Speaker 1: 0:00

All right, you're listening to the Audit presented by IT Audit Labs. I'm Joshua Schmidt, your producer. Today. We're joined by John Massey. He's in South Dakota and he is the technology director at a construction company named Journey. We're happy to have him here today. Thanks for joining us, john. Hey, thanks for having me, josh, I appreciate it. Yeah, I just want to call out. We have Nick Mellom and Eric Brown from IT Audit Labs as well. Want to call it. We have Nick Mellum and Eric Brown from IT Audit Labs as well. I'd like to start by having you, john. Just give us a little background. What do you do day to day? What's it like working at Journey and where do you kind of brush up against cybersecurity?

Speaker 2: 0:34

Yeah for sure. So yeah, day to day at Journey Group my role was added to kind of help them with making technology more than just break fix. So I think everybody knows IT to be the hey, my password doesn't work and I can't get into my laptop, those types of things. But really take a look at how we can use technology to our advantage as a construction firm.

Speaker 2: 0:55

Obviously, over the years we've moved from paper to digital and so we have a lot of data as a result and so kind of how do we do that and continue to enhance technology for more than just break fix? And so day to day I'm doing everything from managing the infrastructure team so keeping the break fix going, as well as kind of building out a business solutions team to look at data, how we use it, how it talks with each other, and then kind of overlaid over both. Is security around both? How do we protect the data we have, the systems, the different things that we use? And so that's kind of my day to day and where I brush up against info security there at Journey.

Speaker 3: 1:32

And John, what sort of construction work does Journey do?

Speaker 2: 1:35

A little bit of everything, I feel like. Sometimes, predominantly, we're in the commercial construction space. We also have an asphalt paving division, a civil division that does civil heavy highway, and then we also do some specialty work in the food manufacturing and cold storage as well as, and then a residential home building division as well. So a little bit all over the board. But yeah, typically most people will seek us out as like a general contractor.

Speaker 3: 2:01

Do you see a lot of different types of cyber attacks or mostly phishing. What comes across your organization mostly?

Speaker 2: 2:10

Yeah, so for us, due to the nature of our work, especially being like a commercial general contractor, we have a lot of financially motivated attacks that kind of come against us, whether that's through phishing, phishing, smishing I think we've had all three kind of come against us whether that's through vishing, phishing, smishing I think we've had all three kind of come through.

Speaker 2: 2:29

We've had your very classic even at our vendor level looking at you know, if we get a sudden request to change payment information, vetting that out, stopping that, those type of things. So kind of on the cybersecurity front, we're not only looking internally with our users on how do you identify this for things that directly attack us, but maybe even a subcontractor or a vendor or supplier that we work with, maybe they've been compromised, how to even identify those when they're coming through a semi-legitimate method and then impersonation. So yeah, we have a lot of attempts of hey, I'm the CEO and I'm asking you to wire this money to so-and-so you know, kind of following those things as well. So doing a lot of combat with making sure that we're doing everything we can do to help our users identify that stuff.

Speaker 4: 3:19

John, I'm curious what kind of training are you guys doing to combat that? Are you doing all before? Do you do social engineering training? What are you guys doing to combat that?

Speaker 2: 3:28

So we do Know Before. That is a big piece of what we do. And then we actually do quarterly training as well. So through Know Before, we offer some training that's just outside of your standard phishing test to kind of keep our people educated on some of those other risks out there, and then we actually financially motivate them through some gift card drawings and things like that, like hey, if you complete your training, it will give you a gift card. So that's what we've been doing to kind of do that. And then just general user education as well. We've ran some events throughout the year that we kind of try to tie to different things. We did some stuff around Christmas with an elf on the shelf, and so we had some cybersecurity things that we were trying to keep people kind of informed and trained on even through that activity. So we're trying to find creative ways to keep it in front of people that maybe aren't always the most technologically savvy or technologically open to using the tech and so trying to keep them informed through some maybe non-traditional methods.

Speaker 3: 4:25

That's cool. We had, uh, another guest on a little while ago who was working in cyber security for an electrical generation company and where you're using the the carrot or your organization is using the carrot to incentivize people to go to training. Their organization was was using the stick the carrot to incentivize people to go to training. Their organization was using the stick and if people failed a phishing attempt the simulated phishing attempts five times, they would be fired. So that's how seriously they took it.

Speaker 2: 4:56

And I could definitely, you know, depending on the industry. For sure we're trying to avoid that. We have looked at some maybe escalated scales of, if you continue to fail, maybe we're having a more direct conversation with you and your manager on safety and security of your IT resources. But no, we found, at least so far, the carrot method has worked pretty well and we're hoping to avoid the stick method.

Speaker 1: 5:24

So you're literally training construction workers on best practices, cybersecurity practices, IT tactics, things like that.

