#279 Matthew Carroll: Immuta's Approach to Secure, Scalable Data Access in the Age of AI

Try OCI for free at http://oracle.com/eyeonai This episode is sponsored by Oracle. OCI is the next-generation cloud designed for every workload – where you can run any application, including any AI projects, faster and more securely for less. On average, OCI costs 50% less for compute, 70% less for storage, and 80% less for networking. Join Modal, Skydance Animation, and today's innovative AI tech companies who upgraded to OCI…and saved. Matthew Carroll, CEO and co-founder of Immuta, joins the Eye on AI podcast to explore how data access governance is evolving in the age of generative AI. As AI drives a surge in both human and non-human data consumers, traditional security models are no longer enough. Matthew explains how Immuta automates compliance, enforces policies across global jurisdictions, and scales secure access for enterprises—from blinded clinical trials in pharma to cross-border data sharing. Discover why AI-powered governance agents, risk-based access controls, and native cloud integration are the future of compliant, scalable data use. Stay Updated: Craig Smith on X: https://x.com/craigss Eye on A. I. on X: https://x.com/EyeOn_AI (00:00) How Immuta Governs Data in the AI Era (02:59) Security Alone Isn't Enough in AI (05:24) From U. S. Intel Roots to Immuta's Platform (07:38) Pharma Trials: Protecting Billions in Drug Development (12:58) The Data Marketplace & Access Negotiations (16:07) Why Native Integration Beats Proxy Models (20:33) Managing Data Across Borders & Sovereignty Laws (25:33) The Data Governor Bottleneck (and AI Solution) (31:05) Inside Immuta's SaaS Model & User Roles (33:26) Big Data Lessons Driving AI ROI (41:05) The Growing Data Governance Market (45:48) Storage Portability & Apache Iceberg Explained (48:32) Future Shift to Risk-Based, AI-Driven Access

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  So think of a Muta as a platform that kind of orchestrates the whole provisioning process. We're getting tailwinds around this movement around AI, not because we're magically going to secure AI, but rather because the nexus of what created what we call our first era was this concept of separating policy from platform. They run these very large clinical trials and studies and for primary and secondary analysis. They will use a Muta now as a blinded solution, meaning they blind between the patient, the provider, and the researcher. And we act as a blinding system. If that fails, we can't prove that those blinds were in place. It does not pass through the stages of FDA cycles.

• 0:44Craig S. Smith?

  In business, they say you can have better, cheaper, or faster. But you only get to pick two. What if you could have all three at the same time? That's exactly what Cohere, Thomson Reuters, and Specialized Bikes have, since they upgraded to the next generation of the cloud, Oracle Cloud Infrastructure. OCI is the blazing fast platform for your infrastructure, database, application development, and AI needs, where you can run any workload in a high availability, consistently high performance environment, and spend less than

• 1:25Craig S. Smith?

  you would with other clouds. How is it faster? OCI's block storage gives you more operations per second. Cheaper? OCI costs up to 50% less for compute, 70% less for storage, and 80% less for networking. Better? In test after test, OCI customers report lower latency and higher bandwidth versus other clouds. This is a cloud built for AI and all your biggest workloads. Right now, with zero commitment, try OCI for free.

• 2:09Craig S. Smith?

  Head to oracle.com/eyeonai. Eye on AI, all run together, E Y E O N A I. That's oracle.com/eyeonai. Okay, so let's talk about Immuta. Everyone knows that data is a big proprietary piece for most enterprises when approaching generative AI. And I guess data security is increasingly important and complex because the attack surface seems to have

• 2:52Craig S. Smith?

  spread with all these generative AI apps. Is that what you guys address?

• 2:59Speaker 00

  Yeah, I think data security is definitely one aspect of the lens. I think the challenge is there's different roles when it comes to access to data. Right, there's definitely a security aspect, which is adversaries trying to steal your data for intellectual property, steal it to use it against you, right? You know, like many other things, but it's equally just there's regulatory risk, right? So especially like clinical trial management, as you can imagine in pharma is like, how do we do blinded studies in the cloud, right? You know, or if you go into a bank, like in the cloud, we converge all this data about how do we separate buy and sell side? So there's not conflict of interest.

• 3:43Speaker 00

  So there's this kind of governance element of it. So if you think of security, you've got governance and you've got legal. And so the problem is, is I think everyone in the world kind of gets security, but not everyone in the world really gets the governance and legal aspects of it. And I think as AI, specifically generative AI, has taken off, what it's done is lowered the barrier of entry for how many people want to get access to data. Right? So that's really the interesting thing. It's not that the data going into the AI is maybe such a risk. It's actually a lot of the generative AI is allowed everyone from someone on a manufacturing floor to the CEO

• 4:26Speaker 00

  that underneath the covers can run queries and code against data. So you're going from hundreds of highly technical users to tens, if not hundreds of thousands of of data consumers that want access to raw data. And so what used to be a security kind of very deterministic rule set for a very finite set of people is now a kind of a gray area that governance and legal kind of have to manage. So think of a Muta as a platform that kind of orchestrates the whole provisioning process for those consumers. And we're kind of hitting, we're getting tailwinds around this movement around AI, not because we're magically going to secure AI,

• 5:11Speaker 00

  but rather because there's a lot more people that want it. So we help the scale of making determinations of who can see what, when, where, why, how.

