See our AI Impact podcast episodes on YouTube.

Most CIOs are protecting against the wrong AI security risk. In the latest episode of AI Impact, Karl Mosgofian, former CIO at Gainsight and now a CIO advisor, joins Larridin co-founder and CEO Russ Fradin. Karl explains where enterprise AI governance fails in practice, and why the tools nobody in IT knows about are a bigger threat than your contracted vendors. He also makes the case that as agents take on real work inside your organization, they need their own identity in directory services; without it, accountability disappears the moment something goes wrong.

Key points

Karl started in IT as a teenager, doing everything from systems administration to programming, and spent his career on the application side before becoming a CIO. His views are practical and grounded in experience. Several key points emerged.

CIOs automate the business, and agents need identities too

Karl's definition of the job is simple: CIOs help automate business processes. Departments can run plenty of their own cloud tools, but at some point someone has to own the company-wide system. That makes the CIO either a vendor's best friend or worst enemy, and when the CFO asks for a 10% cut, the tools the CIO understands are the ones that survive. Karl sees the CIO and HR moving closer together, since both exist to make people effective and productive. Why run two help desks when one phone number could route questions to the right experts? And as agents start doing real work, he says, they need to be tracked like workers. When something goes wrong, you need to know whether a person or an agent acted, and on whose authority. Microsoft recently began giving agents their own identities in directory services, separate from the people who authorize them.

Start with the problem, and measure whether it worked

For now, Karl says, CIOs are enjoying the golden glow of a new technology: departments are eager partners, and few have had to show ROI. That won't last. As AI matures, the CFO will ask the CIO to consolidate overlapping tools and rein in spending. A chatbot for every employee is cheap enough that exact ROI hardly matters, but agents that take whole chunks of work off people's plates are expensive, and that's real money. So the anatomy of a successful AI project is the same as any project: start with the problem you're trying to solve, and have a way to measure whether the tool actually worked. Otherwise, a few years later, you're turning things off because nobody can justify them. Russ describes Larridin's role the same way: it doesn't tell companies to go on a diet; it gives them a scale.

Small groups drive adoption better than speeches

Russ argues that many experienced employees haven't had to learn a demanding new technology in years, and now they're staring at a blank chatbot with no clear idea what to do. Karl saw the same pattern at Gainsight: a handful of people used AI heavily, and many didn't use it at all. Company-wide Zoom sessions helped some, but the most effective approach was bringing small groups together within a team to share use cases relevant to their own work. Companies that don't invest in this, he says, are leaving value on the table.

The real AI security risk is the tool IT doesn't know about

Karl thinks companies are a little overly concerned about their contracted AI vendors. If a vendor's contract says it won't train on or retain your data, you either trust that or you don't, just as with any SaaS vendor. Uploading a spreadsheet to a chatbot for a moment is very different from pointing an AI tool at your entire Salesforce database, but even then, a security review and a solid contract go a long way. What worries him is the free tool someone downloads without IT knowing, with no contract in place. Russ adds a striking data point: on average, across Larridin's customers, two-thirds of the AI tools in use are ones the CIO doesn't know about.

Conclusion

See the full episode on the AI Impact Podcast playlist on the Larridin YouTube channel. To get a demo of Larridin, contact us.

Quotes

• "The CIO can be your best friend or your worst enemy." (Karl Mosgofian)
• "What I’m nervous about is someone downloading a free tool that I don't even know about." (Karl Mosgofian)
• "No matter who you think you're selling to, you're also selling to the CIO." (Russ Fradin)

Q&As

Russ had questions; Karl had answers.

Q: How do you describe the CIO job? What do CIOs really do when they're doing a great job?

A: The reality is CIOs help automate business processes. ... In the modern, technology-driven world, you can't run any department in the company without technology, and somebody's got to manage that who's good at it. ... At some point the overall integrated system becomes so complex that somebody somewhere has to own not just the departmental solution, but the company-wide enterprise solution.

Q: How do you think CIOs think about AI today, beyond mass experimentation?

A: I think it's an incredibly exciting new technology. ... I think CIOs probably take a slightly more jaded view of technology than other folks, just because we've been through this a lot. There's always a hype cycle. ... The generic productivity use case, something like a chatbot for your employee base, is not that expensive. ... I think the much bigger question is when you get into agents, and how we're going to start seriously offloading whole chunks of work from people to agents. ... You're getting into real money.

