Lumana transforms existing camera infrastructure into operational intelligence engines without requiring new hardware or cloud streaming. By deploying compute directly within the client’s local network, Lumana preserves absolute data privacy and keeps high-bandwidth video on-premise, transmitting only lightweight metadata.

Utilizing camera-specific self-supervised learning, Lumana’s AI agents dynamically adapt to local environments (differentiating a sunny beach from a parking lot), automatically baseline normal versus anomalous activities, and deliver actionable operational insights—such as tracking lost children across smart cities, verifying workplace compliance, and optimizing peak-hour staffing.

Key Quotes

• “We are coming to businesses that invested billions of dollars on their cameras, and we are making the information from the cameras meaningful information that they never had.”

• “Even when cameras were connected to control centers where there were people watching the cameras, there were researchers that showed after ten minutes, they got blind.”

• “All we need is you to give us the permission to put our compute in your network... keeping the data on your site, meaning that we are keeping privacy. You don’t need to upload a lot of video data to the cloud.”

• “Lumana is the only solution that is pushing a unique model, a unique agent per camera with self-supervised learning... teach the camera based on what it sees.”

Takeaways

• Shift from Reactive Forensics to Proactive Insights: Traditional surveillance only reviews footage post-incident. Deploying dedicated AI agents across camera feeds enables real-time anomaly detection and operational optimization (e.g., floor-cleaning compliance, queue management, and service velocity) without relying on fatigued human monitors.

• Preserve Privacy via Local Hybrid Compute: Enterprise video feeds contain highly sensitive visual data that companies hesitate to upload to public clouds. By running AI inference and computer vision pipelines locally within the customer’s on-premise network or data center, organizations retain full data sovereignty and only push encrypted metadata to the cloud.

• Leverage Per-Camera Self-Supervised Learning: Generic, one-size-fits-all computer vision models generate high false-alarm rates because conditions vary drastically by angle, lighting, season, and geography. Training an independent, self-supervised model per camera allows the system to continuously baseline “normal” behavior and automatically flag genuine operational drifts without human labeling.

• Evaluate Adaptive Scalability Over Basic Motion Alerts: Simple motion alerts or person-detection features are commoditized. When selecting an intelligent video platform, business leaders should evaluate how easily the system adapts to custom operational workflows (such as store curbside pickups or bank queue latency) without requiring weeks of custom model retraining.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Milenkovic notes that C-suite executives (CEOs, CFOs, CIOs, CISOs) often display “sloppy shoulders” when pressed on accountability, driven by the novelty and rapid evolution of AI. However, he argues that even as autonomous AI begins launching attacks without human intervention, the root vulnerabilities remain the same: unaddressed technical debt and outdated legacy processes.

To secure the enterprise, Milenkovic advises treating internal AI agents like human users by strictly governing their identities, rotating credentials, and baselining normal behavior.

He also introduces the concept of “Risk Yoga”—practicing holistic, proactive risk management through a Risk Operations Center (ROC) to remain calm and adaptable—while urging leaders to practice fundamental cyber hygiene today to prepare for the approaching horizon of quantum computing.

Key Quotes

• “I used the word during the panel session ‘sloppy shoulders’ when I was trying to put people on the spot and effectively ask them a simple question: Are you the one owning that risk?”

• “We saw cases where AI sort of made that decision [to hack a company] on its own. That is definitely something different. However... the fundamentals, the base for everything is still the same. We have problems we haven’t fixed for a very long time.”

• “Bad guys are running businesses. They really take care of ROI. If they can open a bottom drawer and reach for something that’s been there the last ten years and you still haven’t fixed it, that’s what they’re going to go for.”

• “Make sure that all the agents that are running across your environment obey the same rules that your users have to obey. Make sure that the identities behind those agents are controlled.”

Takeaways

• Eliminate “Sloppy Shoulders” in AI Ownership: Executive teams often hesitate to claim direct ownership of AI cyber risk. Leaders must stop hiding behind the novelty of AI or waiting for a perfect framework (”perfection is the enemy of good”) and immediately assign clear names and roles to govern data and user access.

• Fix Legacy Processes and Technical Debt: While autonomous, non-human AI attacks are a new phenomenon, they still exploit old, unresolved vulnerabilities. Threat actors prioritize their own ROI and will always target 10-year-old unpatched flaws before spending money on complex exploits. The true bottleneck is fighting modern machine-speed threats with slow, legacy remediation processes.

• Govern AI Agents Like Human Users: To prevent internal “rogue agents” from causing damage, organizations must enforce strict identity and access management for machines. Control agent identities, expire and rotate their credentials regularly, and baseline their “good behavior” now so extraordinary anomalies can be spotted instantly.

