The Audit - Cybersecurity Podcast
Brought to you by IT Audit Labs. Trusted cyber security experts and their guests discuss common security threats, threat actor techniques and other industry topics. IT Audit Labs provides organizations with the leverage of a network of partners and specialists suited for your needs.
We are experts at assessing security risk and compliance, while providing administrative and technical controls to improve our clients’ data security. Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, while our security control assessments rank the level of maturity relative to the size of the organization.
The Audit - Cybersecurity Podcast
AI Architecture: Stop Button Pushing, Start Building
What if the difference between AI mediocrity and breakthrough isn't the tool—it's how you architect your approach? Carter Jensen from The Uncommon Business joins the crew to reveal why most people are stuck "button pushing" while others are unlocking 3X productivity gains. This isn't theory; it's the frontline reality of businesses transforming workflows with the right AI architecture.
If you're tired of surface-level AI hype and ready for actionable intelligence on integrating AI into security, compliance, and everyday business operations, this episode delivers. Whether you're Blockbuster or Netflix is up to you.
🎯 What You'll Learn:
- AI Architecture vs. Button Pushing – The mindset shift that unlocks 3-4X productivity gains instead of mediocre results
- Real Cybersecurity Wins – How IT teams use AI to speed through compliance audits (PCI, CJIS, HIPAA) and tackle complex security workflows
- Enterprise Implementation Truth – Why expensive AI tools fail without strategy, and what actually works for business adoption
- The AI Bubble Debate – Is this hype or the biggest business transformation since the internet? Carter brings receipts from the frontlines
Don't let your team fall behind while competitors architect their way to 4X output. This episode arms IT leaders, CISOs, and security professionals with the mindset shift needed to deploy AI that actually moves the needle. Like, share, and subscribe for more cutting-edge cybersecurity and AI implementation strategies!
#ArtificialIntelligence #Cybersecurity #AIforBusiness #ITaudit #ComplianceAutomation
You're listening to the audit presented by IT Audit Labs. I'm your co-host and producer, Joshua Schmidt. We have the usual suspects, Eric Brown, our managing director, and Nick Mellum coming from Texas. Today our guest is Carter Jensen from The Uncommon Business. We had the pleasure of joining Carter and his colleague Callan this last summer on an extensive AI workshop that we all learned a lot, a lot in. And so we've become friends and had him over for a speaking event at the IT Audit Lab's office in July. So we had to bring him on the podcast. So without further ado, I'll pass it over to you, Cart, if you could give us a little background on you and what you're working on now. Thanks for joining.
Carter Jensen:Yeah, thanks, guys, so much. And thanks for having me here today. It was an absolute pleasure to host you guys in our Automate to Accelerate group. I think it was the last spring. And then I got to come see the office. And now it sounds like game night is in tow. So I heard you have a wicked Wednesday night game night that I have to jump into every now and then. But uh yeah, I lead curriculum and innovation at the Uncommon Business, you know, and my main focus and our focus as a company is to really bring tangible AI education to business founders and business leaders. We do our best to leave all the sparkle and the fluff and the shiny objects to the side and introduce tools and products that you can immediately insert into your business, regardless of the industry or category you might be in. So we've been on a little bit of a tear for the last 12 months. We're a quick growing company, but uh we could not be more excited about what we've been able to do and really excited to see you guys again.
Eric Brown:And Carter, do we still have access to the when when we attended class? I think they were all recorded. Do we still have access to those recordings? For sure. You have access for a full year. Yep. Oh, great. I gotta go back and listen to the code. Go back and check it out.
Carter Jensen:And of course, you know, you got my phone number. So if you need anything, you just let me know. Sweet. Thanks. Yeah, for sure.
Joshua Schmidt:I I can attest to just how much I learned. And Eric was just asking me this at game night last Wednesday, you know, like what are you using from the class? And it's completely changed my workflow. Um, I've been able to take on way more projects. We just spun up um basically two more podcasts right before uh we had a couple of colleagues, uh Nick being one of them, going paternity, maternity leave, and um just everything from writing copy to you know timestamps for trend from transcripts to coming up with questions for podcasts to writing emails, everything has been totally um optimized in my workflow thanks to your class. So that's incredible. Once again, thank you for that. And and you know, furthermore, IT Autolabs, we're in a growth phase. I think we've been around now three or four about years, maybe a little bit more, and we're really, really starting to hit a new gear. So, um, what have you seen AI bring to the table with growing businesses like IT Autolabs and some of the other people you've worked with?