Speaker 2: 5:31

Exactly, yeah, and it's, you know, we. It's an interesting field because you'll have the construction worker that really has like an iPad and some connectivity, all the way up to an office full of people that are doing all the kind of support services work. So you're more traditional tech users, and so trying to find training and ways to adapt it to each group has been interesting and a nice challenge, like it's been fun and something different than my career where I've typically been dealing with more office folks, and so, yeah, it's been an interesting learning curve, but one that I feel like we've kind of done a good job at it. Getting out there in the field, we can always improve, but, yeah, I think I've definitely enjoyed that piece of it.

Speaker 1: 6:13

So we were talking about AI in the workplace and and how it's becoming ubiquitous, ubiquitous across all, all industries. But I'm curious to know what, what kind of applications, what tools are being used at Journey? What do you see some of the construction workers using, and how's that starting to show up in your day-to-day work activities?

Speaker 2: 6:32

For sure. I mean, I think the most common one, chatgpt, always is a kind of the first out of the gate. We also see things like Copilot has been a new one we've been kind of looking at throwing around. What does that look like? A lot of AI note-taking. So we have a lot of whether that's through, like Zoom calls those type of things.

Speaker 2: 6:52

We'll get a lot of AI note-taking solutions, some AI document review whether that's legal, contract or construction documents, those kinds of things having those reviewed and then for kind of more the office side, we've seen things like beautiful AI for slide deck generations trying to do that to kind of maybe save some time on those fronts. But those have been kind of the pieces of that we've seen so far in construction, where there's some standalone services. Obviously, a lot of our products now has become quite a buzzword. We do have products that are starting to implement AI within their own products that we're looking at and testing, but those are kind of the core ones that we've seen so far kind of try to enter our space that are not super construction focused.

Speaker 3: 7:33

When you're looking at Copilot, are you looking at the internal version of Copilot, where it would index the documents that you have in your environment, or are you really looking at it just externally for the AI search function?

Speaker 2: 7:51

Actually a little bit of both. So one is a controlled you know how can we deploy a chat GPT style of AI within the organization that they can use for some of that searching, where we know if they do put in some of our data it's protected. But also the yeah, the. How can we also use it as an internal resource to let it index documents that we have or find company information or make it easier for our users to access data that we have that's traditionally stored in flat files that you're having to know what you're searching for essentially, you're having to know what you're searched for essentially.

Speaker 4: 8:27

Yeah, just I think it was last week I had a demo on copilot um at one of our clients and you know it does all the cool things here, as you're talking about indexing data. One of the little things I thought was cool was the email plugin and it like actively learns your writing style and how you sound. They were demoing this and you know you put in a few keywords and it spits out a scholarly email.

Speaker 2: 8:46

So it's just like the little things like that that really has me excited yeah, we've found like um interesting, a lot of us use the co-pilot summary, um, so sometimes, especially when you're dealing with outside parties, we end up with these really long email strings and then suddenly 50 emails deep you get added and so it's like, hey, let me click summarize with copilot, it'll catch me up pretty well.

Speaker 2: 9:10

Um, that's been a one we've used a lot, um, internally. Um, it was kind of a running joke. We had a uh promotion that kind of tied up with march madness, and so, uh, our cfo used uh copilot to write some of the messages out to the team, and so it used a lot of like basketball puns. It was just funny, and so we've enjoyed kind of playing around even with that to write some maybe more engaging emails versus like a standard. Hey, we're doing this promotion and we're trying to save money. So here's a thing you can do to submit your ideas, and it was given much more of a marketing flair without having to actually have somebody kind of write the copy for it. So that was kind of fun Awesome.

Speaker 1: 9:49

So can you describe some of the experiences of developing some organizational standards? You know, maybe you can give us a story on how something came up that you had to address or how something showed up as a threat that needed to be squashed.

Speaker 2: 10:07

AI. It's interesting in this role as well as my previous one. Chatgp kind of took off and suddenly everyone wanted to use it and everyone wanted to use the public version of it. And what did that mean? And so in my last role we kind of formed an AI security council that I led and we talked through. Okay, I was previously in the financial services world, so it's like what does this mean?

Speaker 2: 10:32

You know, how can we prevent customer information, pii, those type of things of kind of coming in and we work to say, okay, well, first we just have to come up with a policy we can figure out ways to enforce. But some of it is just basic user education. Here's what we know exists today. Here's why maybe we wouldn't want you to use certain services. Here's what we would approve of. And then, really encouraging people that we would listen to If you have any idea, ai idea that we would listen and hear you out and investigate and look for the pitfalls and have legal and compliance. Really go through a deep dive of the terms of service to figure out where's our data going, how's it being used? Is it being used for learning? Is it just learning within our org, you know? And then the output. So what happens with that output? Is that something you can reuse? Will you give it to someone else? Is it ours? Is it yours technically, all those type of things.

Speaker 2: 11:31

And so we began to kind of bridge it up with user education, but begin to build a policy. Just to say, hey, as a reminder, this isn't just a glorified search engine. When you put things in there, especially the public version of chat, gpt, that's retained and so we can't be. Here's all the things that you need to think about. And so we were also teaching users how to write prompts. So instead of saying, like my company name is looking to do this kind of policy, we genericize it. So a financial company looking to write a policy on X, what would that look like? And have it kind of generate those things and then teaching people trust but verify.