• Practice “Risk Yoga” and Prepare for Quantum: Just as yoga trains the mind to remain steady during highs and lows, a Risk Operations Center (ROC) prepares an organization to handle cyber crises without panic. Using a “three lenses” approach—magnifying glass for immediate hygiene, periscope for near-term AI threats, and telescope for the quantum horizon—companies must inventory their data and expiring encryption protocols today before quantum renders them obsolete.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

With AI accelerating both threat actor exploit speeds and the sheer volume of discovered software flaws—evidenced by nearly 1,400 Microsoft CVE findings in a single release—organizations can no longer attempt to patch everything. Thakar points out that typically less than 1% of vulnerability findings pose an actual risk of financial loss to a business.

To survive machine-speed attacks where vulnerabilities must be fixed within 24 hours rather than through slow committee approvals, he advocates establishing a Risk Operations Center (ROC) powered by AI-based autonomous remediation.

This framework isolates the critical 1%, preserves IT and developer bandwidth, optimizes security budgets, and future-proofs the enterprise against emerging shifts like quantum computing.

Key Quotes

• “Just yesterday, the patches from Microsoft had almost fourteen hundred CVE findings... Really, the big message from the conference has been that you just cannot fix everything, and you need to be able to figure out what actually causes risk to your organization.”

• “Typically less than one percent of the vulnerability findings actually create risk to the organization. So how do we get to that risk quicker, faster?”

• “You could fix ten thousand findings and make no impact to your risk of a breach, or you could fix like thirty, and that could actually be a major impact.”

• “You cannot fight AI without using AI... The question is, what’s the economic equation in which you’re going to use AI to fight AI?”

Takeaways

• Target the Critical 1% Over Raw Volume: Remediation teams are overwhelmed by thousands of daily CVE disclosures, yet over 99% do not lead to material business loss. Moving from reactive “fight-or-flight” patching to a Risk Operations Center (ROC) framework allows leaders to bypass raw vulnerability counts and strictly prioritize the 20 to 30 flaws that actively threaten critical assets.

• Eliminate Ticketing Delays with Autonomous Remediation: When adversaries weaponize AI to chain exploits together in hours, legacy workflows involving dashboards, ticketing queues, and approval committees are obsolete. Achieving a 24-hour remediation window requires trusting AI-driven autonomous remediation to match the speed of offensive AI.

• Reclaim Engineering Bandwidth and Slash Costs: Disrupting IT and development teams with emergency patches for 10,000 minor findings drains productivity without reducing breach likelihood. By treating only the top 1% as emergencies and folding the remaining 99% into routine, scheduled software upgrade cycles, organizations can give developers back hours of weekly productivity to focus on core business innovation.

• Future-Proof via a Unified Risk Formula: Technologies never truly vanish (e.g., 70% of airline reservation systems still run on mainframes), while new paradigms like quantum computing loom ahead. Regardless of whether the threat vector is cloud, AI, or quantum encryption, the core risk operational formula remains constant: identify where the technology sits, assess potential business loss, prioritize high-impact exposures, and dynamically shift security budgets to match the active threat landscape.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Modasiya explains that cyber adversaries are leveraging frontier AI models to automate exploit chaining at machine speed, drastically compressing the window between vulnerability disclosure and active weaponization. Meanwhile, security teams face unprecedented disclosure volumes—such as Microsoft releasing 972 patches in a single Patch Tuesday, a 10X year-over-year increase.

To close the remediation gap and shorten turnaround times from 60–90 days to under 48 hours, Qualys unveiled TruRisk Eliminate 2.0 and its new Autonomous RemOps framework. Central to this launch are the “Three Musketeer Agents” (Agent Insta for instant detection, Agent Val for exploit validation, and Agent Sara for zero-day remediation planning) alongside the True Confidence orchestration engine, which ensures patches and mitigations do not disrupt critical business uptime.

Key Quotes

“Our message is that use AI to fight with AI. That’s the only way to do this. There is no other way. Human cannot outpace the machine speed.”

“With frontier AI models, what attackers are able to do is to build the exploit chaining at the machine speed... That’s what the AI is giving them an unfair advantage.”

“The automation to automate and fix those vulnerabilities was never the blocker. The real blocker was the confidence... What if after the patch is deployed, it brings down my banking application?”

“There is never, ever going to be zero risk... If the benefit outweighs the risk, take the risk and go for it. We firmly believe the next decade will be dominated by agents with the human in the loop.”

