Why Strong AI Governance Gives Organizations Freedom to Innovate with Eddie Borrero, Chief Information Technology Officer at Cyera

[00:00:03] Hello, everyone. Welcome back to the Outcomes Rocket podcast. I'm really thrilled to be hosting Eddie Borrero today. He is the Chief Information Technology Officer at Cyera, and they're doing some extraordinary things across healthcare, but his focus is healthcare, helping leaders understand AI adoption, making sure that it's secure, making sure you got the right governance. So really excited to have him here. His background, he's been CISO at Blue Shield of California.

[00:00:34] Previous to that, Senior Vice President, CIO Estalaris, and many others. So really just a pleasure to have you here on the podcast, Eddie. Thanks for joining me. Oh, Saul, it's my pleasure. I'm so excited to be here and humble and grateful to be invited to the show. So I look forward to our conversation. Likewise, my friend. Likewise. So look, before we get into the meat and potatoes of the business, talk to me a little bit about you. What got you started and what keeps you going in healthcare?

[00:00:59] Healthcare was probably the first industry I walked into because I've worked in many industries, by the way. But the first one I walked into where my heart was really aligned to the mission of the company. Prior to that, it was interesting work. Like I worked in tech. I worked in gaming. I worked in professional services and I worked even in critical infrastructure. All the work was extremely interesting, but nothing really tied to my passion, my emotion, my heart until I got to healthcare.

[00:01:25] And then I understood how technology can actually help every human on this planet live a more healthy life, get access to healthcare in a better way, make healthcare a lot more affordable. I also come from a very humble background. We were very poor growing up. Impoverished would be an understatement. And I've seen how not having money and access to healthcare can really impact people's well-being and their longevity.

[00:01:47] And all of that wrapped up into my first career in healthcare, which was Amgen. And then when I went to Blue Shield of California, I really took hold. So I think I'm in trouble or I'm stuck in this industry mostly because I'm just so in love with how we could help so many people with technology in this space.

[00:02:06] That's great, Eddie. Yeah, no. And by the way, I share that background with you and what a great country that we live in that you could start there, but build a career, a meaningful, impactful purpose. Just a privilege to be able to do that in this country. I mean, you got a pretty big audience and I feel a little timid saying this, but I started off as a homeless teenager.

[00:02:27] And yeah, I joined the military to kind of, I graduated high school during the military, got my stuff together, went to school, worked hard, worked full-time, went to school full-time. And I am still at 52 years old, I'm amazed at how far I've come. And I am so proud to be a representative of anyone can make it. If you see it, you could be it is something I like to say to a lot of our veterans and our youth. And yeah, I want to be the salt. I want to be the light for others to follow and to see what's possible.

[00:02:57] So it just, that's so great. How much of me to be able to do that? That's awesome, brother. I really appreciate you sharing your story. And I love that saying, if you could see it, you could be it. I'm going to add that to my things that I say to my nine-year-old boy to keep them inspired and in the game. That's awesome. That's awesome. Like, there's a lot of things on leaders' minds today as it relates to AI adoption, governance, security, GRC.

[00:03:23] Like, what breaks when you run technology, security, and AI at the same time? And what do you change about how you lead after that? Yeah, I think I talked to hundreds, if not close to a couple thousand CIOs and CISOs and technology leaders over the last five, six months.

[00:03:40] My job is to get out into the industries, to help design strategies, and to really help Sarah build a product that's going to help people govern AI effectively so they can enable its usage in their business to drive a change. And I'm lucky enough to really focus on healthcare in this work. But I think there's a deep paradigm shift that's happened, right? The old architecture, the modeling for governing, securing, and running technology are very different nowadays with artificial intelligence.

[00:04:10] And I haven't met a CIO or CISO or executive in technology that hasn't figured out. It's a complex problem. And I think the work I'm doing, we're getting really close. We're getting really close. So I have developed a common control framework that I'd like to talk about in regards to how do you govern AI? AI. It's aligned to all the standards that are coming out.

[00:04:33] And many of the standards are in flight and trying to figure out how to give guidance around how to securely implement artificial intelligence within your companies. But I say a couple things. I say every business strategy, I haven't met one that has broken this rule yet, has AI behind it. If it's cost-cutting, if it's differentiating your business, if it's developing products, AI is there. And then every company is implementing it in three areas. They're implementing it in the workforce. And this is where you're deploying kind of co-pilots.