Speaker 2: 12:13

We had several cases that we pulled from our stories. One was a legal case of just how AI hallucinates, how people believe hallucinations, how far that goes. And so teaching our users that you know you can use these tools and whatever they produce still needs a human element of review before put into any type of production or put into play within a procedure or document or something like that, and so that's how we began to build our policy on how we use things. We did some of the standard. We tried to block as much as we can on a corporate network, but between phones and everything else there's only so much you can really block. So it was more of a. We know the technology is out there.

Speaker 4: 12:58

Let's try and teach our people best way to use it and define for them on a policy what that looks like To me, I kind of draw the connection between when COVID started, everybody was working from home, right, and we had to like scramble, right, everybody was scrambling. And to me, the AI discussion is kind of the same thing. Right, people are getting pushed, users are using it all over your organization and we're having the AI conversation with different clients and everybody's scrambling to educate and create a policy. But it's really cool to hear you guys have just kind of pulled your bootstraps up and you're already going down the road creating those policies and teaching your people all across the organization best practices, and I think it's rare that we've been seeing that right now.

Speaker 4: 13:43

People aren't really having the conversation and people are still using the tools Very powerful like Copilot and they definitely have a need. So it's really cool to hear all the things that you guys are doing.

Speaker 3: 13:54

And John, as you look at the administrative controls or the policy, there's also technical controls and then physical controls, of course, that we look at from an information security perspective. So you've gotten a start on the administrative controls of creating that policy that gives the guidelines almost the speed limit, if you will, for the users. And then there's the technical control side, or the enforcement piece. Have you gone down that road yet to determine if there are tools that you could use to check and audit to see how people are leveraging AI in the environment?

Speaker 2: 14:35

We've started exploring that to see kind of what's out there. Part of that effort is also some more advanced data loss prevention items to either keep things where they should be or prevent it from being able to be sent. So that's a piece of it. And then, yeah, trying to look at different ways to capture usage. Thankfully, pretty much our data is contained to company devices. We've got a lot in place to keep that in line, so we do have some control of what we see going in and out from the devices web traffic apps, those kinds of things and so we can kind of keep a pulse on that to some degree.

Speaker 2: 15:16

Obviously, when you're dealing with we maybe have a meeting with someone else. They host the meeting. They're using AI. There's only so much we can kind of control on that front.

Speaker 2: 15:25

But for us we've started to do that I would say kind of unique maybe to construction is we don't have as many technologically savvy users so they're not necessarily always going out to.

Speaker 2: 15:39

They're like hey, I use these six things on my iPad and that's the six things I will always use until you tell me different.

Speaker 2: 15:44

So I do have a little bit of advantage there, but for us I think it's a lot of the office staff, or maybe the more technically savvy staff that's looking for ways to improve their workflow, which I think AI is doing a great job for us as far as finding some of those efficiencies, but just making sure they use them safely. So we've tried to make sure that there's an open dialogue between technology and the end user so they feel comfortable to approach us first before maybe diving feet first into an AI solution as kind of just a more of a we'll call it human firewall approach, to say, hey, we'll hear you out, we'll listen to you. We're not here to tell you no right out the gate or to just spew out a policy that says, well, you can't do this. You may have a very legitimate use case. We just want to help you investigate it, to make sure you're kind of looking at it from all angles.

Speaker 3: 16:33

AI in particular is an interesting problem to wrestle with because a lot of it depends on the maturity of the organization that's implementing it. If you're in an organization that's lower on the maturity side and they don't even have policy rolled out, it's really hard to come out and say, well, yeah, you shouldn't use AI, but there's no guidelines for those users as a backstop to say, well, here's our policy, this is our corporate standard, this is why you shouldn't use it. So it sounds like your organization is a little bit more mature, where you have policies and you have a way to deliver policy, educate users, train users and there's that almost a feedback mechanism where you can introduce something new, get feedback from the users and make it really applicable to your organization. So kudos on you for doing that applicable to your organization.

Speaker 2: 17:26

So kudos on you for doing that. Thanks. It has been a let's investigate, let's try things in a sandbox, let's look and do the review and let's keep it rolling and moving forward and trying to stay on the front, forefront of it versus the we're continuing trying to catch with it. So because we do feel that I think in the next few years I mean you're already starting to see it, but it'll just continue to grow. So we wanted to make sure that we're trying to build a good foundation before it gets out of hand.

Speaker 4: 17:50

John, kind of curious with you know you said you're you're encouraging staff to come and, you know, show their use case, their business applications. Is there any one you could comment on a cool idea? You know how they're using it. You know something that we might've thought about. Is there any one you could comment on a cool idea? You know how they're using it. You know something that we might have thought about. Is there anything you could comment?

