Newsroom

AI Impact #2 with Karl Mosgofian: Stop Overcorrecting on AI security for CIOs

Written by Floyd Smith | Mar 27, 2026

The following is a transcript of podcast episode #2 from the Larridin AI Impact Series. (Subscribe to the Larridin YouTube channel for updates.) Join Larridin CEO Russ Freiden and Karl Mosgofian, former CIO of Gainsight, as they discuss the impact of AI in the enterprise. 

Excerpt

Russ: How do you describe the CIO job?

Karl: The reality is CIOS help automate business processes. In a lot of companies, the CIO is your starting point.

Russ: One of the things I found in my whole career doing enterprise sales is no matter who you think you're selling to, you're also selling to the CIO.

Karl: The CIO can be your best friend or your worst enemy. Don't assume that they're going to be your worst enemy. They can be your best friend.

Russ: Where do you think the best CIOS come from?

Karl: A lot of really good CIOS actually come from...


Introduction

Russ: Welcome back to AI impact. I'm Russ Freiden. I'm here with Carl Muscopian, ex-CIO of Gainsite most recently and now CIO adviser to the stars. Thanks for being here, Carl.

Karl: Thanks. Looking forward to it.

How Karl describes the CIO role and what great ones actually do

Russ: Could you tell me a little bit about your pre-Gainsite career?

Karl: Absolutely. I have been an IT guy my whole life. I actually literally started as a teenager in computers and mostly in the application space but I had the great fortune I think of starting early enough that, in those days you had to do everything. So I was my own systems administrator and my own DBA, my own business analyst and programmer.

So I really kind of learned on the job how to do applications work, but also how to manage the whole IT stack, which served me well later when I became a CIO and I needed to understand a little of all of that.

Russ: So this is a question actually, before we talk about AI and all the things we're here to talk about today. How do you describe the CIO job? What do CIOS really do that when they're doing a great job?

Karl: The reality is CIOs help automate business processes. There's a piece of the job that's around the mechanics of getting people laptops and basic productivity tools and things like that. But the reason IT exists is that, in the modern, technology-driven world, you can't run any department in the company without technology. And somebody's got to manage that who's good at it.

It's been an interesting thing. The cloud has led to a lot of individual departments kind of running their own thing and quite often they're able to do it quite well.

But generally what happens is at some point the overall integrated system becomes so complex that somebody, somewhere, has got to own not just the departmental solution but the company-wide enterprise solution.

Why the CIO Is Often the Right Starting Point in Any Enterprise Technology Sale

Russ: Well, this is interesting. I'm sure this relates a little bit to your advisory work, but one of the things I found in my whole career doing enterprise sales is no matter who you think you're selling to, you're also selling to the CIO.

Karl: Absolutely.

Russ: There's really no technology coming, unless you have something very small, very niche, there's really no technology you're going to sell that doesn't ultimately wind up on the CIO's desk one way or another.

Karl: Yeah. And I would also say in a lot of companies, in a lot of circumstances, the CIO is your starting point because those folks in the department don't spend their lives thinking about how to use technology to improve their business. CIOS do, and so often the CIO is coming to that line-of-business person and saying, "Hey, I heard about this great thing. It seems like something that might be interesting to you. What do you think?"

The CIO and HR Relationship in a Well-Functioning Company

Russ: Like I said, I have a bunch of AI questions but I'm curious on this CIO day-to-day life: How do you think about the relationship between the CIO and the head of HR? Because there's so much tech angst, especially with older employees, and that's accelerating a lot in the AI world. And fundamentally, HR becomes in many cases, not their only job but the repository of a lot of the angst and what to do with it. But the CIOs have a lot of policies to push forward, so before we even get into blocking and things like that, how do you think about that relationship in a well-functioning company. 

Karl: It's a really close relationship, if it's well-functioning and it's a great question because I think the two are actually very close, especially when you start to get into questions of governance and privacy and things like that. I always felt like I needed to partner really closely with the head of HR, and the lines are getting blurred. At the end of the day, IT is about making people effective and productive and so is HR. We share a mission and we've got to probably work together, even closer than we have in the past, especially now in the age of AI.

