Speaker 1: Welcome to the Cyber Risk Management Podcast. Our mission is to help executives thrive as cyber risk managers. Your hosts are Kip Boyle, virtual chief information security officer at Cyber Risk Opportunities, and Jake Bernstein, partner at the law firm of K&L Gates. Visit them at cr-map.com and klgates.com.

Jake Bernstein: So Kip, what are we going to talk about today in episode 219 of the Cyber Risk Management Podcast?

Kip Boyle: My new book. I can't believe it is time to talk about my new book. I've been writing on this thing all year. And I really like the title. It's called Gears Don't Guess. And the subtitle really explains it. It's The Executive's Practical Guide to Thriving in the Face of AI Hype and Risk, and there's plenty of both out there right now. It's going to get published-

Jake Bernstein: Including human apocalypse. That's definitely out there.

Kip Boyle: That just showed up last couple of days, right-

Jake Bernstein: Yeah.

Kip Boyle: ... as we're recording this.

Jake Bernstein: Well, I mean, it's been continuous, but it pops up every so often in the socials, and-

Kip Boyle: Yeah.

Jake Bernstein: ... it has done so again recently.

Kip Boyle: Yeah. Like so many gophers sticking their head out of the hole.

Jake Bernstein: Yeah.

Kip Boyle: And yeah. Well, that's another podcast episode, I think, for a different time.

Jake Bernstein: Could be.

Kip Boyle: But let's talk about my book because I wrote it to help navigate hype and risk for the people who typically listen to this podcast. So if I calculated correctly, you all will be listening to this podcast on September 22nd, if you listen to it the day that it drops. So my book is going to get published on Monday, September 28th. And I'll have a paperback version and a Kindle version right off the bat. They'll both be on Amazon. I'm going to put the link in the show notes. And the Kindle version is going to be free during the week of the 28th, and I'll explain why I'm doing that later on.
But I thought, since... So Jake, you've interviewed me about my previous book. You've read a lot of my writing over the years, sometimes because I wrote something that we had to give to a shared client. Anyway. So I thought you could ask me questions about my book that listeners might ask. And yeah, what do you think?

Jake Bernstein: Well, I mean, obviously I'm happy to do it. And I don't think I even have to warn you because I'm sure I'll ask lawyer questions along the way.

Kip Boyle: Of course, you will. That's why I invited you.

Jake Bernstein: Yeah, yeah. Exactly. Okay. Well, let's start with the obvious question, Kip. There are a lot of AI books out there right now. Why did you write another one?

Kip Boyle: I know. Who needs another AI book, right?

Jake Bernstein: Yeah.

Kip Boyle: I'll tell you why. It's for the same reason that I wrote my first book. It's because I went looking for something that I could recommend to the people that I work with every day. So these are senior decision makers, they're executives, typically at mid-market companies. And they're not building AI, they're buying AI. They're getting it either as something that's been built into a vertical application, or they're just using the chat versions of these things or whatever. But the point is, is that I couldn't find a book out there that was written for them. Right? So the chief financial officer, general counsel.

Jake Bernstein: Which is weird because they're by far the biggest audience.

Kip Boyle: I would think so. But I don't know. It's hard to generalize. But I've seen this over and over again. I don't know that publishers consider the audience I'm writing for to be a mass market, to be worth actually spinning up the presses for. But that's okay. I mean, I couldn't find one. So I though, "All right. Well, I guess I need to write another book." And I was even thinking about the corporate risk manager when I wrote it, and of course the CISO. I've spent my whole career really focusing on one particular problem space, which is, how do you buy technology rather than build it? And then how do you govern the risk that it carries into your organization? And CRO, my company, we're in our 12th year, which is awesome and unexpected.

Jake Bernstein: It does seem impossible, but it's not.

Kip Boyle: I know. And-

Jake Bernstein: I mean, it also seems impossible that we're rapidly coming up on 10 years of working together. And I mean, I think our 10th anniversary of this podcast isn't that far off.

Kip Boyle: It's not. In fact, I was looking at the archive today, and one of the first scripts I ever wrote, which we never used, but it's like, how do we figure this out, was at the end of 2017. Yeah, 2017.

Jake Bernstein: Oh, we're coming right up.

Kip Boyle: We're coming right up on it. So we're like nine years. We're coming on the ninth anniversary. Well, but to get back to the question, I've been working with this audience now for in our 12th year, and they're all asking the same questions and they're all trying to figure out what the answers are. And so yeah, I wrote my book for them.

Jake Bernstein: And what is the same thing that you're seeing in every one of them? What are the similar questions?

Kip Boyle: Yeah. I think there's two positions that I've been noticing that senior decision makers have been taking when they first encountered this whole generative AI thing that was slithering into their organizations. They either just said no to everything or they said yes to everything. Right? It was just binary.

Jake Bernstein: Binary, yeah.

Kip Boyle: And I have a problem with both of those positions. Right? You say no to everything and your competitors start messing with it. Maybe they pull ahead of you. And of course, just because you said no doesn't mean people are not going to use it. They'll just use it and not let you see that they're using it. So that's some of the problems of just saying no to everything. And of course, saying yes to everything, it feels enlightened. Right? It feels like, "Hey, we're trusting everybody-"

Jake Bernstein: Yup.

Kip Boyle: "... to do this." But guess what? Most people-

Jake Bernstein: Neither works. Neither works.

Kip Boyle: If I just tell somebody in my team, "Yeah, go figure this Grok Bot out," they're not going to do it.

