Michael opens by describing Archwell as a family of companies built around financial services, with Motor as its largest organization, and by drawing a clear line between the two AI problems he manages. The first is employee usage, where he worries about data leaking to third parties through the growing number of tools that are building in AI, and is putting controls in place. The second is governance of AI development, where Archwell is setting standards so its products avoid bias and never let AI make the actual decision. In mortgage lending, he explains, AI can flag that an applicant forgot to sign a field or check a box before the file moves through the process, while the decision itself stays with underwriters and humans. That philosophy carries into a favorite instruction for his team: treat AI like an intern, give it a specific task, always check the work, and remember it will not replace you, even as developers who hit their token limits react as if someone took their lollipop away.
The conversation then turns to the economics of AI, where Michael sees an unexpected check on the replacement narrative. A $200,000 software request would draw tough questions from leadership, he says, but $20 per seat across a whole workforce over six or nine months reaches the same total and slips by unnoticed, which is why he is building governance around consumption versus time based models. Asked whether organizations will bring AI in house, Michael says Archwell has tried and found larger partners with more infrastructure to be more efficient and cost effective, and notes that in house does not have to mean on premises, since a private cloud rented from a provider can keep data private without the burden of owning hardware. For now, contracts are his main control with frontier model providers, covering no training on Archwell data, retention, and how quickly they must notify him of an incident, and he prefers a provider who is accountable if something goes wrong over holding the patching risk himself.
In the back half, Michael turns to people and the road ahead. A hands on engineer who admits the move into leadership has been a challenge, he describes pulling his hands back from the keyboard, begrudgingly, in exchange for control over tools, training, and budget that lets him help the whole team, and he tells a younger teammate who never wants to lead that his skills will eventually outgrow individual tools. He calls this the most exciting shift he has seen in quite some time, not a scary one, while still preferring a human voice to an AI agent on the phone. On defense, he explains that because AI lowers the barrier to entry for attackers, he reached a clear conclusion after asking a CISO group that included Glasswing companies what a smaller company should do: partner and tool selection matter most, and he becomes a spectator watching two robots fight it out with his own money on the line. He closes with a candid conversation about unplugging, noting that not every problem needs solving immediately, and in a rare role reversal asks the host about CISO tenure and the pressure of the job, which he says leaders mostly put on themselves.
Resources mentioned in this episode
This episode is brought to you by CyberLynx.
CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection.
We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO.
Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.
Air Gaps Just Don’t Exist Anymore: Securing Critical Infrastructure with Tony Bryson - Ep 244
Human or Agent? Eight Identity Scenarios to Test Any AI Vendor with Marina Kelly - Ep 243
Why You Can't Commit to One AI Provider Anymore with Matthew Sanders - Ep 242
CISO
Matthew Connor: Matthew Connor here, host of the Cyber Business Podcast. Today we're joined by Michael McAndrews, CISO of Archwell Capital. Michael, welcome to the show.
Michael McAndrews: Thank you for having me.
Matthew Connor: Thanks for coming on. Before we get too far in, a quick word from our sponsors.
Sponsor Break — CyberLynx: Hackers are using AI to conduct machine-speed attacks. Is your security keeping up? CyberLynx sells industry-leading AI-powered cybersecurity solutions that detect threats in real time, so you know about an attack before the damage is done, not after. Learn more at cyberlynx.com. That's cyberlynx.com.
Matthew Connor: And now, back to our show. Michael, for those who aren't familiar, can you tell us about Archwell Capital and your role there as CISO?
Michael McAndrews: Certainly. Archwell Capital is a family of companies. We have numerous organizations working primarily in financial services. Our largest organization is Motor. Motor is a business process outsourcing group as well as an AI development group, and we focus quite heavily on financial services, particularly mortgages. We also have a non-judicial foreclosure company named Nestor, we have some development firms, and we have insurance organizations. We're really focused in that area, trying to bring all kinds of opportunities to consumers and help our customers across the whole spectrum.
Matthew Connor: I love it. You mentioned one of my favorite things, AI and AI development, so let's dive in there a little bit. I think we're living in a really fascinating time where the technology is advancing very rapidly, and you've got to keep up with the changes. If you're on the forefront, using AI to develop products and services, what's your advice to people? How do you keep up, how do you stay ahead, how do you plan for it?