Q: How much should people think about data and security with all these AI tools and LLMs? Are people overly concerned?

A: I think people are a little overly concerned. ... I have lots of SaaS vendors. They have access to a lot of my data. I either believe what they say in their contract with me or I don't. ... Yes, we need security reviews. Yes, we need governance. But within that context, what I am nervous about is someone downloading a free tool that I don't even know about. They're using it. They're giving it data. I don't have any paper with them.

Topics in this episode

Key topics in this episode include:

1. AI impact: After coding and call centers, Karl predicts the clearest AI impact will come in language-heavy work, such as Legal, Marketing and technical publications.
2. AI tool usage: Russ notes that, across Larridin’s customers, two-thirds of the AI tools in use are ones the CIO doesn’t know about, and Karl’s biggest worry is free tools downloaded without IT’s knowledge.
3. AI/token costs: A chatbot for every employee is inexpensive, Karl says, but agents that take on whole chunks of work cost real money, and eventually the CFO will ask the CIO to rein in AI spending.
4. AI ROI: Few companies have had to show ROI on AI so far, but Karl expects that to change, and he says every AI project should start with the problem it solves and a way to measure whether it worked.
5. Human productivity with AI: Karl found that small-group sessions within teams, sharing use cases relevant to their own work, were the most effective way to help employees become productive with AI.
6. AI agent productivity: As agents start taking whole chunks of work off people’s plates, Karl says they need their own identities in directory services, so it’s clear whether a person or an agent did the work.
7. Enterprise AI: Karl explains where enterprise AI governance fails in practice: the bigger risk isn’t contracted vendors, but tools IT doesn’t know about.

Full Transcript

Chapter 1: Introduction (0:00)

Russ: How do you describe the CIO job?

Karl: The reality is CIOs help automate business processes. In a lot of companies, the CIO is your starting point.

Russ: One of the things I found in my whole career doing enterprise sales is that no matter who you think you're selling to, you're also selling to the CIO.

Karl: The CIO can be your best friend or your worst enemy. Don't assume that they're going to be your worst enemy. They can be your best friend.

Russ: Where do you think the best CIOs come from?

Karl: A lot of really good CIOs actually come from...

Russ: Welcome back to AI Impact. I'm Russ Fradin. I'm here with Karl Mosgofian, ex-CIO of Gainsight most recently, and now CIO advisor to the stars. Thanks for being here, Karl.

Karl: Thanks. Looking forward to it.

Chapter 2: How Karl describes the CIO role and what great ones actually do (0:45)

Russ: Could you tell me a little bit about your pre-Gainsight career?

Karl: Absolutely. I've been an IT guy my whole life. I literally started as a teenager in computers, mostly in the application space. But I had the great fortune, I think, of starting early enough that in those days you had to do everything. I was my own systems administrator, my own DBA, my own business analyst and programmer. So I really learned on the job how to do applications work, but also how to manage the whole IT stack, which served me well later when I became a CIO and needed to understand a little of all of that.

Russ: So here's a question, before we talk about AI and all the things we're here to talk about today. How do you describe the CIO job? What do CIOs really do when they're doing a great job?

Karl: The reality is CIOs help automate business processes. There's a piece of the job that's around the mechanics of getting people laptops and basic productivity tools and things like that. But the reason it exists is that in the modern, technology-driven world, you can't run any department in the company without technology, and somebody's got to manage that who's good at it. It's been an interesting thing. The cloud has led to a lot of individual departments running their own thing, and quite often they're able to do it quite well. But generally, at some point the overall integrated system becomes so complex that somebody somewhere has to own not just the departmental solution, but the company-wide enterprise solution.

Chapter 3: Why the CIO is often the right starting point in any enterprise technology sale (2:27)

Russ: Well, this is interesting. I'm sure this relates a little to your advisory work, but one of the things I found in my whole career doing enterprise sales is that no matter who you think you're selling to, you're also selling to the CIO.

Karl: Absolutely.

Russ: Unless you have something very small, very niche, there's really no technology you're going to sell that doesn't ultimately wind up on the CIO's desk one way or another.