Speaker 2: 18:07

on. The Beautiful AI was one that was brought to us. We do a lot of presentation work, whether that is to customers for potential new projects or even internally amongst different teams of kind of presenting information. So it was brought to us hey, can we look at Beautiful AI? I can put kind of my outline into it. It actually produces a really nice presentation that I have to just do some modifications to but saves me time. So that's been a pretty big one.

Speaker 2: 18:34

And then Copilot it was kind of a joint thing. I had started looking at it as Microsoft was beginning to promote it. We were getting people out in the field as well that were asking for Copilot from like a data analysis view, so being able to take Excel tables and do some analysis against them, or doing more consolidated summaries, so getting a bunch of data from end users and being able to take those documents and say, hey, summarize this for me to save some time. And so those are kind of while not super exciting, but they have in use cases that this was stuff that people was either rekeying, they were doing themselves that now they're taking Copilot in or Beautiful AI and producing pretty succinct presentations or summary docs too which is really necessary, functions.

Speaker 4: 19:21

I was working with a client pretty recently and we were having the AI discussion and they brought up a really cool idea or one they're actively using, and it was for a 911 call center and they suffer a very high attrition rate right.

Speaker 4: 19:35

They have a bunch of people in and out and a high turnover, I should say, and they were building out AI to query how-tos, right. So you're actively on a one call, they can key in a couple of keywords and it'll bring up like oh, this is what you do in the situation or some of that you might not know what to do quickly on an emergency call. And this was able to query all these data sets that they've already built Right, that they have laying around essentially, and they can jump through it really quickly, quickly. So it was really helping somebody new on the desk taking active phone calls to speed up that process. So that was kind of why I was asking kind of what you guys are seeing, because you know, right, this is kind of a that new frontier how are other people using it that maybe we haven't thought about it.

Speaker 2: 20:19

So just wanted to get your take on that yeah, I mean, I think some of the longer term stuff we're looking at is in the construction industry. We have tons of documents, whether that's drawings, plan specs, those kinds of things that go into a project is. Today, if I need to find something, I'm scrolling through what could be tens of twenties of documents, trying to find this answer is finding a tool or a way that we can now consolidate that to let people ask, in that natural language, a few words of just hey, I'm looking for the paint spec on this project, and it provides you that answer to save some time, like on the project management or project engineer side and I think also from a contract compliance sometimes as well. You know, are we within spec of our delivery date? Are we doing this? Is it slipping?

Speaker 2: 21:10

I'm using AI to kind of maybe combine some pieces of data to look at that and maybe give us proactive answers to let us maybe catch things before we would typically see them. And so, yeah, those are kind of the use cases that we see pretty quickly coming up of and that we're kind of exploring is how can we get our data in a way that AI can index it and then present it back to us in a way that lets maybe a newer project manager or someone new to Journey Group maybe not knowing our standards or the way we do something, instead of having to ask around, can literally ask a bot-style to say hey, I'm looking for this and it provides it plus the evidence to back it up, and they get it right away.

Speaker 4: 21:53

They don't have to wait for that email back, it's right at their fingertips.

Speaker 3: 21:55

Yes, yeah, really cool years ago maybe, maybe 10 years or so ago I was working with an organization that had a really large healthcare company as a client.

Speaker 1: 22:08

And that healthcare company.

Speaker 3: 22:09

In their Skunk Works team they were working on an AI project that could listen into intake phone calls and allegedly they could determine within 30 seconds if a person had a high likelihood of having Alzheimer's, just by the conversation, and this was like a precursor to really AI being mainstream the types of things that are now coming to the forefront with all of the different AI mechanisms.

Speaker 3: 22:44

You mentioned beautiful AI around presentation images and and creating those PowerPoints. There's mid journey, which you can text inputs, prompts and it'll create an image based on the, the text that you put in. But as all of those come together, they're still trying to figure out governance, because the deep fakes are really good now and deep fakes as moving images with sound are a thing. So you could create this deep fake of, maybe a politician if the guardrails weren't in place saying something that that person never really even said. So, as a society, as we're becoming more aware of AI coming online, being able to recognize that even something that we couldn't spot was a deep fake potentially could be, and I just wonder where we're going to be in the next 10 years as technology and AI is just integrated into our lives Everything from security camera footage of detecting whether or not somebody had a weapon on them, for instance, to something like sampling a voice and recreating that voice without that person even being aware.

Speaker 2: 24:07

Yeah, it's actually something I was thinking about this week as I saw OpenAI announced their vocal generation service that can essentially take and regenerate the samples that I listened to from the original to what was generated and then, I think impressive to me generated in different languages even was very cool, but maybe a little scary of wondering how we'll be able to begin to know when something is genuine and when something has been AI generated becomes increasingly, increasingly harder. So, yeah, I'm curious to see, as a society, where we'll end up how you know something is truly verified versus a deep fake governing ai is turning into like trying to herd cats, it's like sure typical to do.

Speaker 4: 24:55

Shout out to eric on that one you beat him to it.