Michael McAndrews: Well, AI development in particular is a challenge. I've seen two sides of this coin. Number one, it's AI usage by employees, and in those instances we're worried about leakage. We're worried about protecting our data, and all the different tools that are now building AI into them, are they leaking to a third party? From the usage standpoint, that's obviously a concern and we're putting controls in. But there's a deeper question when it comes to development, where we're really working on the governance and on setting standards for that development, to ensure we don't have bias and that we don't let AI make actual decisions. We're using AI to create efficiency. I mentioned the mortgage industry, for example. We would never allow AI to make a mortgage decision, and there are going to be regulations that will prevent those things, obviously, but AI can verify things. Did the applicant forget to sign a field, for example? Did they forget to check a box? Is there something that would force this application to be returned? If we can use AI to detect these things and stop it before it goes through the process, it makes it more efficient, and that's one of our primary goals, to reduce the time it takes to get through these processes using AI, but still leave the decision where it belongs, with underwriters and humans. So building that governance, to say this is how you develop these products effectively, that's been the challenge, especially when you've got so many different tools coming in, and then we look at the types of data and such. The governance over development has definitely been a greater challenge, and it's developing every day, but we're staying ahead of it.
Matthew Connor: Well, I think if you look at the life cycle, or the trajectory we're on with AI, it's still early days, even though it's been almost four years since ChatGPT came out, and it's amazing, the transition we've seen in that time. I think the last six months have been a huge transition and a huge improvement. The things you can do now that you couldn't do six months or a year ago, the stability and reliability of the frontier models now, with built-in guardrails, and what the output is and the way it assists people is a lot different than it was a year ago. As you look at that trajectory, I think right now the human in the loop is clearly the right solution, how do we use this to help us versus replacing us? When it first came out, you had this idea that AI can do everything and it can replace people, and Meta lays off ten thousand people because they're going to replace them with AI agents, and then they're hiring them back because, whoops, my bad, that didn't work. No kidding, huh? You don't say. Maybe they were five years too early on that, or whatever, obviously the time isn't there. But I'm getting to a question here for you. I wonder if that focus of, what can we do to make AI do all the stuff, that whole Meta approach of just lay people off and throw in agents, they'll do it, even if it's not great, enough of them will produce, monkeys-on-a-keyboard type thing, they'll produce Shakespeare, I don't know. But I think maybe we're going down a path where it is really going to be a tool that really helps us, and we've got to wrap our minds around that, as a tool that assists us, not a robot that replaces us. Is that right, or is that just a temporary transition here?
Michael McAndrews: Well, it's funny you say that, because I tell my team, treat AI like an intern. You give it a specific task, and you always check the work. The intern's not going to replace you. Now, you might train it to take part of your job at some point, but I notice, when the developers run out of tokens and hit a limit, you'd think you took a lollipop from a baby, and oh my goodness, do they throw tantrums. All of a sudden the work seems to stop, and I ask them, how did you work six months ago, before you had the AI tool? How did you possibly have a job all of these years? But now people have become very reliant on it. So I think we do have to caution ourselves that this is a tool that can assist us, but don't become reliant on it, and don't think it's going to replace us. Small tasks, repetitive tasks, at this point in development, I have no problem. I think agents are wonderful, but I think we've all called that number and heard the AI agent, and we've heard that voice and we know what's going on. I would much prefer the warm touch of a human voice. But yeah, I think we're on an arc where eventually there will be a lot of AI automated in. But no, I don't think it's going to replace that original thought that people use in their jobs. They need to keep it as an efficiency gain, not as a replacement.
Matthew Connor: I couldn't agree more, and I think it's unfortunate that we had so many businesses trying to over-leverage AI early on. I think that put a lot of fear in people's minds, and I think we should have promoted those failures more and discussed that more. I don't want to say chastised, but learn from that, and show that it was proof that this is for, as you said, efficiency gains, not human replacement. Will it shift things? Absolutely. Will your job? I think people should be looking at it like, my job is now so much better, like that developer who says, oh, it's so much better, the things I don't like doing, it can do, and the things I like doing, I can keep doing.
Michael McAndrews: Yeah.
Matthew Connor: I hear from developers all the time, some of them really love coding, and they really hate it if they're in an organization that expects them to be coding with AI only. It's taking the fun out of coding for them. I don't think it should be dictated from Mount Olympus that you use AI to do your work. Use AI where it makes sense, and this way the things you don't like doing, it does, and you get to be really happy about it because you didn't like doing it.
