AI Agents Are Taking Action. How Do Enterprises Govern Them? | With Blake Brannon, OneTrust

Blake Brannon (0:00)

So that notion of intent and purpose is really key as we think about scaling this governance at scale. But those are the types of nuances that, again, organizations are going to have to have proofs. They're going to have to have proof and confidence in saying, we don't only trust, like we have an inventory of AI, we have these kind of tools in place. We've got to be able to say we trust what the agents are doing, and the trust is tied to the actions.

Sanjay Puri (0:27)

Welcome to the CAIO Podcast, a show where chief AI officers and leaders driving enterprise AI at Fortune 500 companies and government agencies talk to their peers, not at them. I'm your host, Sanjay Puri, and my guest today is Blake Brannon, Chief Product and Strategy Officer at OneTrust, the AI ready governance platform trusted by over half of the Fortune 500 Blake has been building technology of trust since he joined as OneTrust's first Chief Technology Officer in 2017, coming after nearly a decade at AirWatch, the Atlanta-born mobile device management pioneer that VMware acquired in 2014

Today, Blake sits at the center of one of the hardest open problems in enterprise AI. How do you govern systems that act autonomously at machine speed and across your entire business, including, as we'll get into it, in his own company? So let's get into it, Blake. Welcome to the CAIO Podcast.

Blake Brannon (1:28)

Hey, Sanjay. Thanks for having me.

Sanjay Puri (1:30)

Before we get deep into it, one framing question I had is, as I mentioned, you started your career at AirWatch, writing patents for controlling email access and managing mobile devices, that IT didn't fully own or control. Now at OneTrust, you're building governance for AI agents that IT also doesn't have full control of.

So when you look into your past and when you actually line these two problems up side by side, is there any connectivity, any assumption that was right or anything that was wrong from what you did before?

Blake Brannon (2:12)

Yeah, that's a great question. And there are a lot of really interesting parallels that we can draw from the lessons we learned in, I'll call it the mobile cloud error, not just the mobile error, because they were both kind of happening at the same time. And one of the first fundamental parameters that was happening was the innovation was outpacing IT's ability to kind of keep up with the security and governance, right? So the pull from the business was a lot more about this new cloud capability they found, or this new mobile application they wanted to use. And the imagination was limitless, it felt like. And it was exciting because it was creating real competitive advantage for companies. But this put IT and security on their heels really quickly in organizations which were like, how are we going to embrace all of this? And there were a couple of fundamental shifts that happened. So that we learned from that, that I think do pull forward. The first was the approach to governance went through a pretty dramatic shift, or I'll say security and governance, in that mobile cloud era. Prior to mobile and cloud, the technique for securing was attacking the perimeter, right? All your corporate assets were effectively inside your company network. So you just put bigger walls up around it, right? So you focus that. When you had a mobile phone and a person running around the world that was connected to cloud applications, that was all outside that firewall, right? And you had to completely shift your approach and architecture to governing, to focus more on the mobile app and the identity, as opposed to the endpoint and the perimeter. And that same big shift of the fundamental approach, I think, is what we're going to see happen with the way organizations have to reimagine agents. And agents is actually more, and I'll get more into this as we dive deeper into the discussion, but it's more about the action the agent is trying to do, is where you have to shift your focus into it. So similar big shift that we saw from that type of world. The second thing I would say that is a parallel that pulls forward, is when mobile devices first came out, there was a lot of focus on, let's build trust with the mobile device itself. It was kind of mobile device management. So you had to think about this type of device, this operating system, when is it going to have these native capabilities within it for us to control it, to lock it down, to get it the encryption we need, to give us the protection we needed. And that is a really hard problem for two reasons.