#313 Evan Reiser: How Abnormal AI Protects Humans with Behavioral AI

In this episode of Eye on AI, we sit down with Evan Reiser, co-founder and CEO of Abnormal AI, to unpack how AI has fundamentally changed the cybersecurity landscape. We explore why social engineering remains the most costly form of cybercrime, how generative AI has lowered the barrier for sophisticated attacks, and why humans have become the primary attack surface in modern security. Evan explains why traditional, signature-based defenses fall short, how behavioral AI detects threats that have never existed before, and what it means to build security systems that understand how people actually work and communicate. The conversation also looks ahead at the AI arms race between attackers and defenders, the economics driving cybercrime, and what it truly means to be an AI-native company operating at scale. This episode is a deep dive into the human side of AI security and why the future of cybersecurity depends less on code and more on behavior. Stay Updated: Craig Smith on X: https://x.com/craigss Eye on A. I. on X: https://x.com/EyeOn_AI (00:00) Abnormal AI's origin (02:31) Why phishing is still the biggest threat (05:57) How attackers manipulate human trust (10:05) The true cost of social engineering (11:58) Vendor account compromise explained (15:02) How AI changed cyber attacks (16:28) Behavioral security vs traditional defenses (19:55) Where Abnormal fits in the security stack (22:24) Human psychology as the attack surface (24:01) Why cyber defense is asymmetric (28:48) Humans as the new zero-day (31:01) Why attackers target people, not systems (33:21) Behavioral modeling from ads to security (36:10) Why money drives almost all attacks (40:06) What happens after credentials are stolen (42:18) Text scams and lateral movement (43:55) What it means to be AI-native (47:13) How Abnormal uses AI internally

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Craig S. Smith?

  Let's have you introduce yourself. Tell us how you got to abnormal AI and what abnormal does, and then we'll talk about the current threat landscape.

• 0:11Speaker 01

  Sounds great. Well, first of all, Craig, thank you so much for having me on the show. My name is Evan Reiser. I'm the founder and CEO of abnormal security, which is now called abnormal AI. And you know, my background is not in cybersecurity. I spent the grand majority of my career getting people to click on ads. So if you imagine all those annoying, you know, these companies that maybe, you know, suck up some of your data and follow around the internet with ads showing you things you looked at on different websites. That's almost certainly my fault at some level. So I apologize and now trying to fight back a little bit by, you know, stopping some crime and putting bad guys in jail. So I'm a bit of a cybersecurity outsider, but I've been an AI insider for a long time. As you probably know, you know, behavioral ad targeting, it's all about looking at large sets of data, understanding, you're creating behavioral models of people trying to understand, you know,

• 0:53Speaker 01

  what they do and they're exposed to different types of stimulus. So that's kind of how I got, I got into cybersecurity just through honestly, like love of the technology. I've worked in AI for a long time. I saw the technology obviously getting way better, even seven or eight years ago. It's changed a lot in the last, you know, 20 years, in the last two months it's changed. So the idea for abnormal was actually not really an email security company. That's what we're most known for today. It's really create a behavioral security platform that could basically understand humans' identities better than humans and then predict their behavior. And the idea if we, the idea was if we could do that, we could probably help businesses and, you know, stop some crime. We started with email because, you know, phishing is the number one cause of breaches. Business email compromise, everyone cause a financial loss in the enterprise.

• 1:33Speaker 01

  And a lot of the conventional solutions are overly reliant on threat intelligence, different signatures, patterns and heuristics. What we see, especially in the age of AI and, you know, due to very, you know, sophisticated criminals, there's new attacks every day. They're personalized, they're targeted. There's a lot of social engineering, those things, you know, every attack's unique. You can't use some of the conventional techniques. So rather than kind of studying known bad, we focus on known good. We create behavioral models of every person in our enterprise by integrating directly into their IT systems. And then when a new email comes in or, you know, other activities happen for other products, we analyze it to say, you know, is it risky and is it normal? And does it look weird? Kind of same way a human, you know, would look at that, you know, if you had 100 hours instead of 100 milliseconds.

• 2:14Speaker 01

  So we do that. And it turns out that technique is very effective for stopping different attacks. So we've been doing that for about seven years. We have a bunch of other products as well. The company is over a thousand people today. And today we protect about 25% of the Fortune 500. So excited to go stop more crime in the future. That's a quick overview.

• 2:31Craig S. Smith?

  Yeah, that's, that's really interesting. One thing about, about phishing and I keep, I'm always amazed when there is a major breach or attack. And it turns out that it all started with a phishing email because you would think Yeah. At this point, people would know not to click on things, particularly on their work email. But the attacks are getting increasingly sophisticated. So the attackers are also using behavioral psychology, I would guess, to craft their attacks.

• 3:10Craig S. Smith?

  What, how do you see the, first of all, isn't phishing kind of archaic at this point? And isn't there, aren't there new attack vectors that are being developed? Or is it still, does it still boil down to getting the, the person to click on a link?

• 3:33Speaker 01

  Yeah, I mean, some stuff is old, right? The days of like the Nigerian prince scam, we don't see that.

• 3:38Craig S. Smith?

  Which interestingly enough, my, my wife's Japanese American, her mother has passed away, but she was a Japanese citizen. And my wife just got in a letter from, you know, it's the Nigerian prince scam, but it's in Japanese from someone in Japan. I was like, wow, they're reviving that, I think. Yeah, but anyway, go ahead.

• 4:02Speaker 01

  So, I mean, we, I mean, we see some of those, right? But they're certainly less sophisticated, right? That's not probably the best way to go hack the bank. Same thing, like we don't see typos in emails, right? There's no, you know, bad grammar. You know, every criminal obviously can use chat GPT to send out, you know, perfected messages that are sero personalized, right? They know all about the person that read every webpage in the internet about you. They know your coworkers, they know the business process. So things have changed a lot. What hasn't changed is still about kind of tricking humans, right? And that's going to be a consistent thing in this, I'm going to make up a totally fictitious example here. But Craig, imagine you and I went to go create a cyber gang. We kind of gave up on our day jobs. We said, we're going to go hack the biggest banks in the world, right? How would we do that? Well, we're not going to break through their firewall. We're not going to hack their satellites. We're probably going to send a bunch of like, you know, text messages and LinkedIn messages and emails to all their employees.