Carter Jensen:Yeah, and and you said it perfect, Josh. I mean, you know, one of the things that we see is when implemented correctly, right? And when implemented in uh honestly a non-traditional way, we see that teams like yourselves can get two or three X out of a workday. Um, and and one of the things we like to talk about is everyone was hired for what you do or started your business for a reason, right? You have this genius, you're special, you are unique. But when we actually go back and audit our days, how much time are you actually spending within that zone of genius, right? So much of our days are filled with expense reports and emails. And, you know, when you think about even this podcast, right? It's getting the links up and getting the descriptions and all this. And we focus a ton on those kind of, I don't want to call them low-value tasks, but tasks that are more administrative and tasks that pull you away from your true job. And we find ways to put that into the AI system so that you can focus more on what you are best at. Um I think that's one of the things that we just like it lights me up every day because we hear stories like you, Josh, of being able to take on three more podcasts, navigating parental leaves, allowing you to do two, three X more work throughout the day that's more impactful, but yet still get home at five o'clock, right? And I think that, though it seems basic, is kind of the magic of AI that I think so many people are missing, right? They think they can buy this tool and everything's gonna be fixed. Or they think if they just make this one investment into this one platform that they've figured out AI. And I, and we have found that it's that couldn't be any more wrong, right? And the real answer is truly go back to the simple solutions that get you back into that zone of genius. And that's one of the favorite things, my favorite things that we do every day with with business leaders like yourselves.
Nick Mellem:I've been using AI for a while before this, right? And I think my skills just got so much more sharp during this, or maybe unlocked different ways of thinking about it, uh, building prompts, et cetera. But a more specific win that I was going to call out was, you know, here at ITI Labs, we're doing so much cybersecurity stuff, obviously. But one specific task that we've been working on after hours is an open source intelligence game. So it's a teaching tool game. You could bring it to a conference. I mean, many different uses for this. Uh, but the goal is to learn open source intelligence for it could be a school, it could be somebody later on in their career. So we were having some troubles connecting the dots with some of the parts of this game. Well, our good friend Claude came and helped. We put the game into Claude, what we had, gave it a bunch of a prompt we made, told it about the game, what our end goal was, and you know, what we had so far. And Claude came in like we had 20 other workers, and it was so excited to be working with us. Like I would feed it back. Thank you so much for this. This is awesome. You did such a great job. And it was like, this is the highlight of my life to be working with you guys on this game, et cetera, et cetera. But the way that it was able to speed us up or pick, you know, maybe something that was going to take us six months longer, it probably cut at least six months off of the working load for three other people, including me.
Carter Jensen:Yeah, incredible, Nick. Yeah. Were you using it as a developer, were using it as a marketer, were using it as a product owner? How were you leveraging Cloud in that situation?
Nick Mellem:It was actually both, I would say, or all the above, because it was spinning, we were using Claude to develop uh marketing for it, like pictures and other graphics. And then I would actually take that and feed it to ChatGPT to give me the output for the pictures because it was incredible. You know, because Claude wasn't doing pictures. And, you know, I could so I could feed that prompt in that because it already knew everything about the game, so it was giving me a perfect output for the picture, but put it into ChatGPT for that. And then actually writing the questions for the players and the answers, it was writing the flags for the players because the goal of this is to find the flag in different social media outlets or whatever it may be. We're hiding these things in in on the internet, basically. Sure. So how are we leading people there? It was writing the story that we'd already give it, rewriting it, right? And uh fixing some errors. And um if we had a problem within the game, we'd go back to Cloud and be like, Do you remember at location two, we had the players do this, we're running into this problem. How should we how could we resolve this? And it would give us like four options and and then a best one. It'd say, like, I recommend this. So it was like we unlocked 20 people doing this.
Carter Jensen:Now, now what's incredible at that beyond the obvious um is you're not talking about some $50,000 a month subscription to some fancy coding tool, right? You're not talking about some off-the-shelf, you know, AI and marketing shiny thing. You're truly talking about the $20 a month, maybe a little bit more if you're using Clog Code, but you're truly talking about duplicating what you all do so best is building these experiences to teach people about this in a way that you never would have been able to with the size of and time and investment, etc., all within again that $20 a month tool. And that's just so fundamental to what we think about is there's so many shiny objects out there. But the reality is the true unlocks come from just these core tools and actually knowing how to use them and knowing how to integrate them into a challenge like you just described, Nick, and that's absolutely perfect.
