Thomas explains that Screenvision Media is the second largest on screen cinema advertising company in the country, where audiences watch ads with no skip and no pause. He has been in IT since the 1900s, when cybersecurity meant shared passwords, and he now runs the traditional IT stack. He believes IT and security should be closely knit, because a CISO can only do so much without the infrastructure team and the help desk, which he calls the front line. Holding up a recovery plan binder that is 20 years old and two inches thick, he notes that a major recovery vendor can now sync a business to the cloud in an afternoon, a sign of how mature these processes have become. On AI, he says Screenvision is a Microsoft shop that adopted Copilot and cut out other tools through policy and technology. While watching in audit mode, he was unpleasantly surprised by how much data leaked through web based prompts, with employees holding full conversations about financials and prospecting through what he calls a super powered stranger.
Instead of saying no, Thomas took an education approach. He says IT used to be the department of no, but that stance no longer works because the tools are free and readily available. During what he calls the summer of Copilot, he ran breakout sessions with individual teams on how to write a good prompt and how their own data connects to the corporate AI. Usage now averages about 80 prompts per user per week, by his count, and he is moving into what he calls the agentic autumn, with agents that pull tasks together across departments. He shared usage reports with employees to show he was not reading their prompts, only encouraging use of the tool. He sees his people as good people, but says the road to hell is paved with good intentions, and they do not always know the damage of putting financials into an outside model. On email, he says modern phishing tools look at patterns such as how someone signs a message, so the work is part detective. He teaches that urgency is a warning sign, that the company will never withhold a paycheck, and that people should feel empowered to push back and report. He also builds role based profiles for access and equipment, so activity outside a person’s job stands out, even across a large home based workforce.
Thomas says AI is being embedded in accounting and sales software, but people still have to verify the work and contextualize the output rather than just trust it. Asked how to keep people from treating AI as fire and forget, he points to cross departmental work, understanding how teams operate, and wanting people to be strategic and not tactical. He compares the daily basics to brushing your teeth and wants people to own their roles. He mentors people entering cybersecurity and IT, and says the CISSP reflects a manager mindset, not a doer mindset. He tells the story of employees who pressed a button on a console for years, until someone lifted the console and found it was not attached to anything. AI, he says, can analyze processes, connect workflows, and take the monotony out of tasks like gathering 22 spreadsheets from five departments. He adds that a good question gets a good result, that consistent prompts can be scheduled, and that he can point an AI assistant at his recovery plan and ask for the top five action items after a branch office loses power. Matthew compares leading AI to mentoring employees, and Thomas closes by thanking him for the conversation.
Resources mentioned in this episode
This episode is brought to you by CyberLynx.
CyberLynx is a Bethesda managed IT and cybersecurity company. Local techs you know, not a call center. Month-to-month. 24/7 intrusion detection.
We help growing companies with managed IT, help desk, backup and recovery, and a fractional CIO.
Talk to us at https://cyberlynx.com/contact, info@cyberlynx.com, or 301-798-9170.
Train the Tool: Guardrails, Separation of Duties, and Responsible AI with Roberta Anderson - Ep 252
Defense in Depth for AI: Fundamentals, Tools, and People with James Hengsterman-Cash - Ep 251
Everybody Has an AI Idea and a Tool, but Not Every Shoe Fits with Steve Goudreau - Ep 250
VP of IT
Host: Matthew Connor
Matthew Connor: Matthew Connor here, host of the Cyber Business Podcast. Today we're joined by Thomas Matthews, VP of IT at Screenvision Media. Thomas, welcome to the show.
Thomas Matthews: Hi, thanks for having me.
Matthew Connor: Thanks for joining us. Before we get too far in, a quick word from our sponsor.
Sponsor Break: CyberLynx. Hackers are using AI to conduct machine-speed attacks. Is your security keeping up? CyberLynx sells industry-leading AI-powered cybersecurity solutions that detect threats in real time, so you know about an attack before the damage is done, not after. Learn more at cyberlynx.com. That's cyberlynx.com.