• 5:20Craig S. Smith?

  Yeah, so it's a permissioning platform.

• 5:24Speaker 00

  Correct. Yeah. Yeah, that's how we started. We started, you know, we spun out of the US intelligence community.

• 5:31Speaker 00

  And and believe it or not, there's more lawyers than you could ever imagine in the intelligence community. The government has no shortage of that. And what kind of the nexus of what created our kind of what we call our first era was this concept of separating policy from platform. And so as a couple of intel agencies started investing in real cloud, right? So Amazon Web Services, you can look it up. It was called the commercial cloud solution, so C2S.

• 6:02Speaker 00

  They just threw data in S3 buckets, but the problem was it was the same data, but because it was two different kind of think of as business units, right? Same data, but each business unit, the way they collected it was different. So therefore there's different rules as to who can see it, right? But a data scientist don't, they don't think like that, right? They just like, I just want to merge the data together, get some insight, right? And when they went to do that, the whole policy broke down. Like, because the question you have to ask yourself is not just what, what is the right policy? It's who makes the determination when policies conflict?

• 6:35Speaker 00

  Who gets to decide which policy wins or is it a third policy? And it wasn't clear, there wasn't a business process to handle that. So if you think about what a muta, when we first started was this, how do we build an abstraction tier? Rather than writing code, security logic and code inside a database of what that policy is like, mask this column, remove this, whatever, depending on this user. We built an abstraction layer where a lawyer or a data owner without knowing how to write code can say, basically do that, where they can just click, click, click and build policy on it rather than writing a memo. And it would enforce that policy as, as that end users querying the data.

• 7:20Speaker 00

  So that's gave birth to us. So that, that's what we call the separation of policy from platform. And we then created, that's what a muted started as, yeah.

• 7:28Craig S. Smith?

  Right, okay. Can you give me a use case to illustrate that? I was following you until the click, click, click.

• 7:38Speaker 00

  Yeah, yeah. So let's get to the click, click, click. So it's really important when you understand like governance teams, I always say, woe is the data governor. And especially in this age of AI, they're very capable people, 10 to 20 years experience in their domain. I'm going to take you through like a real world example in healthcare. But like, these are potentially PhDs, potentially JDs. So they may have both. So they're very high IQ intellectuals that have worked in a domain for a very long time. And they're experts in their field and they understand the data very well.

• 8:18Speaker 00

  Right? So in life sciences, these might be eight to 12 of these people in a hundred thousand person pharmaceutical company. This is, so there's a real customer, real world example. And they've got to manage clinical trial data, right? Which is the bread and butter of how they design medications that they want to take to market, right? And they have to go through a traditional FDA cycle, all their approvals. And they run these very large clinical trials and studies and for primary and secondary analysis. They will use a muta now as a blinded solution, meaning they blind between the patient, the provider and the researcher.

• 9:01Speaker 00

  And we act as a blinding system. If that fails, or we can't prove that those blinds were in place, it does not pass through the stages of FDA cycles. That's billions of dollars. That's, it's very bad. And the way they managed this before was they would isolate each study as a separate database in like a SAS, SAS institute. So like a SAS database. And then they would physically move it around. Now they collated it all into like a snowflake or database. So what, what they do is in a muta is we, we can hook into an identity system, pull all the metadata about the users, who they are, what groups they belong to, what's their role, what attributes they have about them, like they're an investigator

• 9:45Speaker 00

  on this study. We also pull all the metadata off the data, right? You know, what are these column tags? How is it sent? What's the sensitivity level? Which study is this part of, right? What are the different types of patients in there? We merge that together and based on that metadata, rather than that governor, the governors are, like I said, they, they know the law, they know the regulations, they know all these things. They use that metadata. So rather than instructing someone to write code as to how to enforce these blinds, what, what they do is they go into our GUI and they can say, for these types of users, let's just say a principal investigator on this drug that they're building can see this type

• 10:28Speaker 00

  of data with, based on this metadata, right? And it'll dynamically filter, it'll dynamically mask. It could do things like can anonymization where we will nullify certain cells. If like, for instance, someone in the trial is seven foot six and is an outlier, right? It'll self-identify outliers and remove what we call indirect identifiers. Sick is like height is an indirect identifier. It's not important to the study, but you can figure out who that person is because there's only one person that tall. But the idea is they can go in our GUI and use the metadata about the identity and the data to create a policy.

• 11:09Speaker 00

  And that policy could be three different types of policy. The first is a subscription. So who can even know about the data? The second is a data policy. How do we put masking and redaction and those types of techniques to remove utility out of the data? And then the third is a purpose base. So are you asking a question of the data by which the reason you're asking is the same reason we collected the data? And so it's a purpose base and that's important for like the GDPR and data sovereignty, et cetera. So that's what I mean when I say click, click, click. What I mean is there's literally a GUI to where they don't have to write code.