Speaker 1: 24:58

This time we have a running joke about Nick's herd of cats. Yeah, one suggestion that I've seen kind of been floated out there is to put some sort of a watermark on the data or some sort of a watermark embedded into the content somehow, where you could use another tool, or potentially another AI tool, to detect the AI. I don't know if it's a great idea. Using AI to detect AI Sounds like a conflict of interest in Skynet style when I've seen it in my career. So, music generation right. It kind of started out very, very cool and very helpful.

Speaker 1: 25:38

I'm using my keyboards here to generate what we call MIDI. It's basically ones and zeros on a key roll, so I could turn this into a flute or a drum, for example, and one of the recent advancements that's been really helpful is it will generate a whole track of drums, for example. You know, using a MIDI generator. It's kind of an AI you can kind of massage it into. This is the chorus, this is the verse. This part is more quiet, this part's louder, so that was super helpful, but now we're at the point even just I think it's been well.

Speaker 1: 26:13

It's been certainly less than 10 years, it's probably more in the range of five years, where I just heard a text generated from text to audio, text to generated from text to to audio, an old Delta blue style sounding track where you know I've been a guitar player for 30 years now I would not have been able to tell, and not only did I have guitar playing, I had singing in it. It sounded authentic and not only that, it had the whole vibe of the era right. So it was sounding like it was recorded maybe like the 40s, where the quality is really low and the frequency range is very limited. You know, it's kind of sounding muffly and then even just down to the artifacts on the audio, like you know, crackling, you know, and some of the, some of the cloudiness. So I just recently saw a news article that said Billie Eilish and Greta Van Fleet and 200 other artists have signed a petition that they want responsible AI practices in music because the fear is this is going to come out and replace a lot of creative work.

Speaker 2: 27:29

What are some of the key factors organizations should consider or industries should consider when developing these kinds of standards. As it relates to your experience, yeah, I mean I think a lot of it is just like you mentioned. One is if you're using AI and it does generate something, where does that intellectual property really lie? Is it yours? Is it technically the AI still? Do they still retain rights to it? I think that's a big piece as you're looking at these things, depending on what industry you're in. I think that whole knowledge of what goes into AI and are you okay with that information, leaving maybe your control in some cases, kind of keeping that in line. And then really education.

Speaker 2: 28:12

I think a lot of companies that, at least, as I've talked to some peers and other people just in the marketplace is we don't really know what to do with AI. So if we just don't talk about it or we just kind of say a one-liner of like, don't use chat, gpt, that that's enough, and really realizing that, yeah, you're really just creating shadow IT and then people are just going to try to do it on their own. So instead, get out in front of it and just say, even if the answer is, hey, we know, it's new, it's emerging, it changes pretty much day to day. Now we're doing our best to kind of keep in front of it. But here's, as a company, this is kind of where at least we're starting and know that we might change it in three or six months or whenever, but it's continually evolving. We're continually keeping the pulse on it. But we are aware and this is how we want to work with it whatever kind of the risk tolerance is.

Speaker 1: 29:02

You know, this is how we want to work with it, whatever kind of the risk tolerance is. Yeah, it sounds like there's a balance between, you know, the innovation needed to stay competitive versus organizational standards to keep you secure, right? I mean, that's kind of the name of the game with cybersecurity, am I wrong?

Speaker 2: 29:16

No, you're totally correct and I think for us, you know, and those I've talked to, that I think that are a little more forward thinking with AI. A lot of people are like oh, is this replacing my job?

Speaker 2: 29:27

And it's like no, but we do believe that humans and companies that choose to embrace AI are going to be the ones that succeed and maybe survive versus the.

Speaker 2: 29:38

No, we're just going to stick our head in the sand and we're going to keep doing what we do and AI is just going to be a thing and we're not going to look at it. Our head in the sand and we're going to keep doing what we do and AI is just going to be a thing and we're not going to look at it. And so even in the construction space I mean, it is a hotly talked about topic in some of the user communities and groups that are not necessarily technology focused that I participate in is what is AI doing to the construction industry and how can we be adopters of it versus just saying, hey, we're going to keep doing what we do because we think that as humans, we can do it better and without AI. And a lot of comparison has been given to the good old blockbuster versus Netflix type of thing of you're going to probably end up being the blockbuster companies that choose to just ignore AI versus the Netflix who choose to embrace it and kind of move forward.

Speaker 4: 30:25

That's a great point, John. One thing I was just thinking about of use cases in construction with AI is you know different cities and counties have different codes, right, Different building codes, and you know, depending on where you're building, if it's commercial, residential. You named a multitude of different areas. You guys are successful and you know maybe one good use case could be quickly finding out what the code is for that area. You know type in a code, type in the area you're in, and boom, the, the general contractor, they have that information. So, yeah, just so many things you can do with it, but you know what you're you're coming before. It sounds like the two main things that you guys are really striving for is education policy and procedure, like get out in front of it, educate the staff and then have those documents to you know back you guys, but then to keep the data secure by having that document to show you know the workers in your fleet.

Speaker 2: 31:14

Totally and, yeah, there's a lot, I think construction has so much that was paper-driven, that just became digital, which is great because it is very indexable data and I think, yeah, the use case that you use there is actually a company out there that is working on that so you can even upload your construction documents.