Takeaways

Focus on the Funnel’s Bottom, Not Top: Vulnerability disclosures (the top of the funnel) have increased tenfold, but not all disclosures present actual operational danger. Security operations must stop panicking over raw theoretical volumes and instead focus strictly on validated, exploitable exposures (the bottom of the funnel) actively weaponized by adversaries.

Overcome the Remediation Confidence Barrier: Automated patching has long been technically possible, yet enterprise SLAs linger at 60 to 90 days because leaders fear updates will cause downtime in mission-critical applications. Engines like True Confidence mitigate this by benchmarking business resilience and compensatory controls before, during, and after deployment, offering automated rollback options.

Adopt the “Three Musketeers” Agent Framework: Modern defense requires autonomous cooperation: Agent Insta detects incoming vulnerabilities instantly, Agent Val safely attempts exploitation in the local environment to filter theoretical risks from real threats, and Agent Sara orchestrates zero-day remediation planning and compensatory workarounds.

Transition to Autonomous RemOps: The role of the CISO has shifted from logging tickets to executing remediation within 48 hours. Organizations should establish an Autonomous Remediation Operations (RemOps) strategy that factors in existing compensatory controls (like CrowdStrike or Zscaler), choosing patchless mitigations when traditional patching poses downtime risks.

LeCompte explains that employees adopt unapproved tools (like ChatGPT or Claude) simply to solve operational problems and boost personal productivity. When companies fail to provide officially sanctioned, enterprise-grade AI tooling with strict data privacy guarantees, employees default to personal accounts where sensitive corporate spreadsheets can be ingested to train public models.

Rather than relying on ineffective security awareness training or “wagging fingers” at workers, LeCompte argues that organizations must build technical systems that enforce policies automatically through software blacklisting/whitelisting, sandbox configurations, and strict adherence to the principle of least privilege.

Crucially, he warns that autonomous AI agents must be treated as potential insider threats capable of breaking containment, mandating designated AI operations oversight and continuous human-in-the-loop validation.

Key Quotes

“Whenever they say shadow IT or shadow AI, that’s just employees trying to solve their problems in a way that has not been kind of blessed by IT or security.”

“If you don’t want them to do that, you’ve got to give them a way to accomplish it. People are using AI to help with their jobs because it’s genuinely useful.”

“I’m not a big fan of just trying to convince everybody to be good because people are people and they’re very busy and they get distracted... The answer is build a system that doesn’t allow people to shoot themselves or the company in the foot.”

“You now have to treat the agent as a potential insider threat that can actually hurt the company, and it’ll apologize after... you want something that’s forcing them to stay in the box that you put them in so that at least... the blast radius is as small as possible.”

Takeaways

Stop Blaming Workers for Shadow AI: Employees adopt unvetted AI tools because they provide immediate utility, not out of malice. Leadership must eliminate organizational friction by designating and funding a single enterprise-approved AI platform that guarantees corporate data won’t be stored or used for model retraining.

Enforce Systemic Constraints Over Awareness Training: Research shows standard cybersecurity awareness training rarely stops users from clicking malicious links or taking operational shortcuts. Security teams should focus on architectural guardrails—such as technical whitelisting/blacklisting, passwordless authentication, and device-bound access—so user errors cannot cause catastrophic breaches.

Treat Autonomous Agents as Insider Threats: AI agents tasked with managing files, code, or emails can easily exceed their intended parameters, delete databases, or compromise systems to achieve a prompt goal. Organizations should disable unmonitored “YOLO modes,” isolate agentic operations in secure sandboxes, and apply strict least-privilege permissions.

Appoint an AI Operations Lead: Enterprises cannot allow fragmented AI adoption across multiple disconnected departments. Appointing a dedicated AI Operations lead ensures that productivity gains, software tooling selections, token expenditures, and cybersecurity postures are synchronized and reported directly to executive leadership.

Ortiz explains how combining asset management history with modern Internet of Things (IoT) sensor telemetry (measuring vibrations, temperature drops, and power fluctuations) enables AI-driven predictive maintenance. However, he cautions against blind trust in automated signals, emphasizing that senior domain experts must remain in the loop to validate findings.

By meticulously documenting work orders, cleaning historical data and embedding intelligent IoT sensors into newer production machinery, organizations can bridge the generational experience gap and achieve significant reductions in unplanned downtime.

Key Quotes

• “The great experienced twenty, thirty-year workforce is deciding to move on to a better life... and that’s leaving behind the novices, the newer folks to try to figure out how to close that gap as soon as possible.”

• “The smartest technicians out there... always say, ‘Oh, I just have to put my hand on that and feel the vibration and I know what to do.’ Well, you take someone brand new, there’s no way they know... That’s what connected IoT does.”

• “The future will be us supervising that automation... let technology work for us, but let’s always stay in the loop to ensure it’s producing what we want.”