Matthew Connor: And now back to our show. Thomas, for those who aren't familiar, can you tell us about Screenvision Media and your role there as VP of IT?
Thomas Matthews: Sure. We are the second largest on-screen cinema advertising company in the country. Basically, when you go to the movies, we're the guys making you watch the ads before the show. I've been cursed at, cussed at, asked why a million times in my day. But it really is a cool place to work. We are at the center of culture, and for our partners, the value proposition is that we're making millennials, Gen Y, Gen Z, Gen Alpha, whoever, sit and watch ads. There is no skip. There is no pause. There is no "if I just move the bar to here, the ad stops." We are getting people to watch some great content, some great ads from our partners, and all the seats face forward. It's the biggest screen you'll see. There are no distractions. It's a truly immersive environment. And there's been some great content this past summer.
A bit about my role and a bit about me. I started in IT way back in the 1900s. You say that to some people and they say, "What?" And I say, "Yep." Cybersecurity meant we had passwords enabled, but everybody knew that password because we were sharing systems at that time. But I've been involved in cyber in one form or another since then, setting up firewalls, setting up rules in firewalls, and delineating networks when it used to be just one gigantic flat space where the finance server could see everything. So we've come a long way in a number of years.
I'm also in charge of the traditional IT stack here. From my seat, talking to people and looking out in the industry, I think it makes sense for the two areas to be very closely knit together. The CISO can only do so much without the help of the infrastructure team or without the knowledge of the help desk. Help desk is a job that everybody sort of says, "Oh, I don't want to do help desk." But help desk is where you see what's going on. That's the front line. That's where people call and complain and tell you why your systems [unclear] right now.
Matthew Connor: That's well put. And the 1900s, that's really funny. It seems so long ago when you say it like that, but in fact it wasn't that long. It's funny how much has changed in that time. You think back to the 1990s, when the Internet was just coming around, and even before that, how much things have changed. I think we're fortunate enough to have seen the massive improvement in society and technology from pre-Internet to post-Internet. And now getting to see that with AI, I think, is such a fascinating and interesting time, especially getting to apply that. It's going to apply very similarly, but at an even greater scale. It's going to be orders of magnitude faster and, I think, more impactful. So I think it's a really fun time.
Thomas Matthews: Something just dawned on me while you were saying that. If I can, I have an unintended prop that I would like to show that could get a laugh from the studio audience. I've been with Screenvision for quite a long time, 13 years. You hear the stats about how people leave. There's no 10-year... well, I have tenure. And I kind of know where all the secrets are, where the skeletons are in the closet, where the bodies are buried. This might seem shocking to the studio audience, but this is a binder. On the side here, I don't know if you'll be able to read that, it says Disaster Recovery Plan. I have to gray the screen out here. But this is, department by department, what we would do and how we would get the business back up and running. This document is 20 years old. This book is two inches thick, and we took the time to write this stuff and we took the time to test it and to build it. To think now that I can go to a major disaster recovery vendor and within an afternoon have my business completely synced in the cloud and ready to go, it's a testament to the industry and how mature these processes have become.
Matthew Connor: Yeah, it really is. You go back to the 90s, even the early 2000s, and the IT job was, "Did you reboot it?" It was keeping the computer running. Now that's a foregone conclusion. Computers don't require nearly the same level of hand-holding they used to. Before, it was like working on an old 1975 Chevy, where you're constantly tweaking it and it's constantly breaking down and you're adjusting. But these days it's a whole new world, right?
Thomas Matthews: Well, and that's where the barrier to knowledge and the barrier to entry is so low. We have a good mix of veteran players and hotshot rookies here. In our AI strategy, everybody's rolling out AI, everybody's doing something with AI. We've really taken a hard look at our DLP policies and our stance on usage, and we're a Microsoft shop, so we've adopted Copilot. We've cut out the other players in the space through policy and technology, and while we were in audit mode, observing how people work and the tools they use and how they use them, I was really unpleasantly surprised by the amount of data leakage via just web-based prompts. It used to be we would go to a website and surf the web and get information. Now they're having full conversations about financials and PowerPoint decks and prospecting clients through essentially a super-powered stranger, and trusting what it says.