Joshua Schmidt:That's awesome. Eric wanted to do uh a little bit of a fun icebreaker here that we usually inject into the beginning, but um, I was gonna say what is everyone's favorite creation or creative creation um built from AI. So I'll go first. My example would be these Motown rehashes that are happening on YouTube. I don't know if you've seen them where they're they're taking a 90s grunge song, whether it smells like Teen Spirit or the one I recently saw was uh Stone Temple Pilots Interstate love song, was turned into like a Motown song with soul singers. And it's gotten to the point now where it's amazingly good, right? And I'm not quite sure as a musician like what the inputs are. I'm I'm kind of curious as to how much they're they're they're messing with each little parameter. But um, but yeah, I think it's it's incredibly cool. The arrangements, the musicality that's coming across is kind of scary. I thought you wouldn't like that, Josh, because it's infringing on your work. Well, it was kind of s AI slop as they call it, right? Up until like 10 minutes ago. And just within the last few weeks, uh late night YouTube scrolling, I've been coming across some scroll. Yeah, yeah, doing some late night rabbit holes, and the ones that are coming out now are are actually really good.
Eric Brown:And Josh, we're we're we're using that music um it when during the the game nights when it's kind of like you know, close your eyes when the the game master is going through the sequence of events of things that happen at night during the blood on the clock tower game. We're using that, those um uh as you said, those Motown kind of AI mashups that people might have heard.
Joshua Schmidt:Yeah, Jamie needs to pump the brakes on some of those tunes that he's picking there. But yeah, that was my favorite creation. I I'm sure you guys have seen some other things. Doesn't have to be music, but I'm curious we can do a little popcorn style here and and share kind of our famous findings.
Nick Mellem:I'm having a hard time picking one that would be my favorite, but I think something that's coming up and we're seeing is um like real-time language translation. I think it's super cool. Like now the new AirPods. Uh, Carter, I see you've got AirPods and I wear AirPods a lot. Um, I think the Pro 2 and the, I don't know, maybe they all are doing it now with software, but specifically the number two and number three, they have uh language translation where you can download and you can have that conversation. So I I mean if I were to pick one right now, I think that you know, AI assisting in translating languages if you're traveling or or wherever situation you're in. Oh wow.
Eric Brown:It it was only a couple of a couple years ago. Remember, you could take a picture of like a sign that was in a foreign language and it would translate.
Nick Mellem:Yeah. I saw some people on YouTube taking this feature and going to a nail salon thinking they could hear the the background what the people are talking about. I guess it didn't work quite well, but I'm assuming we'll be there soon.
Joshua Schmidt:Eric, do you got a favorite favorite discovery?
Eric Brown:Um you know, when Mid Journey first came out, I kind of got enamored with Mid Journey a bit, which um was the ability to to do to create images from text. And that was maybe a you know a year and a half or so ago. And and that was um that was kind of fun because it would you you know, you you'd have these crazy inputs and you can get pretty specific, like use a Carl Zeiss lens or whatever you want to kind of create the the image. And you know, the images at that time were not perfect, like humans are coming out with like five fingers or whatever or six fingers because AI can't do hands or couldn't do hands real well back then. But you know, I I I still like just the the raw large language model because I'm still fascinated by it, right? Like it's all all it is is a great word predictor, and we've ascribed so much to what you know, quote unquote large language models are, but all they are is really good at interpreting human language and predicting what the next logical word is in that conversation. And you know, it doesn't understand, it's you know, it's it's it's just a great predictor, but yet it seems so damn real. So it's almost like the wizard behind the curtain. Um, and I just love that because you know I use it all the time, right? You could throw data into it, you're gonna get get a good response back, you could even have conversations um with it to to kind of help work through uh things that you're working on. Um and and it produces, you know, generally some really good stuff, but it amazes me how it works when it doesn't really have that conceptual understanding of truly what it is that you know it's it's not it's not truly thinking like a human.
Joshua Schmidt:That's awesome. I I know Carter, you're deep into this world, so I'm curious to hear what kind of one of your favorite shopping findings or something you found interesting.