Jake Bernstein: No.

Kip Boyle: Because they're afraid of making mistakes.

Jake Bernstein: Yeah.

Kip Boyle: They're afraid of how do I get my work done and still mess around with this new thing that I don't understand.

Jake Bernstein: Yeah.

Kip Boyle: So those two postures, they're not practical. Neither one of them are. So then it just becomes like, well then what do you do?

Jake Bernstein: What do you do? And look, I saw the ban version a lot early on in the AI era, all of what, three, four years ago. Typically, a general counsel or a CEO or a CFO sees one bad headline, the whole company gets a memo, IT shuts off access to everything with a .ai, top level domain, and then everything else that even sounds like AI, and they default to it. I did have some who were like, "Wild West, go for it." But that also quickly became a bad idea. I don't see the ban as much anymore because it's effectively impossible to do it.

Kip Boyle: Right.

Jake Bernstein: So yeah, why do you think smart leaders default to these binary yes, no mechanisms, particularly early on in an era?

Kip Boyle: Because it doesn't look like anything they've ever dealt with before, and that is a very freaky experience. And so there's no shades of gray that they can discern. Right? It's either the end of the world or it's the beginning of massive competitive advantage and you've got to move on it now. And when I pressed people that I spoke with about this and I said, "Well, what exactly is it about this AI that you either find as troubling or that you see as some kind of a wonder tool?" And they really couldn't say. Right? They didn't have the words for it. And so just like with Fire Doesn't Innovate, I saw a very, very similar deer in the headlights kind of a look in their eyes.
When it came to cyber risk, they were frustrated in part because everything kept changing all the time and they weren't used to risks mutating and changing all the time. So I started my previous book out with the idea of, "Okay, this isn't as weird as it seems. Let me break it down for you." And so that's what's going on here, I think, is that they've just never seen anything like this before. And so they think, "Well, I don't know how to manage this." And the truth is, and this is what I put in my new book is, well, the reason why this looks weird is because everything that you've governed, everything that you've risk managed to this point has been a gear. And I'm using gear as a metaphor for any system where if you give it the same input, you get the same output every time. Right? So I mean, it could be inaudible.

Jake Bernstein: Deterministic computing.

Kip Boyle: That's right. It could be a pocket calculator where I press these same buttons in the same sequence, I'll get the same answer every single time. So the whole budgeting process works like that.

Jake Bernstein: Firewalls.

Kip Boyle: Firewalls. Right, exactly. Once you put gears into motion, you can just trust them and you're like, "I'll just check on them every now and then." And you can have a certain peace of mind that once these gears are set up correctly, they're going to do what they're supposed to do, failing some catastrophe. But AI doesn't work that way because it's not deterministic. I love that term. AI is a probabilistic thing. In other words, it uses statistics to guess at what it should say back to you. And that's weird and it sometimes seems like magic, but that's the breakdown for why this is different.

Jake Bernstein: So gears don't guess. And that's where the title came from this time.

Kip Boyle: Yeah. Yeah, that's the whole book in three words.

Jake Bernstein: It is. And it's funny, Kip, because it took me a little while to understand that. Because in my world, or I should say in my head, gears have oftentimes been associated with robots and artificial intelligence. So I was like, "What do you mean gears don't guess?" But we're talking about the mechanical tool that is a gear. This is a old piece of technology. Pocket watches were based on gears. Why? Because gears don't guess.

Kip Boyle: That's right.

Jake Bernstein: I mean, imagine if your pocket watch was like, "I think, today, a second is going to be twice as fast."

Kip Boyle: Right.

Jake Bernstein: You'd just be like, "This is utterly useless. Utterly useless things."

Kip Boyle: I can't rely on it. Yeah.

Jake Bernstein: You can't rely on it. Right? So yeah. And that is the big problem here. Right? Same input, different output, not just a Tuesday to a Monday, but minute to minute. Right? I mean, you almost-

Kip Boyle: Yeah.

Jake Bernstein: ... are guaranteed not to get the exact same output with an input when you do it.

Kip Boyle: That's right. And if you take a prompt and you put it into Claude and then you take that exact same prompt and you put it into GPT and then you put it into Grok and then you put it into Gemini, again, you're not going to get the same results from any of those models.

Jake Bernstein: You won't even get the same results if you wait five minutes and put it back into the same model.

Kip Boyle: That's true. And you can test this for yourself. Anybody can.

Jake Bernstein: It's easy. Yeah?

Kip Boyle: Yeah.

Jake Bernstein: And look, we're not saying that it's going to be drastically different. Right? If you ask the same question of ChatGPT at 10:00 AM and then you ask the exact same question again at 10:05, it's not like we're saying it's going to be-

Kip Boyle: Totally different.

Jake Bernstein: ... materially crazily different. But I promise you it will not be identical. Whereas if you take deterministic compute and you give it the same input, it will be. That's by definition.

Kip Boyle: Right. Yeah. And so business... And I'm including not-for-profit mission-driven organizations.

Jake Bernstein: Right.

Kip Boyle: When I say this, we have to have a certain amount of control over what happens. And senior decision makers are just used to that as the air that they breathe, that once I set gears in motion, I can count on them. Anyway. So just to bring it back, because they don't understand what it is about AI that's different from everything that they're used to, then their management instinct backfires, right? Because they're like, "Whoa, this thing's weird. I need to get trained, or I need to get an expert, or whatever." And guess what? And I know this because I've had this conversation over the years, right? Once you get some clarity about what is it that, as a risk manager, what's that essence of the difference, then it stops seeing so mysterious and now you can start going, "Oh, I actually do know how to manage risk in a probabilistic environment. I just didn't recognize that at first."