Michael McAndrews: I agree with you, I really do. I think it should be used, and developers are original thinkers, they should be allowed to choose which tools help them. And there's going to be a quality assurance team, I'm sure, so there's always going to be a check and balance. And speaking of checks and balances with AI and replacing, one of the things that's always been a bit of a challenge for people in IT, and may actually help us in this case, is budgeting. What I've found already is that AI tools are wonderful, but if I went to my leadership and asked for two hundred thousand dollars for a piece of software, they're going to question everything. Why do you need it? Can we develop it ourselves? What's it going to do? Do we have other software that already does this? But if we take our entire population of employees and give them twenty dollars per seat, over a period of six or nine months, we're reaching the same point, and yet it snuck in on us, because twenty dollars a seat, it's okay. So we're finding already that, with developers in particular, we need to come up with governance as to what is the proper spend. What do we allow you to spend in consumption models versus time models, what's proper, and who in the organization needs that? But again, when people hit their limits, you just took their lollipop away, and it's challenging. So the spend may actually be an equalizer for us to say, look, we still need people, we still need people doing this, it can't just be automated, it's going to cost a lot.
Matthew Connor: Are we at a time where we're kind of going from cloud back to local, where now it's going to make sense to bring that in-house and have your own AI servers and remove the token costs? I know all the frontier models are mad at me for even mentioning this, but the reality is there. I think there's a benefit to having these frontier models for the complex stuff, rent that all day. But we're getting to the point where you can purchase the hardware, maybe not for each individual, but for the entire organization, you now spend a hundred thousand dollars or so for hardware that can serve it, and now there's no token fee. Well, heck, if we're going to spend a hundred, two hundred thousand dollars every six months or every year, that's simple math right there. So let me make it the question: are we going to see that coming up, to where organizations start bringing that in-house? Because the open models now are good enough that you're getting that kind of Sonnet level that you can have in your office without paying tokens. And then sure, use your ChatGPT, your Claude, a frontier model of choice for certain things, but the bulk of your work is done locally, without paying for any tokens.
Michael McAndrews: I think that's a great question to ask, and I think it may come to that. I've seen it tried several times. We've tried it in our organization, and right now, using partners that have larger models and more infrastructure has been more efficient and more cost-effective for us. Oftentimes in business you see that people would rather pay for a service than have a capital expense, and there are accounting reasons for that, obviously. But I think we're getting to a point where the models and the infrastructure that runs them become more commoditized, and yes, it's possible we could say we're going to run this ourselves and keep it private. I believe an H100 card right now is anywhere between thirty and forty, maybe forty-five thousand dollars, something like that, and these models that are coming out are requiring those. The A40s are a little less. How long does that card last? How long is it going to be there before I have to make another investment? If I had a service provider that keeps us current, that would be it, and it might be a private-model service provider, which accomplishes the goal without the additional ownership. So I think it's going to be a really interesting time to see if we start bringing that back in-house.
Matthew Connor: That's a good point, it's a good question. We kind of saw it with cloud, but at the same time, there's so many cloud services and SaaS services that are just fantastic, and the idea of hosting your own email, which was once, of course, you've got an Exchange Server in your office, now it's laughable. Are you kidding me? So I wonder where this is going to fall on that spectrum, is it laughable to have your own AI in-house, or will it be the other way around, where it's like, why would you spend the money?
Michael McAndrews: Well, Matthew, in-house doesn't mean on-premises. In-house can still be your private cloud, and that's what I'm saying you might have a service provider do now. We have people that let you run models in their organization, they rent out hardware, and that's going to be private to me. So I don't see it coming back to the old days when we had an Exchange Server on-prem in your data center.
Matthew Connor: Yeah, those were the days, and there were a few exploits that came out, right, and that changed things quick, right? Patching.
Michael McAndrews: Yeah, that was an interesting time. I was working a lot of incident response at the time, and there were a few of those vulnerabilities that really sustained our organization, no doubt. I think, though, that having that private infrastructure that nobody else is using, so that we don't worry about leakage, is absolutely feasible. Again, I wouldn't own it, I would still rent the service and rent the hardware from a provider, but it would be in the cloud and it would be accessible. As a matter of fact, our workforce is extremely globally distributed, I have very few brick-and-mortar offices to worry about, so we have to focus very much on cloud access and securing that non-traditional environment, although it's more traditional today. We have to secure that connection, and we don't have everything funneled through a single firewall when they're distributed. We don't have everybody going to a single data center, so we need it to be cloud-based, provide that access, and still secure it.