• 4:48Speaker 01

  Right? And a big bank might have 1000,000 employees. Someone is going to do something or say something they shouldn't be. Right? Someone will maybe think we're someone else and maybe reset a password or send us the invoice. We pretend to be their vendor. Right? I mean, that kind of human, your human judgment is still like the weakest link in most organizations. You know, if you're a criminal, like, why would you try to go up against the big bank? They spent a billion dollars on cybersecurity, got every piece of tool, technology, every FBI threats investigator. It's super hard. But if you email the poor support help desk person and say, hey, I forgot my password. Or you email their accounts, you know, accounts payable and say, hey, like, I'm the CEO's blah, blah, blah. And if you don't do this, like, we're going to delay our service and the flight won't take off. And God knows what happened to you. Like, you know, people are, I'd say 90% of people are like, good citizens are trying to be helpful.

• 5:31Speaker 01

  And so I think, you know, criminals are really trying to kind of exploit the good intentions of humans. They're trying to use our own, you know, people in kind of IT systems against us. That's very hard to defend against because unlike your, your network, you can't just shut off the fire. You know, shut off the ports and block access, right? You need to keep emails open for visitors, phone calls open. You need to tell your staff that they should, like, try to listen to customers, try to help them out and help out their coworkers. And, you know, attackers are using kind of our good intentions against us.

• 5:57Craig S. Smith?

  Yeah. Have you seen, presumably you see these attacks? Have you seen them evolve? And when you talk about an attacker knowing everything about you. If it's corporation with, you know, 20,000 employees or something, they're not doing that. Is it, do they have a comparable AI system? That's putting together all the various data points about each individual and crafting, you know, personalized attacks for each of the 20,000, however many employees are.

• 6:35Speaker 01

  The answer is kind of like yes and no, right? Let me, I'll just give some context, right? Just to add, you know, appropriate and hoping not too much, too little credibility to my upcoming answer here. So I've been doing this for, I don't know, eight years or so. You know, we protect thousands of companies. We process more than a billion emails per day. 100,000 attacks get blocked every day, maybe a million. But I would say at least every day we find one novel attack that's never been seen before. In the history of civilization. So, and I taught, you know, I personally, I talked to at least one CISO a day. I probably met half the global 2000 CISOs right at some point in the last couple of years. So like, well, I'm not a cybersecurity expert in some ways. I am kind of like Wikipedia for like email scams and fraud and social engineering. I've heard about everything. I could, you know, someday I'll write a book, a very long blog post about the top thousand attacks of the century or something.

• 7:20Speaker 01

  So the answer is like, yes and no, right? No, in the sense of like, you don't need hyper sophisticated AI to get people to like do something they shouldn't be doing. Right? Sometimes it takes a basic email, one line, right? You go register a fake Gmail account, you create a fake LinkedIn profile, you send one little message. And it's like, not that hard. You don't have to be that sophisticated. You don't have to have PhD in computer science or machine learning, information retrieval, or like high dimensional math to be effective. So I think from a volume perspective, you don't see that many high risk sophisticated attacks, which is not necessary. However, they do exist, especially when you look at kind of organized criminals and nation state attacks. They are using kind of all the technologies you can imagine, right? Again, the same things that you and I would use if we were the bad guys.

• 8:00Speaker 01

  And I, but I think that the asterisk there is like, they don't need to go spend a billion dollar training custom AI models. But you can use off, you know, off the shelf, open source, kind of large language models, any of the foundation models that are available for free on the internet. And you can just ask it, hey, I'm a small vendor. I'm, I have some financial difficulties. One of my customers, the big bank, you know, you know, my, my bank account, like there was some issue and I had to open up a new one. Can you help me write an email to explain why it's really urgent that they need to change my routing number? Cause if they don't do this, right, you know, I'm not gonna be able to make payroll to my three employees and like, you know, that's whatever I rely on. Hey, here's the person, here's every email that we've had in the past. Here's kind of like some information. Here's their Twitter page or LinkedIn page, right? Like, can you help me imagine, like, what do you think the process is at a big bank, right? To change that, right?

• 8:44Speaker 01

  What are some, what are the compliance, you know, hurdles? And there may be ways to get around it. Come up with 10 ideas and draft me a hundred different emails, right? That you might think might be effective to get that person, right? And then you can go send those, right? And so within five minutes, you're sending a hyper sophisticated, targeted, personalized phishing email. That probably like five years ago, like that, you could only deliver that, right? If you were like a nation state actor. Now petty criminal, right? Even with no computers, you know, technology knowledge can be kind of working at a low efficacy. So I think that's the challenge. So just last comment, I'll stop talking about like, that's the challenge, I think, with the, these attacks in the age of AI. Is that AI allows non criminals to be criminals, sorry, not sorry, non cyber criminals to be criminals. Right? It allows criminals to kind of increase the scale of these attacks, right? They can automate it.

• 9:29Speaker 01

  But it's through fancy Python scripts or AI. And the third piece, which is most disturbing is that AI allows for a level of sophistication. These attacks that are beyond kind of human imagination, right? And we literally see, I personally see maybe, no, maybe not every day, but once a week. There's some new attack where you look at it, you're like, I don't think that's an attack. And I would say probably, yeah, almost every day a customer complained to us, say, hey, you blocked an email that was a safe email. And we go investigate, we say, no, actually, this is sophisticated. Let me explain what they're doing to kind of trick you. So like, we're now at the stage where these attacks are kind of surpassing the human's ability to perceive them.

• 10:05Craig S. Smith?

  Wow. Yeah, that's frightening. Yeah, there seems, there seems to be an uptick in. I mean, it's seems like everybody knows, you know, three or four people that have been scammed out of a bunch of money. The

• 10:21Speaker 01

  But also it's like, it's not like, it's kind of like not the most interesting or sexy thing to talk about. I think if you look at, you know, FBI has this interesting report where they publish for people, when you lose money, you don't, you know, you don't call New York Times always, you don't go on Twitter, X. You do call the FBI, say, let me get, how do I get my money back? So the FBI provides this really kind of, you know, I would say like a most, a more objective view on kind of the where, what cyber crimes are causing what type of damage. So you have this report which describes, I think they call it the IC3 report for the Internet Crime Complaint Center. And it basically kind of talks about when people call us and they say there's money lost, we ask them, well, how did you lose it? And they kind of track the money lost by cybercrime. And so the number one cybercrime, I think outside of like, I think FTX kind of messed this up. So maybe minus FTX and investment fraud. But the last seven years, the number one has been social engineering through email.

