level six consumable Y and you can put a frame but you know and I think small business they don't like that no one like to not know how much you know oh it's plus or minus 200% wow it's a big deal you know >> well and I was going to ask too that it depends answer probably isn't great from a partner perspective to have to say that to your customer either right to your points would much rather just have you go it's 50 bucks a month here you go we'll all move on right so how do you kind of from the partner perspective move forward with enabling your SMB customers when this is kind of brand >> we always say beimo is customer zero.
So everything we do with our customer we do it first on us. So from my perspective all our customers again we show them the we are transparent we show them the how we do it at BBO how we calculate the cost you can see live we share our screen we share so they can see this is a you have a rent that we put because we are an SMB like you and same thing I have I have a budget to manage and it's how we do it and it's how we have been able so far from you know our July August and we are on track for September so far to say okay this is how I how my CFO doesn't get a surprise It depends going to be between X and Y and you can put a guard you know when you eat that number or you're at 90% of it give me an alert so you can control it at least you can control it that you will not spend more that you wanted to spend. >> I want to go back to something else you brought up earlier which is the compliance conversation that that many of your customers face.
Obviously you at Beimo are extremely compliant across many of the the core regulations that we talk about frequently. How do you see AI impacting some of those compliance requirements moving forward and and what do you help your customers kind of keep top of mind in that realm? my our bet internally so me as a CEO of the company is I bet is ISO 4201 will become the number one uh framework requirement and I hope I'm wrong on that but my expectation is within next six month one or two bad thing will happen in the world because of AI and I think we kind of start start seeing it and I think you will need one or two one for people will say we need to do something about it and I think we are in moment and I can see in the first in the next six month and again I can sit at Bimo we have some agent I we call them for us our is one is a level six and you are like you know I'm happy of the governance we do about it because the agent people don't realize but sometime the agent goes on its own or you know has decided to not follow you know so if you don't have the guard rail to control it you know you can have some bad stuff happen so again is the same thing it's I control the the agent I think the same think of an employee.
You may have great employee but one day someone may do something bad to your company. Is the same thing about an agent. So how do you keep track of it? >> To your point right I feel like a lot of the security conversation the past few years has been whether in ransomware or whether in you know kind of other malware etc attacks. Oh, we saw a bunch of these in the headlines and now SMB is concerned right? SMB used to think that they were too small to get attacked.
They weren't worth anything to anybody so they'd be fine. And that conversation has evolved. Do you think people are thinking about AI in a similar space or do you think there's still a lot of oh we'll just adopt AI and it'll be fine going on? >> Yeah, I think we are we are is very early in the conversation again. I think so the people that understand what AI can do, they are like I need to think about it for my small business. But I think many people still think AI is for the big guys.
And I think from an SMB perspective, people will see AI as a simple leg agent, you know, doesn't realize, you know, the power you can really have with it. And it's so I think it will evolve. I think people will start and I think we will have the same where SMB will realize I need to protect myself as well, you know, and people create an agent. So I am you're on Microsoft people are you know one drive shareepoint and in the past they don't really secure their sharepoint and write one drive very well >> but didn't have much of an impact but I think now that you have AI you know it's not configured correctly you could say hey what is the salary of Victoria and I think we'll tell you because you know maybe your shareepoint group is not protected correctly or is not set correctly so I think there's a conversation when before talking with our clients said how do you secure your document internally?
They didn't care too much. Well, I'm fine. I think now the conversation is changing. It's why when you if you want to prep for copilot, there's a lot of thing you have to prep before you [snorts] push it. On the note of that prepping and the data readiness and the governance layers that I'm sure you want to see customers deploy before they get to the point that co-pilot is deployed, do you see more SMBs expressing interest in doing that work to getting to the point where co-pilot can be successfully deployed?