Matthew Connor: So what did you end up doing? Were those people dissatisfied with Copilot and what it was doing, or were they just stuck on whatever other model they were using? They're like, "Oh, I like ChatGPT, Claude, Gemini, whatever," and they were still using that. Did they transition back easily?
Thomas Matthews: What we've done here is, I'm a big teacher. I'm a big proponent of education and the why. In the 90s and early 2000s, IT was the department of no. "Can you go ask your manager?" "I don't have to." "Hard no." We can't do that now because the tools are so readily available and free. My mom is 80 years old and she's on ChatGPT. Anybody can do it. That's where it's incredibly productive, but also incredibly dangerous.
So we took an education approach. This past summer we had what I deemed the summer of Copilot. I had breakout sessions with individual teams. I showed them the value proposition of using the corporate AI as opposed to the rogue AI, and walked them through how to create a good prompt and how to access their data. We started simple, because they're not software developers coming up with the latest and greatest product that is going to be in a million users' hands. They're business users looking to accomplish a goal. That's not lost on me. People are going to do the easiest thing they can to get their job done. So let's take the time, educate them on the pros of Copilot, show them how their data is integrated into it, show them how their meetings are already transcribed and available to them, and from there, build up the prompts.
Now we've come out of the summer of AI, and we're averaging about 80 prompts per user per week, which I think is phenomenal. Again, the usage varies. Some people are very high users, some people are very low users, but everybody's in the pool. So now we're having what I'm deeming the agentic autumn, where I will show them various agents that can pull multiple tasks together and help them get through some friction between departments. All of that comes from that baseline education. Now they understand what a prompt is, what information should go into a prompt, and what I should keep out of a prompt.
We've begun cybersecurity training. I know next month's a big month for everybody and their phishing tests, but unless you do these things every day, people aren't going to be comfortable, and then they're not going to use it the right way. So that's my stance on education. We start simple. Put them in a room, tell them to ask the question, because if you're thinking it, two other people are. We break down the barriers. We make the technology easy and approachable, and then we don't have to worry about them going over the garden wall out to some foreign LLM that will tell them who knows what about God knows what.
Matthew Connor: Well, that makes me wonder, are you using a tool like Darktrace, which has its Secure AI, where they monitor all AI usage across your organization, whether it's authorized or not, what gets in there and what doesn't? You get that visibility in real time and can put in those guardrails of saying, no, anything with this kind of information should not be put into a free tool, this should only be used in Copilot, you name it. Are you using something like that? Or is it just the education approach, where everybody wants to do the right thing and with the education you're finding they're happy to move away from ChatGPT and keep it in Copilot? How did that play out for you?
Thomas Matthews: We did a two-phase approach. We implemented Dope Security and deployed it to all the endpoints, and that's what gave us purview into everything. The old joke is "I don't want to know." Well, Dope told us, and it really opened our eyes to what people were doing. Part of it is we are owned by private equity, so I don't have the standards to lean on that someone at a bank or a government agency would. We have to strike a balance between what's acceptable security and what's acceptable usage.
We started with Dope and put it in audit mode. In audit mode we saw how people were working, and that helped me create a target list. "OK, you're a heavy ChatGPT user, so what we're going to do is focus on you and show you that in Copilot, you can hit the drop-down and you have the latest model of ChatGPT, a Claude, and it's free. You can use it all you want. We're not going to bill you back on it like they would." In that education process, people felt more comfortable. I was sharing usage reports with them, showing them that I'm not looking at your prompts, I'm not studying what you do. All I'm looking at is that you're using the tool, and the main goal was to drive usage. If you're using it for some personal and some professional, it's on the reservation. It's protected by our systems, our corporate standards, our policies. We have DLP enabled with Dope. We have Defender licenses that we've tailored to some of the other things we saw, plus the rest of our security stack. So we feel pretty confident that if the LLM gets poisoned or something happens, it wasn't on our end.