• 11:06Speaker 01

  There's actually more money lost than that, I think, than credit card theft, identity fraud, and like ransomware combines, right? Yet if you look at like, the visibility of some of the, you know, social engineering of the email, right? In, in media and even cybercrime kind of news, it's very underrepresented, right? So it's kind of interesting how, it's kind of like boring, right? Once a fisherman clicked on a link, right? It's kind of not super fun to talk about, yet that is still, you know, the number one cause of breaches, right? So it's actually the difference between like, what's actually happening versus, you know, where kind of our attention as an industry and in society is.

• 11:36Craig S. Smith?

  Yeah. And when you say that you see attacks that you've never seen before, or this example of an email that a customer complains has been blocked, and then you show them, can you give us an example that is sort of out of the ordinary that demonstrates that sophistication?

• 11:59Speaker 01

  I'll give one that I think is extremely ordinary, but my guess is for most listeners that have not considered this, that have heard about it, right? So, one of the most, it's not the most common attack by, like, you know, the number of these we see is pretty small. But if you look at like, if you look at like, okay, if money was lost, how did it get lost? It shows up very highly there. And that is a thing called, well, I don't know what it's called, we call it a vendor account compromise. And so imagine, you know, you're, you're a big bank, super hard to hack in the bank, right? So if I'm a hacker, I don't want to, you know, it's like, it's silly. It's a waste of time. I'm not going to hack your firewall or break through cryptography. What I can do is I can find out who your maybe water supplier is in New York City, right? And I'll go hack them, right? Because they probably don't have, you know, two FA and like, you know, any cybersecurity training. So I'll break into their account, right? Maybe I'll go on LinkedIn, I'll search for

• 12:43Speaker 01

  the accounts, accounts receivable person, person kind of demanding invoices. I'll break into their accounts. And once I'm in their account, I've accessed all their old emails, right? And so what I can do then is I can take every email that I've ever sent, which might be, I don't know, 10,000 emails, and I can load it into, you know, a large language model, right? With ChatGPT or, you know, an open source one like Llama I could do on my laptop. I could say, hey, go through every email I've ever sent and find everyone we've ever worked with, everyone we sent invoice to, find out their account number, and then I want you to send an email to everyone that we've ever worked with in the past and explain why they need to send us, you know, some payments, right? Use their real account ID, use the, you know, use their real name, use their email address, and then look through our past conversations. And make sure you include in that message, right, any, some

• 13:26Speaker 01

  sort of indicator that I know them personally. And so we'll see these kind of personalized messages. And it's really hard on the victim's side, you get an email from somebody you've worked with for 10 years. It's their real domain, right? It's, it's like the real email address, it's replying to an old email. Right? That where you talk about something and in that email references, I don't know. Hey Evan, it was great seeing you. You know, I hope you're recovering from sickness from like the holidays or something. I don't know. Right?

• 13:51Craig S. Smith?

  Yeah.

• 13:51Speaker 01

  And it looks a little personal and there's some like reasonable pretext or excuse. Hey, we're at, you know, sorry to repeat this all the time, but like, you know, hey, we were at SVB and our bank account got shut down and you know, blah, blah, blah. Right? So like, you know, you just wouldn't expect to get a, an attack from someone you've worked with for a long time with a real email account referencing things. And so like, when you imagine from the attacker's side, it's not too incredible. But you know, if it's, you know, Tuesday morning, 8 a.m. You get that email. It seems super reasonable. You wouldn't even think that like you should, you know, think about that attack. So that's an example, right? Where, you know, people are obviously using, you know, generative AI technologies. But they're really kind of relying on, you're just getting good intentions and trust in digital identities that we're so kind of accustomed to in 2025.

• 14:31Craig S. Smith?

  Yeah. And now that we have sort of agentic automation percolating through all these systems, presumably, you know, the criminal could set up one of these systems and it sends emails daily, you know.

• 14:50Speaker 01

  Sure. Yeah.

• 14:51Craig S. Smith?

  Nonstop, right? I mean, it's, it's just, it seems like it would be an overwhelming amount of attacks coming now that AI is hooked up to it.

• 15:02Speaker 01

  Yeah. And like, I think the only reason it's not overwhelming is because you don't need these old certificate techniques to like make a lot of money as a scammer or criminal. That's, and it's because like the basic stuff still works, unfortunately. And there's a new attack every day, you know, other, you know, I think we will see more, right? I mean, one, so I don't know my artificial data point is serious, but like, I'll give like the plus or minus 25% version. When, you know, when we deploy, we are kind of the last line of defense. So we sit behind every other line of defense. So there's things that process that may filter, you know, emails. We are kind of the last kind of check before it gets in front of a human. We, so that means that if things would, if things would get blocked higher up in the stack, we can't see it. We can only see stuff that like would normally get sent to the user. So in the last like, last probably 12 to 18 months, we've seen about a 2X increase in the number of attacks that we see.

• 15:45Speaker 01

  Which means that with abnormal removed, right, there'll be 2X more getting in front of kind of our customers' employees' mailboxes. So, and I think that all the systems around, around us, right, that they're also getting better, but I think the criminals are kind of outpacing like good guys. And so just there, you know, these attacks are very effective. And, you know, I don't know if it's because of AI or other reasons, but we are seeing just, you know, higher volume of attacks. And for the attacks that are for the kind of top 1%, top 1% time most sophisticated, those are now past the point where humans can recognize them. We have, yeah, like I said, we get complaints about people saying, hey, you missed this attack. And sometimes we do, right? But like, a lot of times it's because like, it didn't miss it, just the AI picked up on something that, you know, the hu- the human analyst didn't understand, or doesn't even really kind of believe, even when it's explained, you know, by the AI.

• 16:28Craig S. Smith?

  Yeah. And so you're using, you're training a model, or your system, which presumably is a bunch of models, to understand the norm in our organization and flag things that deviate from that norm zone, right?

• 16:46Speaker 01

  That, that's right. And like, it's, you know, in some ways, like, it's not that smart. Obviously, like, I think it's pretty cool technology, but, you know, most of cybersecurity historically has been focused on just detecting kind of known bad stuff. And so, and that's not how things work outside of cybersecurity, right? I think, like, it's intuitive to most people how credit card fraud gets stopped, right? And so let me use that as kind of the analogy here. So that's probably more relatable. So imagine like if every time you use your credit card, the bank said, okay, is the vendor that Craig just sent money to, is that a known scammer? If so, block it. If not, then it's probably okay. That's how most of cybersecurity works, right? Now, as you know, like, that would not be sufficient, right? Because there's new scammers targeting new people with new kind of trends, right, to steal their credit card, you know, to steal money all the time. And so, obviously,

• 17:29Speaker 01

  if you, if you get a credit card charge in, on your card, and it's from a, a coffee shop in Brazil, and the charge is for $10,000, your bank doesn't need to believe that's a scammer, right? They just have to say, Craig? I don't think Craig's in Brazil. I don't think coffee shops historically haven't spent $10,000 for like a latte. And so, we're going to block this one to play it safe. And maybe we'll just kind of send, you know, Craig a note. If it's on the fence, we'll just ask him. We're going to default to no. So that's kind of a more of a behavioral based approach. So that's kind of the technique that we do, right? So when we see a new email come in, or maybe a new login, right, to kind of Microsoft or Google, what we're going to do is just say, we'll go, what do we know about this person? We have a pre-computed behavioral model. Well, here's who they work with, here's the times of day they're active, you know, here's their tone and their personality, their style and the projects they're working on.