• 11:51Speaker 00

  They can be a lawyer, they can be a scientist and they can build the controls without really having to understand any of the data infrastructure or having to write code or be that technical. That's what I mean by that. And to finish that point, what I would say is that's important because they can make it global. Right? Meaning it's not just one study. It's not just one data source, but you can do this consistently across all of your data landscape, which is ultimately how you have to scale in converged architectures.

• 12:27Craig S. Smith?

  What happens when someone, a user, runs into a roadblock somewhere, doesn't have permission or, you know, certain data is hidden and they believe they have the right to see it and they need it. Then can you go to the governor, the data governor who's managing this dashboard and have a discussion with him?

• 12:57Speaker 00

  Yeah, that's a great question because that's the pain, right? So as we move forward in our journey as a company, going from 2015 to like 2020, that's the core pain. The problem has always been.

• 13:18Speaker 00

  They, a lot of these consumers had to be extremely technical because the only way for them to understand that they, they're not getting all the data and there's actually a policy in place. You would have to be technical. You'd have to write code and basically get a denied entry and then you would have to reverse engineer, well, who's the data owner? Who's, you know, and you have to figure it out.

• 13:40Speaker 00

  Recently, you know, that's where we've, we've built a data marketplace for that exact use case where what we now do is express the visibility. So you as a user can see, what do I not have access to? And then we can then bring governance and legal into the same platform and you can have a like dialogue between one another and a discussion and we, and when you do request, it's policy mediation. So there's a policy exception process.

• 14:19Speaker 00

  Now, policy exception process is a negotiation between the data consumer, governance, legal and security. It's like, how much utility do you need out of this data? Like, do you really need this unmasked? Or do you just want it unmasked? And there's a difference. And so prior to Amuta, like all these companies, they would just create a ticket and service now. And then IT would then make a determination and they make a copy. So there was no negotiation. There was no like, so, so you're, you're spot on in the sense of the pain is, again, it was consumer to IT because it was all engineering. But now that the consumer isn't an engineer, in all cases,

• 15:02Speaker 00

  governance and legal need to have a conversation, a non-technical conversation. And so, yeah, we provide a mechanism for them to learn about what they don't have access to and then create that negotiation to, to be able to ask for more of it.

• 15:21Craig S. Smith?

  Yeah, it is, I would imagine that your business is growing because data is becoming increasingly complicated in where it lies and how it's connected and.

• 15:39Craig S. Smith?

  Presumably, Amuta, you can connect all different data sources to the platform. I mean, there's companies have, you know, everything from vector databases to S3 buckets you mentioned. Is, is, how do you, how does all that get piped into the platform?

• 16:06Speaker 00

  Yes, it's really important. So there's kind of two elements you hit on that I think are architecturally really important. So there's, the first paradigm is this concept of native versus proxy. So, modern middleware is changing quite quickly. So the way we used to operate prior to the age of AI, and what I would say is, is the era of agents. The agentic architectures is where I'm concerned. And so, the, when you think about high transactional volume, that basically, whether it's a human or machine, there's just lots and lots and lots of queries on data. Performance is tantamount, right?

• 16:48Speaker 00

  It's kind of like, could you imagine sitting at a cashier waiting five minutes, or even three minutes for your, for your credit card to process? It would be awkward. So that's kind of the same feeling. Three minutes isn't a long time, but it is in the sense of high transactionality. So, to get, to act as modern middleware between cloud data infrastructure, or cloud storage, and the end consumer, you have to be native. So the proxy design models where you kind of act as a go-between, classic SOA architecture, where you have web services, and so API to API to API, an app connects to you, you connect to the data store, that, that doesn't work. It breaks. So you have to natively integrate inside the compute infrastructure.

• 17:32Speaker 00

  So inside a snowflake, inside a Databricks, inside a Redshift, inside S3, right? Like, whether it's unstructured or structured, you have to be in the compute pattern, or you have to create a compute pattern that can break that query out and scale it, right? So that's the first part of scale, in these, I call them agentic architectures. Because I, I think the AI is all leading towards these, you know, human, human augmented, but agentic, you know, kind of operating environments. So that's like, number one is, so we, Amuta... You know, in my opinion, in our domain, kind of, we're, you know, like the first to go about

• 18:12Speaker 00

  that. Everyone else was trying to do a virtualization model. Whereas with us, we are native inside, and we were very fortunate to partner with a Databricks or Snowflake, like, early days, like, 2018. So that's important for anyone listening. Native is the only way it works. Like, it, because it's, because it's the baseline of scale. The, the second issue, though, is what people don't think about, which is, what happens when I have lots and lots and lots of data consumers? So it's not just humans, but also machines, potentially billions of, of identities, human or non-human identities, requesting access to data, to data products,

• 18:55Speaker 00

  to full domains of data, et cetera. And that's where things also break. And so you have to be able, because the amount of tickets coming in, like, the, the pharma I talked about, right now, with just humans, they average 200,000 data requests a year. So that's 750 to 800 tickets per data governor, per week. Now, let's just say you made that 2 million. So, the, the problem is, is, is you have to add AI into the, the, this, this natively-integrated permitting system,

• 19:37Speaker 00

  to be able to handle that scale. So that's, that's how a Muta, when we talk about how we integrate into the data infrastructure, it's, there's two aspects of that. The, the first aspect is, how do you natively integrate into the compute so it can break and it's performing, just like you ran a query directly against it? The second, though, is, is how do you manage that volume of tickets? And you have to, you have to, like, provide direct access at the speed of the query, which means you need AI to automate those decisions. And that's what a Muta is doing.

