Code Story: Insights from Startup Tech Leaders

Today, we are dropping another episode in our series The AI Control Loop, How enterprises govern the AI they've already deployed - sponsored by our friends at Wallarm.Wallarm is the AI Control Platform for Enterprise AI, protecting every AI workload, API, and application in production, giving CISOs the governance they need and CIOs the speed they demand. Organizations choose Wallarm for a complete inventory of APIs, AI agents, and AI apps, patented AI/ML-based threat detection and blocking that operates at production traffic speeds.In this episode, Craig Thomas, Sr. Solutions Engineer at Wallarm, examines what rogue AI actually means in practice, where the risk materializes, and what it takes to move from detection to control.QuestionsWhen we say "rogue AI," what do we actually mean? Is it only malicious AI, or can legitimate systems become risky too?What are the most common ways AI systems drift outside intended boundaries? Once an organization understands what rogue AI looks like, where does that loss of control typically begin, and who is responsible for preventing it?How do shadow LLMs, unsanctioned agents, and unmanaged AI workflows create risk even when no attacker is involved? If AI drift often starts with normal business activity, where do shadow AI systems fit into that picture?Why can an AI action look legitimate in isolation but still create serious business, security, or compliance risk when viewed as part of a larger sequence of actions? As these shadow systems become more embedded in everyday workflows, why is it so difficult to recognize risk in real time?How do APIs, integrations, and connected systems amplify the impact of those seemingly legitimate actions? What changes once those actions begin flowing across APIs, business applications, and interconnected systems?What kinds of unexpected outcomes worry CIOs and CISOs most today when AI systems are operating across those interconnected environments? As that connectivity expands, what are security and business leaders most concerned about?And given those concerns, what does meaningful oversight actually look like when AI systems can act at machine speed? How should organizations distinguish between the experimentation they want to encourage and the unmanaged AI behavior they need to control? One challenge is balancing governance with innovation. How do organizations avoid slowing down AI adoption while still maintaining control?We know that many organizations can detect risky AI behavior after the fact. But if they can't stop it in real time, what critical gap still remains? Even with governance programs in place, many organizations are still operating reactively. In closing, what's the key difference between detecting AI risk and actually controlling it?Linkshttps://www.wallarm.com/https://www.linkedin.com/in/cu-craigthomas/Full AbstractIn this episode, Craig Thomas, Sr. Solutions Engineer at Wallarm, examines what rogue AI actually means in practice, where the risk materializes, and what it takes to move from detection to control.Not every AI threat starts with an attacker. Some of the most consequential AI risks organizations face today come from systems that are working exactly as designed, just not quite as intended. An agent that calls an API it was never supposed to reach. A workflow that exposes PII because nobody mapped the data path before deployment. A shadow LLM standing up in an AWS account because a developer needed to move fast and approval processes were slow. None of these require malicious intent to create serious business, security, or compliance exposure.Rogue AI is a broader category than most governance frameworks account for. It includes the unsanctioned, the unmonitored, and the unpredictable: AI systems that drift outside intended boundaries, take actions that look legitimate in isolation but create risk in sequence, and operate at machine speed in ways that make after-the-fact detection feel like a consolation prize. The gap most organizations have is not in detecting that something went wrong. It's closing the loop fast enough to matter.Meaningful AI governance requires more than policy and discovery. It requires the ability to observe AI behavior at runtime, understand what triggered each action and what it touched, and enforce boundaries before consequences compound. That closed AI control loop, from knowing what is running to seeing what it does to stopping what it should not, is the operational standard AI transformation demands. Most organizations are not there yet.Our Sponsors:* Check out Cash App and use my code CASHAPP10 for a great deal: https://click.cash.app/ui6m/mt82fpxl #CashAppPod. Cash App is a financial services platform, not a bank. Banking services provided by Cash App’s bank partner(s). Prepaid debit cards issued by Sutton Bank, Member FDIC. See terms and conditions at https://cash.app/legal/us/en-us/card-agreement. Cash App Green, overdraft coverage, borrow, cash back offers and promotions provided by Cash App, a Block, Inc. brand. Visit http://cash.app/legal/podcast for full disclosures.* Check out Plaud AI and use my code CODESTORY for a great deal: https://plaud.aiAdvertising Inquiries: https://redcircle.com/brandsPrivacy & Opt-Out: https://redcircle.com/privacy