• 18:12Speaker 01

  And we say, okay, what do we know about the sender, the receiver, the topics, right? Like, I mean, they're talking about some business reports. If I send you an email saying, hey, Craig, thanks so much for that analysis you sent me. Right, Ari, I'd be like, that's not a thing we've ever heard about. So you basically kind of look at all these entities, right? The identities and the people kind of all together. And then we're using that as context to make a decision. And the decision we're making is really kind of across two dimensions. One is, is it risky? If I got an email from someone I've never seen before and just says, hey, man, great seeing you last night. That's not risky, so we're going to kind of ignore it. But if it's, if it is risky, right, saying, hey, can you pay me soon? And it seems abnormal, then we're going to block it. So we look at the kind of the multiple, the kind of utility, the multiplication of these two things, right? Is it risky and is it abnormal?

• 18:56Speaker 01

  And if so, we don't know that it's bad. We just know it's not good and we block it. And so that's kind of the difference. Most cybersecurity, like we said, focuses on kind of known bad stuff. We basically kind of flip it where we say, we're only going to let known, you know, kind of known good or known normal stuff in. And the reason that's like really important, this age of AI, is that if every attack is unique, you don't have like training data for your machine learning models to help you stop the next thing. Right? If I knew every attack in the world and I built a model to say, you know, is it an attack? I can't predict the next one because it's never been seen, it's outside the trained data set. But we have a lot of data on it, it's what is normal behavior. Right? Every day, all of us are kind of, you know, leaving behind this giant exhaust stream of like, you know, every click and every keystroke, everyone we talk to, all the things we do for work. That's a lot of training data for known good stuff.

• 19:40Speaker 01

  So we use all that stuff to kind of, you know, train our machine learning AI models to figure out what's known good. And then if it doesn't seem to be good, we block it. And that, that turns out to be, you know, extremely effective. In some cases, it's like two to 10x more effective than conventional, kind of the conventional threat intelligence based approach.

• 19:54Craig S. Smith?

  Yeah. And you were saying this is the last line of defense. So it doesn't replace other filters or other, you know, alerts that a system may already be using or a customer may already be using. Is that right?

• 20:12Speaker 01

  I got like yes or no. You know, most companies, almost every business in the world has some form of what's called a security email gateway. And that is kind of like the conventional email security technology. If you use Microsoft or Google as a business for your email, you have that built in right to provide native security made, you know, sometimes bigger enterprise will buy third party securement gateways. We're kind of agnostic. We say you got to use some secure gateway because there's some unique technology there for stopping spam and stuff that you're going to need. And you can pick a great one that's via third party, or you pick the free one that comes with, you know, Microsoft and Google, which is our recommendation. But whatever when you pick, we're going to make sure that anything gets through those things. We're going to stop it isn't good for any users. So you're just going to, there is kind of native security in Microsoft and Google, right? That is that processes these messages and, you know, it does stop a lot, you

• 20:55Speaker 01

  know, a lot of more of that kind of spam, maybe the more commodity type attacks. But we do replace kind of third party solutions, right? That's kind of like more, more conventional third party email security solutions. And that is, you know, one of the reasons why people buy us, right? They want to stop more attacks, but also like not pay for the old kind of legacy thing.

• 21:09Craig S. Smith?

  Yeah. This, so you're coming from the world of ad techs and you, what did you study in, in school?

• 21:18Speaker 01

  I studied at a school I've never used professionally. So I went to school for electrical engineering, which really is, sorry, which is really, sorry, computer engineering, which is really electric engineering for the purpose of building, you know, computer stuff, right? So I took classes on CPU architecture design and network, networking and things like that. I then decided that I couldn't stand the slow iteration rate of like building CPUs and circuits, right? I couldn't wait six months for it to be fabricated. So I really, I got into a kind of, you know, really web based software development and, you know, just fell in love with, you know, programming and software engineering. I didn't really kind of study that in college. I took, you know, I never programmed before I went to college, took a couple of computer science classes. I just loved it. I, you know, wrote, wrote, built my own video games. It was like so fun. And then kind of after school, I lasted about two years in the industry and then kind of have been doing startups since, but just really love kind of building stuff for people and,

• 22:03Speaker 01

  you know, working with kind of a machine learning. It's been just really fun. You can do kind of these magical things and like the industry's been changing so fast, last 20 years, it's very intentionally stimulating. So yeah, my background is mostly software engineering. Then I kind of got dragged into kind of product management because I love building stuff with customers. And then you spend a long time in ads and now get to build cool stuff with AI for our enterprise customers and cybersecurity.

• 22:24Craig S. Smith?

  Yeah, I was asking because I thought maybe you came from a behavioral psychology background or something.

• 22:32Speaker 01

  So I don't, but actually my dad is a psychologist and because of that, I've, I've got really, I've always been very interested in behavioral psychology. And I've, I don't know, I've read, I don't know, dozens, if not a hundred books. And I've always just, you know, my, my specific area of interest that was actually even pre, you know, predates my cyber skin interest is I love reading about cognitive biases, right? And understanding like the evolutionary basis for why your brain works a certain way and like why it's like really set up to work in like a world that is not the modern world and just kind of understanding why we make some decisions versus others. That's more, I'd say that's more of a hobby interest, right? I have like zero academic training and probably don't know half the right kind of like words for things.

• 23:11Craig S. Smith?

  Yeah. And but do you think as L L M's, for example, as they become more nuanced in, in understanding human psychology, which they clearly are.

• 23:25Speaker 01

  Yeah.

• 23:26Craig S. Smith?

  Do you think that, that, I mean, everyone talks about it's an arms race, you know, the attackers get a little ahead and then the defenders catch up and then the defenders get a little head back and forth. And do you think that A, that this will plateau? That, that there is only so much social engineering that you can do and that as new defense systems like yours develop that the attackers will run out of new ideas?