[00:05:03] You're doing chat GPTs. You're doing cloud code, cloud co-work. But the goal there is to have every employee work at the top of their license. I like to say, get our employees to do things they're really happy and passionate about. And remove all the administrative and bureaucratic processes from their world. And they do that on their own. And then there's AI. I call it AI in the platforms.

[00:05:27] And this is where companies are putting agents to take over business work, like call center agents or internal agents to help with business process. This is where they're connecting applications to big foundational large language models. This is where they're transferring the third parties that are doing amazing work with AI. So moving their business pieces and parts to actually become more efficient, to cut costs, to differentiate themselves.

[00:05:53] And then the last place they're implementing AI is in development. And so if you're a big company and you have an engineering shop, the progress of Agentic and our AI-assisted development and delivery of products and platforms is just amazing. In the last six months, there has just been such an adoption of Codex and Cloud Code as an example. I call it the faster, better, cheaper play.

[00:06:18] But it is changing the game at how companies can build and experiment and do work that's amazing. But no one has, though, is what I call the defense, which is the governance of all those things. And many companies are just accepting the risk because they know if they're not adopting AI, the risk to their business is detrimental, meaning they may not even be in business in the next couple of years.

[00:06:40] And so what I've worked on with the help of many at Saera is a model that pulls together kind of nine domains of focus. And it's things like understanding who's, I call it the governance model, but you have governance and oversight. Who's responsible for what? How do you understand what data is in your organization? What AI is doing in your company? How do you put some rules and restraints and policies against it? There's a component of risk management.

[00:07:07] How do you understand all the risks associated with AI, both externally and internally? And then you have to have, from a compliance standpoint, like transparency and explainability. You have to have pieces and parts of understanding privacy and compliance. How do you understand where you need a human in the middle? How do you understand where you have a process to remove bias from your models and your agents? There's incident response you got to think about. But there is a playbook that I'm writing about.

[00:07:36] And if you follow me on LinkedIn, you'll get to read more about how to implement each and every one of those parts in your company. But there is a model. And then we're building capabilities that really help with the majority of how you need to implement governance within your companies. And our goal is to build an AI governance ability to govern AI.

[00:07:56] And so the only way you can keep up with it and ensure AI is doing exactly what you expect it to do is by having an intelligent AI model govern it all. And so my ability to work with our product teams, talk about where we're headed and understand, truthfully, more understand where they're building and what our customers are saying they need into our platform really helps me design.

[00:08:19] How do we help companies build governance in such a way that they can feel comfortable and trusted in deploying AI in the workforce? Feel comfortable and trust their AI deployments in their business processes? And then lastly, the development of AI inside your platforms and capabilities. Like how do you know your developers aren't coding things incorrectly or building in vulnerabilities? Your agentic models or new applications and new platforms?

[00:08:49] There is a world that has to shift and change and adopt agentic development or AI-assisted development. I like to think of it in those three ways. I like to build or building a governance model that applies to it in such a way that it frees up a company's ability to do those things without really having to worry about the risks associated with it because you have technical controls in place that can keep up with the pace of change. Yeah, I like the framework, Eddie. I'm a huge fan of frameworks.

[00:09:18] They simplify the way you understand and operationalize things, business. So I'm definitely feeling what you're saying. So your three areas are workforce, platform, and development. And ultimately, those are the three kind of deployment kind of areas. And then you're allowing for folks to do it intelligently because the engine that runs it is also an AI engine. Yeah. And there's two, I call it the offense and the defense.

[00:09:48] So offensively, you're really pushing to have AI bring value to the company in those three spaces. But if you have a good defense that also ensures that people aren't going off the rails, there's the proper constraints and guardrails within each of those areas, then people can work freely. So if you build, for instance, in AI, one of the major controls that you really have to put in place is the old traditional model of least privilege.

[00:10:15] You have to ensure because AI in the workforce typically adopts permissioning from a human being. And so a couple of interesting facts. Humans, by nature, are overly permissioned within their company. And they only use about 4% of their privilege to do their work on any given day.

[00:10:32] But when they ask AI to do something with a co-pilot, chat GPT, or a cloud agent of court work, that agent adopts all of their privileges, plus any non-human privilege that's associated with them. And so now, and that agent will use 100% of all that access to do a task, which a human's never done before. So is it really 4%? Is 4%? Yeah, 4%. Yeah, on average? Wow. On average, yeah. Huh. Yeah.