Carter Jensen:Yeah, I mean, we we get to see so many great case studies every day from the people we get to work with. And so I was struggling a little bit to figure out what was a personal win because every day we see these breakthroughs, and we get to see these breakthroughs. We could probably get into some examples later on. But from a personal perspective, um, one of my best friends just uh retired from the service after 20 years, and we weren't able to make his ceremony um down in North Carolina, and so we wanted to give him something. We got kind of this book of memories of kind of his life, and we wanted pictures of all ourselves. And the new image models, kind of, you know, jumping into a little bit about some of you guys said, are absolutely incredible. And we use it just for a simple photo editor, which I know seems trite, but at the end of the day, it was so good where we could upload photos that maybe had people in it, or it was cropped in the wrong way, or we needed it to have a higher resolution, or whatever it might be. And we were able to pump this book out so fast because we were able to remove people from different scenes, we were able to place people in different places, and it came out with this really professional looking book, and it was really the first time I had seen AI image generation work to the quality of print, right? And I know this doesn't seem applicable to many as we live in this digital world, but it was the first time I saw that manipulation work so well that we could actually print a high definition book with these edits, and no one will ever be the wiser of the edits that were actually made. Um, and so I think it's just this new territory of image generation, image editing, image manipulation that's gonna be absolutely wild to see what we do with it.
Joshua Schmidt:And do you think that generations getting closer to being just like a human experience where, you know, up until recently you could really tell the difference between the music or the text that's being generated? And I'm assuming what you're meaning, you know, behind the scenes, these prompts or the architecture of these prompts can really influence just how personalized these uh the creations can be.
Carter Jensen:Yeah, it's the prompts with the technology, the two married together to give you that output, right? And we were using Google's new, well, it's not really new anymore, but the nano banana model, which is a funny name, but one of the best image models out there, especially for editing. Um, and you know, we use it in business all the time. We see our clients using it a ton. Um, but you know, when you actually get like a real world application, there's a need, there's a barrier in front of you, and you look across kind of that core tool set and you say, hey, this is going to be the perfect thing. And so quickly with the right prompt and that right tech, again, conjoining together, that then allowed us to get so many things done that would have, you know, been a pain to actually get manually figured out. And so I think that was really unique. Again, that first time we saw it actually come to life while also just alleviating a problem that we had and actually delivering something really meaningful and awesome to a good buddy of ours. So I think that's like what I love to focus on is that real life tangible example of things where, hey, like it all comes together and it works so flawlessly, it's just it's magic.
Joshua Schmidt:So can you walk us through like what you mean by AI architecture when you're talking about that at the uncommon business instead of just being a button pusher? I feel like a lot of these tasks that people are doing are kind of button pushing, and I'm guilty of that as well. 100%. Where's that paradigm shift between being a button pusher and an actual architect?
Carter Jensen:Yeah. So we we live in this model, like this world now where you know Chat GPT is not new for anyone. You know, we're four years into this journey. And when I look across, you know, the the thousand people we bring into the party every couple months, you know, most people no longer are worried about how do I, what is ChatGPT? What is a large language model, how do those things work, et cetera. But what we see is that most people, we call them AI offloaders, right? Uh, this idea that you are that button pusher, Josh, as you just talked about, you're someone who goes to Chat GPT or Claude or whatever your tool is and use it like Google, right? You say, write me a great email or send me a blog post or for this, like write me a description for a podcast, right? And so many people either take that for the face value and use it, which is the worst case scenario, or they immediately discount the ability for AI to do anything, right? It's like, well, it's not that good at writing emails, it's not that good at, you know, we're doing whatever's in front of you. And the reality is that architecture, Josh, you brought up, it's this idea of how do you use it as that thought partner? You know, good AI architects are great communicators because they're able to articulate in the right way, in the right format. They can really dial in what they're asking for, and that's when the models come to life, when you can train them, when you can tune them, when you challenge them. And that is the real difference, I think, you know, when you talk about button pusher, like so many people these days are button pushers. And unfortunately, that doesn't break, you know, the barrier of true value we see with our clients.
Eric Brown:Carter, one of the things that we're working on is an AI voice-enabled help desk where um, you know, users can call in and the AI voice, like uh Air AI, maybe six months ago, was kind of at the top of the game of this, and I'm sure there's others now, but where it could triage, you know, it's it could, you know, take down who the user is, what their problem is, and then route it through a um or ticketing system on the back end, and then maybe there's pager duty or something like that to reach out to the to the tech team who would who would resolve the case. Have you seen any of your customers working with something like that? And what what's the experience been so far?