Why CIO and HR Functions May Eventually Merge as Agent Workforces Scale

Russ: Oh, look, I'm curious what you think, but I've assumed since we started our company, Larridin, that without having a judgment on where it reports or who becomes more in charge, anything like that. I've assumed CIO and head of HR will ultimately become merged into one department, or one job, over time, as you start thinking about agents doing some of the work, humans doing some of the work, humans in the US doing some of the work... you've already had some of this tension with outsourcing in the past, because HR's relationship with their American workforce is different than the outsource vendor call center operator we have in the Philippines or whatever. So, you already had a little bit of that because IT was so involved with outsourcing. But how do you think about how the future looks like between CIOs and heads of HR?

Russ/Karl: So I it's a great question; something I thought about a lot, actually, because I think there's a world in which those are those are groups are combined in some way. However, what I also think is it's always important to think about what are all the pieces that a group does. So there's a piece of HR for instance that's very legal; the people who run HR actually are quasi-lawyers. They know a lot about employment law, how do you not get in trouble and not get sued.

So, does someone with a background in IT have that? Probably not. So I think that there are pieces that overlap. And I can see a world where you say, well, actually the HR team is running a help desk to answer people's questions. So is IT? Why are we running two help desks? They're just different kinds of questions, right? Maybe you shunt them to experts in a particular one.

And if it's something that is sensitive, then that goes to someone who's specifically an HR person. I think there's a lot of opportunities for synergy there. Probably a lot of companies don't even think about it because they have silos in their head and they think, well, those are totally different. But I actually think if you're creative, and especially if you're starting a new company and you have the opportunity to have a blank sheet of paper, there's a lot of opportunities for just more efficiency and synergy around combining some of those things together.

Why Agents Need Their Own Directory Identity Separate From the Humans Who Authorize Them

Russ: It's hard to imagine a world where companies will have a agent workforce in some capacity that's just managed separately, purely from the CIO's perspective, and then this other hybrid workforce. So it'll be one of those interesting things to track, that I imagine if you're under 35 it's very different than if you're getting toward the end of your career, you know if you're over 55 and you've spent your whole career in HR or in IT that probably seems very unusual. It probably doesn't seem unusual at all today if you're kind of earlier in your career

Karl: Right. I will tell you one thing, not to rathole on this, but when agents started to first become a thing one of the first things I thought about was, how do you attribute work? Sure, you know that that was done by this agent, on whose authority? Maybe it was done as this person, but on your behalf the AI did it logged in as you. And I thought, wow, it's going to be really important that we know that, because when something goes wrong I need to be able to figure out why it happened. And so one of the first things I thought about was those agents are going to need to be in your human capital management (HCM) database.

Russ: It's only until a couple months ago this wasn't possible. Microsoft just a few months ago made agents a separate thing inside directory services. So if I authorize an agent now it's not as me. It's its own seller, and obviously that is where this will go.

Why This Is the Most Exciting Time in 20 Years to Be a CIO

Russ: So I'm curious and as a guy who spent my career selling into departments, it's oftentimes been the case from that that perspective you get into the org that the department leaders view IT, sometimes they view them as their partner and sometimes they view them as kind of a real pain, an impediment, you know, bureaucracy, something like that. I theorize that now must be the most exciting time in the last 20 years to be a CIO, because of AI, because all of these departments love you and want this partnership and innovation. When I talk to CIOs now, it's not a relationship where they're worried about, man, I'm going to have to step in and tell the CMO not to do this and not to do that. It really feels like it's kind of a great time of partnership. Is that right?

Karl: I think that's absolutely been true. I don't know if that will stay the same as AI matures.

How CIOs Think About AI Beyond Mass Experimentation

Karl: ...and the CFO starts going to the CIO and saying, "Hey, we're sure spending a lot of money on AI. Experimentation was fine for a while, but now it's time to rein this in, and I need you to now be the person who goes around and says, "Hey, we got 10 different tools that do similar things. Could we consolidate?"

But for now, we're kind of in the golden glow of the new technology where there's a lot of freedom. There's a lot of sense of, hey, you haven't necessarily had to show a lot of ROI because it's been, hey, let's just throw this out there. Let's try it. Let's see what happens. But as it matures, we'll go back to playing a little bit of that bad guy role. And we get it that nobody likes that. We slow them down. We say, "Well, we need a security review. We have governance. We have this." And I get it. If I'm in the department, "I'm saying if I can go around those guys, I will."