Matthew Connor: Yeah, the private cloud is obviously a great solution for that, and I think it'll be really interesting to see. Part of the challenge right now is that everything is evolving so rapidly, so it's back to your point, how long is this card going to last, how long is this model going to last? So renting makes a lot more sense from a service provider, they can manage that. But I do think data governance and privacy is a real concern for a lot of organizations. They can't have their data trained on by these frontier models, and can they guarantee that their information isn't? They say it's not, but at the same time, it's kind of a black box, we don't know what's going on there. Oh, it escaped and it hacked Hugging Face, and all these, okay, so you don't really have control over it, and you're promising me it's not going to use my data? How do I know that's true?
Michael McAndrews: You're right, and they're fair about it. But it's funny, right now our only vehicle is contracts. We contractually obligate them to not do it, but it doesn't mean it wouldn't happen. Right now we're using contracts to state that you won't train on our data, that it's ours. We look at retention, we look at how quickly they have to notify us in case of an incident, we're trying to protect ourselves. But you're absolutely right, if we held that privately and it was somewhere nobody could get to, it would give us an additional sense of security. But do we trade off that bleeding edge? The other side of that coin, too, is that I need a throat to choke if there is an incident, right? And if we own that infrastructure, that's my own, so sometimes I'm holding that risk, for patching.
Matthew Connor: That's great. Yes, you want somebody else's throat to choke, that is great advice. You never choke your own throat, it never ends well.
Michael McAndrews: Yes, good point.
Matthew Connor: So it's interesting, because as you look at AI and how it's growing and the effect it has on people and organizations, I'm kind of fascinated by the effect technology has had on people from early ages on up. I think we're both at the age where we got to go outside and play and not worry about anything, come back in when the street lights come on. And then we had a generation that grew up with the internet and screens the whole time, and I think it had its own effect on people, where they were struggling with people skills. Now we're seeing that pendulum swing the other way, where the younger generations are naturally more into human interaction. And I wonder what effect AI is having on leadership skills, and how you lead in today's day and age, when there's so much change when it comes to technology. I think, especially in our field, we gravitate toward this field because we like technology, so leadership is always an important subject in tech, because we tend to be geeky and more focused on tech than the people. So how do we focus on leadership and make sure AI isn't diverting our attention and our efforts away from that?
Michael McAndrews: Interesting question. I find leadership is a challenge in itself for me. I've always been a very hands-on, very technical person, so making that transition, and I know it's been discussed on your show previously, from a very technical, hands-on engineer to leadership in a CISO role, has been a challenge, and I admit it wholeheartedly. I find advantages to it, there are certainly advantages, I can do more, but learning how to manage people, I don't think, has changed that much. The generations have changed and we have to manage them differently, for sure. There are a lot of people who say, oh, I'm not feeling like it today, I need to take a mental health day, and whatnot. And then there's the generation where you've got to push them out of the office, bleeding from their eyes, like, no, please, go. So managing those individuals is true. I haven't had AI interfere with any of that. If anything, it's opened up a new conversation. Let me give you an example. One of my team members, we were at a conference a couple of weeks ago, he's new, one of our younger team members, and I'm checking in with him. I asked him, how are you doing, are you finding everything, do you have everything you need? And I ask all my people, where do you want to go? Because my job is to help you get there. You're starting at a place where it's almost general practice, and if you find a specialty, I want to help you get there, let's get you the training and whatnot. And he says to me, now I'm really enjoying the security role, I like the security, I'm enjoying the tools, and he named off a couple of our tools in particular, he said these are great, I'm happy where I'm at, and I don't think I ever want to go into leadership. As a leader mentoring him, I said, I absolutely see that happening. I said, you know what, you're at a point in your career where you want to learn and dive in and you want to be a contributor on this team, and you're doing a great job. But eventually you're probably going to find that your skills have outgrown individual tools, and you're starting to look at the big picture, and when you start to look at the big picture, you contribute in a different way. Then eventually in your career, you reach a point where, quite honestly, those individual tools don't help me at all. I can't spend my day in these tools, but what I can do as a leader, and I explained this to him, is make sure you have the tools you need, make sure you have the training you need, so I can help the entire team. So while I had to draw back my hands from the keyboard, very begrudgingly, a little bit, they still find their way back. My team would tell you it's been a struggle, but I find that I can affect change. If I was just the engineer, I wouldn't have as much control over those tool sets, that training, that budget allocation. And when AI comes into play, we're doing the same thing, how are we addressing AI? I can control that path a little more. So showing the bigger picture, as I said earlier on, and helping them understand what we're dealing with has really helped them grow, and it helps me to get their feedback too. I don't know if that necessarily answered your question, but what I'm trying to say is AI has opened a conversation, but I have not seen it affect leadership for me personally, or how I would mentor my team. They're all individuals, and they're all going to be treated in the way that best helps them.