Matthew Connor: Yeah, I think that's such a great way of going about it. Instead of taking the stick approach and just punishing people for going outside of the company policy, you really took the time to see what people are doing and educate them on their options so they could do the right thing. I think that's just the right way to do it. It makes so much sense, but not a lot of people are doing that. We hear a lot of people getting very upset about people going off the reservation and doing their own thing. And I get it. I understand why they would. But the reality is I think you've taken the right approach of understanding, from the baseline, that your employees, the people who are working there, are all well-intentioned. They want to do the right thing, and they're reaching out to use the tools to do the job. They just need a little guidance on what the right tool is, and you've got it in house ready for them already.
Thomas Matthews: There's an old saying, the road to hell is paved with good intentions. That's sort of my stance on my users. I know our employees, and they're good people. We don't have anybody who's nefarious or looking to pull one over on anybody, but they don't know the breadth of damage they could do by putting our financials into the LLM. When I tell you that we're the second largest on-screen cinema advertising company, that's pretty niche. I don't think you have a lot of folks on here who are talking about movie theater advertising. If you want, Matt, we can go to the movies one day and I can give you the inside baseball on everything, and you'll say, "Wow, that's a lot." It's because I'm in it. I do this every day. It's not a very large swath of data. It's not like people are Googling stats for Major League Baseball or asking ChatGPT who's the best football player right now. This is a very niche thing that we do, and I want to make sure that our niche data keeps us unique and protects our employees and our brand partners.
Matthew Connor: Yeah, and people throwing it into an LLM risk not being so unique anymore.
Thomas Matthews: Absolutely.
Matthew Connor: Well, I think it's great that you guys are leveraging AI to be more productive, get more done, and make people's work lives better. The flip side of that coin is security. We're clearly in this arms race, this game of cat and mouse with the bad guys, and I think you kind of have to fight fire with fire, but that's my view on it. I'm curious, because some people are very much "fundamentals only, as long as you do the fundamentals, you'll be fine." I couldn't disagree with that more in today's day and age. The fact that there are new zero-day exploits every 5 seconds, some kid in Lithuania with a prompt now has a zero-day exploit. So what good are your fundamentals when they're walking through the walls? "Oh, I thought that wall was secure," and yet they just walked right through what you thought was secure. So I think you have to fight fire with fire. I'm curious, what's your take on that?
Thomas Matthews: Well, going back to the 1900s, the African Prince asking for all your... "I just need $10,000. I need a Western Union wire transfer." If you think of that attack that worked, they were getting money from people, and it used to be spam phishing. To me it's the ultimate attack, because to craft an email, to send an email, is free, and you can send it over and over and over again. You can go persistent, you can be smart, you can spoof. And everybody, even the new generations, is email-timid, because "Oh, my boss sent me an email, I have to reply right away." "Oh, my vendor sent me an email, I have to reply right away." And so the Nigerian Prince is sending perfectly crafted, perfectly formatted emails as your brother, and you can't tell the difference.
If you look at the modern phishing suite of tools, not only are they looking for the simple stuff like a bad originating IP address, a misspelled domain, a look-alike domain, now they're looking at patterns. So how do you sign your emails? Do you sign, like, "I'm Thomas, but I go by Tom"? If I suddenly started signing all my emails "Thomas," would you pick up on that? That's the contextual side of this job. We almost have to be part detective when we're walking back into the scene of the crime, saying, "Well, I know Matt never sends me an email 'Sincerely, Matthew.'" That would be my first clue. You always sign your emails "MC," so what am I going to do? That gives me a starting point to trace back to on the attack.
We have a lot of partners who might not be as tech-savvy as some of our brand leaders or the agencies we deal with, so we have to put a tremendous amount of scrutiny on that communication, because those people receive checks from us. We've had attempts in the past, and all it's done is help us sharpen our swords so we're able to fight back through process and policy, which are the things we can control in our own house.