Carter Jensen:Yeah, it's um it's absolutely wild, and it's such a great program and project that you guys are embarking on. I think the the reality is that you know 80, 90% of the calls that have come in are something you've dealt with before, right? There are things that you have in your records, you you all have done a hundred different times, you know exactly what needs to happen. And it's when that data gets loaded in, all of a sudden that assistant and that call center or however you want to call it, becomes really powerful because it's based on the knowledge of the business that you guys have built. And it's based on all of your past client experience. You know, even if you were to manually do that, if you were to have a call center, if you were to have someone sitting at the front desk taking these calls and manually routing them, et cetera, they only remember so much. They can only be trained so much. But when you have the ability to have something that's all knowing and all seeing take this on and get the best response back for your customers, like that, that's absolutely wild. So we we see it a ton. We see a couple different things. The the most straightforward way we see it is through um simple text, right? So email, SMS, those types of things where you auto-generate drafts, you auto-route different, in your case, tickets, and it's a really good experience because customers are getting what they want really quickly. The answers are usually better than what the human could provide. And the backside, your efficiency is just out of this world. You can scale that infinitely. And now we're just seeing voice really come into play because I'm sure as you guys have seen, there's kind of two things happening. One, voice is getting really good, right? You know, people are, you know, the intonations and all of that is getting really, really good. The second thing is that we see for our customers' clients, right, they actually don't really care that it's AI because there's this new world where I actually know that AI could answer a problem or a question that I have better than a human could. Like, why is there a human answering this? Like, I know that if I just talked To an AI, like I'm going to get what I need quickly. So, you know, customers or clients are actually, they don't really care anymore. Even if they do hear it's AI, it's fine because they know it's going to be so good. As you kind of have those two things coming together, which is a really interesting way to think about how fast this is going to grow.
Eric Brown:I was just having this conversation the other day that as we're crossing that bridge from the the IVR, that old you know, system where it's like, okay, you know, press one to talk to sales and whatever, right? And then um kind of this you know, robot gets in the mix and you just start yelling operator at the thing, right? Because you need to get it. Because you don't because it you know it's gonna just get you in this loop and it's not gonna work. But to today, and and I would imagine I we're not far off. Maybe it's a year away where, like, as you said, that AI is gonna have that that that really deep knowledge base. It's gonna be able to answer the question faster and more accurately than a human. And you we're not far off from saying, you know, AI, right? Like if a human answer is no, I want to talk to the AI because I'm not gonna have to wait on hold. I'm gonna get the answer and I'm gonna get the help that I need faster. So I I I love it, how it's all coming together, and it's probably not too far off where AI in that capacity is gonna surpass what the human operator can offer.
Carter Jensen:100%. One of the weirdest examples I've seen of this work so well, and you guys are all gonna shake your heads when I say this, is actually the Xfinity AI assistant, right? A company known for absolute horrible customer service, et cetera. Um and the AI assistant through that not only is incredibly smart because they see and know the solutions to common problems, but it is truly agentic. And by that I mean it has tools that it can deploy agentically to fix your problem. And so I would encourage you to try it sometime. It's a really interesting experience because the first thing it's gonna do is it will search for any outages or any repairs happening in your area, and so it'll instantly come back and say, hey, the last repair we saw in your area was actually three days ago. Everything shows green on our side. And then it can actually, and you can deem whether people think this is creepy or not. For me, I don't care if it gets me to the end solution. It knows the last time your router was restarted, it knows what's connected to it, it knows how it's configured, and it can actually do router resets, router restarts, everything like that, all just through an automated chat. And it's just really interesting how the company has not only built, you know, a chat assistant that's really helpful, but you've armed it in a true agentic way with these tools that can actually take control of your system and actually re perform repairs without ever rolling a truck or without ever having to talk to someone that has to transfer you four different places in order to get it done. So, anyways, a quick case study that is probably really confusing for anyone who's worked with Xfinity, but it's one of the best examples I've seen. Is it voice or is it text? This one, well, I it's right now it's just text, uh, or the way at least I have interfaced with it. Um but you can think the infrastructure's there, right? And so, you know, it's easy said than done. But once the infrastructure's there, there should be no reason why voice couldn't be added to the top of it.
Joshua Schmidt:Cardi, you've introduced us to a lot of firsts, but uh calling Xfinity for recreational purposes, customer. It might be uh that's a new one. It wasn't on my bingo card, but uh that sounds like a good idea. Yeah, I think we should give them a call. Maybe we do a live video and just record it. Um my question that keeps bubbling up, and and this happened during the course of our our our workshop too, right? I kept thinking about Eric and Nick. Like, how does this fit into compliance? You know, if if if we're implementing these um AI agentic AIs and these LLMs into our business, Eric and Nick, how do you guys think about navigating that landscape with your clients?