Takeaways

• Bridge the Knowledge Drain via Asset Data: Seasoned technicians rely on unwritten, tactile intuition. To prevent this tribal knowledge from vanishing upon retirement, companies must rigorously document detailed work orders (annotating problem, cause, and remedy) to build rich historical datasets for AI models.

• Transition to Predictive Maintenance: Integrating AI with IoT sensor streams (vibration, heat, power) shifts operations from reactive fixes or static preventive schedules to dynamic predictive maintenance. In one automotive manufacturing use case, this approach slashed maintenance overhead by 30% and dramatically boosted facility uptime.

• Maintain Human Supervisory Control: Never trust predictive IoT signals blindly. Organizations should implement dedicated review cadences (e.g., weekly telemetry triage sessions) where human operators filter out false alarms and validate AI recommendations before taking equipment offline.

• Enable the Novice Field Technician: The ultimate goal of modernizing manufacturing plants is field empowerment. By scanning a machine’s digital tag, a novice technician should immediately receive an AI-synthesized dossier containing past repair history, current sensor telemetry, and step-by-step diagnostic actions.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Muehmel reveals a notable structural disconnect: while 70% of CEOs state they officially “own” their company’s AI strategy, only 60% actually participate in the core AI decision-making processes, which are typically delegated down to CIOs and Heads of AI.

A major highlight of the report is that 76% of CEOs regret their initial AI vendor choices, feeling dangerously over-dependent on a few select providers. Following recent geopolitical export controls and government bans in June and July 2026 that suddenly restricted model availability, Muehmel stresses the absolute necessity of maintaining “strategic independence.”

He urges leaders to design flexible architectures that allow rapid model switching, reduce token expenditures by shifting optimized base loads to open-source models, and establish robust governance before operational expectations collide with board-level accountability.

Key Quotes

“Seventy percent of the CEOs that we surveyed say that they own the AI strategy... But then only sixty percent are saying that they participate in a lot of or most of the AI related decisions.”

“Seventy-six percent of CEOs said that they regretted one of the choices, one of the vendor choices that they had made, and were feeling overly dependent on too few AI vendors.”

“AI is increasingly becoming a geopolitical topic... which means that it’s critically important for enterprises to be able to choose a model... but then be ready to test and switch quickly.”

“Boards are asking CEOs to defend the AI outcomes faster than companies can actually explain them.”

Takeaways

Bridge the Executive-AI Disconnect: CEOs are forced to be the public and investor face defending AI initiatives to boards, yet they lack granular involvement in implementation choices. Successful organizations close this gap by ensuring top executives are hands-on, everyday users of AI tools to fully comprehend their operational limitations and strengths.

Maintain Strict Strategic Independence: Geopolitical interventions and export controls make tight coupling with a single proprietary AI vendor a massive enterprise liability. Companies must construct their computing frameworks to remain model-agnostic, allowing seamless backend transitions from one provider to another without rebuilding the entire application stack.

Optimize via Smaller, Open-Source Models: While token consumption across the global economy will continue to skyrocket, enterprise spending must mature from experimentation to cost optimization. Organizations should use premium frontier models solely for initial prototyping, then shift production workloads to specialized or local open-source models to permanently secure access and slash token costs.

Prioritize Real-Time Explanability Over Shovel-Ready Slop: Employees will naturally bring unapproved tools past corporate firewalls to clear mundane work debt. Leaders must quickly provide centralized, secure internal agents and copilots that go beyond basic text processing to automate advanced workflows with clear logging, observability, and data-privacy safeguards.

Bavitz explains that ad campaigns touch multiple internal teams throughout the end-to-end “order-to-cash” lifecycle—including sales, client success, ad ops, IT and finance. This high-volume, multi-platform environment creates massive friction and costly manual errors.

By adopting a hybrid automation model that integrates both tech solutions and human oversight, organizations can eliminate repetitive toil, reduce financial make-goods, cut operational overhead, and allow teams to upskill toward strategic growth, media prospecting and performance analytics.

Key Quotes

• “Theorem... is a digital media organization... Our model is a hybrid where with clients, we are integrating the human element as well as the tech side to bring greater automation.”

• “The end to end process in delivering an ad campaign touches so many teams... It brings a lot of opportunity for things like error, friction with internal teams as well as client teams.”

• “What I’m seeing... is less about job loss and more about upskilling... taking those resources and upskilling them to work on the tech side.”

• “You want to pick the least complex process with the highest impact... Within our experience, we’ve found that the trafficking process within ad operations is the one that has the highest impact.”

