Hey channel insiders, I'm your host Katie Bavoso and welcome to this episode of Partner POV brought to you by Sure Path AI and AWS. Generative AI is no longer a future conversation. It's already embedded into the fabric of companies of all sizes. Employees are using tools like Copilot, ChatGBT, and custom AI applications every day, often faster than security, governance, and compliance teams can keep up. That's created a new challenge for organizations.
How do you move fast with Genai without losing control of your data, your IP or your regulatory posture? Today's interview is all about answering that question. I'm now joined by Casey Bleecker, CEO and co-founder of Shure Path AI, a company focused on helping organizations safely adopt and scale generative AI without slowing innovation. Welcome, Casey. >> Thank you so much for having me, Katie. I'm excited to talk to you about this critical topic today. [snorts] >> Critical is right.
I'm excited to talk to you about it as well, Casey. So, thank you so much for your time. Let's jump right into it. Despite my introduction, you've actually told me the biggest risk organizations face today isn't adopting Gen AI incorrectly, it's not adopting it at all. Why is hesitation around security and governance becoming the single biggest blocker to Gen AI progress? >> When we set out to build Sure Path AI, it was really because we saw organizations struggling with what we now term the AI adoption paradox.
Do we choose to not adopt AI and face existential risk or do we adopt it as quickly as we can without the ability to manage the risks to be without the ability to properly manage it? And that kind of paradigm that this selection between one bad decision and another bad option uh is often leaving companies kind of in a chicken and egg scenario where they don't really know how to define a strategy going forward. they don't know what policies, security controls to put in place because they haven't necessarily said we will absolutely adopt AI in certain ways.
Now, I think that's shifted in recent years uh and really in recent quarters where companies have now realized like we've been innovating, we've been testing things. it is no longer an option to not adopt AI and that's really what we knew would would uh come and so there has to be security controls there has to be governance that doesn't impede adoption that doesn't block users access to these critical innovations that accelerate their business that accelerate their productivity and so we really built Sure Path AI around what we're now seeing in the market knowing that the future would require businesses to adopt AI but no business wants to be the first to break because of the risks they've introduced uced into their business with AI. >> Well, Casey, as I'm sure you know, many organizations assume they know how AI is being used inside their environment until they look.
What typically surprises customers the most when they get real visibility into their Gen AI usage for the first time? You know, that's one of the the core features of Sure Path AI is giving companies visibility to what AI services, models, tools are in use across their new AI workforce, their AI users, their AI developers, their AI agents. And I think what's often most surprising to organizations is they may assume that uh it is a larger volume of AI usage than they they would maybe predict or be able to put a number on, but it is often orders of magnitude higher volume.
And so I think that's one of the first areas that is surprising to organizations is that within minutes of turning on Sure Path AI, they're seeing the volume of AI usage within their organization. And it's absolutely surprising to them and they realize that this isn't something they could have just turned off or blocked because it is being used to run their business already by end users, by developers, by applications. There's a second and I think that is how it is being used.
It's not just being used in the ways that uh organizations think that uh maybe somebody's, you know, drafting an email or creating maybe marketing assets or software developers. Those are kind of uh wrote kind of predictable use cases for AI within the organization. But then they say, well, why is my CFO vibe coding an application against our ERP with MCP resources? Well, they may not even know they're doing that because they're us utilizing AI to move at such a fast pace to get the business outcomes they were looking for.
And so I think that it's both the breadth of use and the depth in the complexity by non-technical users in which AI is is finding its way into organizations and that introduces new types of risks because a lot of users aren't aware of the types of risks that they're maybe introducing as their AI usage becomes even more complex and ingrained into enterprise systems. >> It's so interesting to hear you talking about a seale executive vibe coding. I don't know if I should be hearing about those two things in the same sentence.