• 24:00Speaker 01

  It's an interesting question. I, I don't think so because the AIs will generate ways of attacking us in ways that we can't imagine. I'll make sure one example. There's a kind of in a second. The other comment I'd say is like, it's not, it's a bit of an asymmetric war, right? And like, it is true, there is kind of like a cat and mouse game, right? You know, they try this, we block that. They try this, we block the next thing. And it is true that every, there is a new attack every day and that requires, you know, companies like us and all of our peers to have new defenses every day. And that is the bare minimum is just like tread water, right? You can actually still be losing. It can be, you can be, you know, getting better every day and still underpacing the attacker. And so it's a very interesting industry. And then frankly, it's very intellectually stimulating to work in industry where it's actually the kind of like challenging and fun to like know that if you don't get better every single day, you lose. The reason it's

• 24:44Speaker 01

  a kind of asymmetric is because attackers, they don't have to. They have they have very high tolerance for being wrong about stuff. They can try a thousand attacks, you know, the only one to work and they don't have to worry about privacy or security or compliance or like obeying the laws. They can try crazy stuff. They usually don't have to deal with like supporting a million customers, a hundred thousand, you know, coworkers. So they have to like only get it right at once. The good guys on the other side, they have to be right every single time, right? The one time they mess up and it's not just a breach, it could be like they roll out the AI model too fast. They don't have the right compliance for the new privacy law. They can only get, you know, they can't, they have to be right every single time. So it's a little bit unfair, right? Even just the adoption of AI, right? Criminals are adopting this technology instantly. You know, chat G P came out three years ago. There's, I'm sure there's some fish are using it the next day.

• 25:29Speaker 01

  And there's some enterprises today that are still trying to figure out, hey, how to roll it out a safe compliance way. And so it's a bit of an asymmetric war and so it's kind of unfair, right? And I think that's the, you know, and I do think there are some advantages that the defenders have. But I, I think to your question, like, I, I think it's gonna be, you know, the, we're not gonna get to it. I think there's gonna be always new types of attacks that are escalating. I do think the defenders will have the data advantage, right? We have, you know, we'll have more data about inside of like how the business works and how people behave and the bad guys, right? There's more data inside the enterprise than outside. And so I think that's why defenders will win long term. And just the final thing I'll say is like the future of cyber attacks, even cyber warfare is gonna be very strange. Or the same way, if you explained, you know, cybersecurity to someone from, you know, a thousand years ago, they wouldn't know what you're talking about.

• 26:11Speaker 01

  I think it's the same thing, like, you know, 10 years from now, there's gonna be cyber attacks that we can't imagine. I'll give kind of one example. I talked to, you know, one of my, maybe a friend is too strong with statement, but like, there's a customer I'm close with who's a CISO of a big bank that we've all heard about. And I said, hey, what is your biggest worry about kind of AI? What's like, what's the biggest AI attack you're worried about? You think no one is talking about? And what he said is that, he's like, look, there's a lot of stuff I'm worried about that we're trying to actively face, but there's new class of attacks I think we can't even imagine today. What if like one of these models had a small cultural bias, right? A malicious cultural bias that was not observable, you know, on a day to day basis. But every day, right? It was giving answers that would make all of our employees maybe point 00001% a little bit more socialist.

• 26:55Speaker 01

  And we wouldn't know, you know, it took 10 years to realize that it's actually a cultural attack, you know, with the culture of the company is being changed very slowly by one of these AI models. It may not be malicious, it might be, you know, unintentional, right? Whether it's socialist or capitalist or any dimension, any kind of values charts, doesn't really matter, right? But there may be kind of a cultural and values based like campaign that's being run either intentionally or unintentionally. Like, and he's like, I have no idea how we would even detect that in the short term or the long term. And so some of the kind of second order consequences of these AI usage is still, I think, to be determined and how those will be weaponized and used against us. I'm sure there's a bunch of very bad, very annoying people out there that are going to try, you know, everything they can to, you know, discover those new techniques. And obviously it's job of, you know, me and abnormal and probably all of our peers to help stop them.

• 27:41Craig S. Smith?

  Wow. Yeah, that's fascinating, that idea of sort of long term, you know, subtle attacks that are not trying to get into your bank account, but change your opinions. I mean, that's going on actually with

• 27:57Speaker 01

  Yeah.

• 27:58Craig S. Smith?

  That was the concern about TikTok.

• 28:00Speaker 01

  Exactly. Like, I think historically, if you look at, I mean, I'm not like a military expert by any means, but like historically, if you look at some of the longer term conflicts, kind of geopolitical conflicts, there's many examples where kind of a culture was used as a weapon, right? In very subtle ways, we're used to influence our populations to kind of achieve political objectives, right? And like, I like, I'm a huge sci fi nerd and sci fi reader. I've read basically pretty much every book about space and AI in the future, like, yet we're still seeing new ideas emerge in 2025, right? About like ways these technologies can be used, right? For bad purposes. And so I just, I have to believe that whatever the worst thing we see in the future is, right? It's probably not imaginable today. And like, yeah, that's why we have to be invested, make sure we're prepared. So I don't have to be like, I don't mean to be like a, you know, super negative. I'm

• 28:44Speaker 01

  actually very optimistic long term on behalf of civilization, but like, we got some work to do.

• 28:48Craig S. Smith?

  Yeah. You talk about humans as the new zero day. Can you explain what you mean by the?

• 28:55Speaker 01

  Yeah, I think if you look at conventionally at, you know, cyber attacks, there's been this game of you're trying to identify the flaw in the technology system before. You know, it's fixed, right? And that's true for petty cybercrime, right? For organized cybercrime, even nation state cybercrime. Look at cyber weapons. The idea is like, yeah, you found some flaw that no one knows about and you kind of hide that and you keep on it to want to use that for some purpose. And like, that's kind of like the zero day attackers, right? You're trying, you're launching attack when there's like zero knowledge about the weakness, right? And like, these things can get quick fixed pretty quickly. So you want to kind of get ahead of that. I think the challenge is like, you know, AI is going to help us defend against a lot, you know, fix things quickly, ideally like remove all these vulnerabilities in software, right? We've actually seen our number of like bugs

• 29:38Speaker 01

  per unit of what, you know, something go down with, you know, AI software development. So I think kind of like the conventional attacks of like using these zero days and malware, and I'm sure there'll be crazy negative examples, but like, I think that that's going to be a lot harder. Someone I said earlier, right? You know, the best way for me and you to hack a bank in our new cyber gang, Craig, is like not by generating some custom malware and breaking into iPhones or Windows servers, right? It's going to be to you try to trick humans in some way. And so I think that's the vulnerability, that's the persistent vulnerability that is always going to be there, right? You can't kind of not to sound, not to, you know, land a catchphrase here, but like, you can't patch human brains. And as we talked about earlier, when we talk about cognitive biases, like we all have them, right? We all kind of do things that are irrational in somewhat predictive