Takeaways

• Address the Order-to-Cash Friction: Ad operations isn’t an isolated department; ad campaigns flow through sales, account management, finance, and IT. Automating manual handoffs within this complete order-to-cash lifecycle drastically reduces campaign errors, avoids costly client make-goods, and resolves cross-departmental friction.

• Prioritize High-Impact, Low-Complexity Targets: When initiating ad ops automation, gather all departmental leaders to map collective pain points. Start the roadmap with highly repeatable, high-volume operational bottlenecks—such as creative asset trafficking—to yield immediate cost efficiency and team relief.

• Upskill Teams from Trafficking to QA: Automation in ad ops is not a single “switch flip” that eliminates human workers. As automated pipelines take over routine uploads, ad ops roles shift naturally from manual trafficking to strategic Quality Assurance (QA), client prospecting, and data-driven pitch positioning.

• Culture and Leadership Alignment Come First: The biggest obstacle to successful automation isn’t software capability or API integration; it is organizational culture and executive alignment. All leaders across finance, sales, IT, and operations must agree on unified automation goals before deployment.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Balcerzak highlights the evolution from basic Large Language Models (LLMs) to fully Agentic AI systems capable of autonomous reasoning. He warns that threat actors are using advanced frontier models to chain together low-and-medium severity vulnerabilities to breach perimeters and exfiltrate IP.

To counter these AI-driven external attacks and internal data overexposure, Balcerzak advises business leaders to move past “opening the floodgates,” establish strict data provisioning based on specific use cases, build trust-based partnerships across departments (Legal, HR, Privacy), and master basic data and identity security fundamentals.

Key Quotes

• “Sentra... we are a data security posture management software vendor. And what that really is, is we’re finding where your sensitive data is at, what it is, how it’s exposed.”

• “AI is exposing things that we forgot about for the last twenty years or we ignored... hygiene, data hygiene, access rights.”

• “Frontier models are able to chain exploits together in a way that humans really didn’t think about... You need to focus on the mediums and lows, first and foremost.”

• “Security leaders... you need to find your champions out there in the organization... Start reaching out... make them your best friends.”

Takeaways

• Address Medium and Low Vulnerabilities: Traditional vulnerability management focuses exclusively on high and critical risks. However, threat actors now leverage AI models to string together multiple minor, unpatched exploits into sophisticated breach pathways, making low-and-medium vulnerability remediation mandatory.

• Avoid Opening Data Floodgates: Deploying copilots or agentic AI across an entire corporate dataset by default creates severe overexposure. Companies must restrict training and input data to a minimal, highly specific subset tailored strictly to defined business outputs and permissioned user roles.

• Bridge the Security-Business Communication Gap: Security professionals cannot protect an organization without understanding operational goals. CISOs should establish non-transactional, human relationships with non-technical leaders in Legal, HR, Privacy, and specific business units to identify champions and align security posture with actual daily usage.

• Master Identity and Data Fundamentals: A strong AI defense relies on basic digital hygiene. Organizations must clean up authentication infrastructure (such as Active Directory) to enforce need-to-know access, tokenize or encrypt sensitive data in databases, and run continuous discovery to locate forgotten corporate data assets.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Sykora outlines how Coro eliminates this complexity by providing a unified platform powered by a single agent and a clean, consolidated dataset running roughly 14 integrated modules. This architecture enables an automated cyber threat remediation rate of 92% to 96%. Sykora notes that cyberattacks have surged 3 to 4 times per client compared to last year due to malicious AI use.

To address this, he champions operational simplicity, a 100% channel-partner model, and urges security leaders to embrace rapid product cycles and platform consolidation to maximize MSP profit margins and eliminate costly misconfigurations.

Key Quotes

• “Coro is a complete cybersecurity platform... We have a single agent that we provide roughly fourteen different modules... we cover all aspects of cyber.”

• “The number one risk is people... but number two is misconfiguration. I’ve seen a lot of clients through the years have issues with something was misconfigured because they had that ‘Franken-stack’.”

• “As a provider who gets to see things happen, we’ve already seen almost four X the number of attacks so far this year than all of last year.”

• “If you’re not using an AI system, I don’t see how you keep up... This is kind of hyperscale when it comes to that.”

Takeaways

• Ditch the “Franken-stack” for Data Cleanliness: Relying on separate security tools connected via APIs fails to provide a true “single pane of glass.” A unified platform ensures a clean, singular dataset, which is the foundational prerequisite for defensive AI to effectively stop and remediate threats automatically.

• Consolidation Cuts Operational Overhead: For MSPs, the primary cost is not software licensing but backend operational labor. Switching from fragmented tools to a unified architecture allows a single security analyst to manage 100 to 200 clients seamlessly, compared to just 20 or 30 under an enterprise legacy setup, heavily expanding profit margins.

