Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, Virtual Chief Information Security Officer at Cyber Risk Opportunities, and Jake Bernstein, partner at the law firm of K and L Gates. Visit them at cr-map.com and klgates.com.

Kip Boyle: This is the Cyber Risk Management Podcast, episode 192. How I use AI, and you can too. 5, 4, 3. Welcome to episode 192 of the Cyber Risk Management Podcast. I'm Kip Boyle, and today it's just me talking to you about something I've been diving deep into for almost three years now, which is generative artificial intelligence, and I wanna share how I'm using it, how it's affecting my team, and what I think it means for all of us in cybersecurity.

I've been getting asked a lot about AI for a while now. People wanna know if it's, you know, is this just hype? Is there real value here? What does it mean? How do I secure it? I don't really wanna talk about the security of AI today, per se, but, But if you wanna go deeper into AI security, that's not a problem.

You know, we've got several previous episodes that you can check out. I'll put them in the show notes for you. No doubt we'll be talking about it again in the future. But after using generative AI daily for almost three years, I can tell you there's real value here. But it's a lot like really any tool that you'd pick up, right?

You gotta learn how to use it properly, otherwise you could actually hurt yourself. Yeah. So let's, let me start by explaining how I approach AI. So. If you remember the episode that we did with Daniel Miessler, we talked about an augmented approach, and, and that's the one that I'm taking, which is to say, I'm not trying to replace myself with a robot.

I don't wanna stop making podcast episodes. I don't want to stop making, videos. I know some people wanna do that. I'm just trying to make myself better at my job. I still want to be the one that shows up. I still want to be a real human being for other human beings to experience. So I have found that I primarily use AI for work.

Related tasks and, and especially anything that's language intensive is gonna be a good choice. So that would be things like writing research, data analysis, editing, anything that's written, you name it. So if it involves processing or creating text, I'm probably already using AI to help. And I don't just mean like machine learning based AI, right?

Like, Google Maps the way that it, you know, guides us around, products like Grammarly, which, you know, does predictive text and, you know, real-time text analysis, like that stuff's been going on for a long time. Right? I'm talking about generative AI and. You know, one thing that that I think is important for you to know upfront is when I'm using it, I don't use it as if it's a chat buddy and I know that it's called ChatGPT, and so people are like, you know, well, yeah, I just, I just chat to it, you know, just like I'm texting with somebody and I think that's fine for, you know, personal use, informal use, but at work I get the best results when I frame a task for.

ChatGPT like I would if I was delegating the task to a human. Now I have years of experience getting work done through other people. You may not. So this approach that I'm talking about may not make a lot of sense to to you the way you think about it, but I have found that if I take what I've learned about setting people up for success with assigned tasks, and I use that in a thoughtful way.

To delegate tasks, to AI, that, I get the best results with that approach. Okay. Now I want to, talk about the technical details now, because I know a lot of you are really curious about kind of the nuts and the bolts of how, of, you know, how, how people are using this. So, for public AI services, so I'm talking about OpenAI, Anthropic, Grok, those kinds of things, right?

I am accessing those services through APIs, and I do that using a Mac OS app called Bolt AI. And, and I'll put a link to that, in the show notes if you'd like to, if you'd like to check that out. Now, why do I use API access? You know, I think API access is mostly used by people who are. Coding, right?

They're writing software. I'm not doing that. But the reason I'm going through the API is because I learned that, first of all, it's very inexpensive. You're paying per use. So if you're not using Claude Sonnet 4, one for a month, you don't pay anything. But if you, if you do use it, then you're, you're paying based on a usage rate, and it's really inexpensive now.

I say that as an individual who's using it, if you're using it at some kind of scale, well then cost per token really matters. But so it's, but it's not just about. Cost control. It's also about control over the prompting. See, when you're using the web interfaces, there's a built in prompt that is filtering everything that you do.

But when you use the API, that's not the case. You're actually getting raw access to the model. And so, so it really cuts down on the chance that you're gonna get a bad result. Now, recently I did get a ChatGPT Pro account, so I am accessing it through the web interface. Sometimes now I'm paying like $200 a month for that, which is, which is a steep price, but I did it because I wanted access to GPT-5.

Pro, which I couldn't get through the API, maybe you can get it through the API now I'm not sure. But when it first came out, I wanted to access it because it has PhD quality research available. Right. That's how they market it. Is it really PhD quality research? Sometimes it is. It's incredibly good. At complex reasoning tasks, at figuring things out.