So why do legacy security tools and approval processes struggle so much with LLM based workflows and what fundamentally changes when Gen AI enters the picture? >> You know, I think there's there's uh really two aspects to where legacy security tools really can't help manage and secure AI usage. And the first is that generative AI has created a paradigm shift. 5 years ago, users in your organization weren't taking corporate data to any random thirdparty service or website.
They weren't going to paste bin or a social media service and putting critical internal financial documents or sales presentations into just a random website because they weren't getting business value. But now they can go to one of thousands of AI services and get a business value, a productivity gain. And there's a paradigm shift in the relationship where 5 years ago users might only interact with the internal productivity tools, their own maybe word processors or document processing systems, their own internal tools that IT and and the security teams have blessed and deployed.
That's where they got their productivity gain and got work done. Now they can get work done outside of the organization rapidly. And so that means that the relationship of how much data is going outside of your organization and where it should be approved to go is a huge challenge. The second challenge is that legacy security tools have always been built around the concept of blocking or allowing behavior. They evaluate security risks. They look for heristics and keyword matching.
They designate maybe a service shouldn't be allowed to be utilized. And they always arrive at the same decision. I'm either going to block the user activity or I'm going to allow it. If we just block the user activity, we're actually driving users to riskier behavior. They're going to go to their personal device. They're going to take their personal data to their personal device to accomplish the task or they're going to find a riskier service that hasn't yet been blocked by a legacy service.
And if we just allow the usage, we're not actually securing or mitigating any of the risks. And that's why Sharpath built the ability to transform usage as it's going through our platform to be compliant to remove some of the security risks transparently to end users in line so that they can get the productivity the gain they're looking for but only when it's compliant with the enterprises acceptable use of AI. >> Casey Sure Path AI applies zero trust principles to Gen AI usage.
What does zero trust actually look like in an AIdriven environment and why is this so critical of a principle? >> Absolutely. I think the the reality is that organizations have already tried playing whack-a-ole of we're going to try and block access to unapproved AI services or we're going to put written policies out that say you can only use AI in these ways and we're going to cross our fingers and hope that people adhere to our written policies if they've even read them.
And the reality is is that not only is AI changing so rapidly, but there's so many services available, but there's also a nuance of application of business policy. What license level should a user be able allowed to use based on their group or role or department? What types of business activities do you want to approve for usage with AI? Do we want to allow loan approval decisions to be made with thirdparty AI tools? It's illegal in many jurisdictions.
Do you want to allow medical decisions or diagnostic decisions for a physician? There are many different business decisions that also fall outside of the traditional cyber security realm, but that are critical business applications of policy. And the reality is is that whether it's an approved AI service or an unapproved AI service, these are the types of policies and controls that customers want to apply. And so you really need to take a zero trust position where you're going to allow the user to access a system.
But what you're going to do is actually decide based on the interactions whether or not the individual interactions are adhering to the security data and business policy controls that an organization has placed for that individual group, user or department. And that's really the approach we take from a zero trust perspective is we're evaluating the risk and the adherence to policy on every interaction to and from an AI service. And we're able to ensure that those risks are mitigated, but our customers don't have to play whack-a-ole and trying to define the policies of which new services should a user be able to access, what types of activities should we put into our written policy that won't be adhered to.
Instead, they can say, "These are the types of behaviors we don't allow on these types of services or at this risk level." And now, Sherpath can apply that to any of the AI services that a user is accessing or utilizing. >> Casey, Sharpath AI applies zero trust principles to Gen AI usage. What does zero trust actually look like in an AIdriven environment? And why is this so critical of a principle? >> One of the best examples we have is actually more of a a mid-market financial institution. and they were owned by a parent company who when you know generative AI came onto the scene they very quickly told all of their portfolio companies because of our regulated vertical needs and our our sensitive customer data we're not allowing access to any generative AI tools and it was really impeding their ability to innovate they're a software company they build internal products they have to service their clients and customers and they were worried about falling behind that existential risk of of not adopting AI and so with Sure Path in place.