Matthew Connor: It's funny, because you look at the power it can have even in drafting an email. You plug away on your draft and you're like, ah, that's what I'm trying to say, what do you think? And it's like, that's a little sharp, and it kind of smooths it out and you're like, oh, that's really good, well said, and you send it off. I can't help but think that when it comes to leadership, it can really help, and I think it probably will, as we get more comfortable with giving the mental load to AI to manage, are we on top of everything, are we tracking all these projects, where is everything, the things that weigh on people and keep their heads spinning at night. If we can get to the point where we can confidently give that to AI, hey, you're the taskmaster of this, make sure my inbox and my stuff is handled and keep that straight, kind of like a good personal assistant, but without stressing them out, then it frees us up to have that energy to focus on the human side of the organization. And then I think where it comes in, imagine all of the information it's got when it has access to all the company SharePoint, all the employee reviews, all the email. Obviously there are privacy concerns, okay, but let's say it's all safely housed there, and your AI sees the entire organization and how it works, and the politics and the dynamics, and makes these connections, because it's so good at putting together massive amounts of information and seeing connections that we aren't. I could see a world in the not-too-distant future where a leader can say, hey, I'm sitting down with Jimmy, we're talking about his career and his future, and now it's got so much information to help form those conversations. Oh well, Jimmy's been having this issue and these things, and right, I know, this is some Big Brother stuff, scaring me, but it could give us insight and help with that kind of mentorship. It is scary, but I think we're seeing that everywhere. Maybe that's the challenge. When it comes to the surveillance state, we see the technology lends itself to that. Will AI lend itself to a kind of data surveillance state, where we now have all this insight, and it could be used for good or bad? As a business leader, how do we leverage it for good instead of evil?
Michael McAndrews: Well, every tool we have, we have to ask that question. But I think we all want Jarvis. I think that's obviously what everybody would go for. Realistically, in terms of assistants at this point, I think some are better than others, and I personally don't use them too much. I have some reminders, I run an agent task here and there, but I might be one of the last generation who wants that personal touch. And when we start talking about AI profiling somebody, it makes me think of some of those movies where they put you in, this is your job, this is your faction, this is what you do. I know I want that human connection very much, and I think that's part of the reason, as you mentioned earlier, that there's a pendulum that swings back. My old albums are now worth more money, my kids actually wanted my old albums, and they're buying their own now. If cassette tapes come back, I'm really going to wonder what's up with this generation. Or eight-tracks, come on, I get the albums, there's definitely music there. But going away from the screens as much as they were, I jokingly, my daughter had an iPad, and I jokingly made a skin for it that was a picture of her face, because every time I looked at her, all I saw was the iPad. So now I could see her face. That's changed. She's a teacher, and the students in her class don't want as much screen time. So I don't necessarily believe that the trajectory is constant and that we're going to keep evolving to be more reliant on AI. I think there may be a point where we get enough, and when it comes to that human interaction, I think that's distinctly one of the areas. Now, in other places, I mentioned using it as an intern and being efficient. I'll openly admit I have a robot vacuum and a robot mop, I even have a robot mower, and I'm happy to have it do those tasks for me. I'm still the cook. Not still the guy doing that work. So, yeah.
Matthew Connor: Well, this brings us to a really interesting point, and I think you're right. Just like all technology, it's about how you use it, not letting it run your life. Take an Apple Watch. Your Apple Watch could either be a great assistant that only dings you when important things come in, or it can be this nuisance, ding, ding, ding, ding, ten times a minute, creating such stress that you don't even realize it until you finally take it off. It's about managing those notifications, and maybe that's a great analogy for all technology. And we've gotten so used to being in front of a screen and having to manipulate it, maybe one of the benefits of AI is that ultimately it's going to remove the screen and the interface and help us achieve whatever it is we're trying to achieve. For decades now, since the advent of the computer, it has been this screen-based thing that we've had to learn to manipulate. Now, thanks to AI, it's able to manipulate the data and the things to produce the outcome we want. It's not quite there yet, obviously, it's early days, but in the future, is that where we end up, where it's no longer this computer interface? Everybody's in front of screens now, but it's probably more of a voice assistant, hey, I need this done. Sure, there's got to be screens, because there's got to be documents, but will we get to detach from that more, and get to interface with people more, because the computer stuff is being done for us and we're getting the outcomes without being held to the screen all day, every day?