• 20:15Craig S. Smith?

  How does this apply to sharing across international borders? I mean, there are a lot of companies and organizations that are global.

• 20:28Craig S. Smith?

  Yeah, can you talk about the governance of that kind of data sharing?

• 20:33Speaker 00

  Yeah, absolutely. So, so there's two types of international data law, if you will. So there's data sovereignty rights.

• 20:43Speaker 00

  And so people, I think sometimes just assume when you talk about data sovereignty, that's all kind of, you know, one kind of big bucket, just like one use case. It's actually not, right? So like the laws in China, for instance, and data exfiltration out of China, they, China, the People's Republic of China sees data that is produced there as government controlled. Right? So that is not going to leave there. You can extract certain metadata out of there, but raw data needs to stay in the sovereignty of China. Same thing in like, we see a similar type of legislation in Brazil.

• 21:23Speaker 00

  The EU with, you know, there's a lack of treaty between, you know, the EU and now US. You know, a lot of people think of GDPR, right? But that's really not data sovereignty, right? It's just, that's more about a series of permissions around like use. So why did you collect it? Why are you processing it? And there's ways to utilize statistical de-identification. So you can anonymize data to then export it, right? And so the question isn't, the tech isn't the hard part.

• 21:58Speaker 00

  The hard part is actually applying policies consistently as a global company to, where is this person? Where did the data originate? And who wants to access? It, right? Who are they? And you have to make real time policy decisions on that. And so that means you need to categorize your data appropriately based off of geozones. And you need to establish purposes on that data as to certain purposes need to enact different types of policy. Cause like a purpose is like in Europe, great, we just need to anonymize that raw data, which we can do in flight. In the case of China, no, we need to run that locally. That becomes really important in analytics. So if you're adding AI,

• 22:43Speaker 00

  if you're training a model, let's just say I'm a manufacturer as a customer of ours. And they obviously collect a lot of telemetry off vehicles in China.

• 22:54Speaker 00

  That that model needs to run and be housed, trained, validated and run in China on Chinese infrastructure. Now in Europe, that's not necessarily the case. We just need to anonymize certain aspects of it. And so that model can be running in, let's just say,

• 23:14Speaker 00

  California as well as UK as well as Germany. Right? So, but again, what Amute is doing as part of that is we're taking the metadata. So the data, like the metadata on the data. So where is this data located? Where did it originate from? And we can look at the metadata, like the attributes of the user. So the metadata of the user, and we can make a real time determination based on that policy. What that data needs to look like depending on the use case. And we can change that dynamically and change the policy dynamically. And what's really interesting is, and this is where audit becomes really important is your audit records need to

• 23:53Speaker 00

  tell you that it was, you know, the data was run, processed and queried out of China and stayed in China. But in Europe, we did this. In America, we did this. In Brazil, we did this.

• 24:07Speaker 00

  Each of the compute systems though.

• 24:10Speaker 00

  Don't share audit records. And your current, your seams aren't very good at this. So what a muted does is we unify that audit across all that. Who access what data, when, where, why? And we can express that into a report in our audit logs. Um, so we can help the data infrastructure layer and we help those governance teams simplify the, not just the policy, like I said, but also the control in that policy, guaranteeing you met the regulation, if that makes sense.

• 24:37Craig S. Smith?

  No. Um, and, and this, how, how you talked about scale and we're talking about international now. Um, what are the limits to scaling? Is there? Um, I mean, if you have multiple, um, you know, jurisdictions that you're operating in, um, and multiple data sources and, you know, a huge community of users in different markets. How, how do you scale that?

• 25:14Craig S. Smith?

  Is it, uh, is, is the platform, um, elastic enough that it, it, it can just scale infinitely? Or is there some, uh, bound, uh, at which you've got to set up a new account and, and, you know, split, uh?

• 25:33Speaker 00

  Yeah, no, no, no. Um, that's, that's actually kind of the, the interesting thing about this. He, well, like sovereignty, um, uh, legislation, um, is complicated. The reality is the tech is not the limiting factor, actually. Um, this is why you have to have a native paradigm. Uh, the, the performance and, um, compute has just gotten so good that the, the tech side of the house is actually not the limiting barrier. Can scale at cloud scale. The problem always, this is, again, we go back to woe is the data governor. And no one's title is data governor, but there's so few of these in there.

• 26:17Speaker 00

  It's, it's a, you, you can't scale them. We have an exponential growth in, in those who could potentially consume data. And we have a linear potential growth, but even that would be cost effective. Like when you're talking to someone who needs to have 10 to 20 years of experience in data governance and working within your domain. It takes them at least a couple of years to ramp in that corporate because these are big companies, right? And to understand how they work and how you make decisions and the risk tolerance of security and legal. And then the CEO may change out and you get reorgs like it takes a long time to ramp in these companies.