Jake Bernstein: Right. And the crisis framing, you used the word crisis in the introduction.

Kip Boyle: Yeah.

Jake Bernstein: And that's a strong word for you.

Kip Boyle: It is because I don't generally frame risks in fear, and I still don't. However, I think generative AI is, gosh, it's already a crisis. Because why? Well, nobody purchased this stuff. If you remember, it all seeped in through the floorboards of the organization. Right? It just started showing up in stuff that we had explicitly purchased. But now, this AI stuff just showed up as a feature one day. And so it's like, well, when is the last time that's ever happened? Right? So it's already a bit of a crisis because we didn't order this and it's here and it's weird.

Jake Bernstein: Yeah.

Kip Boyle: And so what do I do? And again, it goes back to, "Well, let's just block it all." "Well, no, that doesn't work too well as we've discussed." "Well, then let's just embrace it." "Do you understand what you're embracing? I don't think you do." So that's pretty risky as well. So yeah. So again, the book is saying, "Look, you already have a lot of what you need. You just need to get a reframe on it and you need to understand why it's different." And the book contains... I mean, it's just like practical advice for how you do it. I'm not just breaking down why it's different, I'm actually laying out exactly a practical way for dealing with it.

Jake Bernstein: So the book isn't learn AI. It's adapt what you already know.

Kip Boyle: That's the dominance of it. Right? And I'll just give you an example right off the bat. So chapter one, I tell the story right away about a CFO who takes the thing that I often see them do. They ban AI company-wide in February because they read a headline about a competitor that got really embarrassed because they had an AI misfire. Well, so this CFO, three months later, her CEO walks in with an article. This time, it's about a competitor that cut its quote-to-cash cycle by 35%, and they did it with AI, and that's huge. And so the CEO says, "Hey, we need to do this." Well, okay, so now she's trapped. She's like, "Okay. Well, if I stay with the prohibit course, now we're going to become obsolete because we have competitors who are making these massive improvements. Or if I permit it, well, now I'm going to be exposed to some of this awful stuff that I keep reading about."
And again, she's frozen because she doesn't understand that her choice isn't just binary. She actually has more choices than that. She just doesn't know what they are.

Jake Bernstein: I mean, yeah, your choices are... I mean, frankly, very few choices are truly binary. I think that this ban or embrace trap is one of those black or white moments that is never correct. I mean, lawyers love... We live in shades of gray for the most part.

Kip Boyle: Yeah.

Jake Bernstein: So for me, I can tell you... Pardon me. I can tell you the vast majority of the advice I give, whether it's privacy related or cybersecurity related or AI related, it all can be boiled down into risk management. But what does that actually mean? Right? It means looking at the totality of the circumstances and deciding whether or not to go forward with a certain decision based on not a yes or a no, but on gradations of potential risk. Is it a big risk? Is it a small risk? What's the probability that it's going to happen?

Kip Boyle: Yeah.

Jake Bernstein: Risk times probability times-

Kip Boyle: And impact.

Jake Bernstein: ... impact. Right? It's a classic risk formulation.

Kip Boyle: Right.

Jake Bernstein: Or I should say risk equals probability times impact. And I think that the AI is just more of the same. That part's not different about it. Okay, let's talk about the reader. Right? You've got a section right up front, which I think, if I recall, also exists in Fire Doesn't Innovate, which is how to use this book. And you break it out by role. So why don't you walk us through it? Who is it for?

Kip Boyle: Sure. Yeah. Now I've already talked to this. I've talked about this a little bit at the top of the episode, but let's just take a few more moments and just dig into this just a little bit. So who's the primary reader? I think that's the CFO, the general counsel, or the corporate risk manager. And notice that none of these folks in these roles are guaranteed to be experts in systems, in IT.

Jake Bernstein: It's not even IT. It's not even IT.

Kip Boyle: Right. No, it's not. It's not. And so they're really the same audience that I wrote Fire Doesn't Innovate for. And so, one of the side effects of that is anybody should be able to read it and understand it, because if you've worked in a business or in a mission-driven organization, especially if you've ever been a manager or a supervisor, you should be able to read this book and really understand it. Because I don't explain what an LLM is. I don't define tons and tons of jargon. I don't even try to explain the statistics and the modeling and all that stuff, or the history of AI. I completely sidestep all that. I wrote this primarily for people who govern their budget, who govern contracts, who govern risk, and not for the firewall administrators.

Jake Bernstein: Yeah. That's exactly right. Because the firewall admins, the CISO, the CISO, I mean, that's mostly who these books are being written for.

Kip Boyle: Yeah, I think so.

Jake Bernstein: So I'm going to assume though that it's not like no CISOs allowed is printed on the book, right? You haven't gone that far.

Kip Boyle: Absolutely not. Same as Fire Doesn't Innovate. I think that-

Jake Bernstein: That'd be funny though. Actually, you'd probably get even more CISOs to read it if you say-

Kip Boyle: Probably.

Jake Bernstein: ... no CISOs allowed on the cover.

Kip Boyle: That's right. That's right.

Jake Bernstein: Yeah.

Kip Boyle: The same communication chasm that I observed when it came to cyber risk management exists here too. The CISO doesn't necessarily have the vocabulary, or the framing, or the stories or the-

Jake Bernstein: At least not all CISOs.