Nick Mellem:Yeah, Josh, this is a great question. And I think it's great. We could probably have a whole episode just on compliance with AI and how we're you using it, but we're using it every day, I think. Uh, you know, specifically me. Uh I do a lot of auditing for a specific client, um, whether it's it could be FTI, we do a lot with CGIS. CGIS is probably one of the biggest um PCI, um, HIPAA, obviously one of the big uh all the big ones. Um, and Eric touched on one of the points I was going to bring up was how quickly these organizations are changing the protocols, they're changing the goal line, right? They're making all these new adjustments that we need to comply with to stay compliant, right? You know, the clients are changing things constantly. So projects are continuing, they the you know, they're the length it takes to do a project now is becoming longer because the the landscape is changing so much. So that was a long-winded answer to using AI has sped it up for us that we can keep our compliance hats on quicker, easier for many different governing bodies to help organizations stay compliant. Um, another big one that we use AI for is uh, and I recently did this maybe six months ago, uh, the last time was uh cybersecurity insurance. Um so we have some organizations that are going through these long audits, and it can really help um bring things into layman's terms to help them get through these long audits. Because if anybody's done done a cybersecurity insurance audit, they can be very, very long. Um and uh, you know, Eric also talked about like, you know, building our own AI, right, and keeping that stuff in there so we can generate for the organization, put all these policies in one place, it can make these audits so much easier to do because you can key this up and basically feed it the question, and it's gonna get you the answer. Instead of you going through all this documentation over the years you've maybe been at this organization, you have it right away. And it's cutting edge from A, what you just had most recently, and B from the compliance standard. So, you know, to me, it's actually one of, and for us, it's one of the biggest helps, I think, to get through these audits.
Eric Brown:Nick, uh I'm gonna jump in here because I I love everything you said there. And as you mentioned, PCI and CGIS, just to double-click on the CGIS piece, CGIS criminal justice information system. So there's um sets of data that um are labeled CGIS, and uh the the data comes from the FBI because the FBI manages the uh the criminal justice information system. And then states have state-level organizations that interpret the FBI policy and apply it at the state level. So in the state of Minnesota, the Bureau of Criminal Apprehension, the BCI, Bureau of Criminal Umvestigation, sorry. BCA, BCA, yeah, Bureau of Criminal Apprehension is the state level interpretation of the FBI CGIS policy. And it can get convoluted because the the FBI issues policy guidance, and then uh the the BCA comes through and and they issue their interpretation of that policy guidance. And one of the sticklers for me, as I play a variety of CISO roles helping organizations be compliant with the BCA that we've bumped up against is the the requirement of password um complexity and password resets. So NIST, the National Institute of Science and Technology, they've issued a standard years ago, like back in 2020, that passwords should not be changed regularly, because regularly changed passwords just encourage people to do spring, you know, 2024, summer 2024, and you know, that that because you've got to change it and it's gotta be different every quarter. So it it's just it's a very poor policy. The the BCA's interpretation in Minnesota is that the FBI standard still requires that frequent password change. So, you know, every 90 days, but that just leads to users having bad passwords. Uh the new standard is you create a long, complex password, you check to make sure that that password is not in a compromised database, and you don't change the password, you know, unless it becomes compromised, that that's much more secure. And um, I'm gonna go on a tangent here, but it we we work a lot in the government space, and sometimes you find that government you're working on a project team, and people aren't looking for ways to advance that the project. Sometimes they're looking for ways to get in the way of moving quickly. One example of that is people saying, well, that that's not PCI compliant, and and they don't even know what PCI compliance is, or that's not uh, you know, that's not CGIS compliant, right? Because they hear these things and they think they sound important by, or they think they have some interpretation that they've heard from somebody else, bringing it back to AI, you have that policy right in front of you, and sure, the policy is 190 pages, but now I can interrogate that policy. It's publicly available. I can pull it down, I can throw it into notebook LLM, I can interrogate that policy and say, you know, show me where it says this in the policy or that in the policy. And I can cite back, well, no, you know, you think you you you think you're saying this, but it's not true. Here is the actual referenced standard.
Joshua Schmidt:What do you what are your thoughts on that, Carter? Do you have anything to add about how you've approached like the cybersecurity angle to AI implementation?