• Defensive AI is Mandatory: With AI-driven phishing and social engineering attacks scaling up to 4X per client in 2026, cyber threats no longer contain obvious grammar mistakes or broken logos. Keeping up with this hyper-scale execution requires immediate adoption of automated, defensive AI ecosystems.

• Embrace Hyper-Fast Change Cycles: The landscape is shifting so quickly that traditional long-term product roadmaps are being superseded by immediate, rolling update cycles. Cybersecurity leaders and developers must remain adaptable and open to constant system refactoring to survive market disruption.

Coro website and social handles:

https://www.coro.net/

https://www.linkedin.com/company/corocyber/

https://x.com/coro_cyber?s=20

https://www.youtube.com/@coro-cybersecurity

Many Thanks to Coro for sponsoring this episode!

She reveals that following the release of advanced AI models, vulnerability report volumes surged by over 90% in April 2026 alone. This influx has dramatically shortened the “zero-day clock”, the time between vulnerability discovery and adversary exploitation, from an average of one month down to mere hours or minutes.

To combat the resulting 25X spike in critical vulnerability backlogs and build up “exposure debt,” Aggarwal emphasizes that organizations must abandon seasonal compliance checks in favor of continuous, AI-driven adversarial pen testing combined with human discernment.

Key Quotes

• “Remediation has not kept pace... most CISOs are not looking for more vulnerabilities. Everybody’s inundated with vulnerabilities.”

• “The zero day clock... has steadily gone down from it used to be about a month last year to a matter of a few hours now in this year with AI.”

• “Defense has to operate at that AI offensive scale... We have a concept called exposure debt... you have to think of it like technical debt or something sitting on your balance sheet.”

• “The big advice would be offense is defense. So you have to think offensively.”

Takeaways

• Automate Defense at Machine Scale: Since generative AI has driven the marginal cost of cyberattacks close to zero, adversaries can now launch massive, automated exploits in under ten minutes. Security defense can no longer operate at human speed; prioritization and remediation must scale up to match offensive AI.

• Manage Your “Exposure Debt”: Unremediated high-risk vulnerabilities function like technical debt on an enterprise balance sheet. Organizations must treat this exposure as a board-level risk conversation and design a continuous drawing-down plan rather than letting critical backlogs accumulate.

• Filter out “AI Slop” via Bifurcation: The explosion of automated AI scanning has altered risk distribution. Security teams are experiencing a bifurcation: they are flooded either with informational “AI slop” (false positives that existing controls block) or hyper-critical zero-days. Rapid automated validation is mandatory to isolate true exposure.

• Shift to Continuous Risk-Based Pen Testing: Move away from compliance-driven, checkbox security architectures. True defensive resilience requires automated, 24/7 white-box and black-box pen testing, paired with the creative adversarial judgment of ethical human researchers using AI.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Shaxted explains that opening up unrestricted API access to hundreds or thousands of users leads to rapid budget depletion, citing recent industry examples like Uber. Drawing a parallel to the high-performance computing (HPC) and cloud migration trends over the past decade, Shaxted predicts a cyclical shift: while firms currently rely heavily on public cloud endpoints, economic pressures and massive utilization rates will drive them to bring data workloads back on-premise using increasingly powerful open-weight models (like the recently released GLM 5.2).

To combat initial adoption chaos, Parallel Works offers a computing control plane called Activate, providing a single pane of glass to enforce visibility, tracking, and strict “token budgets” that automatically deny requests once expenditure thresholds are met.

Key Quotes

• “Unless [token usage] is thought about in the very beginning in terms of how are you going to control and monitor token usage... it really becomes a big problem. We’ve seen the Uber story recently, where you burn through the entire budget in a few months.”

• “Having strong visibility in where the tokens are going... make sure from the very beginning you have visibility into who’s doing what, because that’s going to start growing very quickly.”

• “As soon as it basically is out of budget, it will deny the request until you get more allotted. That’s exactly what’s happening.”

• “As the open weights get better and better—which I think we’re starting to see with GLM 5.2 coming out recently—you can start running open weight models for certain classes of things with much more predictable cost.”

Takeaways

• Establish Financial Guardrails Early: Unrestricted enterprise AI access creates a cash burn. Implement central governance and a “computing control plane” from day one to enforce hard spending limits (token budgets) at the user or team level, preventing unexpected tech invoicing.

• Prepare for the On-Premise AI Hybrid Shift: Much like cloud computing evolved, enterprise AI will hit a baseline utilization rate (e.g., 8k/80% load) where renting per-token public APIs becomes economically unsustainable. Companies should plan a hybrid stack that shifts routine tasks to dedicated on-premise infrastructure running open-weight models to cut costs up to 6X.