Matthew Connor: Well, does that mean you leverage things like Abnormal, Darktrace Email, these kinds of AI-led email tools? Because email, I think you're really on to something here, because everybody's got it, everybody uses it. The traditional security email gateway, using the old rules to try to filter through it, doesn't work. It's simple. I don't even think a knife to a gunfight is a good analogy for that one, because it is simply too antiquated and the attacks are too modern and too sophisticated. They go right through it. It's ridiculous. Or you're filtering out so much that people are always in their junk mail, always going through it. What's the point of having the filtration if everybody's going through the garbage to find the stuff they wanted anyway? So I think we're in the day where email really has to be secured with AI, because it doesn't make sense otherwise. Come on.
Thomas Matthews: A big part of that goes back to education. We run our phishing simulations. Part of the problem is that the same people are going to fail all the time. You go to them and say, "Look, if it's too good to be true, it's not true. Nobody's going to give you a $100 DoorDash gift card for no reason." And on the flip side, we are never going to withhold your paycheck, and that message comes even from out of band. It's not going to be "sign into this spreadsheet and verify your pay."
So the tools are all great and they work, but with ultra-sophisticated attacks or hijacked emails, if you have a partner that gets their email hijacked and they're asking you for money, what's going to happen? That message is going to get through. So education plays a huge role: showing people what is a good message and what is a bad message. Whether you buy the best email phishing tool or you run with the Microsoft phishing tool, they all give you the same guidelines. Urgency in an email is not something you should deal with. What do you immediately need a gift card for? People want to please people. People want to be responsive. When you get an email from what you think is an executive at the company, you want to react right away. You want to be a good employee, a good teammate. But empowering people to push back because they're educated helps everybody. You can report the message, and you don't have to jump immediately just because the fake CEO said "I need you to expense 50 gift cards."
Matthew Connor: Well, I've got a hot take for you. I think that currently we have extended security to be everybody's job because I don't think the tools have allowed us to do our job completely. So we can't do it all, and we ask for help from everybody else. Finance doesn't reach out and say, "Hey, I need your help finishing these spreadsheets." Same with HR and everybody else. But we've made it industry practice, culturally accepted, that security is everybody's job. I think that's only because we don't have the tools to do it completely and securely.
I may be an AI optimist, but I think we're headed in the direction, and in the not too distant future we are going to be able to do security completely in IT and not have Jane in accounting have to care whether something in her inbox was meant to be there. And if something was so sophisticated that it got past the sophisticated AI, then you know what, we're not holding Jane accountable, because there's no way she was going to be able to defend against that. I think that's where it heads, because the reality is, with how sophisticated these attacks are getting, you look at the MGM attack. Brilliant. A great use of technology and social engineering against a very hardened, sophisticated, well-funded target, and they got it. And they didn't go against Jane in accounting. Not to pick on you, Jane, you're great, we love you. But the reality is they went up against the IT and security adversary and they won. They are the ones who are supposed to know this, but without the tools to look at it and say, "Wait a sec, day-one admin, and they're moving at lightspeed across the network in different systems. Hold up." That's the perfect use for AI, for machine learning. It's like, "Boom, immediately I am pausing their account. Hold up, something's wrong here, because this is not how day-one admins work. This is not how any admin works. I don't have a model for it and I'm not going to accept this, so I'm going to stop and call for an adult." I think that's a great example of where machine learning works, and AI would have stopped that and could. And in the future, I think we get to the point where Jane in accounting gets to just do accounting, because we will have the tools to do it. But that's my hot take. What do you think? Feel free to call me crazy.
Thomas Matthews: You're not crazy. They always say the easiest people to sell are salespeople, so the easiest people to get with techno mumbo jumbo are IT guys, right? Bad guys always act like they belong. If you can sound like you belong and act like you belong, then everyone will think you belong. And that's where context comes into play. Jane in accounting, I love her, she's great. The numbers are always right. She always gets her TPS reports in. If we contextualize Jane as an accountant, then we can create a role profile for Jane, understand what Jane's supposed to access, and then give her that profile. I'm a proponent of a profile and a kit for everybody. If you're in finance, you're in the finance group, we have a profile set up for you with what you're supposed to access and the equipment you're supposed to get. If you're in sales, we have a profile for you and the equipment you're supposed to get, and that's who you are. There's no reason for somebody in sales to be reaching into the accounting folder to check on a quarterly update. That report is sent to them via a system, and that's all they're supposed to know. They're not supposed to know how the sausage is made. Here's the sausage.