Speaker 2: 31:36

They compare it to the local code and then tell you here's where you're going to need to maybe make a modification or do a change order to be in code with where you're building in and then you know.

Speaker 2: 31:50

I think in our space we've also seen maybe some potential for, like on the mid journey side, like image generation. So being able to maybe more quickly build some conceptual models for people and seeing how we can do that and then use that in conjunction with making quicker changes. So, hey, what if I, as an owner, want to look and see what would it look like if I did this, or what if I did? This Is being able to build some of those scenarios faster without having to have a person build a whole full 3D model and show it them. We can maybe use AI to generate some of those scenarios faster without having to have a person build a whole full 3D model and show it them. We can maybe use AI to generate some of those. So even those type of things I think are being explored in construction. But yeah, there seems to be a ton of use cases and the industry is pretty ripe for it in construction to do that.

Speaker 4: 32:33

Yeah, and you mentioned before, people are maybe worried that their job could be, could be lost to this technology. But, you know, maybe the conversation could be flipped to well. You use the word streamline, but really, like you know, along with streamline, we're we're trying to make the job. We're trying to provide you with this tool that's so powerful to make you more successful, right? So maybe you have a bigger bandwidth to do a better job or have lower stress, right? Or, along with doing a job, maybe you can do more right and be successful, be more of an add to the company as well.

Speaker 4: 33:05

So, there's a lot of different ways.

Speaker 1: 33:06

like you're saying that AI can make somebody successful in their career field, wherever that is, what would be some of the tools or some of the things you're seeing implemented that expedite kind of arduous processes or designing things? Where's that showing up? That's really speeding up the workflow.

Speaker 2: 33:24

We're pretty much we're in the infancy of some of it, but when use case I can tell you. We had a situation where a particular company we were working with for some reason, required us to have a policy on overwater, underwater oil drilling. We don't do that. Therefore we don't have a policy for it, but we had to provide a policy someone had to write. So normally, if we didn't have AI, we would have gone to our legal and risk team. We would have had them research it. They would have put together a policy, even if it was a short one pager, just to say we don't really do it. Here's what we would do if we did it, but we don't. Here you go.

Speaker 2: 34:05

We actually used AI to help build the first draft of that document. So we were like this is what they're asking for, based on this code Help us write a policy that essentially says we don't do this. And AI generated it legal, then tweaked it, reviewed it, and then that became part of it. So what was probably a several hour long process became like an hour meeting, that was, and it was done by the end. And so those are some of the large language. Model generation stuff is where we're seeing some of that pickup today, some of the responses we have to do. We can use large language model to draft responses, those kinds of things. So it's pretty early on in our stages, but that's kind of where we're seeing. Some of that to start pay off even quickly, is just some of those basic tasks that we would normally do ourselves and that are now kind of reduced down to maybe a meeting or 30 minutes.

Speaker 3: 34:58

Performance reviews are another good use case for those, because most companies have them, nobody likes to write them, nobody likes to give them Complete waste of time. So you can throw that right into the AI and set it at. Done A couple edits afterwards and you're good to go.

Speaker 2: 35:15

See, there you go Exactly Selfishly. I also use it for a lot of vendor responses Larger company we do get solicited a lot, and so sometimes I use AI to help me draft responses or pull out key points that I want to highlight or use. We just went through a software selection process for one of our groups and so I had chains and strings of email from three different vendors, from demos to questions we asked and responses, and I used Copilot to actually help pull those together into summaries, help us do some analysis on product comparison between them for us to kind of come to a selection. So, yeah, some of that tedious stuff like that, we're trying to find ways to remind ourselves like, hey, we have some AI that can actually help with that.

Speaker 3: 36:09

And it actually has proven helpful, which is nice.

Speaker 3: 36:14

The current county policies, ordinances what have you around? How you could feed power back into the grid if you were generating your own power and it seems to be almost a city by city governance around their interpretations of, maybe state and federal laws, federal laws so I could really see AI providing that streamlined view, rather than the human inspector interpreting the law that says, well, no, these batteries have to be eight inches from the wall or from each other for fire protection or whatever. That was that person's getting that information from somewhere. And I think halfway through the project, the story that I was hearing was the numbers somehow had changed and a portion of the project had to be redone, which was costly and probably not really adding any value to the customer. But being able to have that AI essentially as that intermediary and I think you were mentioning that there was some of that AI already in place or at its infancy to be able to take designs and maybe press them against standards to ensure that you're doing the right thing before you even start the project.

Speaker 2: 37:37

Yeah, especially in construction, rework or what we would call rework is is big obviously, is a GC.

Speaker 2: 37:45

You're eating that cost to go back and so trying to compare a lot of that to, yeah, local ordinances, making sure your plans are within spec of them and doing as much as you can to prevent rework, I think not only I mean just obviously helps you as a company from a financial performance, but also helps from a relationship with your owner or your customer that you're building for to not have to be the bearer of bad news, to come back in the middle of a project and say, actually I need to change this now and there's costs associated or time delay, but building better customer relationship as a result, and so we hope to see more of that.