• 26:59Speaker 00

  Like a Roche is going to take you five years to really be good as a data governor, right? And they're one of the best, in my opinion, at these data mesh architectures and establishing data product managers. And so it's like really difficult to scale those people and they unfortunately are at the center of all this. And you can't make access decisions and you can't make sovereignty decisions and you can't make security decisions without the governor approving it. And so when you've got 10 of them for every 100,000 employees, that's a problem.

• 27:43Speaker 00

  And so the only way to solve that scale problem is to build AI for them and to have agents that act on their behalf based off of their pattern of what they, how they make decisions.

• 28:02Speaker 00

  And that's the only way forward here.

• 28:05Craig S. Smith?

  And is there an agentic layer to your platform?

• 28:10Speaker 00

  That's what's coming. That's what we're building, but the problem that here's, there's no magical solution. There's no horizontal governor. Every company is going to have a different risk tolerance. Right? Like talk, let's like, like talk about iconic brands, like what, you know, like ignore the, like, like customers or not, but like a Disney is going to be very cautious.

• 28:38Speaker 00

  About like their brand.

• 28:42Speaker 00

  And they're not going to just accept, I don't know. The risk tolerance of, let's just say, maybe like a, a, a company like a, you know, a high flying tech company like, I don't know. Facebook, right?

• 28:57Speaker 00

  I, I don't know, but they're, they wanna, they wanna govern their data and they wanna regulate themselves their way. So you can't have a, a, you can't collate. All of the access decisions and negotiations of how they got to those decisions. And build one horizontal system. So you, you have to create the mechanism. By which each. Company can kind of create one mind of how their governance team works and makes decisions. And so we are building agents for governors, but we, what we are doing first. Is creating the engine.

• 29:40Speaker 00

  To collect all that metadata, to understand this one collective mind of, of data governors in these companies. And we're doing that through a policy exception workflow. As I said, someone requests, but they don't have everything they need. So they then have to negotiate. And through that negotiation of literally chat back and forth, like all this natural language. And then we can collect the metadata on how they got to the decision. And the metadata on the data and the metadata of the identity who requested it and the metadata of the. Identity who approved it and then did legal have to get involved, did security have to get involved? We, we mash that all up and what Gen AI is really good at is making sense of that. And creating a pattern out of that.

• 30:25Speaker 00

  And so we need to do, what we're doing is. Forcing companies rather than creating lots and lots of little like edge case policies like we always have. We need to actually create global policies that everyone has a problem with.

• 30:42Speaker 00

  And then force those exceptions.

• 30:44Craig S. Smith?

  Yeah.

• 30:45Speaker 00

  Because that is the way we create the data that creates the AI to allow these governance teams to scale.

• 30:53Craig S. Smith?

  Yeah, that's interesting.

• 30:57Craig S. Smith?

  The platform, how does somebody use it? Is it a subscription SaaS product?

• 31:05Speaker 00

  Yeah, yeah, it's, yeah, classic SaaS, like truly SaaS. We have, we can also fulfill via self-managed on their cloud infrastructure. But classic web application, you log in, SaaS subscription. We're not cheap. This isn't a $15 per month, per user kind of, kind of a platform. But so we're kind of like the Apple, if you will, of, you know, data provisioning and data access management.

• 31:32Craig S. Smith?

  And it's, it's, it's billed is based on usage or?

• 31:40Speaker 00

  Users. So we have two different types of users, very similar to like the, the business intelligence construct. So, you know, in Tableau, you have those who can create dashboards and then those who consume from dashboards. In our world, we have those who can create policy and then those who can consume data via our protected data, right? So that's kind of how we, we view the world. And so we have our, our governors, our data governors, which is like data stewards and those who can build policy. And then we have data consumers, which, you know, some of our customers, hundreds of thousands, right? And, uh, so, yeah.

• 32:15Craig S. Smith?

  Yeah. Are, are there areas, I mean, where do you see data governance and data availability and data generation going? I mean, it's just, you know, people talked about big data 20 years ago. But this is another scale and another

• 32:43Craig S. Smith?

  level of complexity. What's, what's happening now with generative AI is?

• 32:51Craig S. Smith?

  Are are tools or platforms like commuter keeping up with the complexity? Or or do you think there's going to be a further layer of abstraction?

• 33:05Craig S. Smith?

  You know, I don't know, maybe at the government level? Or or across regions or something where?

• 33:17Craig S. Smith?

  People are going to want to know where data lies and where it's going and how sensitive it is and all of that.

• 33:26Speaker 00

  Yeah, I think you're on to something. I mean, I think it's going to take quite some time. I mean, I was at the center of the big data movement. You know, like when I first started thinking about big data, it was just as like in Q tel just had invested in claudera. You know, we, you know, I was in Baghdad at the time. And, you know, our biggest issue was we we had all sorts of assets that were collecting data volumes. We we couldn't even comprehend because a lot of it was video, right? So it was the first time we really had like drone operations at massive scale. And so you can, I mean, even today, you take a video, it's, you know, they become big real quick. Luckily, they, you know, Internet's gotten really fast.