You know, instead of me taking four hours to figure something out, I can have GPT-5 PRO go and do it. And that's, that does save me a lot of time. So, and it's, it's almost to the point where I feel like I have another team member or kind of like a PhD on demand. Right. So that's good. Now I'm a business owner, so economically that makes sense for me.

But if you're listening to this and you're not a business owner, I could see why you would say, man, that's this, that's this crazy talk Kip, I can't believe you're throwing so much money at this. Okay, fine. You don't have to do that. You do not have to spend $200 a month to get good value from AI. You can easily get by with the $20 monthly subscription.

Or in fact, I would just say start with a free account and. If you have Microsoft Copilot on the job, use that and work your way up to more robust models, possibly paying for some access, but based on your use cases. Alright, because that's what I found is there's a really. A productive way to think about AI is what are my use cases?

And, and, and then let my use cases drive which models I use and, and the frequency of my use case is also gonna determine how, you know, which subscriptions that I, that you know, that I, that I purchase. And, and which algorithms. Now a key distinction in the way that I. Use generative AI is between the public models, which I've been talking about, and local AI models.

So for public models like ChatGPT, I use that with work that is of low sensitivity with respect to the data, right? So I'm using, like ChatGPT or Claude Sonnet to help me with marketing. Pieces, right? So whether that's email or if I'm building a landing page or something like that, a one pager, you know, to leave with a customer or a prospective customer.

The podcasts that I put out, right? I'm using public models to help me make sure that, the scripts are as good as they can possibly be. And also general research, right? So like, if there's a, a new, cybersecurity issue that's come along and I really deeply wanna understand it, then I can turn.

GPT-5 Pro and it can go and do all the research and then, then I can read it, right. I didn't have to spend time crawling the internet looking for this information myself. now. If I need to do something that involves sensitive customer data, I'm not taking that to the public models. I'm running that locally on my own hardware.

So, my company is a third party right to all of our customers and we know from. The data that third parties are the ones that usually drop the ball and cause the data breaches. And I'm like, no way am I gonna be that third party. So my local setup has evolved over time to handle the use case of here's this sensitive data and I don't want it to live in a public model.

You know, I know you can get. Public model accounts where they say, well, we won't use your data to train our models. And let's say That's right. Well, there's a, there's a court case going on right now. The New York Times is suing, I think ChatGPT, OpenAI and a court ruled that OpenAI has to keep copies of all the queries that come in through the web interface.

it's an evidence preservation, right? Well, that means anything I put in there is potentially piling up and could be revealed in a court now. That's not training their models, but I still don't feel comfortable with putting sensitive data into these public models. So, so right now locally I'm using Ollama, which is a, a little piece of code that you can download and put on your computer.

And then with Ollama you can run different models. So I'm using  GPT-OSS-120B. And I'll, I'm not gonna unpack all the, you know, terminology there, but I will put a link into the show notes so you can go check it out for yourself. Now, before that I was running DeepSeek-R1 with a 70 billion parameter model with a, with a quantization level of four.

Again, I'm not going to unpack all those details, but you know that that's something you can look up and, and learn pretty easily, I think, or you can just send me a note and I'll be happy to explain it to you, outside the podcast. But, the point is that the models that we can run locally keep getting better.

So I keep upgrading now. What hardware am I using? Well, I've got a Max Studio M three Ultra and I've got 512 gigabytes of unified memory. And this is an expensive piece of equipment, no doubt about it, but it's, it's cheaper for what I have here for the tokens per second that I can generate. It's much cheaper than a comparable, Intel based, you know, machine.

That is, you know, has discrete GPUs running in it. So it's, it's less money to purchase and it's less money to operate. And my, my, my home office does not get incredibly hot from having, GPUs going, like crazy. So anyway, for my business, given what we do, having the ability to process sensitive data locally is really.

Really important and it's worth spending some money. Now, again, I'm a business owner. I'm using business money to, to buy this stuff. If you are an individual who, you know, doesn't have a budget, a, a business budget, I get it. Like, you know that doesn't make sense. Possibly, but. If you are gonna use local models, here's a tip that I have for you.

I actually use GPT-4o to help me write the prompts that I use with my local models. You see, every model has a different prompting style, and you can go get the prompting handbooks, like OpenAI publishes them. The way you prompt GPT-4o is different than the way you prompt GPT-5. The way you prompt Claude Sonnet 4.1 is different than the way you prompt Grok or DeepSeek-R1, and I just, you know what?