Karl: Yeah. And I would also say that in a lot of companies, in a lot of circumstances, the CIO is your starting point, because the folks in the department don't spend their lives thinking about how to use technology to improve their business. CIOs do. So often the CIO is coming to that line-of-business person and saying, "Hey, I heard about this great thing. It seems like something that might be interesting to you. What do you think?"

Chapter 4: The CIO and HR relationship in a well-functioning company (3:14)

Russ: Like I said, I have a bunch of AI questions, but I'm curious about CIO day-to-day life. How do you think about the relationship between the CIO and the head of HR? There's so much tech angst, especially with older employees, and that's accelerating a lot in the AI world. HR becomes, in many cases, the repository for a lot of that angst and what to do with it, but the CIOs have a lot of policies to push forward. So before we even get into blocking and things like that, how do you think about that relationship in a well-functioning company?

Karl: It's a really close relationship, if it's well-functioning. And it's a great question, because I think the two are actually very close, especially when you start to get into questions of governance and privacy and things like that. I always felt like I needed to partner really closely with the head of HR. And the lines are getting blurred.

Russ: Sure.

Karl: At the end of the day, IT is about making people effective and productive, and so is HR. So we share a mission, and we probably have to work together even more closely than we have in the past, especially now in the age of AI.

Chapter 5: Why CIO and HR functions may eventually merge as agent workforces scale (4:26)

Russ: Look, I'm curious what you think. Since we started our company, Larridin, I've assumed, without having a judgment on where it reports or who becomes more in charge, that the CIO and the head of HR will ultimately become merged into one department or one job over time, as you start thinking about agents doing some of the work and humans doing some of the work. You already had some of this tension with outsourcing in the past, because HR's relationship with its American workforce is different than with the outsourced call center operator in the Philippines or wherever. So how do you think about it? What do you think the future looks like between CIOs and heads of HR?

Karl: It's a great question, something I've thought about a lot, actually, because I think there's a world in which those groups are combined in some way. However, it's always important to think about all the pieces that a group does. There's a piece of HR, for instance, that's very legal. People who run HR are quasi-lawyers. They know a lot about employment law: how to not get in trouble and not get sued. Does someone with a background in IT have that? Probably not. So I think there are pieces that overlap. And I can see a world where you say, well, actually, the HR team is running a help desk to answer people's questions. So is IT. Why are we running two help desks? They're just different kinds of questions. Maybe you route them to experts in a particular area.

Russ: There should be one phone number.

Karl: One phone number. And by the way, if it's something sensitive, it goes to someone who's specifically an HR person. So I think there are a lot of opportunities for synergy there that a lot of companies probably don't even think about, because they have silos in their heads, so they think those are totally different. But if you're creative, and especially if you're starting a new company and have the opportunity to work from a blank sheet of paper, there are a lot of opportunities for more efficiency and synergy by combining some of those things.

Chapter 6: Why agents need their own directory identity separate from the humans who authorize them (6:36)

Russ: It's hard to imagine a world where companies have an agent workforce in some capacity that's managed separately, purely from the CIO's perspective, and then this other hybrid workforce. It'll be one of those interesting things to track. I imagine it's very different if you're under 35 than if you're over 55 and getting toward the end of your career. If you've spent your whole career in HR or in IT, that probably seems very unusual. It probably doesn't seem unusual at all if you're earlier in your career.

Karl: I'll tell you one thing, not to rat-hole on this. When agents first started to become a thing, one of the first things I thought about was, how do you attribute work? This was done by this agent, on whose authority? Or maybe it was done as this person, but the AI did it, logged in as you. And I thought, wow, it's going to be really important that we know that, because when something goes wrong, I need to be able to figure out why it happened. So one of the first things I thought about was that those agents are going to need to be in your HCM.

Russ: Microsoft, right? A few months ago... Until a couple of months ago, this wasn't possible.

Karl: Microsoft just a few months ago made agents a separate thing inside directory services. So if I authorize an agent now, it's not acting as me. It's its own entity.

Russ: And obviously that's where this will go.

Karl: Exactly. Yeah.

Chapter 7: Why this is the most exciting time in 20 years to be a CIO (8:00)

Russ: So I'm curious. As a guy who spent my career selling into departments, from that perspective it's often been the case that department leaders sometimes view the CIO as their partner, and sometimes view them as a real pain, an impediment, bureaucracy, something like that. I've theorized that now must be the most exciting time in the last 20 years to be a CIO, because of AI, because all of these departments love you and want this partnership and innovation. When I talk to CIOs now, it's not a relationship where they're worried about having to step in and tell the CMO not to do this and not to do that. It really feels like a great time of partnership. Is that right?