Speaker 2: 38:21

South Dakota as much as I love them, we do have, I think, probably some counties that still have a lot in a book that's on paper. So some of our challenges maybe in this part of the country will be more digital access to that type of information. But in the larger metros that we build in, those are digitally available, and so I'm hoping to see more of that kind of evolve of, yeah, how can we run things through and maybe check for this before?

Speaker 3: 38:46

we ever get started.

Speaker 3: 38:48

And I'm just thinking here in the Twin Cities with Target and the work that they were doing to refine who their target customer was and then market to their target customer.

Speaker 3: 39:01

And this goes back a few years I think it was in the early 2010s where they had an analyst on their team Andrew Poole, I believe, was his name and or is his name his name and he created an algorithm of sorts that would be able to ingest information that Target was collecting on its customers, based on, potentially, where those customers moved throughout the store, their patterns of buying, and they were able to really create a persona for that person and really truly know what influenced that person and target at the time.

Speaker 3: 39:41

I'm not sure if it's still the same, but expecting mothers were Target's primary target customer, because they want to get that person before they have the baby and they're buying all of that you know, the pre-baby stuff and then, certainly after they have the child, all of the things that go along with it formula diapers, what have you so being able to identify who was going to become a parent and then, in particular, a female parent, and then go after that person specifically, and I think the way the story went with the work that Andrew had done was to be able to determine that there was a person who was going to become a parent and they sent them targeted advertising. Well, the person was still living at home under the age of 18, I believe and the person's father was getting the mail and they saw these flyers that were addressed to the young woman, and it was, you know, target flyers focused on baby things. So he went into Target and said why are you sending my daughter these things? Well, turns out, his daughter was pregnant. He didn't know about it and the Target formula was doing exactly what it was supposed to do.

Speaker 3: 41:13

As I understand, what they've done is they've just tweaked the advertising so that it's maybe not all, just the focused content, in this case, of baby related things. Maybe it's baby related things, but then there's other content around that so that when you're just looking at it, it doesn't stand out to you.

Speaker 3: 41:34

But if you're the person being marketed to, then it would resonate with you and this is going back again before the large language model. Ai was really in the public space. But I think companies have been tinkering with this for years and those companies that are high revenue companies are probably already doing this and have worked it into their algorithms to market to us.

Speaker 2: 42:04

Oh, I would completely agree.

Speaker 2: 42:05

I know of.

Speaker 2: 42:06

I have seen a couple of instances of predictive AI and that type of piece targeted end user or in some cases, being used for predicting project viability or profitability.

Speaker 2: 42:32

So being able to take past data and see if a similar project, what would be our change orders, what would be pitfalls, what would be things that are most likely to occur, just based on past data, has been something that's interesting and I think, with as much as things can be tracked now with data I mean we do almost pretty much everything digitally. Now using AI to be able to crunch that faster and look at predictive analysis or picking out people, projects, things that may be harder to have done in the past, will become very commonplace and I think it'll be interesting to see stuff that was only reachable by, like the targets of the world coming down to more of the mid market, that now we have access to cost effective AI technology that can do the same for us, and what that'll change for kind of that mid market space of business will be interesting to see in the kind of the next five to 10 years, I think.

Speaker 1: 43:22

So what kind of strategies do you employ to keep your business up to date? If these things are changing so fast, there's got to be, there's got to be some talk around. You know you had mentioned, you know you do quarterly, quarterly meetings or quarterly educational experiences for the staff. What are some of the other, the other strategies you guys like to use?

Speaker 2: 43:43

I know for us. I mean, we have a group internally that kind of looks over and is talking about AI, so we're all, in our own ways, trying to keep pulse on it. But yeah, it's kind of an ever evolving thing and it's something that is being talked about more at more levels. It's no longer I would say I've seen a pretty big shift even after the first of the year of it's no longer just a technology topic. More is being marketed to CEOs, other C-level executives, the mid-management level, whereas I feel like prior, maybe even to the beginning of this year, it's still kind of held out in the IT space.

Speaker 2: 44:25

And now I'm getting messages from my CEO that's like hey, I got this email from this group that I work with and they're talking about AI. Is this something you want to attend or should I attend it and learn about it? And so it's just interesting to see even how it's we're trying to keep a policy, even how that's kind of changing and where information is being given out that way as well. And so that's kind of how we're kind of taking a multilevel approach on how we keep up to date with what's going on, and then even we look at, yeah, and then even higher education as well, seeing what they're doing at the higher ed level, what exists out there, and so just kind of trying to attack it from multiple different angles so we kind of know where we stand in the marketplace.

Speaker 1: 45:04

Yeah, I know, I know you all deal with this on some level. The communication is a key aspect to kind of making sure your whole team is aware, and we've talked about procedures and policies a lot. Maybe you know we could do popcorn style. I know you probably could all commiserate on the challenges of, you know, working with diverse groups of people that tend to glaze over when you start going into the tech talk. Maybe we could just go around and just give some like pointers on when you're working with an organization. How do you keep the communication fresh other than just loading up the schedule with more meetings, Because I know how much we all love to attend an extra meeting every week?