• 30:19Speaker 01

  way. You know, humans for years and centuries have exploited those kind of irrational decision making systems, right? And our various biases, criminals still do it today and AI will take advantage of that in the future. So maybe kind of calling that a zero day is like, not quite right, but I do think like every day we're going to see a new type of attack that's never been seen before and could not have been predicted about how some criminal or bad guy or AI system is trying to deceive or trick or, you know, bypass critical thinking or judgment of humans. And that's going to be increasingly common thing. It's already like literally, very literally, the number one cause of financial loss, right? Reported FBI is social engineering, which essentially is a technique to, you know, bypass critical thinking of humans. And I think it's only going to get worse going forward.

• 31:01Craig S. Smith?

  That's interesting because I would think as agentic AI becomes more prevalent and which are backed or based on foundation models, that the models themselves would be

• 31:19Craig S. Smith?

  The attack vector would be the vulnerable point that because you have agents that have access to proprietary data or to even to financial systems. That the attackers would be focused on fooling the L L Ms, you know, as opposed to humans, but you're saying the opposite.

• 31:46Speaker 01

  I think it's a little bit nuanced, right? And maybe both are true. I think that obviously like you're just, you know, you just kind of breaking into the support staff's brain, there may be limited assets there to steal, right? Compared to the bank account or a bunch of corporate data. And so like the real target for a lot of criminals is probably, you know, it's basically is to make, outside of nation states, basically to make money, right? So I think that they will be going after, you know, bank accounts and passwords and data and ransomware and things like that. That is kind of the objective. But I think this strategy and the approach that criminals, you know, take today, and I think will be increasingly true in the future, is they're going through humans. And my kind of first principle of the argument would be that like there, there does exist a state, right? Maybe an impossible to reach or difficult to reach, but there does exist a state where you could have perfect technical security.

• 32:31Speaker 01

  You can block off all your firewall ports, right? You can, you know, patch all your vulnerabilities. You can have perfect software and all the code you use, right? And you're impenetrable in theory, right? I know it's impossible to get to, but in theory it's possible. However, as a business or an organization or a government, you can't shut down your channels of communication between your people, right? You can't not read emails, you can't not, you know, close down your phones. You can't like have all your employees not talk to anyone on the outside. No organization can work like that. So the purpose, that's the reason why we have organizations, has to do something. And so you can't kind of like, you can't firewall that stuff off. So there'll always be an open channel for, you know, you know, a bad guy or a rogue agent to interface with people inside that organization. So as long as that exists, that's going to be kind of the, like the front door that people get into or like the side doors.

• 33:16Speaker 01

  Maybe they're going for other things inside the house, right? But they're going to come in kind of by trying to trick people in various ways.

• 33:21Craig S. Smith?

  Yeah. And you, you came from ad tech. Are there parallels between behavioral profiling and?

• 33:30Craig S. Smith?

  For advertising and cybersecurity.

• 33:34Speaker 01

  I would say like, yes, like kind of yes and no. Obviously, like the objective is totally different, right? But if you think about like, modern ad systems, and this is true at Google, Twitter, Facebook, and obviously, it's all like, public information you can read on the internet. The core systems are trying to understand, you know, people, right? Private consumers, what are their interests, you know, who are they? Most importantly, what's, what might they be, you know, interested in buying or consuming? And what are some of the techniques we could use to get them to kind of push them over the edge to go from consideration to purchase? And so if you're building an ad system, you need a lot, you need a lot about the people, you need to know a lot about the products. And then in some ways, it's a bit of a matchmaking game, right? I know that you're in the market for, you know, buying some soda before that party coming up. And so I'm going to try

• 34:15Speaker 01

  to kind of subtly push you from going from, you know, Diet Coke to Diet Pepsi, right? And then, and so like, what's kind of the perfect stimulus, right? Whether it's a audio or video or an image that I can use to kind of influence you to kind of explain that. Oh, well, you know, here's the identity of a Pepsi buyer, right? And like, Craig, don't you want to be a little more like that? And so like, that's kind of what you're trying to use machine learning to do. Understand people, understand the products, understand kind of like, do the matchmaking about kind of what creative or what media is going to cause them to kind of influence their decision. So there, so that's like the core of, you know, all the most digital, you know, digital ad systems where a machine is kind of making that, doing that modeling and that matchmaking, right? There's no human involved in that process. And as you and probably most of your listeners know, that happens every time

• 34:58Speaker 01

  you load a webpage on the internet. There's some ad auction going on behind the scenes, a thousand computers are calculate, you're calculating a million things to figure out, what should I show on that page to like, influence you in some way? It's not always, you know, well done, or kind of smart, but that's kind of how the system works. There are some similarities, at least kind of our technology, right? We are trying to get a bunch of data on people, except it's not consumers, it's enterprise workers. It's also not random websites they visit, it's kind of what do they do for their job? And then we're using that behavioral model to make more intelligent decisions about kind of how they might be influenced or persuaded in some way. You see, the difference is we're not trying to like, convince, you know, our, the users we protect to do something. We're trying to figure out, how might they be convinced or tricked by a third party? And how do we defend against that? And helping us kind of like, block that, block the wrong.

• 35:43Speaker 01

  You know, media from kind of getting in front of that person like that's, you know, there's a similarity there. What's a little bit different is, you know, we are trying to understand their behavior and then identify, you know, is it appropriate in some way or is it normal? And that's maybe like it uses some of the same kind of pre computation of behavioral modeling, but I think maybe like the business objective and some of the techniques are a little bit different. So there's showing some parallels, but you know, I hope we're acting much more as, you know, I think we're doing a lot more good in the world than getting to people that click on ads.

• 36:10Craig S. Smith?

  Yeah. The, what are, from what you see, what is the main attack, the intent of the main attack in, in all of this? I mean, what are attackers, what are most of them trying to get? Because there are data breaches and then there are direct financial, you know, theft, like getting into a bank account and wiring out money. I mean, what is the main?