Chapter 8: How CIOs think about AI beyond mass experimentation (8:48)

Karl: I think that's absolutely been true. I don't know if that will stay the same as AI matures.

Russ: Sure.

Karl: The CFO will start going to the CIO and saying, "Hey, we're sure spending a lot of money on AI. Experimentation was fine for a while, but now it's time to rein this in. I need you to be the person who goes around and says, 'Hey, we've got 10 different tools that do similar things. Could we consolidate?'" But for now, we're kind of in the golden glow of a new technology, where there's a lot of freedom. You haven't necessarily had to show a lot of ROI, because it's been, "Let's just throw this out there. Let's try it. Let's see what happens." But as it matures, we'll go back to playing a little bit of that bad-guy role. And we get that nobody likes that. We slow them down. We say, "Well, we need a security review. We have governance. We have this." And I get it. If I'm in the department, I'm saying, if I can go around those guys, I will. Some of that has to do with the particular CIO and the particular culture of the company, in terms of how positive a collaboration it is versus an us-versus-them feeling. I'm sure in sales you felt that all the time. You talked to some people who said, "Whatever you do, don't talk to IT," and other people who said, "Please, let's bring them in right away."

Russ: At my last startup, CIOs were always involved, because we were selling to heads of HR, who would say, "Look, we don't really know how to buy technology at all. We have to bring in our partner, or we won't be able to do it." At my company before that, we sold to CMOs. They generally have the stance of, "We're good."

Karl: When I joined Gainsight, one of the things I really wanted was to understand how to work with CIOs, because we were selling to the CCO. We were selling to customer success departments that had never previously bought any technology. And I explained to the sales folks, and continued to explain over the years, that the CIO can be your best friend or your worst enemy. So don't assume they're going to be your worst enemy. They can be your best friend. It's super important that the CIO understands what you do and appreciates your value in the tech stack, because there will come a day when the CFO says, "Hey, we've got a lot of stuff. We want to cut 10%." And you don't want to be the one where the CIO looks at the list and says, "Wow, that's really expensive, and I've never heard of it. I don't even know what it does." You want the CIO to say, "Well, I'm pretty sure we don't want to touch that one, because I know the value it's bringing."

Russ: Where do you think the best CIOs come from? There's always debate: are the best CFOs former controllers? Are they former FP&A people? Are they M&A and fundraising people? I'm sure CIOs can come from anywhere, but what's the background of the best CIOs you know?

Karl: CIO is such an interesting, odd job, because it really is an interesting mix. It's policy, it's procurement, it's a lot of things. A lot of really good CIOs actually come from the business. I think in general they come from the application side, because they understand business process and how to speak the language of business. They understand how to talk to a VP or a CEO or a board. Whereas someone who came up, let's say, running the help desk may or may not have had the opportunities to learn some of those skills, although it's not at all impossible, and so much of this has to do with the individual person. I think this is true of any executive role. So much of it is people skills, communication skills, and, to be honest, common sense. It's funny to say it that way, because we think in terms of needing deep domain expertise. I think sometimes you can almost be too much of an expert. The ability to understand things at a higher level, abstract them somewhat, and understand systems thinking, as opposed to going really deep into some technical domain: those are the skills I think actually help you be a CIO, or frankly any executive.

Chapter 9: The anatomy of a successful AI project and the question most teams skip (12:42)

Russ: Let's talk about AI for a little bit. I have a bunch of questions around training I want to get back to later, and my theory for why there's so much angst in the workforce. I'm curious whether you think I'm on the right track or not. But how do you think of the promise of AI when you talk to your friends who are CIOs? AI has really been around for many years, but with the release of ChatGPT three years ago, it obviously took the enterprise by storm, as it did on the consumer side. You've seen extremely fast-growing companies. We've all seen it in coding; we've all seen it in call centers. But how do you think CIOs think about it today, beyond mass experimentation?