I don't study those guys. I just go to GPT-4o and I say, look, this is what I, this is what I'm running. This is what I want to do. Help me build a really great. Prompt and it does, and, and it's really cool, right? It's kind of a meta sort of thing where I'm using AI to help me use AI, but it's, it's, it's really great because I can even take the performance of a local run where I'm not, I.

Compromising the sensitive data, I can just take the performance and I can, feed that back into GPT-4o. And I can say, this is, you know, this was the tokens per second and so forth that I got. you know, could my prompt be more efficient? And if it can, it'll come back and tell me how, and it'll actually rewrite it for me.

So. so that's my recommendation there. Now, two of my biggest wins with local models. I've got a couple of specific use cases that I wanna tell you about. So the first use case is think about like a SOC two report that you would get. you know, if you're evaluating a third party, and these, these reports are often written, you know, in, in, complex language, you know, there's, you probably, you're probably reading it at a college or maybe a graduate level of sentence construction and word choice, and some of these things can just go on and on and on for like 200 pages.

Well. What I found is I can upload a PDF of a report like that into my local model, and I can ask it, you know, Hey, tell me about this provider, right? I can ask very specific questions or I can have it generate a summary. And so instead of spending hours reading through a 200 page report, I can just ask targeted questions and get targeted answers in a fraction of the time.

So that's a huge win. Now there's another area that I've used, It's just, just obvious win. I wanna tell you about, have you ever had, have you ever had the situation where you're, there's a, like a long email threat, it's been going on for a long time. Multiple people weighing in and you get added late, right?

Somebody just goes, let's loop in Kip and see what he thinks. Right? So, you've got dozens of people chiming in. You are coming in late, you have no idea what's going on. Somehow you gotta figure out what is this conversation that I've just walked in on? Well, I convert that email thread into a PDF. Load it into my local model and I ask it, summarize the key issues like, and where does everybody stand on the key issues?

Right? It's total game changer. So much easier for me to get my head into that, email thread by using that approach now. Again, just to recap any task that's language intensive, I think you're gonna find that an AI is gonna be helpful. And if it's sensitive information, you're gonna wanna do it, offline, or at the very least, you're gonna want to, know what your company's acceptable use policy is and follow it.

And if your company doesn't have an acceptable use policy, talk to your supervisor. Or just be super, super cautious. Alright, now I'm getting a lot of benefits. My writing is clearer. The research that I'm relying on is more thorough and in complex documents and email threads, I can, get more of the nuances and less time.

Now you might say, well, geez, you know, Kip, that sounds like you're being really productive. Eh, not really. Well, not yet anyway. The reason why is because I am saving time. But that time is. Ends up getting reinvested, learning more about AI to keep pace with the rapid change. And you know, the drinking from the fire hose metaphor is absolutely going on here, right?

So. not only am I trying to learn how to prompt the models that I'm using, you know, trying to do that better, I actually just went to a four week course on ag agentic workflows, and it was very hands-on course. It wasn't full-time, it was online. It was partially prerecorded lessons partially. Live lessons.

It was really good. And I got exposed to the Cassidy AI platform. I'll put a link of, to that in the show notes if you wanna check it out. Now, what is an agentic workflow? What I learned was this is where you have multiple agents and they're working together on a complex multi-step task, right? So think of it as like a bunch of, real world experts that come together, right?

So your database expert. your, storage expert, you know, somebody who knows about web apps and, and they, they get together because, you know, your web app is having some kind of performance problem, right? So where is that performance problem, right? So you get a bunch of experts together and they work on it.

And that's what age Agentic workflows are kind of like, I find that the workflows. To the extent that they're repeatable, they're, they're a lot more helpful at this, at this time. They don't really seem to handle a lot of variability very well right now. That seems to be the status quo. But anyway, this course was incredibly insightful and it helped me understand what's possible today.

It's very different than what was possible 12 months ago, and it also helps me understand the current limitations. And I gotta tell you, things are changing fast and. That's where I'm putting some of the time that I'm saving from some of these tasks is into, learning about stuff so that I can, you know, kind of anticipate when these technologies are gonna be useful.

Now, let me tell you how AI is affecting my team. So I'm the owner and operator of a company called Cyber Risk Opportunities. We're a boutique cybersecurity advisory firm. Another way to think of us as a virtual CISO. So I've got. Six full-time people, on my team and, you know, different companies that would love to have access to a CISO but cannot afford to put them on their team on a full-time basis, can hire us as needed and then, you know, we can help them.