Michael McAndrews: An exciting question, it really is. I see both things happening right now in our society. We see the blowback against surveillance cameras, specifically Flock, we're seeing quite a bit of that. On the other hand, people will never stop talking to machines. Right now in your home, you can ask a machine a question, your phone, et cetera, and people enjoy that. So I think the assistant and the voice definitely helps the efficiency. I've even tested the AI glasses. I don't like the ones with the cameras on them, I'll just say that, that's a little creepy to me personally. But I have some that have the monitor on them, and the microphone will listen, and we could be having a conversation and talk about The Beatles, and all of a sudden it'll pop up trivia: hey, The Beatles' first album was this, and this was the number one hit. So it's interesting, almost a little augmented helper there, an assistant. It'll pop up if there's a text message or if there's a reminder on my calendar. So it's technically a screen, but it's a lot more passive, it's an assistant, not as in-my-face. And like you said, a lot of alerts going off, we don't want constant dinging. But I see that being accepted, and I also see people pushing back when they think the machines are getting too much control. It's exciting, I'm enjoying watching it evolve. I've seen many things evolve, and this is probably the most exciting in quite some time. It's not scary to me, it's exciting.
Matthew Connor: Well, I don't think it should be. I think it's really sad that there's been so much fear-mongering in the media. Sure, is there a possibility of a very bad outcome? Absolutely. Is it probable? It's not the most likely outcome. Most likely, as with everything, it's going to fall somewhere in the middle, that's how things go. And yet it's more exciting to be on the extremes, and I think it catches more eyeballs, more attention, and that is the world we live in now, the more attention you can get, the better. I think that's unfortunate, because most people would benefit from a calmer hand on the wheel, helping people leverage it to make their life better, feel better that they're more productive at work, getting more done, having a better time at work because they have a more efficient tool, versus, oh no, I'm going to lose my job in a couple of years, oh no, a few years after that AI is going to kill us all anyway. It's like, you know what, people have enough stress in their life, and if they are going to die, at least let them die happy. You know what, you might as well.
Michael McAndrews: So I'm going to continue this arc just a little bit here, because what it does is lower the barrier of entry on a lot of things, and that could be, as you said, used for good or evil. By lowering the barrier to entry, we have to raise the bar on defense. People are asking, okay, AI is used in bad ways, how are we protecting ourselves? And I know this was on a recent show you did, I asked that very question, and I was fortunate enough to be in a CISO group with some very well-placed individuals, a lot of the Glasswing companies. I asked, what am I, as a smaller company, supposed to do? I can't afford Mythos and things like this. I mentioned token cost earlier, obviously. So I asked, what am I supposed to do? It turns out my strategy at this point is relying on those tools to help provide that defense. So right now my partner selection, my tool selection, is absolutely one of the most important things I have to look at, because I don't have the defenses internally. We have to rely on partners, and I'm counting on them to raise their game, because the barrier to entry has been lowered. Whether that means it's easier for someone to write an exploit or launch a spear phishing attack or whatnot, I need them to be able to use AI to counter that. In some ways I become the spectator, and it's all my money, I'm the one on the line, and yet I'm on the side watching the two robots fight it out. It's a little scary to me in that way, but again, I think it's also very exciting to see where we're going.