Karl: I think it's an incredibly exciting new technology. It's a great new tool in our toolbox. I think CIOs probably take a slightly more jaded view of technology than other folks, just because we've been through this a lot. There's always a hype cycle. I don't think there's any CIO who would say this is not incredibly important, but I also think we probably have a perspective on how it fits into our tech stack and how it impacts our business that's a little more measured, and that understands that no, this one technology is not going to do everything for everyone all the time.

Russ: Well, it's also an interesting question when you see the companies you work with advising the rest of their organization. As a CIO, I'm partly helping procure these tools, but I'm partly the leading edge of advising the company. Do you think people at more mature companies are mostly thinking of these AI tools in terms of growing revenue faster, or firing a bunch of people? There are only three ways this can go, right? I'm going to grow revenue faster. I'm going to fire a bunch of people. Or the tools are so fun that I'm just going to have a lower gross margin permanently. That's not going to happen, but it is technically an option. So since it won't be that, how do you think CIOs are thinking about it with CFOs on that journey? Where do you think we are?

Karl: Yeah, I think it's both, right? Obviously there's a productivity and efficiency play here.

Chapter 10: Why the early adopter framing no longer applies to enterprise AI (15:09)

Karl: Again, I think CIOs may be a little more questioning of that than some of the hype you see, just because we see in real life what happens with productivity tools. At the same time, the generic productivity use case, something like a chatbot for your employee base, is not that expensive. So, to be honest, if that's all an LLM is worth, no problem. How much exact ROI do we get? I don't know. But I'm not spending that much money, and obviously I'm getting some efficiency gain, and then you can talk about how you drive adoption and greater value from that. I think the much bigger question is when you get into agents, and how we're going to start seriously offloading whole chunks of work from people to agents, not just making someone's life a little better and more efficient. That's another whole world that's much more complicated and much more expensive. With those kinds of tools, you're getting into real money, and they're much more impactful. I think we all see a lot of opportunities there, but that's also the area where there's so much hype.

Russ: Literally today, the day we're recording this podcast, though it won't come out today, OpenAI announced its positioning for its new product: your AI coworker. That's going to be expensive. Either the coworker won't be very valuable, in which case OpenAI won't charge much for it, but they are charging a lot for it, or it will obviously impact headcount. There's no third option.

Karl: Absolutely.

Russ: In that world, and this gets a little bit to reporting as well, that's obviously going to be some combination of the CIO, the CFO, HR and the department head. Any time you're talking about headcount... Let's leave reporting to the CEO aside for a second. In your opinion, where is it healthiest for an organization to have the CIO report? Is it inside finance, or to the CTO or head of engineering?

Karl: This is a question that comes up a lot. How I feel about this is that it doesn't matter. What matters are your relationships. If you have a relationship with the CEO, you don't have to report to them to have a line of communication. I actually think that's more important. I have worked mostly for CFOs, but I have also reported to a CEO for a while. It just depends on the person. Some of the CFOs I've reported to have been absolutely fantastic, and I would say in general the CFO is a good place for this, for two reasons. One is that they tend to be down to earth. They're not up in the sky.

Russ: Did it happen or not?

Karl: Exactly. Are we hiring more people or fewer people? Are we selling more or not? The other thing gets to a different question people sometimes ask, which is, what would you do if you weren't in IT? I've thought about that, and I've said I would be in finance. The reason is that I like knowing a little bit about everything. I'm a systems guy. I enjoy understanding big, complex systems, as opposed to being, let's say, an engineering person who's really deep in a domain. And that's the other reason I think the CFO is often a great place for IT to report: CFOs are also systems thinkers. They also see the big picture of how all the departments in the company tie together. And that's the thing about selling to a department: it's so different than it was when I got started in this game a long time ago. There are no silos. There's nothing anybody does in any department in the company that doesn't have upstream and downstream data. So if all you're thinking about is that department, it's not going to work.

Russ: What's your platonic ideal of how an AI project should be run? Pick any project you'd like inside an org. What's the CIO doing? What are the department heads doing? How are we setting it up ahead of time? Obviously there's been a ton of experimentation. We can describe a lot of what happened in the last year as: the tools are amazing, the vendors seem great, CIOs have been told to spend, and they've clearly purchased tools faster than at any other time in your career or mine. And by the way, many of those pilots failed, which was the plan. There's nothing wrong with that. When you say you're going to run a lot of experiments, some will fail, and then that becomes a headline: McKinsey says... But yes, that was the point.

