Interview with Gregg Willsky on AI, Security, and Enterprise Risk

Welcome to CloudTweaks, Gregg Willsky. We’re thrilled to have you. To start us off, could you give our audience a brief introduction to your background, your focus as Principal Analyst at GlobalData, and the core value the firm provides to enterprise clients?

I am a member of the Enterprise Technology and Services (ETS) team. My focus is on team collaboration and contact center platforms from vendors in the US such as Cisco, RingCentral, and Zoom. I offer my perspective regarding what is happening in that space. GlobalData provides clients with qualitative and quantitative insight into numerous industries so they can make better decisions.

Perfect context. Looking broadly at your coverage area, everyone is talking about how AI is suddenly everywhere. But from a high-level conceptual standpoint, how massive is this shift really for collaboration platforms, and what is the underlying risk of letting AI agents run within existing user permission frameworks?

That observation is spot on. Platforms are having a Sgt. Pepper moment. The infusion of AI is transforming them by delivering far greater functionality than before, but that comes at a heavy price. AI agents are acting upon and disseminating data such as sensitive customer information. And while those agents often simply follow the user permissions afforded to them, those permissions are far from foolproof.

I love that "Sgt. Pepper" analogy. If these permissions aren't foolproof, it creates a silent risk. From a market perspective, how severe is the visibility gap for enterprises here—do organizations typically catch these gaps early, or are they completely blindsided?

Therein lies the heart of the problem. Organizations are often unaware that the failure actually occurred until, for instance, an angry customer alerts them to the fact their confidential information has been compromised or stolen and leveraged in some malicious way.

That is a sobering reality check. Is this visibility blind spot uniform across the board, or are there specific sectors carrying more complex transaction environments where this vulnerability is particularly pronounced?

Unfortunately, almost any scenario is subject to long gaps between the actual breach and discovery. But usually, situations involving complex transactions have the widest gaps. For example, financial services organizations are particularly vulnerable.

You don't even need a formal empirical study to understand why financial services are so exposed. When you look conceptually at what these institutions handle on a daily basis—mortgages, trading, deposits—how would you frame the potential stakes for them if a breach gap stays open too long?

I am not aware if there have been studies investigating what missteps financial services organizations have actually taken. But one doesn't necessarily need such studies to draw conclusions regarding what it cost them in time, money, or credibility. Imagine an institution handling customer requests for withdrawals and deposits, the processing of a mortgage application, or the buying and selling of stocks and other securities. These are all highly sensitive and often complex requests. The costs are absolutely tremendous in terms of time, money, and credibility once the gap is finally closed.

Exactly—the sheer sensitivity of the data speaks for itself. Looking at this from a broader macro perspective rather than the weeds of a specific bank, how does this usually play out as a case of "unintended consequences" when self-service tools execute valid commands but produce a terrible outcome?

I can speak to this issue more generally than what specifically happens inside financial institutions. It's a case of unintended consequences. The guardrails are followed but the permissions put in place for the tool can not anticipate every scenario. For example, what if someone accidentally cancels rather than confirms a reservation using a self-service tool? The tool can handle cancellations and thus the appropriate process was followed, but yet an error still occurred. The costs in situations of unintended consequences such as these are customer frustration at least but at the other extreme are potentially catastrophic such as identity theft or the loss of huge sums of money.

That example perfectly illustrates the gap between strict logic and human intent. If we lift our gaze to the vendor ecosystem, what is the fundamental disconnect when a macro relationship between an enterprise and a third-party vendor goes sideways due to misaligned expectations?

The most likely scenario is that the vendor did not fully understand the organizations' requirements or their industry or both. That could be the fault of either or both parties. In terms of cost, the relationship between the two has been damaged, perhaps irreparably and certainly the vendor's reputation has been soiled at the least.