[00:11:00] Just think about like all the things you have access to. I like to use like Microsoft 365 as a great example. Yeah. Your permission for email, for shared drive, for OneDrive, and you have access to all these things people have shared to you. A lot of what happens in a company is a lot of SharePoint and OneDrive is over-permissive, meaning a lot of shared drives or shared documents have global access, everyone access. You can have access to so much information that you've never looked at before.

[00:11:29] But with a co-pilot, you can say, hey, co-pilot, tell me what the CEO is doing. And if you have any access to any documentation that your CEO has put forth, then you have it now. And it's that easy. Is my company going through any kind of merger and acquisition? Guess what? Like you wouldn't even know where to look previously, but now because someone mistakenly gave you access, a co-pilot will find it in second. And so one of the basic things you have to do with AI in the workforce is practice least privilege.

[00:11:57] Like get a great understanding of what the human has access to, what data, what systems, and constrain it as much as possible. Move all the things that have global access within your environment that have confidential data or sensitive data in there. And there's tools that help you do that now very quickly, like a Syra. We can help you automate that process very quickly. But unless you're constraining the human roles, you're starting off in a losing position.

[00:12:23] And then I believe we have to get into kind of ephemeral kind of access, meaning like just because Eddie has full write and read access to all these systems, when I ask co-pilot to do something, it doesn't need all that privilege. So if I say create a document for me, it doesn't and do some research, it doesn't need write access to that research material. It only needs to read it. So how do we then constrain that agent to say, oh, you only have read access to the data Eddie has access to. And of course, you can write him a document.

[00:12:52] But you start doing that on scale and thousands of people in real time, it becomes very complicated. But that's where we're headed with governance capabilities. It gets easier in the other areas. So like if you build an agent as an AI in the platform, you can actually give that agent an identity and constrain it and constrain its skills, its knowledge, what it can connect to. You can build a harness that has real good guardrails, but you have to actually be able to constrain it. And so doing that has been it's proven difficult, but it's possible.

[00:13:22] And then with technologies like us, you can actually then really put another layer of control on top of your harness to say if the harness ever deviates, if the agent ever deviates, take action. So there's a lot to it. But I think just being on the cutting edge of who's doing the best work in this space, I get to see it all. So that's awesome, Eddie. And I realize we like go straight into it, but like tell me more about Syara. I didn't give you a chance to really kind of and I know you have been sharing more about capabilities here.

[00:13:50] We've been having our discussion, but tell me about Syara. Yeah, so I'll tell you about my history with Syara first and then I'll give it a little bit of a backing company. Syara was founded a few years ago. I was an early adopter of technology. And it started off with a I like to think of it as a data intelligence capability. It was a data security instrument tool. And its real focus on life was to help you identify where your data lived, what that data is.

[00:14:18] So help you label and classify it with precision and then help you understand who had access to that information so that you could actually start to do the job of security because you understand where your crown jewels were. You needed to put the right protections over the right level of classification or confidentiality of data. You really needed to understand who's accessing and who's using it. And these are all questions you have to answer, by the way, in a breach.

[00:14:47] But as a security practitioner, that has been foundational for security from day one. Understand your data, which is your assets, and constrain and control who has access to it. And so that problem has been really hard to solve. So Sarah built an intelligence engine to do that work. And then they got into helping you understand where your data is moving. And so we built a data loss prevention intelligence engine. We call it Omni.

[00:15:15] That then helped the security world really build a data prevention or data protection model. That once you understood where your data was, who had access to it, you can intelligently put some rules and constraints around who's sending it out of the company, which has been a big challenge for many organizations for a long time. And now we have also acquired a major non-human identity company called Oasis.

[00:15:40] So we have now built into our product or building into our product a great ability to understand the identities that are accessing data, be it human or non-human or agentic. Oh, okay. Because that's a big issue, right? Right now, that's a black box for people. That's right.

[00:15:58] So now we have just deployed as of three weeks ago or two weeks ago, what we call Agent Guardian, which is agent security intelligence capability that helps you understand what AI is running in your environment. What are the agents? How are people using tools like Copilot? You can understand everything about that agent, what data it has access to, what knowledge and skills it has, what its intent is. It has traceability.

[00:16:28] We log every transaction and every event of that agent so that you can understand and discover in your company what's going on with AI and that you can control and govern it. And so now we are a big agent security, I call it an agent governance platform.

[00:16:47] But you think about having the ability to understand every bit of agentic modeling within your company, the intent and knowledge and logic behind that agent, understanding what it could do and who has access to it, and then understanding what it does and what output it's putting in place.