Some of that has to do with the particular CIO, and the particular culture of the company, in terms of how positive a collaboration that is versus a kind of us versus them feeling. I'm sure in sales you felt that all the time. You talked to some people who said, "Whatever you do, don't talk to IT." And other people who said, "Please, let's bring them in right away."

Russ: At my last startup, CIO's were always involved because we were selling to heads of comm and HR who would say, "Look, we don't really know how to buy technology at all. We got to bring in our partner or we won't be able to do it." But my company before were CMOs. They generally have the stance of we're good. Let's, you know, we're good.

Karl: You know, when I joined Gainsite, one of the things I really wanted was to understand how to work with CIOS because they were selling to the CCO. They were selling to a customer success department who had never previously bought any technology, right? And I explained to the sales folks and continued to explain over the years to people, the CIO can be your best friend or your worst enemy.

So don't assume that they're going to be your worst enemy. They can be your best friend. If the CIO understands what you do, appreciates your value in the tech stack. That's super-important because there will come a day when the CFO will say, "Hey, we've got a lot of stuff. We want to cut 10%. And you don't want to be the one that the CIO looks at the list and says, "Wow, that's really expensive and I've never heard of it. I don't even know what it does." You want the CIO to say, "Well, I'm pretty sure we don't want to touch that one, because I know the value that it's bringing."

Russ: Where do you think the best CIOS come from in terms of, you know, there's always debate, are the best CFOs former controllers? Are they former financial planning and analysis (FP&A) people? Are they mergers and acquisitions (M&A), fundraising people? Of all the skill sets, if you think about it, and I'm sure they can come from anywhere, but what's the background for the best CIOS that you know?

Karl: CIO is such an interesting, odd job because it really is an interesting mix; it's policy, it's procurement, it's a lot of things.

A lot of really good CIOs actually come from the business. I think in general they come from the application side because they understand business process and they understand how to speak the language of business; they understand how to talk to a VP or to a CEO or a board. Whereas someone who came up, let's say running the help desk may or may not have had the opportunities to learn some of those skills. Although it's not at all impossible, and so much of this has to do with just the individual person.

The Anatomy of a Successful AI Project and the Question Most Teams Skip

Karl: So much of, and this is true I think of any executive role. So much of it is the people skills, right, the communication skills. And to be honest, common sense; it's funny to say it that way. Because we think in terms of you have to have deep domain expertise and be an expert.

I think sometimes you can almost be too much of an expert and the ability to understand things at a sort of higher level, abstract them somewhat, understand systems thinking as opposed to going really deep into some technical domain. Those are the skills I think that actually help you be a CIO or frankly any executive.

Russ: Let's talk about AI for a little bit, and I have a bunch of questions around training I want to get back to I want to get back to later. I'm curious if you think they're on the right track or not. But how do you think of the promise of AI when you talk to your friends that are CIOS? Obviously three years ago, outside of some people paying Google for call center work, because AI has really been around for many years. But outside of Google, with the release of ChatGPT, it obviously took the enterprise by storm, as it did on the consumer side. You've seen extremely fast-growing companies; we've all seen it in coding, we've all seen it in call centers, but how do you think CIOs think about it today beyond mass experimentation?

Karl: I think it's an incredibly exciting new technology; it's a great new tool in our toolbox. I think CIOs probably take a little bit more of a jaded view of technology than other folks, just because we've been through this a lot. There's always a hype cycle.

I don't think there's any CIO who would say this is not incredibly important, but I also think we probably have a perspective about how it fits into our tech stack and how it impacts our business that's a little bit more measured and that understands that no, this one technology is not going to do everything for everyone all the time.

Russ: Well, it's also an interesting question of when you see the companies you work with when you see them advising the rest of their organization. So, as a CIO, I'm partly helping procure these tools, but I'm partly the leading edge of advising the companies. Do you think people at more mature companies are mostly thinking of these AI tools in terms of I'm going to grow revenue faster. I'm going to fire a bunch of people?