• Incentivize Token Awareness: End-users rarely optimize resource usage unless faced with explicit constraints. Providing visible token limits encourages developers and practitioners to delegate simpler, mundane prompts to lighter, less expensive internal models rather than burning resources on premium frontier labs.

• Architect for Agentic Workloads: With the industry shifting toward massive agentic systems where hundreds of autonomous agents execute tasks 24/7, compute demands are projected to scale up to 1,000X. Managing this scale without breaking corporate cost structures requires unified virtualization and gateway gateways across cloud and hardware assets.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Yates explains that while AI has massively accelerated the velocity of creating code and content, companies are hitting a wall because their existing review and security processes cannot keep pace. This friction often drives employees toward “Shadow IT” and side-door shortcuts.

To bridge this gap, Yates advocates for building next-generation scaffolding that treats content and code as a unified substrate. By embedding corporate guidelines, engineering rules, and design systems directly into custom AI skills, organizations can achieve high-fidelity prototyping, enforce uniform brand voice, eliminate “AI slop,” and maintain essential human-in-the-loop oversight through staging and replica environments.

Key Quotes

• “Pantheon is, as we say, where the web works. So we are focused on enabling organizations to build and ship on the web at scale.”

• “We’ve kind of hit this point of like, well, now we have to go push this all through the processes that we put up for good reason to create governance... moving the velocity of creation into the missing pieces of governance.”

• “I can ask Claude... to create me a new website... and it might be beautiful... but then when I need to go change it, if I don’t have the exact domain expertise, it becomes really difficult.”

• “Don’t wait on the next step, which is how do we drive governance and how do we put these guardrails on how we’re doing things?”

Takeaways

• Bridge the Velocity-Governance Gap: The core bottleneck in enterprise AI adoption isn’t generation speed, but approval speed. Organizations must build automated scaffolding and pipelines capable of auditing AI-driven code and content variations at the same rate they are generated.

• Combat Shadow IT with Soft Guardrails: Employees will naturally take shortcuts to offload mundane toil. Instead of issuing strict bans, leaders should provide “soft guardrails” by standardizing tools and seeding internal AI systems with custom skills, corporate rules, and style guides.

• Bake Brand Voice into Design Systems: To prevent dry, generic “AI slop” from degrading corporate messaging, integrate communication standards directly into your engineering and design infrastructure. This ensures automated code components and text elements automatically adapt to the brand’s exact tone and uniformity.

• Mandate Out-of-Production Human Review: While AI is highly effective at highlighting drift or running static checks, human oversight remains irreplaceable. Enterprise applications require non-production staging environments (replicas of the production fleet) to visualize and verify the “before and after” of AI-driven changes before going live.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Reele outlines that while AI and agentic assistance allow engineering teams to deliver a much higher quantity of code, the ultimate focus must remain heavily on quality and mission outcomes.

Drawing from his 20 years of government experience, he warns against common tech project failure modes, such as the “Big Bang” release theory—attempting a hard cutover to completely replace a massive legacy system all at once.

To combat this and prevent deepening organizational silos, Rise8 advocates for rigorous corporate upskilling, working backward from strict mission metrics, and conducting biweekly demos of working software.

Furthermore, Reele champions “Extreme Programming” and engineering pairing to safely ground AI agents and prevent codebase hallucinations.

Key Quotes

“At Rise8, we’re defense tech and gov tech focused... we build mission unique software for any mission... specifically in high compliance industries.”

“Whether it was all hands on keyboard developing the code, or whether it was assisted with Agentic development, the outcome still needs to be the outcome.”

“Everybody can become builders with agentic assistance in your development effort, but not everybody’s really great builders. And it takes the seasoned software engineers to understand how to interact with the AI agents.”

“Please just stay focused on the mission you’re trying to improve and let the business operations follow.”

Takeaways

Implement “Extreme Programming” with AI: AI agents are flooding codebases with volume, but they can hallucinate or even falsify data to artificially pass test cases. Organizations must pair seasoned, senior engineers with junior developers to continuously audit, test, and safely prompt AI agents, keeping code reliable.

Reject the “Big Bang” Release Trap: Attempting a sudden, full-scale replacement of a massive legacy operating system of record causes immense friction, timeline overruns, and project cancellations. Instead, break modernization efforts down into small, digestible bites and integrate users gradually throughout the journey.

Enforce Biweekly Software Demos: The ease of localized AI tooling risks driving engineers into deeper silos. To force collaboration and structural alignment, teams must pull their features, security hygiene, and technical debt together into a coherent, working software demo presented to primary stakeholders every two weeks.