Tim Lidman lives in Denver, CO. He has had an unconventional path to being a Tech CEO. In fact, He moved from London to Sweden when he was 18... to try to be a heavy metal rock star, trying to make it big as a drummer. To earn extra income, he got into tech sales - which went really well. Eventually, he worked with WebEx (around the time it got bought by Cisco), for Success Factors (when they got bought by SAP), and then eventually, doing his own startup (which eventually got bought by Accenture). Outside of his professional life, he is married with 2 girls. From his music years, he extracts skills that drove his success to date, which is the ability to product development and execution down the same way you do music. In the days of his first startup, Tim's solution was used by consulting firms to power client engagement. Post exit, while overseeing things at Accenture, he noticed that the whole industry was powered by Microsoft files (PowerPoint, Excel, Word, etc.) - IE, driven manually. He started to wonder if he could codify the consulting process, to remove the manual burden. This is the creation story of Clyde. Our Sponsors: * Check out Cash App and use my code CASHAPP10 for a great deal: https://click.cash.app/ui6m/mt82fpxl #CashAppPod. Cash App is a financial services platform, not a bank. Banking services provided by Cash App’s bank partner(s). Prepaid debit cards issued by Sutton Bank, Member FDIC. See terms and conditions at https://cash.app/legal/us/en-us/card-agreement. Cash App Green, overdraft coverage, borrow, cash back offers and promotions provided by Cash App, a Block, Inc. brand. Visit http://cash.app/legal/podcast for full disclosures. * Check out Plaud AI and use my code CODESTORY for a great deal: https://plaud.ai Advertising Inquiries: https://redcircle.com/brands Privacy & Opt-Out: https://redcircle.com/privacy

Gregory M. Kurtzer is a veteran open-source pioneer, technologist, and entrepreneur with over 25 years of experience in high-performance computing (HPC) and large-scale enterprise infrastructure. He first gained widespread industry prominence as the co-founder of CentOS Linux, which grew into one of the world's most ubiquitous enterprise operating systems, and he later created other foundational open-source projects like the Warewulf cluster management toolkit and the Singularity (now Apptainer) container system. In 2020, Gregory founded his current venture, with the goal of modernizing infrastructure stacks for the cloud and AI era. He and his team recognized that traditional enterprise infrastructure was too fragmented and ill equipped to handle the next generation of data intensive computing. This is the creation story of CIQ. Our Sponsors: * Check out Cash App and use my code CASHAPP10 for a great deal: https://click.cash.app/ui6m/mt82fpxl #CashAppPod. Cash App is a financial services platform, not a bank. Banking services provided by Cash App’s bank partner(s). Prepaid debit cards issued by Sutton Bank, Member FDIC. See terms and conditions at https://cash.app/legal/us/en-us/card-agreement. Cash App Green, overdraft coverage, borrow, cash back offers and promotions provided by Cash App, a Block, Inc. brand. Visit http://cash.app/legal/podcast for full disclosures. * Check out Plaud AI and use my code CODESTORY for a great deal: https://plaud.ai Advertising Inquiries: https://redcircle.com/brands Privacy & Opt-Out: https://redcircle.com/privacy

Yoni Avital lives in Tel Aviv, Israel, with his wife and 3 older children. The oldest kid is a boy, so Yoni and he try to see as many football games as possible. He enjoys shopping with this girls, though it's cause he is their Dad, not because he enjoy shopping. He likes to travel, hike, and enjoys a nice white wine in warmer weather. His most memorable hike was at Yosemite, when he started at 4 am and came across a lot of wildlife. Yoni was in the virtual desktop space in the past. What he and his team realized was that troubleshooting these virtual experiences were incredibly complicated. They started to build an enterprise task manager, to centralize a task management UI to control the endpoints. When customers started asking to use it daily, Yoni figured out they had something unique. This is the creation story of ControlUp. Our Sponsors: * Check out Cash App and use my code CASHAPP10 for a great deal: https://click.cash.app/ui6m/mt82fpxl #CashAppPod. Cash App is a financial services platform, not a bank. Banking services provided by Cash App’s bank partner(s). Prepaid debit cards issued by Sutton Bank, Member FDIC. See terms and conditions at https://cash.app/legal/us/en-us/card-agreement. Cash App Green, overdraft coverage, borrow, cash back offers and promotions provided by Cash App, a Block, Inc. brand. Visit http://cash.app/legal/podcast for full disclosures. * Check out Plaud AI and use my code CODESTORY for a great deal: https://plaud.ai Advertising Inquiries: https://redcircle.com/brands Privacy & Opt-Out: https://redcircle.com/privacy