There's only three ways this can go, right? I'm going to grow revenue faster. I'm going to fire a bunch of people. Or the tools are so fun that I'm just going to have a lower gross margin permanently. I mean, that is not going to happen, but that is technically an option. Yeah. So, since it won't be that, how do you think CIOS are thinking about that, with CFOs, on that journey? Where do you think we are in that journey?

Why the Early Adopter Framing No Longer Applies to Enterprise AI

Karl: Yeah, I mean I think it's both, right? I mean, obviously there's a there's a sort of productivity/efficiency play here. Again, I think CIOs may be a little more questioning of that, than some of the hype that you see, just because we see in real life what happens with productivity tools. At the same time, the sort of generic productivity use case of something like a chatbot for your employee base is not that expensive.

So to be honest, if that's all LLM's were, then no problem, right? And how much exact ROI do we get or not? I don't know. But I'm not spending that much money and obviously I'm getting some efficiency gain, and then you can talk about how you drive adoption and greater value from that.

I think the much bigger question is when you get into agents and how are we going to actually start seriously not making someone's life a little better and more efficient but offloading whole chunks of work from people to agents. That's another whole world that's much more complicated, much more expensive. Frankly those kind of tools now you're getting into real money and much more impactful, and I think there we all see a lot of opportunities for that, but that's also the area where I think there's so much hype.

Russ: Obviously, this podcast won't come out today, but today, the day we're recording this podcast, OpenAI announced its positioning as their new product for your AI coworker and... That's going to be expensive and either what will happen is, by definition, the coworker won't be very valuable, in which case OpenAI won't charge much for it, but they are charging a lot for it, or it will obviously impact head count.

In that world, and this gets a little bit to reporting as well, obviously that's going to be some combination of the CIO, the CFO, HR and the department head, anytime you're talking about headcount and all those... Outside of reporting to the CEO. Let's leave that aside for a second. In your opinion, where do CIOs report that's the healthiest for an organization? Is it inside finance, inside, you know, the CTO, head of engineering?

Karl: This is a question that comes up a lot. How I feel about this is, it doesn't matter. What matters are your relationships. If you have a relationship with the CEO, you don't have to report to them to have a line of communication. I actually think that's more important. I have worked mostly for CFOs, but I have also reported to a CEO for a while.

It just depends on the person. Some of the CFOs that I've reported to have been absolutely fantastic, and I would say in general CFO is a good place for this because I think it's two things. One is they tend to be kind of down to earth, right? They're not up in the sky. There's not a lot of comments. Did it happen or not?

Russ: Exactly. Are we hiring more people or fewer people? Are we selling more or not?

Karl: Right. The other thing is, and this actually gets to a different question; sometimes people ask, which is what would you do if you weren't in IT? And I've thought about that and I've said I would be in finance. And the reason is I like knowing a little bit about everything. I'm a systems guy. I enjoy understanding big complex systems, as opposed to being, let's say, an engineering person who's really deep in a domain. And that's the other reason why I think CFOs are often a great place actually for IT to report because they're also systems thinkers. They also see the big picture of how all the departments in the companies tie together. And that's the thing when you talk about selling to a department, it's so different than it was when I got started in this game a long time ago. There's no silos. There's nothing anybody does in any department in the company that doesn't have upstream and downstream data, right? And so if all you're doing is thinking about that department, it's not going to work.

What Separates AI Projects That Scale From the Ones That Stall

Russ: What's your platonic ideal of how an AI project should be run, pick any project you'd like inside an org, what's the CIO doing? What are the department heads doing? How are we setting it up ahead of time? Obviously there's been a ton of experimentation, right? We can describe a lot of what happened the last year as the tools are amazing, and the CIOs have clearly purchased tools faster than at any other time in any career that I've seen. And by the way, many of those pilots failed, which was the plan; there's nothing wrong. When you say I'm going to run a lot of experiments, some will fail and that then becomes a headline but yes, that was the point. But what have you seen? What's the anatomy of a successful AI project?

Karl: To be honest, it may be a boring answer, but I think it's the same as any project. The first thing it starts with is what's the problem we're trying to solve. And I think AI has been a little dangerous in the sense that there's a sense of, well, we don't really know, but it's cool stuff, so let's throw it in there and see what happens. If you're talking about generic productivity tools, to some extent, that's okay. But when you start saying, we're going to go buy something to make the finance department more effective. What problem are you trying to solve? Do we have some way to measure whether it actually worked?