They were able to get approval from their parent company to allow broad access to AI services. And so for the first 6 months, they were really the only plat the only member company of their portfolio that was able to accelerate internal knowledge and adoption. But what we're really proud of is that that translated into a much broader awareness and adoption because they were building and tuning AWS bedrock models and deploying them through Sure Path.
They got awareness of the capabilities that they should be building into their own products. They became comfortable with the types of security guard rails that they needed to apply and they actually embedded many AI features natively into their products and so we actually impacted their own customer experience by accelerating their adoption. >> Casey, you brought up AWS, talked about their bedrock solutions. So let's keep talking a little bit more about AWS.
There are multiple hyperscalers in the market. Why was AWS the natural partner for sure path AI when it came to delivering secure private and enterprise ready Gen AI environments? >> A number of different reasons. Uh the first is AWS is is uh really channel and partnerled. They are very mature in the way that they grow their partner ecosystem, the way they lead with partner engagement. And that's really I think something that we've all experienced in our past prior to starting Sherpath.
And so that was a natural uh reason to partner with AWS. But there were also a lot of significant technical reasons and really the vision of where AI is leading that years ago most of the hyperscalers really didn't have a vision and I think you know for the first I'd say 3 4 months people said oh AWS isn't doing anything with AI they're they didn't rush to announce an open AI partnership and what we saw was that they were actually building a much more intelligent longer term strategy they were building the model garden strategy around AWS bedrock which has become bedrock agents and expanded into bedrock knowledge bases, the integrations into Sage Maker.
They really were building the model garden approach where any model from any thirdparty vendor, any uh internally trained models could be leveraged in the same platform. And at the same time, other hyperscalers were like, hey, here's an open AI API. That's it. It's basically the same thing you would get if you went directly. And so there wasn't a differentiation from other hyperscalers. And we saw that AWS was clearly building to the enterprise requirements to both securely deploy solutions to be able to adapt and have the flexibility and vendor portability of any of the foundational model providers being accessible to their customers in their own secure environment.
And like they've done many times in the past, that drove the behavior in the market where other hyperscalers had to respond with a similar model garden approach, but that was kind of slapped on to their architectures. And so we really saw early on that our customers wanted access to the latest and greatest models and that AWS was providing that capability. There's a second piece too there and that was alignment on the long-term vision that it's not just getting access to the model.
Customers will come back and say we need to put security, visibility, observability, management on top of the capabilities we're building. and they were one of the very first partners to start speaking about guard rails about how you constrain and secure access to different services. And so we knew that both from a vision and the the optionality that we wanted to provide our customers that we were aligned with AWS. And when you add in their partner ecosystem, it was a very natural fit for us to prioritize our partnership with AWS very early on.
Casey, for customers already working with AWS partners, how does Sure Path AI fit into that ecosystem to help customers move faster without having to give up a relationship that they've already built, trust, and invested in? >> You know, that's really important. I think uh AWS does a great job of of not being opinionated, of saying, "Hey, here's your partner to a customer." It's always the customer's decision. And we came from a channel background at Cisco, CDW, and other consulting partners in the past.
And so we built Sherpath to be channelled and partnerled day one. A lot of the product value we provide is being used by partners today in their own consulting motions. And so with any AWS partner that a customer has a relationship with today, those partners can leverage Sure Path in their own existing consultancy motions. AWS through their MAP funding programs can support those partner engagements as well. And then we also have a referral and resale program that supports those partner relationships.
So we are really channel and partnerled. And so if a customer is looking to be able to consume the value of Sure Path, but they want their consultancy partner to tie that into the work they're leveraging, that's a very natural motion that any of the AWS partner ecosystem can leverage today. And it also aligns to accelerating the work that the partner is doing because oftentimes they're looking for what are the high priority workloads or use cases of AI we should be prioritizing.