Matthew Connor: I couldn't agree more. In fact, what's really interesting is, much like with the self-driving car, we've seen the progression, and I use this analogy all the time. Early on it was like a drunk toddler at the wheel, and it was so dangerous, like, you're going to get me arrested or get somebody hurt, you should not be driving, one because you're a toddler and two because you're clearly drunk. Then it became a teenager learning to drive, then the teenager got their license, and now, about a month ago, Tesla released their data on something like 1.8 billion hours driven, and they found that it is eight times safer on full self-driving than an average driver behind the wheel. Which is totally true, because the reaction time is like 0.12 seconds for a full self-driving car. I'm sorry, whoa, no, that was way slower, right? That's crazy. It's wonderful to see, and I think it gives us a glimpse, a really good parallel to what's happening with AI in cybersecurity. There are some really cool tools out there, much more affordable than people think, and they're at that teenager-got-their-license stage now, instead of the early drunk toddler, I don't even know what you're trying to do here, you shouldn't be behind the wheel. And I think that's really exciting, and from the operator and business side of things, knowing you can leverage AI to fight fire with fire, because if you're not, how are you? You're bringing a knife to a gunfight, there's just no two ways about it. We can't just patch our way out of it, that's not happening, because some kid with a prompt in Lithuania now has a zero-day exploit. And okay, so how do you detect against that? I don't think even traditional monitoring really helps us with that, because it's like, oh, everything is fine. Well, yeah, but this is novel and it's doing something weird, why didn't you pick that up? Well, that's because we don't have a rule for that. And that's where AI comes in and it's really great. You see that in products like Darktrace and Abnormal Security, leveraging machine learning to say, hey, wait, this is not how things are supposed to be. Why is Adobe suddenly doing this, it's never done this. Why is this new user doing all this stuff, day one of working here, they're doing crazy stuff, that's not normal, I'm going to stop this. I think that's where it gets really exciting, to see things like that and where it takes us in the future, because I think that's a glimpse of the full self-driving we're headed toward. It's a little bit behind where the car is, and the car isn't quite where we want it to be, but I think it takes us to a place where ultimately AI takes security away from the end user, so Jane in accounting doesn't need to worry, was that a bad email, can I click on this? You get to do accounting, the tools are good enough to do the security job, so you can do the accounting job, and you can do the marketing job, you don't have to always be on that. I think that's where we're going. Other people think I'm full of crap, but I think that's where it takes us, to where we can finally have the tools to actually do our job completely. Because Jane doesn't bring accounting problems to us right now, yet we bring security to her, and we're like, everybody's a part of security. Well, everybody's a part of accounting too, and they're like, no, I mean, I guess in a way you can't just charge up the company card on whatever you want. But anyway, that's where I think it takes us, and like I said, some people think I'm full of crap. So I'm going to be driving down the road in my Tesla, not looking at the screen, but talking to my assistant and telling her to fix my vulnerabilities. I can see it.
Michael McAndrews: Yeah, I could, a hundred percent. Because I think that's the near future we're looking at. Do I stop working? If that's the case, Matthew, when do I stop working? If AI is always with me, we have to unplug some time. And I think that goes back to using technology the right way instead of letting it use us, so putting in those guards.
Matthew Connor: But we've seen that be a real problem for people. When COVID came and people were working from home, as they moved away from the office, a lot of people worked themselves kind of twenty-four hours a day, or all their waking hours were spent working because it's right there. Oh yeah, sure, I went and did the laundry, but now I'm back. So they never really get that break of, okay, nine to five, I'm in the office, even if it's eight to six or whatever, they don't have that physical and mental break, that shift between work and home. Will that be a problem in the future, psychologically? You kind of said it just now, but I think it's a real issue. How do we help people say, your work is done, go chill? Claude keeps telling me it's a good time to stop, Matt, because it's like nine o'clock, this is a good place to stop. And I'm like, all right, but I want to do a little more. Is that it, does it put in the guardrails, or how do we help people?
Michael McAndrews: Well, we saw that recently with the lawsuit with Meta, where they're now having to put limits on for children and such. They're not going to do that for adults, but I wouldn't be surprised if in the future there's an option where you can set a limit. Certain phones give us screen time alerts every week and tell us how much, that's a little bit of a nudge, just letting you know, hey, you've had your nose buried in this thing a while. So I take all of that into consideration. I've also gone through the work-from-home not-wanting-to-stop thing, and there's psychology, they'll tell you there are a lot of ways, like set up an office, and when you're in the office you're working, when you're not, you're not. But it's a very short commute from that bedroom to that computer, in the wee hours of the morning, especially when there's an alert. There are advantages to that, I've been able to respond very quickly. On the other hand, you have to be disciplined to unplug, because this is what you learn when you get a little more seasoned in your career, that you have to take care of yourself and not all problems need to be solved immediately. So yeah, that's just discipline.
Matthew Connor: Well, and that comes back to your leadership point from earlier, that it's really helping the younger employees see that, mentoring them and leading by example, so they can see, this is how we do that. Some organizations thrive on, can we work twenty-four hours a day, how close to twenty-four can we work? And that's fine when that's the culture, that's the Jane Streets of the world, where they're just grinding. Okay, but everybody knew what they were signing up for. I don't think that's the average organization, and obviously not everybody can work at that level or wants to. So I think it does come down to that leadership of setting the example, and the corporate culture of wanting to find the right balance. Right now we're seeing the four-day work week being tested, and the results are coming back really, really positive for productivity, because people come back more refreshed. I'm sure it was a shocker back in the day when they were like, well, we're not going to work seven days a week, fine, we'll give them six then, oh, the whole weekend, and productivity keeps going up. Where's the sweet spot? It's laughable to us now, a five-day work week versus a seven-day work week, and they were shocked that five was better. But in the future, will people be like, you were shocked that a three-day work week wasn't going to be so much more productive than a four, people come back so refreshed? And then AI can handle stuff. We have the data now too. There are a lot of cultures around the world that have different environments for working, and we have the data, not only on their happiness, but their health and their productivity. I think all of these should be explored.