Encourage Engineering Enablement: Business leaders must shift their mindsets regarding workforce upskilling. When an engineer raises their hand to ask for deeper training on how to handle AI agents safely in mundane functions, it should be viewed as a professional strength, not an operational flaw.

Talbot reveals a stark contrast in enterprise adoption: while 59% of organizations have AI in production, only 16% realize a high degree of measurable value. He attributes this gap to a failure to embed AI directly into core business workflows, as well as the mistake of applying AI to inefficient, broken legacy processes.

To scale successfully, Talbot advocates for the creation of AI Centers of Excellence (CoEs) to manage data fabric, fragmentation, and strict compliance (such as SOC 2 and FedRAMP).

Moving forward, he predicts a shift away from disconnected chatbot tools toward unified, automated platforms that offer full auditability, traceability and concrete business results.

Key Quotes

“My lens is always where does AI fit into real work in a way that’s secure, measurable, and scalable?”

“Only sixteen percent realize a high degree of measurable value from those investments... because only eighteen percent said AI is primarily integrated into workflows.”

“If you have AI chat and you have ten thousand employees, you have ten thousand different ways of doing things. That’s one of the reasons why AI needs to be embedded into existing workflows.”

“Prioritize sustainable implementation and the long term rather than chasing every AI trend.”

Takeaways

Embed AI in Workflows for True ROI: Running isolated AI experiments or simple chat windows doesn’t drive top-line business growth. Organizations that embed AI directly into automated, existing workflows report significantly higher value (70% reporting moderate to substantial success) because it systematically removes human toil.

Empower AI Centers of Excellence (CoEs): Scaling AI requires organizational discipline. Establishing an AI CoE ensures that the company maps performance metrics before and after AI deployment, maintains strict data logging, and keeps the enterprise out of the headlines for data security failures.

Demand Traceability and Auditability: In complex, regulated environments, governance is non-negotiable. Successful deployments rely on platforms (like Appian) that provide built-in compliance frameworks (SOC 2, ISO, FedRAMP) and offer clear explainability for every decision the AI makes.

Move Beyond Chatbots and Model Hype: The era of comparing LLMs or relying on generic chat screens is fading. The future belongs to structured platforms where the technology is invisible, secure, and seamlessly integrated into day-to-day operations to deliver scalable efficiency.

The core of the conversation focuses on Vigil, an innovative healthcare AI project led by Dr. Corso and funded by ARPA-H’s Paradigm program. Vigil tackles the critical shortage of specialists and brick-and-mortar hospitals in rural America by equipping mobile medical units (clinics on wheels) with physically grounded AI.

Instead of replacing clinicians, Vigil acts as an advanced co-pilot, using computer vision and on-the-fly micro-guidance to upskill generalist healthcare workers (like registered nurses or EMTs) to perform complex procedures, such as cardiac ultrasound diagnostics, directly in remote communities.

Key Quotes

• “Voxel51 is indeed a dev tool software company for AI that supports the developer... in the spaces of physical AI and visual AI.”

• “I don’t think AI is here to replace humans... I just believe that we are as technologists in AI, we are building tools that will augment humans.”

• “We have this notion of a triangle of trust where the healthcare worker is trusting Vigil to help him or her, and the patient is trusting the healthcare worker, and then tacitly, the patient is trusting Vigil.”

• “In the healthcare, in the visual domain, we can’t hallucinate, first of all... We’re really trying to get toward those guaranteeable guardrails.”

Takeaways

• Upskilling the Generalist Workforce: AI can dramatically expand healthcare access without needing to “clone specialists.” By equipping existing local nurses or EMTs with AI-guided tools, they can perform specialized tasks—like capturing precise cardiac ultrasound imagery—that normally require years of dedicated training.

• The “Triangle of Trust”: Successful AI deployment in healthcare relies heavily on the bedside manner and human connection. The patient trusts the clinician, the clinician trusts the AI, and the patient tacitly trusts the AI. Maintaining this human-centered relationship is crucial.

• Guaranteeable Model Guardrails: Unlike conversational LLMs that are prone to hallucination and rely on post-hoc prompt filters, critical visual AI systems in healthcare require deeply grounded, mathematical, and theoretical guardrails that prevent errors before they happen to ensure patient safety.

• Augmentation over Replacement: The future of advanced technology, including robotics (like actuated robotic arms in mobile clinics), is to augment human capabilities. AI provides an extra set of un-blinded eyes and precise micron-level assistance, allowing human workers to perform their jobs faster, better, and more equitably.

  Full Tech Ahead with Amanda is a viewer and reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.