• 36:41Speaker 01

  It's almost always money with like, with some exceptions, right? So then you can break the criminals into three buckets. You have your petty criminals, right? We're just trying, like petty criminals and scammers. They may work in groups or by themselves. That's probably 90% of the attacks, right? It's probably 9% of the attacks and a small percentage of the money that's actually lost. Then you have your organized criminals and that's probably 99, it's like 9.99% of the attacks, right? And that's like, you know, and some of these are very sophisticated organizations. These organizations have IT departments and recruiting arms and like different divisions to pass on stuff. One team will kind of, you know, get the password, it'll pass it off the team too. There's like, when I say like organized crime, they are highly organized, right? Maybe more organized

• 37:24Speaker 01

  in some, you know, many businesses in, you know, in the world. And then you have the remainder kind of point one to point zero one percent. And that's kind of the nation state attacks. And those are not, they don't care about money, but they have money. What they care about is some political objective, right? It could be cultural, it could be chess beating, it could be intelligence reasons, it could be because like they just, you know, want to be a mean person. I don't know. Most, you know, very few people will encounter that kind of point zero zero one percent, you know, if you're a large enterprise, you may be a risk. If you're critical infrastructure, right? You're certainly at risk. If you're a government, you're absolutely at risk, right? That's what they want. They have a political objectives. But outside of that, people are trying to get money and everything else is just a step in

• 38:05Speaker 01

  the process to get money. Why steal your password? No one cares about, no criminal cares about your personal email. They only care about the extent that I can access other accounts, eventually get in your bank account, or convince your friends to send money or some gift cards, right? Why do you care about hacking a computer? No one cares about like, you know, my Microsoft Word document I wrote to my grandma. They're trying to put ransom around there to get me to pay a hundred bucks, right, to them. So all the kind of like symptoms that you see in cybercrime, I would say always goes back to like, they're just trying to make some money, right? These are, you know, these criminals are, they run businesses, right? They're illegal businesses, but their goal is almost always to make money, sometimes indirect, right? You see, you also have like, you know, more conventional organized crime, doing cybercrime to enhance their kind of, you

• 38:48Speaker 01

  know, real world, you know, criminal operations. But I would say a lot of it comes down to kind of money and the normal things you'd imagine for why people go into crime.

• 38:57Craig S. Smith?

  Yeah, although, and you're talking about corporate attacks. It seems that most of the corporate attacks you hear about, they're stealing customer data. I mean, they're not stealing financial assets. Where are they? And you don't hear about it.

• 39:16Speaker 01

  Well, they absolutely are. You don't hear about it. Again, like, don't take my word for it. Go, you go to FBI's website. They have Internet Crime Complaint Center. They have a pledge report every year. I think it's in May. Where is money actually lost? That's like the truth, right? About where's money lost? It's very underreported by, you know, one or two orders of magnitude. And I would say a lot of things you hear about, like, you know, data theft, whether it's kind of consumer data, enterprise data, that's just a means to an end, right? I don't think criminals care about, like, you know, all the things I bought at that one retailer, right? Outside of the extent helps them make money, right? They might steal that as a threat, right, to the company and say, hey, like, we're gonna leak all this data, make you really bad, make you look like a bunch of bozos, if you don't go do X, which is usually pay us money. But, you know, and I'm sure there's some like edge cases, and it's obviously very nuanced,

• 40:01Speaker 01

  but I would say the great majority of the time, everything is a means to the end, and the end is to make money as a criminal.

• 40:05Craig S. Smith?

  Yeah. And the data theft, then that data is sold on the dark web to brokers or?

• 40:14Craig S. Smith?

  I mean, it's not used directly. And we have my, I have all, you know, I'm sure everybody these days, you know, use a password manager and like half your passwords are compromised. I saw them breached somewhere, you know, and I know I should change passwords and but, but what's, but I haven't been attacked. So what's happening to those passwords that have been compromised? Is it just that someone buys, you know, a million passwords and they just haven't gotten around to attacking me? Or is, yeah, what's going on there?

• 40:54Speaker 01

  I mean, it's nuanced, obviously, you know, when these, you know, if one come, you know, if some website is breached and they didn't, they stole their passwords in a really foolish way and play tech something. Then criminals will use those passwords to try to, to like login other websites through the same email account. And they might go through a billion other websites and see where you say username, password. Break into that, see what data is there. Eventually that kind of like propagates and spreads until they find something that's valuable, right? It could be, I don't know, information to go blackmail people to make money. It could be to log into your Amazon account to ship them some, something. Could be your bank account, could be your email account itself. So you can reset your other passwords and kind of spread. So I'd say like a lot of, again, I'm being very reductionist nature, right? Obviously, I know there's other neck diseases and there's obviously organized activist groups that do have political objectives or not, kind of nation states.

• 41:38Speaker 01

  But I'd say generally people are kind of, these are all kind of means to like, you know, making money in some way. And so like, at least that explains the grand majority. So, yeah, like, and it's, it's complicated, but I think most people, most of these criminals are trying to like, you know, make money.

• 41:50Craig S. Smith?

  Yeah. And I'm getting a little off the topic because we've all faced this and you wonder, I mean, there's this other vector that you get text messages and I'm sure everyone's getting them, you know?

• 42:06Speaker 01

  It's crazy.

• 42:06Craig S. Smith?

  Higher, are you going to be there on Sunday, you know, from something? What's going on there?

• 42:12Speaker 01

  Yeah.

• 42:13Craig S. Smith?

  I mean, you know, sometimes I answer just to see if they'll say anything.

• 42:18Speaker 01

  Yeah.

• 42:18Craig S. Smith?

  And most times it, it ends there. I, they don't follow up.

• 42:23Speaker 01

  Yeah, it's again, it's kind of saying that these are all kind of like many steps along the way to get to like some money. So you might get a text message, very innocent. Hey, how's it going? We call that kind of, you know, again, assuming it's malicious, we would call that reconnaissance, you know, email or text message. Does the phone number work? Is there a human on the other side? That's kind of helpful because maybe you want, they want to, you know, send attack from a different angle, right? So knowing like, will someone respond? Or they might not want to burn, like maybe they broke into my cell phone and I have your number, Craig. They don't know if that's a real number. They can validate with kind of a cheaper number. That's a human before they kind of risk using their compromised number. That might be more effective for social engineering attack. Right? That might be one technique. There's other things a little more direct. They say, hey, Craig, this is Evan. Like, thanks for having me on your show. Cause they saw this posted online. Hey, do you mind, you know, stuck at the airport?