• 34:12Speaker 00

  But, you know, that was a big, we call it PED, like, you know, we couldn't. We just ran out of storage and then it was like, how do you process it? And so and those are petabyte days. That was 2007. So now it's like you move fast forward to today, it's at a totally different scale. Concepts like Hadoop have obviously morphed into, you know, Spark. And, you know, the the type of distribution on cloud is just a totally different game. I think what people see is is one, storage is, you know, kind of coming out of that movement today. Storage is essentially free, right? That's the way they look at it. So I think, but compute isn't. And I think that's what large corporations, which are leading the charge, right?

• 34:56Speaker 00

  Government organizations are not leading this charge. It's it's corporations are are driving this innovation. And I think the compute isn't cheap. And I think they're trying to rationalize because there's a movement around AI. They're willing to expend it. They're they're willing to have high capex investments. So whether it's buying, pre-buying infrastructure, buying Nvidia chips, et cetera, et cetera, right? Everyone's willing to hit the CapEx. But the question is the ROI. But, but, so you got to separate, what I'm kind of getting to the point here is, is there's a limit to which people are willing to invest. And that's coming up pretty soon here. Now, what I do think is happening with AI is there is ROI.

• 35:40Speaker 00

  So then the question is, is, okay, where are we getting ROI and where are we not getting ROI? So I think that's the first kind of iteration of, of what you're going to see. Now, when they do understand where the ROI is, they're going to double, triple, maybe even 10x down on that, right? Because we all understand the cost savings and the value of AI around these kind of core data sets. That is where I think there will be regulatory oversight. Because I think sovereign nations are going to say, it's not just how we process that data that is like a strategic advantage to our country, but it's the data itself becomes a strategic advantage. And, but I don't think the government will want to get into the business of

• 36:24Speaker 00

  owning that data, but I do think they'll want to get into the regulatory oversight of it, reporting around its use, reporting around how transitory it is. And establishing treaties will likely be something I see happen in the next five to 10 years. What I will also say though is this, in between that timeframe of the next five to 10 years and this type of what I would call government oversight of, of, of, of national security use of, of data for AI. What I will say is more third parties are going to need to understand corporate access to data. Because I think what's happening is all of our data, it's not to sell it.

• 37:09Speaker 00

  It's because we're, our economies are so intrinsically tied to data.

• 37:14Speaker 00

  Right economists are like just desire, you know, like right now, obviously, if you're following inflation and how like the stagflation problems, they need access to more data faster to understand it. Our central banks want it. Manufacturers want it with supply chain, like looking at these tariffs. How do we calculate the the supply chain issues? Where's our risk? Everyone needs each other's data because it's in the best interest. Like GM working with Stellantis, working with Ford, while they all compete, it may be in their best interest to understand, you know, steel prices and how those things. So companies

• 37:54Speaker 00

  need to be able to tag their data and be able to expose their data to to non-traditional third parties, which means contractual management of that data is going to be critical. So if I could kind of summarize that, it's, I think, one is purpose and all data is going to be really important because purpose defines how anyone could access it. Two is you need a really good tagging of the data to understand how to build a policy for third-party contract management, because it's going to be corporation to corporation. And the last is is the auditing of use of that data and where it goes in your AI. It's going to be really important for regulators to be able to understand. And I think all that's going to happen the next five years.

• 38:38Craig S. Smith?

  And the auditing, that's auditing, not monitoring.

• 38:45Speaker 00

  Correct.

• 38:46Craig S. Smith?

  At the government level.

• 38:47Speaker 00

  Correct. I don't see now, monitoring is definitely necessary. The zero trust concepts around data provisioning and access are really important. You have to assume there's insider threats, there's adversaries in this ecosystem, because the data is the intellectual property rights into AI. The AI is just. Right. You know, a foundation model, right? Like in you're like an open AI, et cetera. But the data you put into it is what's really key to you. Um, and the data that comes out of it and you store that and make decisions off it is also equally important. So you need to monitor and you need to have SLAs and SLOs around that monitoring. So you can have alerting and everything. But I fundamentally do not believe the government, or at least the US government, I should say.

• 39:32Speaker 00

  I think foreign nations, um, I think will be different. Obviously China has a much different view of how they insert themselves into their economy. But I like, so you can look up something called CALEA. All legislation around, um, call device registry. So how, how does NSA potentially hook in via a warrant legally? Um, or law enforcement agencies into, you know, telephone networks, right? You know, we've all watched the, the movies, right? You know, and they look in and tap someone, right?

• 40:07Speaker 00

  The legal oversight of something that is relatively limited infrastructure like AT&T, Verizon. Like, you know, there's only so many providers. And that is extremely complicated. Right? Technically and legally to do that across all corporations in the United States. I just, there's, we don't have enough budget and, and time and technical know-how to, to handle that. I think in my opinion to, to, to monitor. But to get audit to regulate, yeah, I can see that.