Because otherwise, you know, you're just spending a lot of money and you're hoping stuff will work out. What tends to happen with things like that is that a few years down the line you, you know, you're turning off stuff and it's like, well, uh, we can't really justify that because it's not actually doing anything. So, that's a big waste of time for everybody.

Russ: Look, this is why we love talking to CEOs at Larridin, right? What are we really selling to people at Larridin? It's, AI is amazing. A lot is happening in your org. Some you know about and some you don't. Let's just understand what is happening, right? My perspective has always been, we're not telling you to go on a diet. We're just telling you, you should have a scale.

Why Small-Group Peer Learning Drives More Adoption Than Top-Down Training

Russ: And then do whatever you'd like, but it's good to have a scale. It's good to get blood tests. See if those things are useful objectively, and then whatever decisions you make with that data, that's fine. And our perspective at Larridin has been, hey, CIO and org, let's just set ground truth for what's happening in the organization and constantly measure it so that we can share.

I want to talk a little bit about, I've had a theory, apart from the PR hype, that everybody's going to get fired and there'll be no jobs in the... let's ignore that, because I think we all know, as much as it's fun when various big leaders will talk... One of the things you'll hear a lot is today global IT spend is $1 trillion, but thanks to AI it'll be $10 trillion and that is just not true. IT budgets are not going to 10x. First of all, for IT budgets to 10x you'd have to fire every American. We're not going to have that in at least in our foreseeable future. But IT budgets are clearly going to grow. There's clearly angst in the org. One of the things I've thought about - I'll tell you my thesis. Tell me if you agree or disagree and then if you agree what should companies do about this?

So I actually think a lot of the angst is, generally inside an organization. By the time you're 40, you've gotten to some level of success if you're still in that organization. By the time you're 50, you've gotten to probably the level of success you will reach in your career, whatever that is inside that organization. And they probably like you a good amount, assuming, you know, bigger companies, less turnover. I don't mean the job you just took.

And one of the things you find with people in their 40s and 50s is on average, not the best performers, but on average, they really haven't had to throw themselves into much new recently. It's a lot about their expertise and training younger people with their expertise. They've become very efficient in their way of doing things. And the truth is, if you froze time in 2022 and asked the average 45-to-55-year-old, pretty successful person, VP, not CEO, not the top 1% performer. If you ask them the last piece of new technology they really had to learn to use, it was really Zoom. And Zoom's just not so hard to use.

I mean, okay, we went remote. We have, but like Zoom and Slack are just not particularly hard to use. I am now staring at a blank chatbot.

"Do better in your job." It is not clear what to do for some people. And I don't like it when people talk about high agency, low agency. There's a lot of people who they're 45. They've been very successful in a lot of ways. They've done a lot for their org. They just haven't had to learn a lot about new technology in the last 10 years.

So A, does that sound right? And then, B, more importantly how do you think CIOS and heads of HR... my theory for Larridin has been CIOS and heads of HR are going to have to get much closer because, regardless of where they report, that is actually a giant problem of, we are trying to retrain the entire global knowledge worker workforce all at once. We're not exactly sure how to retrain them but we know they need to use these tools to be more efficient.

Karl: Absolutely. And we spent a lot of time in the last few years at Gainsite trying to help people just use a chatbot more effectively. It's interesting, when you're in IT and you roll these things out, you can see who's actually using it and who's not. And typically, what you see is a handful of people use it a lot and a whole lot of people don't use it at all.

Russ: Sure.

Karl: And so we did lots of Zoom meetings and things to try and walk people through it, give them examples, make them feel more comfortable with it. We found, by the way, the most effective thing to do is when you get groups, smaller groups together within a team. And those folks are kind of brainstorming together and talking to each other about, well, I used it to do this and it worked really well. And it's great because those are relevant use cases for people in that group. And they're sort of inspiring each other as opposed to me trying to give a speech on Zoom telling you how to use chatbots. But absolutely, it's something that's sort of a core skill. It reminds me a little of when things like Google came along. There was a little bit of an art to how to ask Google for something to get the answer you wanted.