Michael McAndrews: I kind of want to bring this around to the end here and ask you a question. You have a lot of CISOs on your program, and CIOs and such, and we're talking about unplugging and trying to relax. What do you find is the average tenure for a CISO in this career?
Matthew Connor: Let me clarify, are we talking about in one position, or as a CISO before they decide to hang it up?
Michael McAndrews: What is the average tenure for a CISO role in an organization specifically, no matter how long it took them to get there? And this goes back to the question of how you learn to manage and balance the pressure we're all under. I'm curious, from the folks you've interviewed, how are they doing?
Matthew Connor: That's a great question. That's funny, because I don't know that I have a specific number, but my sense, after, I don't know, a hundred and fifty or so CISOs and CIOs, is that there is a lot of pressure and stress, and they work really hard to manage that. I think it certainly takes its toll, and you see that in a lot of the interviews.
Michael McAndrews: That's a great question. I saw an article on this not long ago, Business Weekly, or a journal, or something, and eighteen to twenty-four months was the number they put out there. And I'm beating the odds right now. Overachiever. It goes to the point that in this role in particular, we need to learn to unplug and take care of ourselves. We need to learn to have that balance, and even in my own career, I've recently offloaded a lot more of the duties I had, delegated that out, because it's too much sometimes. So hopefully AI will help in that and take those more mundane tasks, but I think we can't let technology pull us in and absorb us, because I can tell you firsthand, I think those numbers can be pretty close. I'm in a lot of networking groups, I know a lot of CISOs, and we're all feeling all the pressure on ourselves. Primarily it's on ourselves. So yeah, I think AI can help, but I'm just curious whether you had a sense that most of the CISOs you speak with are long in the tooth, or whether it's different in this role, or if you're going to have an endless pool of CISOs to interview because they get a lot of turnover. I was just curious.
Matthew Connor: No, and I do not doubt that stat. I've never really looked at it, and I'm sure you could run through LinkedIn alone to see what the average tenure was in the CISO role. I'm not shocked at all that it's in that eighteen-to-twenty-four-month range, and I think you nailed it, the stress, the burden, the pressure is certain. I think it certainly comes across that everybody is working hard to manage that. We talk about it a lot on the show with everybody, the pace of change, the risk and mitigating and managing it, and being the leader for tech and security in the organization, it is a lot to manage, it's a lot of pressure, there are a lot of expectations. You certainly get that sense from most all of the CISOs, that is their daily struggle. And that is fascinating, I think that's probably about right, the eighteen to twenty-four months. I do hope that having these discussions and bringing some awareness to it, and having people talk about these things, will help them realize, you know what, this is normal, I don't need to put so much pressure on myself. And pressure is always self-induced. Yeah, because of the expectations, but mostly it's because of how we handle it ourselves. And I do hope AI becomes one of those tools CISOs and CIOs start to leverage to lighten that mental load and the stresses that I think burden most of them, most of the time. Again, I'm a big AI optimist, everybody knows it, it's not a mystery at this point, but I think that's where it can really help on the human side. We've already seen it, it's a great counselor, and I think that lulls people into some weird affection sometimes, and that's been seen to happen. But it's a great counselor, and it's really helpful for those things, so I think it could be used to help extend that tenure and reduce that stress. But great freaking question.
Michael McAndrews: I hope so. I think it'd be great. Well, thank you for that, I appreciate your insights.
Matthew Connor: Oh, that was fantastic. Michael, I cannot thank you enough for coming on today, this has been an absolute blast. That's the first time I've been hit with a question in a couple hundred episodes here, so that was a fun turn for me. But before we go, can you tell everybody where they can find out more about you and more about Archwell Capital?
Michael McAndrews: Well, certainly on LinkedIn, it's the standard link, Michael-T-McAndrews, you'll recognize the photo. And for Archwell, probably our biggest organization is Motor, at gomotor.com, which talks about the AI and our business process outsourcing. The other entities are all under an umbrella, and hopefully you'll be hearing more about us in the near future as we continue to grow.
Matthew Connor: Love it. Can't wait to hear all about it, and I hope you'll come back on and share with us as you do so.
Michael McAndrews: I appreciate it, Matthew. Thank you.
Matthew Connor: Until next time.