• 40:38Craig S. Smith?

  Yeah. And where do you guys, uh, stand in the market? I mean, frankly, I, you know, um, it's a market that I'm not familiar with. Are, how many players are there in this? This particular market, the, the governance platform market? I'm not sure how you define it.

• 41:02Speaker 00

  Yeah, it's a broader market than you realize. Um, we've kind of built a niche role because we've really focused on data access governance and this whole provisioning concept. So that's a very. You know, small group of players, right? There's like three of us and we are by far the largest. When you get in, but, but reality, what's happening is, is

• 41:28Speaker 00

  our adjacent areas are starting to converge. Right? So when you think of governance, you have to think of data quality, you have to think of cataloging. You have to start thinking of, you know, the data tagging aspects of it and then the audit. So DAG is, so data access governance is just one part of it. The whole piece of it though is this governance, governance ultimately to provision, who can use what data, how and why? So I think these adjacencies are starting to come together and they each kind of have a piece of the TAM and, and we're all gonna likely converge into a couple of big players.

• 42:08Speaker 00

  And it was just, we all kind of were born out of, the problem was you couldn't create one super platform because none of us, even though you used to be able to raise a lot, a lot of money, now you certainly can't. But the reason we all were able to create sizable enough companies is because we all had to reinvent an existing area, but make it cloud scale. Because the snowflakes in data bricks grew so fast. That, that type of scale, that, that you couldn't try to build everything and make it scale like that. So you had to pick your poison.

• 42:40Speaker 00

  But like I said, in our domain of data access governance and this whole concept of data provisioning, very niche, but I think growing really fast. And, and hopefully that affords us the opportunity to kind of partner in some areas and, and then, you know, expand into other adjacent areas.

• 42:56Craig S. Smith?

  Yeah. So you mentioned, uh, storage is almost free. That's something that, that I don't really understand.

• 43:07Craig S. Smith?

  And a couple of years ago, I was trying to track like what happens to data as it gets older. And some of it literally ends up on tape decks in, in old mines, like under the earth or something.

• 43:27Craig S. Smith?

  Yeah. I mean, the, how could the storage be free? I mean, it's, it's, uh, is it because of compression technologies are getting better?

• 43:41Craig S. Smith?

  I mean, there's just so much data.

• 43:44Speaker 00

  Yeah, I mean, first of all, there's no such thing as a free lunch. So I think it's it's all in proportionality. Right? I mean, so when you is the problem is, is of course, it's not free. But this generation of engineers that that have entered the workplace, they see it as a negligible cost unit relative to everything else. So I think to your point, that it's a very, very valid point, which is, I think those have been in this business a very long time are gonna start to have to think about, how do we, yeah. You're gonna see this spike probably in a couple of years, where all of a sudden, you know, your retention requirements, let's say you're required to retain for 10 years. You know,

• 44:30Speaker 00

  seven years ago and beyond, it's like not that big of a deal, but all of a sudden those numbers start going up and up and up. I I think one is, yeah, compression technologies. I do think, I mean, people joke about this, but I don't think it's a joke. Yeah, I do think some of these legacy mainframes and tapes and like legacy warehousing systems, there might be a cost analysis, say, hey, that's good enough. Just leave it there. Just do that. Right? We don't need this in the cloud. It's it's, you know.

• 44:59Speaker 00

  But I also think this, so that's one part of of storage. I think the second part of storage, though, is storage is becoming just as important as the compute. Because I think AI especially, so so there's AI, which one just directly pulling from structured data is highly valuable. And there's real use cases now. It's not just like deep learning where those tend to be edge cases in the big scheme of things.

• 45:27Speaker 00

  But the second aspect is, I don't, anyone, I'm happy, anyone listen here, we can go have a beer and have a debate, but like, federation technologies are really complicated for any real world use case. Most of the time when you're federating, it's just to go reach out, pull it and put the data somewhere else. So the concepts like iceberg are really important. I mean, that's why, you know, Tapu was bought by an absurd amount of money, you know, like equity from Databricks. It was like, you want to be able to lift and shift. You know, your warehousing in your lakes via storage, right? And so the idea in a perfect world is this paradigm where I can, I can,

• 46:08Speaker 00

  I can rip and replace any compute infrastructure because my iceberg, they're all compatible with iceberg or some sort of, you know, data format at the storage layer. And that helps me lift and shift, right? And so therefore, I get economy of scale because I have the ability to force those compute vendors to compete. And it brings my compute costs down. So ergo, the cost savings there are worth the spending on the, on the storage, which is a fraction of the cost, right?

• 46:40Craig S. Smith?

  Yep.

• 46:40Speaker 00

  So I think that's the paradigm I'm seeing right now. But I, but to your original point, yes, compression is going to get way better. I think storage is going to get way better. Then there's going to be a huge advancement in that in the next couple of years.

• 46:52Craig S. Smith?

  Yeah. And just to unpack some of what you just said, because I wasn't following all the acronyms and things.

• 47:01Speaker 00

  Yeah.

• 47:02Craig S. Smith?