Carter Jensen:Yeah, so a couple things on that, you know. First of all, you know, what Eric brought up is I think one of the more powerful things that it's so many, you know, I I was in big corporations for so long, and I remember poring over policy documents because I was always pushing the envelope, but obviously never wanted to go too far to put anything at risk or whatever it might be. You know, and and what ended up happening is you know, you would find one document that would allude to something, and then you know, that wasn't very crystal clear, but then as an employee, you'd have anxiety about the not clear policy because you're worried you're missing something, right? You know, and you're worried that you you might not be in compliance because heaven forbid you can't navigate whatever intranet has been built to hold all those policies and you can't actually do it. And I actually remember downloading the policies and then uploading them into Notebook LM to actually try to figure out how I can interpret those in a better way. Um but that that's just my my experience. Coming from like our clients and our customers, one of the interesting things that we have now is we're working a lot with enterprise who do mandate you know copilot usage, right? They mandate you know the ability for you to, yes, you can use AI, but it has to be within this very protected environment. And and really there's there's two things with that. One, it's actually great, right? I'd rather have them using co-pilot and using maybe a little bit more of a watered down, safe AI system than not using AI at all. We've worked with a lot of companies who are just saying nope, never, not uh that's never gonna happen, right? Um, and so uh we welcome them with open arms. The second thing is that ironically, just this morning we launched co-pilot training, right? And what happens is really copilot training, the stuff we teach and the prompting and that unification of communication and technology that we've talked about 10, 15 minutes ago, it still works in Copilot. It doesn't matter what platform you're on or what large language model you're on. Yeah, you might have some differing results. Yeah, some bells and whistles might be limited based on your environment. But at the end of the day, like, you know, these AI systems are so good, I don't really care if it's included in your enterprise system or if it's some off-the-shelf model. We can still see so much benefit from actually deploying this perspective in an internal system. And so we believe that this is a big bridge for us is the ability of saying, hey, yes, there's been a lot of compliance concerns. My company won't allow me just to use a Chat GPT account in the walls. Like, cool, but you do have copilot, right? Or you do have another enterprise system that is approved. The great thing about our teaching and what we talk about is again, not one of those shiny tools. Take all the learning and just translate it right into copilot. And we just actually launched that training here this morning of ensuring people felt comfortable and just some of the copilot basics. So that's a little bit uh kind of a two-edged answer, but I I do think you guys are spot on.
Joshua Schmidt:Interesting. You know, we just got these new hats here from IT I Labs. I submitted my design to be made of tinfoil, but uh they haven't been made yet.
Carter Jensen:I didn't check the mail yet. I think mine's probably right, it's in the mail.
Eric Brown:Your hat, or what size hat are you? Are you extra large, large medium? It's a normal large, straight ahead. Straight ahead. We have medium slash large. Yep, perfect. Or large large large.
Joshua Schmidt:We gotta get the tinfoil version for from the audit. Um I'd be remiss if we didn't get the tinfoil hat section in. So we're gonna wrap up today. Unless you guys got something to interject. We're getting towards the end. Oh, no. I got a little bit tinfoil. Depends on who you ask, right? If this is tinfoil or mainstream. There's been so much hype, and rightfully so, in the AI space, right? But I'm a big YouTube guy, spend way too much time on YouTube. There is a little bit of foot in the market, right? There, I don't know if it's clickbait, and I want to get your take on this, Carter. There is some talk of an AI bubble. There's a lot of investment happening here. We've seen bubbles in the past, whether it's the dot-com. What's your take on that? Is is there a bubble happening, or do you think the amount of investment and money being pumped into this is in lockstep with uh with the development and implementation and the um the increased productivity?
Carter Jensen:Yeah, that's a deep question. And one of the things that I love about my job now is I get to see businesses that are scaling in ways they've never been able to scale before, leaders being able to do things they've never even dreamed about doing, and doing it at a speed that I've never seen before. And I get to see, and I'm like I said, I feel like I have the best job in the world. I get to see that happening every single day. And so when I think about the bubble, yes, you can look at some data that, you know, you can look at this, you can look at that, you can look at the investment. But I think we are on like we are really not even on the verge, I think we are in the middle of just this incredible entrepreneurial, you know, powerhouse time, right? Um, and when I look at the businesses who are accurately involving these tools, even in the most simplistic way, we're seeing three or four X output from teams, you know? And whether that math lines up with the investment, I'm not here to actually calculate that. But I do not see a slowing down of this. The amount of success stories we see every single day that are driving tangible revenue for companies is just something I've never seen in my life before. And so I'm a little skeptical on said bubble. Um in that it's currently kind of hitting the news.