Kip Boyle: Right. Some probably do, but not all do. But that's okay. Because even if you are a CISO who totally gets it, you probably are trying to have a great conversation with your CFO or your corporate risk manager or your general counsel. Maybe they don't get it. You can give them this book and you can say, "I read this book. It makes sense. I want you to read it because I think it's going to really help us have a better conversation about how to deal with this AI stuff." And that's the same idea that I had for Fire Doesn't Innovate.
So just because you got it all figured out doesn't mean the people you really need to talk with have it all figured out. And rather than you getting frustrated and going, "Well, hell, how do I teach them this?" You don't have to now. You just grab a copy of my book, you give it to them and you ask them to read it, and it'll help them get unstuck. Now, if you're the CISO, I would start with part four because that's where I talk about control patterns. Yeah. And we'll-

Jake Bernstein: We like controls when we're a CISO, Kip.

Kip Boyle: Right.

Jake Bernstein: We like controls.

Kip Boyle: That's right. Yeah. Yeah. We did controls, right? And we do talk about controls in the book. But parts one, two, and three are context setting so that you know what the controls are for. So even though I'm telling you to go right to part four, you really would benefit from reading the first three as well.

Jake Bernstein: Okay. So how about the third seat? Who's the last audience set?

Kip Boyle: Yeah. So the third segment would be advisors. That's what I am.

Jake Bernstein: Hey, that's me.

Kip Boyle: That's what you are. Aha. Also, insurance brokers. Right? So anybody who's in the business of helping the owners or the governors of organizations make great decisions, this would be a good book for you to read. Even if you're not talking to them about AI right now, this would be a good book to read so that you could talk with them. Maybe you are the one that needs to broach the subject, right? Maybe you need to bring it up so that they're like, "Oh, thank God, somebody I can talk to about this." And I think some of the best advisors are the ones that just ask the best questions.

Jake Bernstein: I agree. I agree. Let me take the lawyer seat for a minute just because it seems natural.

Kip Boyle: Oh, please do.

Jake Bernstein: What's the pain point for general counsel? And I know what I would say, but I want to know what your idea is.

Kip Boyle: Yeah, sure. So you can check me. Right? So by observation, I think that one of the biggest pain points is accountability without visibility. So general counsel who's signing off on contracts and policies doesn't today really know which of them has AI inside as a force to be reckoned with, Right? Because it doesn't appear on the order forms like other stuff does. Right? Like I said before, it's just a feature that gets added in the next software update. And we can all see this. Google, Microsoft, they've woven this into their tech stacks. Vendor portals might have an agent bundled in there that you've unintentionally become dependent upon because it'll actually give you answers that you can actually use. So nobody bought it. So guess what? Nobody's governing it because it didn't show up in the normal governance processes. But the general counsel's still on the hook.

Jake Bernstein: Well, and I'm not going to distract you here, Kip, but the other problem isn't just that nobody bought it. Maybe someone did buy it. But what did they buy? "Oh, we bought ChatGPT Enterprise." Okay. Well, what are you going to do with it? I mean, there's things that the GC is going to be like... I mean, a GC could look at that and be like, "Okay, great. I don't know what that means." Or they can be like, "Okay, it's fine."

Kip Boyle: inaudible. Is that what we're doing now?

Jake Bernstein: It doesn't matter. That the point, Kip, is there's so many risks. Right? There's financial risks. And speaking of financial risks, we're going to talk about the CFO in just a second.

Kip Boyle: Yeah.

Jake Bernstein: But that is one of the things that makes it so hard. And that is why, just to call back to a recent episode, that's why you have the use case based air maps, is that they really... You can't just look at an AI product and understand it or know the risks.

Kip Boyle: Right.

Jake Bernstein: It has got to be looked at on a use case by use case basis. And Kip, forgive me, I've not worked with it enough. What is the official name of the use case air map?

Kip Boyle: It's a core air map.

Jake Bernstein: That's right. Okay. Core air map.

Kip Boyle: Right.

Jake Bernstein: As opposed to a culture air map.

Kip Boyle: Right. Right. Yeah. Yeah.

Jake Bernstein: So you need lots of core air maps, right? You cannot just do one air map for a thing.

Kip Boyle: No.

Jake Bernstein: And by the way, Kip did not ask me, it is not in the script to call back to the air map service, but it's so important to understand for this reason, right?

Kip Boyle: Yeah. It really is. Because what I've noticed is that... Take the CFO, for example. The CFO is, like a lot of people, is used to thinking about tools, right? "Hey, we're going to sign up for Salesforce." Oh, okay. Wow. I can immediately begin to think about how Salesforce will be helpful, but also maybe some of the risks that Salesforce could introduce into the way we do things. And that's because Salesforce does a very, very specific thing. It's not trying to be your word processor.

Jake Bernstein: It is not your word processor.

Kip Boyle: Right. So it's pretty straightforward to say, "Well, that's what this tool does, so I can get oriented-"

Jake Bernstein: Well, Kip-

Kip Boyle: "... to the risk by looking at the tool."

Jake Bernstein: Here's the hardest thing for a CFO in the new world. That Salesforce contract, well, I know what that's going to cost me. I know what that's going to cost me month after month, year after year, for as long as my contract goes.

Kip Boyle: Yeah.

Jake Bernstein: Recently, I've started talking about AI as, it's kind of amazing that we tolerate it. Because imagine if a car company tried to sell you a car and you didn't know if you were going to get 10 miles to the gallon or 100 miles to the gallon. Any given day, you'll wake up and you'll go get in the car, you'll see that you have a half tank of gas, and just literally you have no idea how far you're going to get. That would be intolerable. It would be-

Kip Boyle: It would be.