Maybe they're managing the AI center of excellence for a customer and Sure Path is an accelerator to a lot of those motions for our partners as well. >> Time to value is always important. So I know those listening want to know when they'll see results. Once customers put the right guard rails in place, how quickly do you see their Genai adoption accelerate and what are some of the early wins you're seeing in AWS powered environments? >> Absolutely.
So, we almost pause in in saying how quickly customers get value because people don't believe it until they see it. But in in a one-hour implementation, we are turning on Sure Path to give full visibility of AI usage in their enterprise. And that can be in a passive monitoring mode where they can really inventory and understand not only what AI tools, services and models and license levels are being used by which users and departments, but what are they using them for?
Are they using them for HR tasks? Are they developing specific types of software? The understanding of the business use by the group and tool and and department specific to which tool they're leveraging. That's incredibly valuable data. and our customers start seeing that data flood into their sure path tenant and seeing the insights that they can start to understand and drive their AI strategy with and the way that we present that through our AI insights.
And so that's a time to value that we see customers get within the first hour of implementing Sure Path even in a PC period. Now what we see what we're really proud of is that within about 30 to 60 days almost every one of our customers shifts from I want to understand which tools and AI services are in use and I want to understand the risks because now with the appropriate guard rails in place from Shure path they know that those risks are being managed they're being mitigated and that users who are using AI are doing it in the secure destination that the business has defined and they're only doing it in the ways that are approved but they're not blocking or mitigating or blocking or inhibiting the users's ability to get the outcome they're looking for.
And so customers shift within 30 to 60 days from what tools are in use and where are the risks to who's not utilizing AI because now I know if I'm pushing adoption, it's going to happen in a secure destination. It's going to happen securely and I'm going to have visibility to how effective it's been. And so they shift from a risk mitigation lens to an adoption lens and accelerating adoption. And that's really what we built Sure Path for is once you've removed that barrier to adoption, now they can focus on that larger existential risk of we need to be adopting AI effectively. >> Casey, if you were advising a CIO or CISO who feels pressured to move fast with Gen AI, but is worried about breaking something along the way, what's one principle they should anchor to to secure the future of AI in their organization?
Yeah, I think the the first is uh I'll I'll quote uh Jeff Goldblum from uh Jurassic Park here. Life will find a way. You know, a lot of CIOS and CISOs want to respond with, you know, we're just going to be we're going to have to say no because we don't have these controls in place. We don't have the visibility in place. And so, we're going to say no. I would say that that that in itself is actually we've seen it drives even riskier behavior. Users will go to their own devices.
They'll find riskier services. MIT Sloan did a great study on this last year that proved blocking access to AI tools drives users to riskier behavior. They take the data with them outside of their organization. So if you just think about that on its face alone, just blocking access to tools and services today will actually increase your risk, then you should be the department of yes. And obviously behind that, you want to apply the visibility and policy controls and security controls that you need.
You want to be sure that users are granted only the permissions that they should should be allowed to access. And so core security and identity principles are more critical than ever. >> Well, I've so enjoyed this conversation today, Casey. I think you've brought so many great nuggets of information for our audience to use on top of the great services that Sher Path AI provides with AWS. My final question for you today, Casey, where can those watching and listening learn more about Shure Path AI?
Any customer or partner that would like to learn more can obviously visit us at sherpath.ai. You can view us within the AWS marketplace. Your AWS account team can connect with us and get us connected with somebody from our our sales team and get an overview of our platform. But we're also in person at a lot of events this year. Uh we were just at reinvent. We'll be at reinvent again this next year. Please come see us at RSA and Black Hat. Uh so we'll be at many of these security and uh AWS events throughout this year as well.
You heard it here first, folks. Go to those events. Look for the Mohawk. Look for Sher Path AI. They'll get you where you need to go. Thanks, Casey. And thanks to you at home for joining us today. To see more episodes of PartnerPins.com. Once again, I'm Katie Bavoso, and I'll see you next time. >>
This transcript was generated automatically from the
video's captions and may contain errors.