Eric Brown:Carter, it's almost like if we if we rewound the clock to like 19, you know, ninety-three, ninety-four when companies were starting to come online and you know, everybody's got those big CRT monitors and everything. And then you had the companies that adopted and were moving into the internet age, and then the companies that hadn't yet adopted it. It seems to me that it's, you know, there's still companies that haven't adopted AI, as you were saying, but uh pretty soon it's like that's just the new standard. Like the new standard is all of the workers are AI enabled. They know how to pose a query into chat just like you would use Google, and you're just gonna fall away if you're not there, if you can't do that, if you can't augment your code with a little bit of AI. And that's probably where we are transitioning to over the next five years or so, where it's just that that's the new norm. And we're not gonna have these conversations anymore. Like almost like, you know, can you do calculus w without a graphing calculator? And you you can't. So, you know, why are we trying to do you know hard math, pen and paper when we have all of these tools that'll do it for us?
Carter Jensen:Yeah, 100%. And I'll actually add one more dimension to that. There are a lot of companies that are investing in AI tools that are frivolous investments. So the equivalent of what you just brought up, Eric, is like you could have, you know, yeah, you could make a significant investment into all of the best machines and computers and CRT monitors in '93. But if they're sitting in a computer lab and no one's actually going in because they don't know how to use it, there it doesn't mean you are a technology or digital first company. What I'm seeing right now is that we have a ton of and big enterprise businesses are the absolute worst of this, in my opinion. Um, but they know they should do something, and the only thing they can do is throw money at the problem. And I'm not saying that's a disadvantage. If you have money, you can do a lot of things, but the amount of tools I've seen invested in and that sit somewhere and no one uses them, or the degree in which they would use them are just the 1%. There is a there's a complete mindset shift that has to happen within your employees. And it's not just the executives, it's not just the IT team, it's everyone to be able to actually use these tools in a way that shifts your perspective, that gets that 4x return. Just because you bought that fancy thing, that fancy tool, doesn't mean that you are AI first. And I think that's why I'm actually seeing it from the ground up. These smaller businesses as mid-sized companies who can truly embrace it are seeing the majority of advantages, in my opinion.
Joshua Schmidt:It's awesome.
Nick Mellem:It's pretty simple to me, honestly. And we've said this many times on the podcast. Are you Blockbuster? Are you Netflix?
Eric Brown:Well, I love Nick's example there of the Blockbuster versus Netflix. And if if folks don't know this one, um blockbuster actually wanted to pivot to an online model to compete with Netflix, but that um was undermined by Carl Icon, who was the the um investor into the organization. And Carl got the the um CEO fired, and then they brought in uh another CEO uh who reversed the strategy. Jim Keys reversed that strategy to go back to the physical stores, which you know ended up um just you know killing the company. And it's just like, wow, you know, that that that that was such a a pivot point for the the company and the investors that was just spoiled by the the overall owner's lack of ability to see vision and the future.
Joshua Schmidt:There's still one storefront left in Portland, Oregon, I believe.
Nick Mellem:Yeah, is it in Bend, Oregon, I think?
Joshua Schmidt:Yeah.
Nick Mellem:Yeah. There's a documentary about that. I have one last super quick question for Carter. And uh, that is you're if you have a question right now, whatever it is, you're looking something up, which AI model are you pulling up? Claude, chat GPT, who are you? Depend depends what you ask.
Carter Jensen:I knew you were gonna give me I knew you were gonna give me what that um uh but I will I will answer it. Um the Swiss Army knife is Chat GPT. If you're looking to write or you know um communicate, it's Claude. If I'm looking for real world opinions, knowledge, links, software, it's grok. Um and then if I'm looking for more news, current events, it's perplexity. Right? Um, and so we kind of seamlessly move between all four of them based on kind of the thing I need to get done. It's a great answer.
Joshua Schmidt:Well, we know you're a busy guy, Carter. So thanks so much for joining us again today. You've been listening to the audit presented by IT Audit Labs. My name is Joshua Schmidt, co host and producer. Today we're joined by Eric Brown and Nick Mellum, and our guests is Carter Jensen from the Uncommon Business. Please like, share, and subscribe. Leave us a little comment or a rating on uh Apple Podcasts or Spotify. Podcast, and we'll see you in the next one.
Eric Brown:You have been listening to the audit presented by IT Audit Labs. We are experts at assessing risk and compliance while providing administrative and technical controls to improve our clients' data security. Our threat assessments find the soft spots before the bad guys do, identifying likelihood and impact, where all our security control assessments rank the level of maturity relative to the size of your organization. Thanks to our devoted listeners and followers, as well as our producer, Joshua J. Schmidt, and our audio video editor, Cameron Hill. You can stay up to date on the latest cybersecurity topics by giving us a like and a follow on our socials, and subscribing to this podcast on Apple, Spotify, or wherever you source your security content.