Jake Bernstein: ... absolutely intolerable.

Kip Boyle: Yeah.

Jake Bernstein: And yet, we're all tolerating it for AI right now, which is a little crazy.

Kip Boyle: Yeah. It makes me think about agriculture, because the price of commodities can just move all around on you. You put-

Jake Bernstein: Fluctuate. Fluctuate dramatically.

Kip Boyle: Yeah. You put seed in the ground, you have no idea what you're going to be able to sell it for when you harvest it. And so we've created really sophisticated financial instruments and markets in order to dampen the extremes of prices, right-

Jake Bernstein: Right.

Kip Boyle: ... to save everybody.

Jake Bernstein: Because you don't really know is it going to be a super hot year? Is it going to be drought? Now, Kip, we have-

Kip Boyle: Maybe you overproduce and everything's cheap.

Jake Bernstein: Yeah. But the human species has literally millennia, about 10 millennia of experience dealing with the vagaries of crop production and weather-

Kip Boyle: Yeah. And controlling-

Jake Bernstein: ... and the effects on it. And controlling it.

Kip Boyle: ... its impacts. But not with AI.

Jake Bernstein: So we know it is similar. But with AI, it's brand new.

Kip Boyle: That's right.

Jake Bernstein: Maybe we'll get there. I mean, we probably will.

Kip Boyle: Right.

Jake Bernstein: Right? We probably will. But right now, it's very hard.

Kip Boyle: It's very difficult. And so that's another issue that the CFO has to deal with is, we're spending a ton of money on this, but are we getting any business value out of it? Right? And so-

Jake Bernstein: Yeah. That's my life, Kip.

Kip Boyle: Yeah. So from Fire Doesn't Innovate, I'm used to talking a lot about what's the business value of cybersecurity money? Yeah, we're going to control risk, but what else are we going to get for it? And the CFO's struggling now with AI, we're spending all this money on it, but what are we getting for it? And the core air map, which is use case focused, doesn't just focus on risks to sensitive data or critical systems. It actually also focuses on, are we going to get a return for this money we're spending as we try to innovate? And again, the use case from the beginning of my book was, "Hey, my competitor just increased by 35% the productivity of their order to cash business process. Wow, that's huge. How am I going to do that?"

Jake Bernstein: How am I going to do that? Yeah.

Kip Boyle: Yeah. Right. So the CFO is just-

Jake Bernstein: Yeah.

Kip Boyle: ... another person who's really got to figure this out.

Jake Bernstein: Why don't you give me an example of an incident or something that could be avoided or-

Kip Boyle: Sure.

Jake Bernstein: ... something that would make a CFO sit up? Because I see you've got one here and I love it.

Kip Boyle: Well, yeah. So I put this in the book. Right? So think about a distributor, a distributor of products, physical goods. So in the book, I talk about a CFO who rebuilt her program. She started counting the AI related near misses that her team caught every quarter. And by the end of year one, there were 11. All right? So 11 things that AI did that if a human being hadn't seen it, it would've caused real trouble. Right? So three of them would've been customer facing or regulator facing if they had shipped what the AI had messed up. One was an AI drafted purchase order that included a five-year exclusivity clause that nobody in procurement had approved, but a named reviewer, again, a real person, caught it before the contract was signed.

Jake Bernstein: Yeah. And that's a lawsuit, not just a typo, Kip. That's a big problem. That is not a-

Kip Boyle: Yeah.

Jake Bernstein: ... an, "Oh, it's no big deal." No, that is a substantial problem.

Kip Boyle: Right. So if we walk out, well, what does that mean, Kip? Exclusivity. Well, it means that the contract would've given the CFO's company an obligation to use a named supplier for five years with no opportunity to renegotiate the deal or to switch to another supplier. So I mean, the doc looked totally normal.

Jake Bernstein: That's the problem with AI generated work, Kip, is that-

Kip Boyle: Yeah.

Jake Bernstein: ... it always looks great.

Kip Boyle: Yeah.

Jake Bernstein: It looks phenomenal. It's like building a house with the studs all messed up and some are disconnected, but then putting perfectly manicured drywall over it. You're like, "Look, what's the problem? It looks perfect." And you're like-

Kip Boyle: That's right.

Jake Bernstein: ... "Yeah, but a stiff breeze might knock it over."

Kip Boyle: Yeah.

Jake Bernstein: That's the issue.

Kip Boyle: Yeah, it really is. Right? And so what I like to focus on is that the cost of catching these 11 serious AI missteps, the cost of catching it is a fraction of the cost of living with the consequences of it, right?

Jake Bernstein: Oh, absolutely. There's no question about that.

Kip Boyle: Yeah.

Jake Bernstein: The problem though, Kip-

Kip Boyle: Well, that's the business value of governing it.

Jake Bernstein: It is. It is. The challenge though is, the cost of catching it is a fraction of the cost of living with it, true, but what was the moment cost of actually catching it? That's the issue. Right? And this is the problem that lawyers have right now is, does AI save us time? What is the business value of AI? Does it save you time if you have to reread the whole thing to make sure it's not messed up? And we don't need to go into that detail here, but it's just another example-

Kip Boyle: It is.

Jake Bernstein: ... of why you have to think through this stuff very carefully and it's not a super obvious thing to do.

Kip Boyle: Yeah.

Jake Bernstein: So let's move on to the corporate risk manager just as we are.