And we all had to learn that. And it just took us a little while. And then some of us got better at it than others. But it's a similar kind of skill. How do I interact with this thing to get what I want? It's something that smart companies put that energy into. At Gainsite we had a CEO who very quickly got it and he said I want people to be learning this.

He said I think it will be important for Gainsight, but also, I think it's important for them. Like, this is a massive new life skill that everyone needs and I want to make sure to help get people that. Companies that don't do that are I think really missing the boat. They're missing a lot of opportunity for their teams because most companies have something. If you're a Google shop, now, everybody's got Google, they got AI mode right? A lot of people have rolled out you know Copilot or ChatGPT or something, but I think if you really looked at the numbers you'd find there's still an awful lot of people who are not really using it very much.

Russ: Correct.

Karl: Then that's just leaving value on the table.

Russ: So the other thing that we haven't really touched on yet, that I'd love your thoughts is how much should people think about data and security in the world of all of these AI tools and LLMs? For instance, you'll see a lot of people loving the idea of these very cheap on-premises Chinese open source models. You'll have another end of the spectrum saying no no no, I know it's open source, and... China. So that's one question.

Then there's just the generic, "Do I really want OpenAI to know all that information. I've signed this non-data retention with Claude. I'm not accusing any of these companies of doing anything wrong." Like, how do you think people are overly concerned or, well, underly is not a word, but underly concerned?

Karl: Yeah. My particular take on this to be honest is that I think people are a little overly concerned, for this reason: I have lots of SaaS vendors. They have access to a lot of my data. I either believe what they say in their contract with me or I don't. I either trust them or I don't.

But honestly, at the end of the day, if I've got a contract that says you're not going to train on my data and you're not going to keep my data, what am I going to do, right? I can't live my life in a way that I'm like, well, I've got 200 vendors. I've got all these contracts in place, but I'm going to stay up at night worrying about are they going to... really, at some point, life goes on.

Russ: Well, truly, any one of your employees could theoretically be a spy for a foreign government, but they're probably not, and it's not how you live your life, right?

Karl: Now, having said that, there's a big difference between going to a chatbot, asking an ephemeral question, maybe uploading some data that's going to live for a moment and go away. There's no reason for them to keep that data. It's not, you know, I mean, not only do they say they won't, but why would they? Why do they care about that spreadsheet that you uploaded?

There's a big difference between that and saying, I have a corpus of corporate data. I have my entire Salesforce database and all of the documents in my library and I want to operate against all of that. I think that gets a little bit scarier, and for some companies they may say I want to run this in-house. But even that, I think as long as you have done a security review and you have a contract and you have some reason to believe, "Hey, these folks actually know what they're doing."

You know, one of the things that came up when SaaS first happened is people will say, well, how can I trust the SaaS companies to run their data center in a way to keep my stuff? And my feeling was always, why do you think you're better at it than they are? That's all they do, right? That's literally all they do. And by the way, if they mess it up, their whole company is gone, right? I think they're actually more motivated than you are to pay attention to security. So, I trust them a lot actually, which is not to say they're perfect and that nothing ever happens, but I don't think it's that much different than any other SaaS solution. And to be honest, I think it's a little overblown. Yes, we need security reviews. Yes, we need governance, but within the context of that... I am nervous about, you know, someone downloads a free tool, so I don't even know about it, they're using it. They're giving them data. I don't have any paper with them.

Which Job Functions Will See the Clearest AI Impact First

Russ: We see with our tools on average with our customers two-thirds of the AI tools being used in the org the CIOS don't know about. I want to end with one prediction from you, I'm curious, I think we'd probably agree that AI has clearly had a measurable impact on coding, true measurable impact on coding. It's clearly had a measurable impact in call centers. So, two years from today, your prediction for top three departments impacted by AI.

Karl: I think it comes down to language, because it's right in the name. It's an LLM. It's good at words. It's good at language. So, I think the departments that will get the most value from LLMs will be people like legal who work with words. I think people like marketing will also get a lot of value out of this. I think the tech pubs department. So, I think about it more in terms of use cases and what is this tool really good at, right? I've got a new tool in my toolbox. Where I think it's going to add the most value is where that tool is the most appropriate.

Russ: Excellent. Thank you so much for taking the time. I really appreciate it.

Karl: Thanks.