We've done that for every department here because we have a very large home-based workforce. We put people where we have screens. There are people who work here that I've met via Teams or Zoom, I've spoken to them on it, but I haven't met them. We have an employee who lives and works in Hawaii, and I've emailed with him a bunch of times. I email him late at night and he emails me early in the morning, but we make it work. I know what he's supposed to do and what he's supposed to access. I'm not trying to create super high walls over that employee. I'm just trying to set a standard that makes it difficult, so that if something goes over the wall, we can get alerted and say, "Well, he's not supposed to be there," and then we can react to it. It's a little bit trickier with some people, business operations people, people who sort of work between two departments. But typically those folks don't have access to all that sensitive information anyway, so we don't have to worry too much about them.
Matthew Connor: I think the challenge now is with one sophisticated email. Going back to your example, it's a partner you communicate with all the time, their account gets breached, and then they use AI to reproduce the language, the tone, the way Jimmy speaks and writes, and then send that message. That's really tough, because it's Jimmy's account, it passes all the checks, it sounds like Jimmy. If it walks like a duck and quacks like a duck, it just might be Jimmy, right? So is that the argument for security awareness training, or is it actually the argument that we have to be using AI to detect it? The only way you would see that it was AI-written is from AI. They're the only ones who can say, "Yep, that is textbook AI. This is how we write," even though it's not watermarked. AI can identify if something has been written by AI. Sure, people are writing more emails like that, right? So you're right, it's this game of cat and mouse.
But going back to whether we can get there, let's say on email, with clicking on things, I think we can eliminate that, and I agree with you. Let me just pause that and tell you I agree that you have to have those fundamentals in place: have the profile, have granular access control. I think it's all very, very important. But when you start looking at where AI is going and how the technology is improving, I think we're going to start seeing it moving from the data centers to the edge devices. You'll be able to have that locally and have that local control, so that when there's something weird going on on the device, your email can be securely viewed with a second set of eyes on it. I think stuff like that ends up helping us alleviate the burden. Maybe we never get to the point where it's 100% Jane gets to be Jane and not worry about IT and security. But right now it feels like a 50/50 shared responsibility matrix, and I think it should be more like 99 to 1.
Thomas Matthews: Well, the context again, I keep going back to context. You need to train people up for the one that does get past the goalie. On Hail Mary plays, there's always one guy the coach says, "Do not let anybody get behind you." So you want to make sure your people are aware of these things. I would love to be in a utopian world where AI protects us and does no harm and is looking out for me. But at the same time, the bad guy's AI is looking out for him and his nefarious approach. When you read these case studies, somebody always figures out a way to make the AI go rogue. It doesn't just happen. People prompt it and goad it and badger it to do something until it finally agrees to do it.
And that's where, in this world of "can Jane just be Jane," she can, but she's got to be on her toes, because if we extrapolate, the accounting software she uses is going to have AI embedded in it. That AI is going to run the quarterly reports for her, and she's going to look at that information as our trusted resource in accounting and say, "These numbers make sense. They're in line with what they should be," as opposed to the AI just wanting to make Jane happy and saying, "Jane, you guys are killing it. All the numbers are up." And then when you look under the hood, you see that the AI is inflating sales because it doesn't want Jane to look bad to her boss.