  And I, I'm not going to remember the first one that I missed, but iceberg, what do you mean iceberg?

• 47:09Speaker 00

  So Apache iceberg, so that is a, um, a storage technology that, that emerged over the past couple of years where, um, what we're seeing is the community like the snowflakes and the data bricks and the starburst like slash trino of the world, um, they're compatible with that, that storage. And so the idea being is, is like, if I have data in there, lands in there and there's like a, a file format to that. Um, I could theoretically have, dump it in there. Snowflake and data bricks could be in my infrastructure and they both know how to read from that and then build their tables out of that. Let's just say.

• 47:45Craig S. Smith?

  Right.

• 47:46Speaker 00

  So if I, let's just say, snowflake, I'm just making this up, but like snowflake is way cheaper than data bricks. I as a CIO could say, you know what? Move it over here. Just keep doing what we're doing on our landing zone. And I just focus there. Or I could say, you know what? I need to rip snowflake out for the next cool thing. Drop it in there and it just works, right? So there's, um, the, the migration costs, which typically are at the brunt of your, your upfront investments.

• 48:16Speaker 00

  Are now negligible in theory, right? This is all theoretical. We don't see this at scale yet.

• 48:21Craig S. Smith?

  Yeah. Yeah. Okay, well, um, is there anything we haven't talked about that you think listeners should hear?

• 48:32Speaker 00

  I would just say the, like, I can finish on just like one big point, which is agentic architectures are going to be adopted at a faster rate than any other kind of like era of AI, if you will. I think non-human identities are are very much a game changer for large-scale corporations. I actually don't think they're as much of a game changer for small companies and startups, even though I think VCs are saying you can create, you know, billion-dollar revenue companies on 20 people. I I don't believe that. I don't think there's a bunch of agents that are just magically going to be your customer success. But for large corporations, these agents that can be working in the background

• 49:18Speaker 00

  and in doing things for, you know, people will make them far more efficient. They can work 24/7. They can be finding things that are that are issues. Ergo, what I would say to everyone is

• 49:33Speaker 00

  the number of data consumers that are going to be non-human is going to go up exponentially.

• 49:38Craig S. Smith?

  Yeah.

• 49:38Speaker 00

  Therefore, and this is, I guess, highly academic.

• 49:46Speaker 00

  We always think of everything in set of rules. Like, because we're a law and order society.

• 49:52Craig S. Smith?

  Mm hmm.

• 49:53Speaker 00

  And so everything's deterministic of how I can. Can I use someone's HIPAA data, like HIPAA-controlled data or not? And there's a set of rules. We have law. We have legislation that defines that.

• 50:07Speaker 00

  I think the world's going to go to deregulation because these agents are going to be so important that we're going to take a lot more risk. So everything's going to be non-deterministic. It's going to be risk-based approach to everything. Who I share whose data with, how I do that, when I do that, why I do that. So I think as regulation goes out the window, because these agents are so important to these companies and to governments. And their economies are dependent on it. I think regulation goes out and I think how people get informed as to how their data is going to be used is going to become a big deal.

• 50:52Speaker 00

  So non deterministic access rights, AI driven access determination and sharing are going to become the thing of the next couple of years. And then the government is going to legislate, it's less about the rules of how your data is being used, it's more about a contract and you'll be notified about how it's being used, just like any other contract that you have. So.

• 51:16Craig S. Smith?

  Yeah, that's fascinating. So agents will be asking other agents for data and there will be some sort of a negotiation over.

• 51:26Speaker 00

  Yeah, based off of perceived risk tolerance. And they'll have to be like a circuit breaker in there of some sort to say, yeah, this thing's broke. All right, let's insert a human to figure out what the heck's going on, but the deed's already done. So you'll just, it'll kind of just be like, you'll then inform, it's like when you get a letter in the mail, it's like, hey, your data was part of some breach, you need, you have questions, call this number, right? It'll send you to some chat bot and it'll be agentic AI in there and you're talking to it, right? But, but that's the world we're going, expect quote unquote, lots of these kind of breach notifications on your data relative to an agent, talked to another agent and got some of it on you.

• 52:08Craig S. Smith?

  In business, they say you can have better, cheaper, faster, but you only get to pick two. What if you could have all three at the same time? That's exactly what Coher, Thomson Reuters and Specialized Bikes have since they upgraded to the next generation of the cloud, Oracle Cloud Infrastructure. OCI is the blazing fast platform for your infrastructure, database, application development, and AI needs, where you can run any workload in a high availability, consistently high performance environment and spend less than you would with other clouds.

• 52:51Craig S. Smith?

  How is it faster? OCI's block storage gives you more operations per second. Cheaper? OCI costs up to 50% less for compute, 70% less for storage, and 80% less for networking. Better? In test after test, OCI customers report lower latency and higher bandwidth versus other clouds. This is a cloud built for AI and all your biggest workloads. Right now, with zero commitment, try OCI for free. Head to oracle.com/eyeonai.

• 53:36Craig S. Smith?

  Eye on AI, all run together, E Y E O N A I. That's oracle.com/eyeonai.