Chapter 11: What separates AI projects that scale from the ones that stall (19:56)

Russ: But what have you seen? What's the anatomy of a successful AI project?

Karl: To be honest, it may be a boring answer, but I think it's the same as any project. The first thing it starts with is, what's the problem we're trying to solve? And I think AI has been a little dangerous in the sense that there's a feeling of, "Well, we don't really know, but it's the cool stuff, so let's throw it in there and see what happens." If you're talking about generic productivity tools, to some extent that's okay. But when you start saying, "We're going to go buy something to make the finance department more effective," okay, what problem are you trying to solve? Do we have some way to measure whether it actually worked? Because otherwise you're just spending a lot of money and hoping things work out. And what tends to happen with things like that is that a few years down the line, you're turning things off, because you can't really justify them. They're not actually doing anything. So that's a big waste of time for everybody.

Russ: Look, this is why we love talking to CIOs at Larridin. What are we really selling to people at Larridin? AI is amazing. A lot is happening in your org. Some of it you know about, and some of it you don't. Let's just understand what's happening. My perspective has always been: we're not telling you to go on a diet. We're just telling you that you should have a scale. And then do whatever you'd like, but it's good to have a scale. It's good to get blood tests. Those things are objectively useful, and whatever decisions you make with that data, that's fine. Our perspective at Larridin has been: hey, CIO, let's set ground truth for what's happening in the organization, and constantly measure it so that we can share it.

Chapter 12: Why small-group peer learning drives more adoption than top-down training (21:26)

Russ: So I want to talk a little about a theory I've had. Apart from the PR hype that everybody's going to get fired and there will be no jobs, which I think we can all ignore, one of the things you'll hear a lot is, "Today global IT spend is $1 trillion, but thanks to AI, it'll be $10 trillion." That's just not true. IT budgets are not going to 10x. For IT budgets to 10x, you'd have to [unclear]. We're not going to have that, at least in our foreseeable future. But IT budgets are clearly going to grow, and there's clearly angst in the org. I'll tell you my thesis. Tell me if you agree or disagree, and if you agree, what should companies do about it? I think a lot of the angst inside an organization is this. By the time you're 40, you've reached some level of success, if you're still in that organization. By the time you're 50, you've probably reached the level of success you'll reach in your career inside that organization, whatever that is. And they probably like you a good amount, assuming bigger companies with less turnover. One of the things you find with people in their 40s and 50s, on average, not the best performers, is that they really haven't had to throw themselves into much new recently. It's a lot about their expertise and training younger people with it. They've become very efficient in their way of doing things. And I think if you froze time in 2022 and asked the average pretty successful 45- to 55-year-old, a VP, not the CEO, not the top 1% performer, about the last piece of new technology they really had to learn, it was really Zoom. And Zoom just isn't that hard to use. Okay, we went remote, but Zoom and Slack are not particularly hard to use. Now I'm staring at a blank chatbot: "Do better in your job." It's not clear what to do for some people. And I don't like when people talk about high agency and low agency. There are a lot of people who are 45, who've been very successful in a lot of ways and mean a lot to their org, who just haven't had to learn much new technology in the last 10 years. So, A, does that sound right? And B, more importantly, how should CIOs and heads of HR handle it? My theory for Larridin has been that CIOs and heads of HR are going to have to get much closer, because regardless of where they report, this is a giant problem: we are trying to retrain the entire global knowledge worker workforce all at once. We're not exactly sure how to retrain them, but we know they need to use these tools to be more efficient.

Karl: Absolutely. We spent a lot of time in the last few years at Gainsight trying to help people just use a chatbot more effectively. It's interesting: when you're in IT and you roll these things out, you can see who's actually using it and who's not. Typically, a handful of people use it a lot, and a whole lot of people don't use it at all. So we did lots of Zoom meetings and things to walk people through it, give them examples, and make them feel more comfortable with it. We found, by the way, that the most effective thing to do is to get groups, smaller groups, together within a team. Those folks brainstorm together and talk to each other: "Well, I used it to do this, and it worked really well." And it's great, because those are relevant use cases for people in that group, and they're inspiring each other, as opposed to me giving a speech on Zoom telling you how to use a chatbot. But absolutely, it's a core skill. It reminds me a little of when Google came along. There was a bit of an art to asking Google for something to get the answer you wanted, and we all had to learn that. It just took us a little while, and some of us got better at it than others. It's a similar kind of skill: how do I interact with this thing to get what I want? Smart companies put energy into that. At Gainsight, we had a CEO who got it very quickly. He said, "I want people to be learning this. I think it will be important for Gainsight, but I also think it's important for them. This is a massive new life skill, and I want to make sure we help people get it." Companies that don't do that are really missing the boat. They're missing a lot of opportunity for their teams, because most companies have something. If you're a Google shop, now everybody's got AI mode. A lot of people have rolled out Copilot or ChatGPT or something. But I think if you really looked at the numbers, you'd find there's still an awful lot of people who aren't really using it very much. And that's just leaving value on the table.