Part of my going back to my DLP is the embedded AI in things. Now every single app, everything you do, has some AI embedded in it. As a security practitioner, I'm looking at this on my phone and saying, "So all you're doing is sucking everything out of my phone. That's all you're doing." At what point is the embedded AI in Salesforce leading everybody to the same prospect? At what point is the embedded AI in self-driving vehicles driving everybody down Main Street, causing traffic? These are the things where, since it's embedded, we have less control over it. But we need to educate our people to say, "Yes, this is going to help you. This is going to give you answers. This will do a lot of the routines for you, but you still have to verify the work. You still have to look into it and see, well, in Q2 the numbers were really high. Why? Oh, well, these two salespeople had banner months. OK, well, there's the explanation." You still have to be able to contextualize the output and answer it, not just trust it.
Matthew Connor: Yeah, no. And I think that's the real challenge, because I think humans, our brains, we don't want to think because it uses energy. It's just how we're designed. We're designed to do pattern recognition, not deeply think about stuff, so we like to follow the same routines. That's why you go to the store and you buy the same darn groceries every time. You've made that decision once and now you do it every time with very little variation, for most people. Most people don't go in, look at all the condiments, and then choose a new one every time. Maybe there's one person like that, but for most people it's the repetition, because it's more efficient and we're naturally more efficient. I'll use that instead of lazy. I think AI feeds in very nicely to that. It's like, "Oh, thank goodness I don't have to do this."
I think what you're saying is 100% true, and the challenge is we now have to position ourselves as the strategic thinker on the team of human and AI. We have to be the manager reviewing their work and making sure we gave the right guidance and instructions, and then check the work afterwards, instead of seeing it as an extension of ourselves where it's like, "Oh yeah, that was me doing it." No, that was AI doing it. That's your AI employee, and you need to make sure they did a good job, because otherwise it's your butt on the line when they totally screw up, because that's you screwing up. You're responsible for them. I think that's hard for people to do.
You look at the self-driving cars, which I love and are amazing. It's already eight times safer than human drivers, 100% true. The problem is we're still at the supervised stage, where you're supposed to be kind of paying attention, at least in a Tesla. It's funny, because you're like, "Yeah, I don't really need to pay attention. It's so good," and you find yourself kind of not paying attention, because it is faster reacting. But occasionally, like all AI, it can make a mistake. The self-driving car makes a lot fewer mistakes than the AI on your desktop. But still, if the AI on your desktop makes a mistake, you might not injure somebody or yourself or cause physical damage to anybody. That's the difference. There's a higher standard, and I get it, but it plays into the natural tendency for us to be lazy about it. So how do you get people to fight that tendency or reposition their thinking so they're not just kind of fire and forget?
Thomas Matthews: There has to be cross-departmental involvement. You have to work with the teams. You have to understand how your teams work so you can create an alignment between the education, the penalty, and the go-forward. We're not a bank, so I'm not going to sit here and lecture people on FINRA standards and which banks we can't do commerce with. That's a waste of time. That's a handful of people here, and we know our vendors. But understanding what your people do, and you touched on something before when you said being strategic. What you want is for your people to be strategic and not tactical.
The blocking and tackling has to get done. It's like you've got to brush your teeth every day. You have to take care of yourself, eat right, exercise. Those are the basic things we do, and that's in your job description. That's the end: other duties as assigned. But what you really need is people to own their roles and be strategic. I do a lot of mentoring and teaching kids who want to get into cybersecurity and IT, and with the alphabet soup that is certification, someone asked me, "Why can't I just go for my CISSP right now?" I understand what he's saying. The test is easy if you study. It's the contextualization of why we're doing it. The CISSP is a manager mindset, not a doer mindset. It's policy, it's strategy. It's the things your boss's boss is doing, not just going in and saying "Oh, report junk on this email." That's the blocking and tackling. That's the stuff we have to do every day, so that when we go to the doctor, we don't have a bad visit. And empowering people to think strategically, to say, "Well, if there's a better tool, let's sit down and work it out and figure out how to get it." The build-a-better-mousetrap scenario.