Kip Boyle: Okay. Yeah. Just really briefly, the risk manager owns a risk register. That's their stock-in-trade. Right? And so what I tell them in the book's first Monday morning task is, "Hey, you need to add a new row to your risk register and it's the AI category. You can use the same taxonomy and severity scale and review cadence. But you now have a new risk and you've got to start with that one new row and you got to maintain that." And so that's what the risk manager needs to do. And I've got tools in the book to help them do that.

Jake Bernstein: Yeah, that's great. All right, Kip. So given that we have what, about 35 minutes on the clock-

Kip Boyle: Yeah.

Jake Bernstein: ... let's see how much farther we can get through here.

Kip Boyle: Okay.

Jake Bernstein: So let's get practical with it. Somebody buys the book, what do they actually walk away with? Walk us through it.

Kip Boyle: Oh, good. Yep. So there's six parts. So part one is really the goal that I have for the reader, which is that governance, good AI governance is going to accelerate adoption rather than block it or waste money. Part two is a decision framework that you can use to figure out what's allowed and what's not allowed in terms of AI tooling and use cases is what it gets to. Part three is the operating model. So once you make your decisions, what's in, what's out, well, who runs that model? Part four are the controls so that, hey, it's not just a paper program, we actually have things in place that will technically enforce it.
Part five is the rollout playbook. So I'm giving you, what's the first 90 days of living with this program? And then part six is, well, what do you do if something breaks? What if you need to do an AI incident response? I also talked about common failure patterns, things that I've seen already that you can use in order to possibly predict what kind of trouble you might see.

Jake Bernstein: Exactly. Okay. And that's why every chapter... Yeah. Okay. So 17 chapters. I almost read your piece. It's funny. It's a lot for a busy executive.

Kip Boyle: Yeah.

Jake Bernstein: And that's why every chapter ends with something called Monday morning. Kip, tell us about Monday morning.

Kip Boyle: That's right. So if you just flip to the end of each chapter, I'm going to give you two or three things that you can do this week based on what you've just read. And so you don't have to finish the whole book before you get busy. You can just start going through it one chapter at a time. And at the end of each chapter, look at the stuff that I recommend and do it. One of my beta readers, because I had a lot of people read this manuscript inaudible, but I had one of them that told me that the Monday morning pages were the best part because you could act on them without reading anything else first. So if you know something about AI already, well, there's your cheat code.

Jake Bernstein: Interesting. Very interesting. Okay. So what about the tools in the back? This was something that was great about Fire Doesn't Innovate. And in Gears Don't Guess, you've got four appendices. So just run us through those four appendices.

Kip Boyle: Yeah. So in Fire Doesn't Innovate, part two of the book was all about how to do a CR map.

Jake Bernstein: Right. Yeah.

Kip Boyle: Well, so I went bigger this time. So appendix A-

Jake Bernstein: I saw the proof of the book. I can confirm it is substantially bigger. He means that literally, not figuratively.

Kip Boyle: Yeah. Yeah. Yeah, it's about 100 additional pages. Right? But trust me, everything that's in there is in there for a reason. There is no fluff. If you get my book and you read it and you go fluff, fluff alert, you need to tell me because I'll take it out in the next edition if I agree with you. Okay. So Appendix A is a self-assessment. There's 20 questions, four phases. And the purpose is I want you to score your whole organization about its AI governance readiness. And what this really is, is a light version of the culture air map that we use with our customers, and it's built on the NIST AI Risk Management Framework, which we reviewed in this podcast a couple of years ago, I think. We had a two-part episode.

Jake Bernstein: Interesting. Yeah, we did. That's true.

Kip Boyle: Yep. Now appendix B, there are 10 templates that I specifically talk about over the 17 chapters of the book. And all 10 of those templates are written out in Appendix B and it gets better. We'll talk about that in a moment. Appendix C is the core air map, the light version. So you can take a single use case. You can read it.

Jake Bernstein: So it's an example of the core air map. It's not the full thing, but it's pretty close.

Kip Boyle: Right. Yeah.

Jake Bernstein: Okay.

Kip Boyle: But I wanted it to be practical and easy for people to use as opposed to the ones that we do are a bit more sophisticated. And I was just like, I don't want to overwhelm people with that. But you can use this light version and you can focus on a use case and you can pretty quickly get to a, "Yep, this is fine," or, "No, this is not fine." Or, "Okay, we can do this, but we need to add a few things in order to make it within our risk tolerance." That's appendix C. And then appendix D is a complete crosswalk to the NIST AI RMF. So if you've got an auditor or a regulator that's saying, "Hey, show me how you're NIST compliant," well, that's what that appendix will do.

Jake Bernstein: So tell me about these 10 templates because I love templates.

Kip Boyle: Yeah. All right. So we've got 10 minimum viable templates. And you know what? I know they're all listed out here in our script, but I'm just going to pick a few, okay? So there's a severity triage card. So if you have an AI incident, you can use that to zone in on what's important right away. I've got a 30-day board briefing that you can use after a major AI incident. I've got a sample AI acceptable use policy. I've got a five-day promise intake form so that when IT commits to evaluating a new AI tool, they can give an answer very quickly as opposed to a multi-week time to answer situation, which if you do that, that's where shadow AI comes from, because no one's going to wait around for that to happen.

Jake Bernstein: Got it. Okay. So there are a lot more we could talk about, but we are-

Kip Boyle: Yeah.

Jake Bernstein: ... legitimately beginning to run out of time. I do want to ask about this. You've got something here called a five-day promise intake form so that IT commits to a yes or no on a new tool inside a week.