Chapter 13: Where CIOs are overcorrecting on AI security and what actually matters (26:40)

Russ: The other thing we haven't really touched on yet, that I'd love your thoughts on, is how much people should think about data and security in a world of all these AI tools and LLMs. For instance, you'll see a lot of people loving the idea of very cheap, on-premises Chinese open-source models. At the other end of the spectrum, people say, "No, no, no. I know it's open source and we host it, but it's from China." So that's one question. Then there's just the generic: do I really want OpenAI to know all that information? I've signed a no-data-retention agreement with Claude. I'm not accusing any of these companies of doing anything wrong. Do you think people are overly concerned, or under-concerned?

Karl: My particular take on this, to be honest, is that I think people are a little overly concerned, for this reason. I have lots of SaaS vendors. They have access to a lot of my data. I either believe what they say in their contract with me or I don't. I either trust them or I don't. At the end of the day, if I've got a contract that says you're not going to train on my data and you're not going to keep my data, what am I going to do? I can't live my life in a way where I've got 200 vendors and all these contracts in place, but I'm going to stay up at night worrying about whether they're really honoring them. At some point, life goes on.

Russ: I mean, truly, any one of your employees could theoretically be a spy for a foreign government, but they're probably not, and that's not how you live your life.

Karl: Right. Now, having said that, there's a big difference between going to a chatbot, asking an ephemeral question, maybe uploading some data that's going to live for a moment and go away... There's no reason for them to keep that data. Not only do they say they won't, but why would they? Why would they care about the spreadsheet you uploaded? There's a big difference between that and saying, "I have a corpus of corporate data. I have my entire Salesforce database and all the documents in my library, and I want to operate against all of that." I think that gets a little scarier, and some companies may say, "I want to run this in-house." But even then, as long as you've done a security review and you have a contract and some reason to believe these folks actually know what they're doing... When SaaS first happened, people would say, "How can I trust the SaaS companies to run their data centers in a way that keeps my stuff safe?" And my feeling was always, why do you think you're better at it than they are? That's literally all they do. And by the way, if they mess it up, their whole company is gone. I think they're actually more motivated than you are to pay attention to security. So I trust them a lot, actually, which is not to say they're perfect and nothing ever happens. But I don't think it's that much different than any other SaaS solution, and to be honest, I think the concern is a little overblown. Yes, we need security reviews. Yes, we need governance. But within that context, what I am nervous about is someone downloading a free tool that I don't even know about. They're using it. They're giving it data. I don't have any paper with them.

Chapter 14: The data point on shadow AI that most CIOs have not reckoned with (29:46)

Russ: We see with our tools that, on average, across our customers, two-thirds of the AI tools being used in the org are ones the CIOs don't know about. So I want to end with one prediction from you.

Chapter 15: Which job functions will see the clearest AI impact first (29:54)

Russ: I think we'd probably agree that AI has clearly had a measurable impact on coding, and clearly had a measurable impact in call centers. So if you had to predict, two years from today, the top three departments impacted by AI, we'd probably know those two. What would your third be?

Karl: I come down to language, because it's right in the name. It's an LLM. It's good at words. It's good at language. So I think the departments that will get the most value from LLMs will be people like Legal, who work with words. I think Marketing will also get a lot of value out of this, and the tech pubs department. So I think about it more in terms of use cases, and what this tool is really good at. I've got a new tool in my toolbox. Where I think it's going to add the most value is where that tool is most appropriate.

Russ: Excellent. Thank you so much for taking the time. I really appreciate it.

Karl: Thanks.

This transcript was prepared by AI and may contain mistakes.