Do you see demand continuing to grow over the next six months? I'm just curious how you see that. >> So it will grow no doubt. What's interesting I see from you know pre-sales call that we have. So you have some people that will come and just say hey I'm calling you I would like to deploy copilot okay and so they just say okay they buy license and yes you could do it by copilot deploy but then we start a conversation about oh let's talk about security and they're like oh I just want to deploy copilot and you're like you can but you may not like what you will see and I think they don't realize this and the problem is someone who had this idea of I want to play with it internally in my organization I will 55 license 10 license and now you are telling them well you should spend some money before to first secure your your document your data before you can do it and then now it's the scope of their product completely changed and they were not ready for that they were not expecting so I feel like sometime I give them bad news of you can do it if you accept the risk you can do it I would not do it if I was you so again I think deploying AI is not just buying sh GPD or you know it's there's a lot more behind that. >> Well, and to that note and I know we've talked about the cost of the AI itself increasing and and the worries there and also the cost to get to the point where you're okay SMB is famously not exactly flushed with cash at any given moment in time.
So when you talk to customers and you lay out what will really be required from a budgeting standpoint, is that still an inhibitor to many of your clients in terms of getting this across the board or do you think they're finding the budget somewhere because they want the AI? >> I think again I always go back and I tell them the story as people again we are 30 people company. Last July the plan was you know people everyone said okay we should maybe look at co-pilot across the company.
So, I was like, "Wow, 30 people time the $30 and you know, $1,000 a month. Okay, will I get worth $20,000 worth of my return?" Okay, let's, you know, we bite the bullets. Okay, let's let's go for it. And to be honest, I was amazed after we train the people how much people were able to create and got my ROI was, you know, and then we went to co. So if I look at now from a budget perspective, I can see from a BIMO, our bill last month was $1,000 of code work just in one month.
So if I take that 10 12, okay, let's say I will spend $15,000 plus Microsoft license. But now do I get my money back? I can tell you again my most advanced agent are doing work that they are doing in few hours that will take the employee two weeks. So my the ROI is there but the agent cannot run on his own because he has to be on our side supervised by a human but now I feel like my human can do much more a lot faster. So again it goes back to did I get my money back?
Yes for for be the RI is there and today I could not remove AI from the company. So a year ago I didn't know if I would even if worth it. So I will tell SMB in the world of today from my perspective you have no choice you have to go there and now it's for you to see how you can use it but there's no way you cannot go there I think personally even if I was the the one person scared of it at the beginning >> as we start to wrap today's conversation and thank you again Bruno for the time I'm curious I'll ask you the the crystal ball question and I know nobody can predict the future and I'm sure we could have the same conversation in three months and new things will have come But when you think about how co-pilot adoption will continue to expand into the SMB market, right, obviously I think a lot of the stories coming out now are mid-market and enterprise focused use cases maybe, but when you think about SMB and what they can unlock to your point, if they do invest the budget in getting there, how do you see adoption continuing to expand?
And then kind of as the part two to that question, how do you see security and governance concerns and conversations then continuing to grow with that? >> It will continue to grow. No doubt. Maybe not at the speed everyone will want but again I think it will AI is there to stay. From my perspective now you are going to have the one that will do it correctly that again we'll see it as an investment. I need to secure first. And it's your first deploy AI train my people and make sure I have a governance.
So which mean yeah I will not be ready to deploy it tomorrow. It may take me six months and I will but I will do it correctly. And you will have the one that will just decide again. They will just go buy a license deploy it and they will find out six months a year later that my data is everywhere. So then they will come back to try to fix it because they will have. So at one point it's like you know the SMB they didn't want to put security and everyone today has to have a certain level you know not everyone is equal but you cannot I don't think there is many company today that don't have MFA turn on it will be the same in AI at one point people realize there's a minimum of AI security that you have to deploy it will be part of it >> okay it will happen and the same today there's some companies they don't put security and they get hacked and they go out of business and I can see with the agent you don't control your agent will start to go everywhere spray your data you're out of business so again it's same case for both >> sure well for those who maybe have listened to this conversation and and now think okay I got to get serious about my AI security or just want to learn more where can they go to learn more about Beimo and the work that you do >> yeah so they can go to our website is bimopro.com be bm o.com or they can reach me via LinkedIn and be happy to have any conversation about AI and security. >> Perfect. Well, Bruno, thank you again so much for joining me today. >> Thank you for having me.
This transcript was generated automatically from the
video's captions and may contain errors.