We want smart people. We want our people to be engaged. If you just go down the same path every day, like you mentioned the grocery store, you walk down there and it's, "Oh, here we go, we've got Cheerios, we've got oatmeal," that's boring. It's not engaging. You want everybody to think they can make a difference in their job, and then you want them to make the difference in their job. You want them to come up with an idea, a new way of doing things, look at an old process and figure out a better way. A lot of people sit there and they just push the button. They push the button on the console. And when you say, "Why do you push the button?" they say, "I've been pushing this button for 10 years. The guy before me pushed this button for 10 years, and the guy before him pushed it for 10 years." And then you lift up the console and the button is not attached to anything. So let's take a step back and empower people and say, "If you push the button, if you don't push the button, what happens? Is there a bigger button you can push? Is there a better button you can push? Let's figure that out."
That's where I think AI will really make inroads within the business. It's analyzing your processes, connecting disparate workflows, reducing the monotony, and giving people that "Whoa, all this time I've been spending all morning collecting 22 spreadsheets from 5 departments and then copy, paste, copy, paste. I told my AI assistant to put them all together and tell me what looks remarkable in the spreadsheet, and now my work's done." And then I can analyze that and write something up to my boss about it. "Hey, look, we're up here, we're down here. Maybe we need to give this client a little bit more attention. Maybe we need to tap this vertical for more engagement."
Matthew Connor: I couldn't agree more. I think it's really interesting, the parallels between AI and leading AI, if you will. It's very much similar to mentoring, and to how you should be treating your employees. That is how we should be treating our AI. The more we supervise them, the more we give them proper guidance, the better the output. You've talked about context a lot, and it really does apply so beautifully in both the human aspect and the AI aspect, of giving somebody the right context: to understand where they go in their career and how they get there, where they go with this task, where they fit in the organization, what the goals are, where we all fit in the organization, what our whole goal is here. I think it's really interesting how much overlap there is.
Thomas Matthews: It's funny, in the Copilot ecosystem they just released an agent called the prompt agent. You describe to the prompt agent what you want your prompt to be, and it will give you the structure to then paste in chat so you can ask a good question. To me that's brilliant, because you just sold somebody suspenders to go with their belt, but that's the basis of it. Ask a good question, you get a good result, and that should spark conversation with your AI agent and get the ball rolling on ideation and strategy and thinking of the next big thing, or even knocking the next small thing off the list. Your prompts are the basis of that, so you need good prompts and you need consistent prompts. If you ask it the same question and then schedule the result of the prompt, you'll be sure to get a very similar result. "What did I ask it last week? Oh, I asked it what the top three selling things off the sales report were, I think, and send it." When the week before you had a very elegant, lengthy, well-thought-out prompt. That's where the garbage in, garbage out comes from. You really need to ideate with it and come up with a standardized way in which you do your work, and you're taking the monotony out of it, versus the other way: take the sales report, run through it. "OK, it took me all morning to read this and I forgot what I started with at 9:00 AM."
I go back to my big book here. If I have the DR Bible in my documents and I ask my AI assistant to reference it, "Hey, we lost power in the branch office in Tacoma. Give me the top five action items to do from the DR report," it saves me a ton of time. I don't know about you, but I organize my files so well it's hard for me to remember how it got nine folders deep in my OneDrive. But the AI can find it right away.
Matthew Connor: No, I'm the opposite. It's one to two levels. It's all right there. I don't know if AI likes that or not, and I don't really care, but it finds it so quickly in my pile of documents.
Thomas Matthews: Yeah. I'm a desktop guy. Everything on the desktop. Twelve billion things on the desktop.
Matthew Connor: Thomas, this has been so much fun, but before we go, can you tell everybody where they can find out more about you and more about Screenvision Media?
Thomas Matthews: Sure. Our website is screenvisionmedia.com, and I will be speaking at Infosec World the week of October 11th in Kissimmee, FL. I'll be giving a talk on mentoring and how we can help advance the cybersecurity field. And I'm on Twitter at Tommy Matt, so if anybody wants to reach out, feel free. I've had a great time with you, Matt. Thanks for the conversation.
Matthew Connor: This has been an absolute blast. Tom, thanks for coming on, and until next time, bye bye.