Kip Boyle: Yep. Yep.

Jake Bernstein: I mean, I would like to hear about that. I'm curious because-

Kip Boyle: Yeah.

Jake Bernstein: ... the bottleneck I see isn't the policy, it's the approval queue, it's-

Kip Boyle: That's right.

Jake Bernstein: ... the question and answer, all that stuff.

Kip Boyle: Yeah. So we should learn from our previous mistakes, right?

Jake Bernstein: Ideally. Ideally we should.

Kip Boyle: Yes. I think we should.

Jake Bernstein: Yeah.

Kip Boyle: So where did shadow IT come from? Well, it came because people could easily access technological tools that their IT department wasn't giving them that they felt that they needed. Right? Well, guess what? We have the same phenomenon going on here right now, shadow AI. So if we want to learn from this mistake, then my allegation is that we should quickly approve things, like five business days to give you an answer about whether this is something we can do or is not to do. And this goes back to the idea of you want security to be the default that people turn to because it's the fastest path to get to the answer that you're looking for. Right?
So if governance works faster than just going out and doing it myself, people will go to that. They will. Not everybody possibly, but you're going to get a lot more people playing with the system than you are circumventing the system.

Jake Bernstein: Yep. Exactly. Okay. So again, you lean on some real good cases like Air Canada's chatbot, Samsung and ChatGPT. I understand why you have case studies in there. In the interest of time, let's skip ahead. I want to let you end with how to get it. Someone's listening, someone's a co-host, they want it. How do they get it?

Kip Boyle: You're all co-hosts, right? So you all want it.

Jake Bernstein: No, no. That's actually just me. I'm the only co-host. And I do want it because... I don't know if I've mentioned this. I think I have mentioned it on the podcast, but I'm now the firm's global AI and innovation partner. So in a real sense, I have an additional hat that I wear. And Gears Don't Guess is not just relevant to me as an advisor, Kip, it's also relevant to me as a decision maker for the firm.

Kip Boyle: Right. Well, you participate in the AI governance of your firm.

Jake Bernstein: I do. I do.

Kip Boyle: Yep. Active participant.

Jake Bernstein: So I want it. How do I get it?

Kip Boyle: Okay. So again, go to Amazon, September 28th. Paperback and Kindle, both available there. And typical Amazon, you go to the product page and you choose the version that you want. You can also go to gearsdontguess.com, and I'll have some buttons on there that you can just click right through, take you right to the Amazon page. And again, as I mentioned at the top of the episode, during launch week, I'm going to set the Kindle to free. So as long as you can purchase Kindle books, then you'll be able to get mine for free and you can keep it forever.
And the reason why I'm making it free is because I need reviews. I studied this a little bit, and here's the thing. In order for people to find my book, it needs to have honest reviews. I'm not telling anybody, "Hey, you got to go give me a five-star review." That's not what I'm looking for. I just want honest reviews about, is this book useful? Is this book something that's helping you do your job better? And even if you only have the time to put one sentence or two sentences, it makes a big difference to have a bunch of people saying, "This is my role. This is what this book either did for me, or maybe it disappointed me because it didn't talk about that."
But it's just really crucial that I get some reviews up there. And so I just want to make it as easy as possible. So go get a free Kindle version, check it out, and just give me that honest review.

Jake Bernstein: Okay. I will do that. What about audio? A lot of our listeners are, well, listeners. What if they want to listen to the book?

Kip Boyle: Yeah. Well, I am going to make an audiobook. Just like with Fire Doesn't Innovate, it's really hard just to get the manuscript out in Kindle and paperback. And so the audiobook just comes second. Sorry, that's just the way it is. I don't know any better way to do it. Unless I hired somebody to read it, but I'm not going to. I'm going to read it because I think that's important. I appreciate it when authors narrate their own audiobook, so I want to commit to doing that. And I'll announce that later on. If you're subscribed to my Inflection Point or if you listen to this podcast in the future, don't worry, I'll tell you.

Jake Bernstein: Okay. And for anyone who read Fire Doesn't Innovate, do you consider this a sequel? I mean, obviously you already did a second edition of Fire Doesn't Innovate.

Kip Boyle: Yeah.

Jake Bernstein: But this does... I mean, we couldn't have guessed when Fire Doesn't Innovate was released that this would be the sequel, but I think it is.

Kip Boyle: I think of it as the sequel because it's the same risk discipline in the hands of the same audience, but I'm just pointing you at a different related risk. In fact, the origin story of the book goes back to the fact that here I was just playing with ChatGPT like everybody else, and I had current customers calling me saying, "Hey Kip, what do you think about this new AI stuff?" So they came to me asking for my perspective. And that all just snowballed a couple years later and I'm like, "Okay. Well, I've got something to say on this topic to the same audience." So yeah, it's the cousin, it's the brother, the sister. I don't know. They're related.

Jake Bernstein: Yeah. I do want to give you a chance to mention some of your endorsers. There's some great names. If you want to do that real fast.

Kip Boyle: Yeah.

Jake Bernstein: I do want to have one more thing that I want to talk about, which is gearsdontguess.com and what's there. So go ahead and give some shout-outs.

Kip Boyle: Yeah. So I really want to express appreciation for folks who read the manuscript and then agreed to give me an endorsement that I could actually put in the book. Keri Pearlson from MIT Sloan. Anton Chuvakin, who works at the Google Cloud Office of the CISO. Jim Reavis.