On pretty much whatever a a, a, strategically minded CISO could, could help them with. Right now, based on what I've learned, I want my team using AI agents using workflows. I think those can boost productivity and also increase the quality of our work. We are taking a measured approach, though I don't wanna, just, you know, yell AI for everybody and just kind of, you know, jump into it like some other,very high profile CEO's have done.

But let me explain kind of how we've done it so far and what we think we're gonna do next. So our first step was to get everybody,augmented with generative AI, right? To be clear about what our acceptable use policy is, that we're not trying to replace people, we're trying to augment people. And then a little bit of training.

We've since set up a GPT team. account for everybody. And I've even created some custom GPTs to guide my team members through specific repeatable tasks that they have to perform that are a little laborious, a little error prone. And I've even built a custom GPT that coaches my team members through a complex analysis process that in the past I would've had to have, like, worked with them in real time, to, to do this work.

Or maybe create a training video that they could watch and rewatch. But now I've got this custom GPT that handles the routine guidance and I only need to jump in when there's some kind of an exception. So for my team members, it's kind of like having virtual Kip, right? Available 24-7 to help with a very specific piece of work that needs to get done.

And virtual Kip's kind of cool because he's tireless, he never gets cranky, and You know, he'll, he'll just go over the same thing a hundred times if that's what you need. So the next step is for us to actually create an agentic workflow for a more complicated but highly repeatable data analysis. And what it looks like we're gonna have to do again based on the state of the art, is we need to do some number crunching.

So we'll probably do a Python, A little piece of, of software in order to crunch the numbers, because that's very deterministic and we can, we can count on it to not hallucinate. But then for trend spotting, we'll use an AI agent and we'll teach it what kind of trends that it should look for. And then, and, you know, and then we'll get all these results back.

Now we're always gonna verify the results that we get back from AI. with customer work, because we, we don't want errors, we don't want omissions, we don't want hallucinations. So, you know, so we're, we're gonna, we're gonna keep having a human in the loop, and I'll talk about that more in a moment. But I think that these ag agentic workflows have the potential for not just speeding us up, but also protecting us from, errors and, and increasing quality.

I mean, an AI could see some things that either we don't see or that. You know, maybe we're just feeling tired on a particular day and, and we miss it so. Now I would be lying if I said everything's great and there's no long-term issues. Right. Happy path. Hey everybody, you know, let's just act like we are, you know, CEOs that just think everything's gonna go well and nothing bad's ever gonna happen.

Right. Well, that'd be silly, wouldn't it? I mean, it'd be really hypocritical actually. So, So I, here's what I'm seeing that I think is kind of a downer. I do believe AI is going to replace people in white collar work. I think it's already happening to some extent with entry level white collar workers.

and I think. It just as a phenomenon, it's, it's reminds me of factory robots replacing blue collar workers on assembly lines. You know, decades ago when that first started. Now, as somebody who's running a boutique cybersecurity advisory company, it it, it makes me wonder, right, are we going to get replaced by AI in the next few years?

Is there going to be any need for a company like ours? I think some of the work we do is gonna get replaced by AI. However, I do think that we can offer something that AI's not gonna be able to do for quite some time. We'll see. Right. It's hard to predict, but, but I really think that the better we can stay ahead of the AI adoption curve, I think the longer that, you know, we're gonna remain viable and we can continue to be successful.

Now, in case you're interested, here's exactly what I think we need to do. I think we need to use AI to deliver. better results more efficiently when we can. But I think we have to like get into this niche, which I think we're partially in already, where we have a role as an indispensable human expert who validates contextualizes and implements the things that we learn by using AI, right?

These insights that we can get. so I'm betting that by being the human in the loop. Right, the strategic partners who help turn data into decisions and to make sure that the solutions actually work, you know, that we can operationalize this stuff, then I think we have a chance to continue to thrive even as AI is reshaping our field.

you know, we've got a thing we do for customers called the Culture CR-MAP, and what we're doing there is we're trying to figure out. what are the top cyber risks? But at the same time, we're trying to shift culture so that the organization as a whole practices more reasonable cybersecurity. And guess what?

That's a really messy human affair. Organizational change management. Right? But this is an area that I don't think AI's gonna be able to get into anytime soon. To the extent that we'll continue to have groups of people trying to do work, then I think, we're still gonna have to have organizational change management.