• 43:07Speaker 01

  Do you mind sending me like a Starbucks gift card? Like, I know it's like silly for me to ask, but blah, blah, blah. That's just, again, trying to get money. It could be, hey, you got a pack, you know, you missed a package delivery. Right? Just log into this website. Right? And that website, you know, I don't know, they're trying to get UPS passwords. They can actually reroute your mail. Or maybe they're trying to actually like, they put a Google or Microsoft login or Yahoo login in front of that. Try to get into email accounts. It kind of propagates like the next thing. So they kind of take this like land and expand the approach. So it's called like lateral movement through kind of your accounts, your friends' accounts. But the goal there is again, do they really care about, you know, your Starbucks gift balance? Or like your UPS deliveries? No, they're trying to like make money in somewhere, get receive some sort of goods of value. So again, I've been reductious, but my guess is like 90% of these can be explained by someone trying to do something,

• 43:51Speaker 01

  you know, through a couple of hops or steps to kind of get money or value in some way.

• 43:55Craig S. Smith?

  Yeah. And you guys, you're open sourcing your AI native strategies. What is that? I mean, what are you talking about when you say that you open source your AI native strategies?

• 44:08Speaker 01

  I think like what we're trying to do is really, so I think probably what you're referring to is like what we're doing AI transformation. And my belief there is the way companies should operate in the future, using AI to kind of integrate that into their core business processes is a lot different than, you know, the way all of our companies, including ours, have worked the last couple of years. As you have to imagine the best way to engage your customers, the best way to build product, way different than the age of AI. And so I think there's a lot of talk on the internet about people, you know, saying they want to use AI. I, you know, I'm a big believer in kind of, you know, do it, so don't just talk about it. So one thing that we've done, we've started publishing all of our internal AI transformations. That's everything from AI generated, you know, art for our software, automate, you know, new features, automatic.

• 44:48Speaker 01

  Bug fixing in 24 hours, sales and marketing tools that kind of use AI to help customers, help our staff kind of better engage your customers. We're trying to share that, not because we think it's like some unique IP, but we want to be a role model of like how AI native company should work. And I think that's again, I think people will figure out these things by themselves. We just want to share with the world. And it's somewhat selfish nature. We want our customers to see that we will, you know, listen better and respond faster and build products, you know, more, you know, faster and better. Because we're using AI, we want all the people, all the builders in the world that want to work in a company like that to come join Abnormal. So we have this kind of awesome program where, yeah, once a day we publish new ways using AI to kind of transform our business. And my goal, at least my stated goal, and who knows how you measure this, but I want to be kind of the most, the furthest along compared to any other company.

• 45:33Speaker 01

  Kind of using AI to reinvent how we run our business. And I think we're just, you know, sometimes we're just getting started, but I also think we're very far ahead of our peers.

• 45:39Craig S. Smith?

  I see. Okay. I misunderstood that. Yeah. So you're not open sourcing the models, your defensive models. You're talking openly about your own digital transformation to AI native.

• 45:54Speaker 01

  That's right. Yeah. Like I do think that the value of proprietary code base and go down with AI software engineering. And I think the reason we're best is not because we have new code, but because we have, you know, the best data, which allows us to kind of train these models. So maybe at some point in the future, we should open source like everything we have, because I don't think it'll matter, want to help our competitors kind of win against us. But yeah, I think we're trying, at least for now, we have closed source software. That's our proprietary advantage right now. But we want to kind of share all the ways we're using AI. So we've always been an AI native product, right? Use machine learning AI since day one, you know, eight years ago. You know, that was before generative AI. Now there's new ways of kind of, you know, building, running and managing our business using AI. It's better for our customers, better for our employees, and we want to share that with the world because I think every other company needs to be doing that or they're not going to win in the future.

• 46:36Craig S. Smith?

  And what are some of the areas that you're talking about? Because this is something I'm tracking and then interested in. There, there are all these legacy players in every industry, but there are AI native startups that are, you know, starting with L L M's and building businesses up from there. And they're going to be much leaner, more efficient.

• 47:03Speaker 01

  Hundred percent.

• 47:04Craig S. Smith?

  Targeted than legacy companies. So is that what you're talking about is becoming an AI native company? And what, where do you start?

• 47:13Speaker 01

  So we do AI transformation, it's across every part of the business. And I think about kind of the four core business processes. You have your product development lifecycle, your employee lifecycle, your customer journey and kind of like the sales and marketing lifecycle. Then you're kind of like the meta business management process. And we're kind of investing in all those areas. In software, you know, in software engineering, we're doing all the things you expect. We have all AI generated product design. We listen to, you know, eighty percent of our customer calls. That gets, that's get kind of interpreted by basically AI product management. It pulls out features to build, bug fixes. We have AI bug fix validators, which try to like, take the feedback from a customer call, reproduce the bug. If it's a bug, right, it submits it to our bug tracking system. We have an adversarial AI which goes through every bug in our bug tracking system and say, hey, the user got it wrong. Prove them wrong.

• 47:58Speaker 01

  They can't prove it wrong. We have another AI go generate code to fix the bug. A fourth one to go figure out how to, you know, if the bug fix works. A fifth one to summarize that for engineers, they can do a human review. If they accept that, a sixth one to go and kind of respond back to that customer, right? We're trying to have 24 hour bug fixes. So all the things you'd expect, same, everything from like technology selection, architecture design. I think people underestimate the, you know, how much you can do there. In like customer success, right, we are in kind of one of the HR side. We have AI that listens to our calls of customers. It analyzes kind of how well did the person do? Where are they showing empathy? Where are they showing kind of good product knowledge? It gives kind of a personalized executive coach for every employee, right? Their managers see their feedback, just say, hey, here's what you did great. Here's an upgrade game, so you become better at your craft.

• 48:39Speaker 01

  For on the sales and marketing side, we have AI that will basically kind of do meeting briefs. You go do deep research on every person, every customer. Are they in the news? So every salesperson is entering a conversation with the equivalent of like 20 hours of the research. Here's the people, here's what they care about, who they saw online. Here's the technologies we think they use, basically what we can see on the internet. So every person's coming in fresh, all their homework done, not spending all that time. You know, we're using AI. I personally use AI for executive coaching. I have AI go through every, I record all my calls inside the company. I have my AI go through that and say, what did Evan misunderstand? Why is he not listening? What can I do better? Right, and I kind of have that feedback to me. I have AI go through all my meetings, all my documents and summarize for my human executive coach. Here's what would be most valuable for him to see to give me better coaching.

• 49:24Speaker 01

  So I think across every part of how we do business, AI can transform, right, how it works. And like in some pockets of engineering, we've seen a 10x improvement, not 10%. And so I think the, you know, obviously there's never more hype around AI technology. But I think the, you know, this is like the real deal when it comes to transformation.