Speaker 4: 45:45

Yeah, josh, that's great. I think one key thing that I've talked to some organizations about and this doesn't just have to be for the AI topic but for education it could be a newsletter, right, that goes out maybe once a month or every other week, something like that, with tidbits of new information, recent issues for attacks or phishing emails. You could have one targeted towards ai. Maybe what we're doing hey, this is the use case that you know, so-and-so used to help them, you know, with this project or whatever of safe uses for ai. But I think the power of a newsletter because a lot of people you know tend to this project or whatever safe uses for AI, but I think the power of a newsletter because a lot of people you know tend to use that or read that. They maybe get it on a Friday morning.

Speaker 4: 46:25

Friday afternoon or whatever it is, some light reading. Hey, take a, take part in this, and John commented on it before they were giving out gift cards. Right, Maybe read to the end. Do you comment or give us your take on this? You get a five dollar gift card to Caribou Coffee Starbucks or whatever it is.

Speaker 4: 46:48

But I think for me that's it. The quick advice really is to get out in front of everybody, but I think a newsletter you don't have to herd everybody into a room and death by PowerPoint, but it could be a quick hit newsletter.

Speaker 1: 46:59

Put Nick down for the newsletter. What do you like to use? What's your favorite strategy?

Speaker 3: 47:05

You know, just kind of extrapolating what Nick said, I think the future is delivering content to people in a way that they would best absorb the content.

Speaker 3: 47:16

So some people might be visual, some might be audio, some might want to read the content.

Speaker 3: 47:22

And leveraging AI technologies like HeyGen, which can essentially make a talking head and take text inputs and turn it into human voice, along with animation, is pretty cool. But I really think the way in which we want to deliver important content, like security training, for example, is to leverage AI to deliver that content in a way that would resonate most and be most impactful. So I don't know that we're there yet. There's technologies that do all of the things, maybe a little bit differently, but I don't think we have a platform yet. Potentially, index your organization If a co-pilot's able to index the team's communications that people have, the email communication they have, and if they're doing voice content over teams, potentially being able to absorb and translate that audio conversation, you're going to have a really good understanding of that person in their work environment, how they like to be communicated with and potentially we'd be able to deliver that in a way that resonates with them. And you know, we're probably three to five years off from that if things go along the current trajectory.

Speaker 2: 48:52

And I would agree I think kind of along both those lines is meeting people where they are.

Speaker 2: 48:57

I think that's the best success we've had.

Speaker 2: 48:59

So sometimes we may today, because of the lack of that kind of platform or technology, we may be triplicating some of what we do, but we do try to look for ways to, instead of what maybe was more traditional, of like saying, hey, we're either going to have death by PowerPoint or I'm just going to email you a different Word doc every week of here's the new policy we have of trying to find more creative ways of, yeah, whether that's a video, or we've even done events like, hey, we're going to have donuts with IT in the central part of the thing and you're going to show up and I'm going to give you kind of an informal talk for 15 minutes on this important topic, trying to just do different things to meet people where they are and where they learn best, and I think we're even just outside of AI.

Speaker 2: 49:41

We're trying to do that as a whole organization. But, yeah, I think that has proven effective as trying to not just assume that one way of communicating is going to be the best for everyone, but has. Yeah, I would kind of go with that as far as a good way of trying to meet people where they are.

Speaker 1: 49:59

If you want to meet me where I'm at, you can just offer free beer. You know pizza works, but yeah, free beer is usually a good one. Yeah, we're almost at an hour here, guys. I wanted to. You know pause. You know this will edit out, but offer up any last insights or anything that we didn't get to. If not, we can wrap. Otherwise, we can go for just a few more minutes and kind of conclude the episode.

Speaker 4: 50:26

Any thoughts on this? This was great.

Speaker 1: 50:28

Thanks, john, yeah, yeah.

Speaker 2: 50:30

No, I really appreciate it. I really enjoyed the conversation. It was great. I have a small team, so it's nice to get to talk to other technology folks. So, yeah, no, I really's nice to get to talk to other technology folks. So, yeah, no, I really enjoy this.

Speaker 1: 50:41

We're going to cut back in here and say, yeah, you know, podcasts another great way to communicate with people. We've been we've been getting a little on the comments section, so if you have anything you'd like to add, hit us up in the comments section. On YouTube, like and subscribe if you want more of the content that we're providing here. On the audit, Big thanks for john massey for coming on today. Uh, shout out. South dakota, midwest, um. Once again, nick mellon, eric brown. Thanks for your time. You've been listening to the audit yeah, josh.

Speaker 3: 51:09

One other thing. I think nick was talking about getting a third cat, so maybe in the comments if people want to come up with a name for the cat yeah, might be.

Speaker 1: 51:16

Uh might be good. A cat centric episode.