We're gonna have to understand organizational culture and human behavior. And I think those were, we're still going to need human expertise now. despite the fact that I, that I'm telling you there's a niche for us. I still think AI can help us with research, with analysis. With documentation. I mean, I think it really comes down to we can either learn to work with AI or we can, you know, not pay attention to it and risk getting left behind.

You know, I've seen a lot of transformative technology show up and I have yet to see a case, at least in my lifetime, where not getting on board with the transformative technology was the right way to go. I'd rather be in the first group. I'd rather figure out what's happening so that I can. Absorb the stuff that makes sense and stay away from the stuff that doesn't make so much sense, right?

So I think you can tell I'm excited about generative AI. but I also wanna acknowledge that there's some real problems, right? We've got copyright violations because of the way these models are trained. We've got job displacement, we've got misinformation, in social media and in news. These are all serious issues.

I don't think we can ignore them. But I do think it's risky to not figure out how to use this technology so that you can, engage with it thoughtfully and responsibly. I mean, there's even environmental issues and there's a lot. That we have to figure out. I don't have answers for all that stuff. I think we're just gonna have to continue to watch and learn and then make the most responsible choices that we can.

Now, if you're, if you're still listening and you're like, man, I want to go deeper. And KIPP's mentioned so many things, but there's so many things he hasn't really talked about, you know? And, and that's right. So if you wanna go deeper. I was trying to figure out a way we could do that. You know, the best way was if you and I could meet one-on-one, but that doesn't scale and I can't do that.

I, can't, I can't possibly meet one-on-one with everybody. So I was inspired by this course that I took, and so I'm gonna borrow from that. So, on September 15th, which is less than a week away from the time that this episode is being released, I'm gonna host an online. Cohort-based training. It's gonna start on September 15th.

It's gonna run for about four weeks, and it's gonna be a combination of self-paced learning with prerecorded videos and hands-on exercises. We're also gonna have some live sessions, so, I've designed the course so that you only need to spend between three or four hours a week. Doing the exercises and one or two hours joining with live sessions.

Now, if being in a live session is a deal breaker, that's not a problem because we're gonna record them and you can watch them later if that's what you need to do. Now, the course covers everything that I've learned over the past three years, how to choose the right tools, how to build effective prompts, how to set handle that sensitive data, how to stay ahead of the curve, and how to implement AI.

In your organization? Did I mention that? I just released a LinkedIn learning course about that. You might wanna go check that out. I'll put that in the show notes as well. Now here's the deal. If you sign up before we start the class, you'll get 50% off the price. I've put the URL and the coupon code in the show notes.

If you wanna check it out. There's a money back guarantee, you know, so, kind of low risk for you. But anyway, whether you sign up for the course or not. Doesn't matter for this episode. Right. I hope you've learned something, maybe, hopefully more than one thing. And let's talk about what are the takeaways?

Okay. I think the big takeaways are, first of all, we know AI isn't magic, but it is very powerful. You have to use it. Right? And I think hopefully you understand that there are ways of using it, right? But you have to figure out what those ways are. what I did as I started small, I experimented and I built over my skills over time.

I think that's a good, still a good choice. Now, the second big takeaway is this idea of public models and local models and when to use one versus when to use the other. You can get a lot of value from either one. I just think you have to be thoughtful about. Which data, you know, you, you put into public models.

The third big takeaway is this stuff's moving fast. No doubt. What I'm telling you right now is gonna be outdated in six months. This episode, the course that I'm going to do, probably by the spring of 26th, everything's gonna change. So you gotta start learning right away so you can keep up. And I think the last big takeaway is.

I don't think AI is gonna replace good hu human judgment right away. I think it's gonna amplify it. I know there's some use cases where right now where that's not true, but I think those are exceptions. So I think the people who learn how to use AI are gonna retain and advantage over the people who don't.

I think we're living through one of the most significant. Technological shifts in our lifetimes. it's like the introduction of the internet or of the smartphone, right? And I think just like those technologies, early adopters did have an advantage. So here's my challenge to you. I don't think you should wait.

If you're waiting, don't start experimenting, start learning. I think that this future of AI is, is going to come whether we're ready or not. I'd rather that you be ready, right? So. All right. That wraps up this episode of the Cyber Risk Management Podcast. Today I shared how I'm using generative AI, how it's affecting my team, and what I think it means for all of us in cybersecurity.

So go start learning. We'll see you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cybersecurity hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.