Jake Bernstein: He did. He just recently moved. That on his LinkedIn.

Kip Boyle: Yep. Yep, he did. Jim Reavis, the CEO of the Cloud Security Alliance, who I've known for a long time. Scott Stransky, who works at Marsh, and is such a smart guy on modeling cyber risk. George Finney. Chris Cronin, who was in episode 216. So there's a lot of people who were very generous and wrote an endorsement for the book. So thank you everybody. And you're all going to get a paperback signed, autographed copy from me, so watch out for that.

Jake Bernstein: All right. Okay. So gearsdontguess.com, what's there? And I want to mention that I was somewhat joking with you when I said in the chat, in our little stream yard thing that I wasn't going to ask you live. But I see that I actually don't have to because we're already going to talk about it, right?

Kip Boyle: Right. Yeah.

Jake Bernstein: I wanted to know, Kip, if any of those appendices were going to be downloadable.

Kip Boyle: Yeah.

Jake Bernstein: I jokingly asked about JSON or Markdown files. And you probably could do that. But it turns out they actually are available.

Kip Boyle: Yeah.

Jake Bernstein: So tell us what's there.

Kip Boyle: Yeah, yeah, yeah. So with Fire Doesn't Innovate, I didn't really feel the need to have a companion website because there wasn't a lot of things changing. Some, right? I did do a second edition. But AI is different. I mean, it's just moving at this massive pace. So I decided upfront, "No, I'm going to have a companion website." So now that I made that commitment, what do you get as a reader? Well, first, you get the self-assessment. So I took Appendix A and I turned it into a live self-assessment web-based that you can do right in the browser. You can do-

Jake Bernstein: I hope you did that using AI. Because otherwise, that would be an unreasonable amount of effort.

Kip Boyle: Yes, I did. I used AI. It was my coworker, however you want to characterize it. But yes, I used AI to create that thing. There's a whole other story I could tell about what that was like. It was good. But listen, if you want to take the Appendix A self-assessment, you don't have to sign up for anything. You don't have to give me your email address. Just go do it. So I like that. The template library. So there's 10 templates that you'll find in Appendix B. They're up on the website. I'm giving you both editable word files as well as PDFs that are form-based. So you shouldn't have to retype anything.
Now, you do have to give me an email address to get that. All I'm asking you to do is sign up for the Inflection Point. So once you subscribe, you're going to get the 10 templates, but there's 27 templates in total that I have on hand right now.

Jake Bernstein: There were only 10 in Appendix B. What happened?

Kip Boyle: Yeah. Well, there's-

Jake Bernstein: Did they multiply?

Kip Boyle: There's 17 more that I couldn't fit into the book. So I'm going to be releasing them on the website, and more in the future if I get them.

Jake Bernstein: Excellent. You and I will have to talk. You'll have to think about releasing them on GitHub as well to allow the-

Kip Boyle: Yes.

Jake Bernstein: I think that'd be a great place to-

Kip Boyle: The JSON and the Markdown people.

Jake Bernstein: Yeah.

Kip Boyle: Yeah.

Jake Bernstein: To make it a repo that someone can just clone and sync to.

Kip Boyle: Happy to do it.

Jake Bernstein: Actually not a bad idea.

Kip Boyle: Now the third thing on the website is the blog.

Jake Bernstein: Yeah. What's the last thing? Yeah.

Kip Boyle: So I needed a place that I could give updates, things that I would say like, "Oh man, I wish this was in the book." But the book's done. Right? So I can put it on the blog and I can say, "Hey, remember when I said this in chapter whatever, whatever. Well, this just happened, and so that changes things, or maybe this is another data point to make the case that I'm making," what have you. But what I don't do on the website is sell you anything. If you want to buy the book, you click through the-

Jake Bernstein: Other than the book itself, obviously.

Kip Boyle: Well, but I don't fulfill that purchase. I just send you to Amazon and you buy it there. Okay?

Jake Bernstein: Correct.

Kip Boyle: And privacy related, I think you're going to like this, Jake. No cookies, no analytics, no surveillance capitalism of any kind. I don't have any of that on there. So you don't need to worry about that. And if you do sign up for the Inflection Point, I never share my subscriber list with anybody for any reason, so you don't have to worry about that.

Jake Bernstein: You heard it here, folks. That is the policy.

Kip Boyle: Yep.

Jake Bernstein: And I trust it. So okay, Kip, I think we need to wrap up this episode.

Kip Boyle: We do. And I appreciate how much you've been paying attention to the clock today because that's not something you necessarily do all the time.

Jake Bernstein: It isn't. It is not. It's true. It's only because I have a packed day.

Kip Boyle: Okay.

Jake Bernstein: And I wanted to make sure we got through as much of this script as we could. And we did it, I think.

Kip Boyle: I appreciate it. I think so too. And that's why this wraps up this episode of the Cyber Risk Management Podcast. Jake interviewed me today about my new book, Gears Don't Guess. We talked about why I wrote it, who it's for, and hopefully, what it'll do to help you, our listeners on the job. Again, it's going to be on Amazon, starting September 28th. And the Kindle is free through Friday, October 2nd. Go check out Gears Don't Guess when I launch that website at the same time as the book gets released. And I hope it helps you. We'll see you next time.

Jake Bernstein: See you next time.

Speaker 1: Thanks for joining us today on the Cyber Risk Management Podcast. If you need to overcome a cybersecurity hurdle that's keeping you from growing your business profitably, then please visit us at cr-map.com. Thanks for tuning in. See you next time.