[00:17:05] So every time I show it to a customer or a prospect, they're just amazed at how much insight and control we've already built around this world of agent deployment within companies. And so Saera is a data intelligence platform that can help you understand where data lives, what it is, how it's being used, who has access to it.

[00:17:28] And it is now an agent intelligence platform that can help you govern AI and all those three use cases that I talked about. Love it, man. Really succinctly put. And, you know, that piece around knowing the difference between human activity and agent activity inside their own systems is a big thing. And for health systems or even health plans sitting on patient data, let's talk about them for a second.

[00:17:54] What's the first thing they should do about this technology and how should they be thinking about it? Well, I think about it in so many different ways, but let's keep with our three offense or three use cases, right? So many companies, be it a payer, provider, law sciences, you name it, they're deploying AI in the workforce. And the challenge there is that they don't have a great understanding of where their patient health information lives.

[00:18:23] It could be in SharePoint. It can be unstructured. They have a great understanding of where it is from a structure standpoint, right? I know my systems of records. I have my claims management system. I have Epic. I have all these pieces and parts. But humans have been taking data out of those systems and putting in places and building it into business process for years.

[00:18:43] So once you light up AI in the workforce, the biggest risk for health care is that information gets leaked and are put into models that aren't regulatory wise permitted to see that data or use that data or process that information. And then there's a large risk around it having bad outcomes that are used for the health outcomes and are treatments of patients.

[00:19:08] And so AI in the workforce, if you don't have a great grip on where PHI is, how it's being used and the outcomes of the AI models when it is being used, it's a massive risk. It's a compliance risk around HIPAA for sure. But even more so, it's a risk to patients because maybe there's some bad advice given to a patient. The patient outcomes and care could be at risk. And then you think about AI in the platforms.

[00:19:34] And this is where companies are spending a lot of time, especially big payers and our providers, on how to automate revenue management, how to automate claims, how to do care management better, how to build better call center environments. And the same things are true. It's like, are you actually understanding what data is being pulled into the model? It's for sure going to have personal health identifiable information of our patients because it's what we do.

[00:20:03] So is it meeting all the regulatory? Yeah. And are you audit ready? Like the biggest question I ask technology leaders in healthcare is, all right, you built an agent and AI on the platform. Do you have traceability and explainability? Can you see every transaction that your agent is doing? Do you understand what data it's pulling in, the decisions it's made, the outcomes it's put forth to a human, and then how that's being used?

[00:20:31] And so if you can't see that, then you're in big trouble when an incident happens and breaches are systemic in healthcare right now. Or when a regulator comes in and audits you and says, show me the evidence of how you're managing what that agent's doing, which is a big problem. And then, of course, you need to have controls around what that thing can do with this information.

[00:20:50] And there's news article after news article of AI going wild and making its own decisions and trying to do what it takes to please the human that's using it. And so this concept of AI in the platform space, there's a lot to figure out. But people are moving forward because of the benefits of better quality scoring, better revenue management.

[00:21:15] You hear stories of providers actually upping their claims models so that they can get paid more. Care of payers actually using AI to actually deny claims. And so there's just like all this work that's happening, but the governance behind those agentic modeling, I can guarantee isn't there effectively. Well said and great to think about. And we've all got to think about our AI strategy, folks. It's got to be documented. And now an agent strategy on top of that.

[00:21:44] The things that Eddie brings to the picture here, traceability, being able to verify what it's actually doing. These are all important questions. And there's a way to do it now with Syara. So that's kind of cool. So I love it. You guys are. It is, man. You guys are at the forefront of this. Eddie, if people were at time, I could probably do a part two with you on this one. But if people wanted to, if you're up for it, let's do it. I'm in 100%. I love it.

[00:22:13] But for now, I feel like we've shared enough for people to get curious and learn more. So if people wanted to reach out to you or the folks at your company, what's the best way they could do that? I think hit me up on LinkedIn is a great way to do that. I'm always watching, paying attention there. I'm also writing quite a bit around. I'm going to keep up with your writing, man. When you mentioned that, I was like, ooh, okay, I got to follow you. I got more there. Okay. I'm working on a book too. So eventually I'll plug that. I love that.

[00:22:43] What's the timeline for that? I'm almost done. So I got to figure out, I have it mostly written and I got to transfer it over to an editor and a publisher. So I would say probably two, three months, the latest. Dude, that's exciting. Maybe that's our part two. We kicked that one off. I love that. I like it. I love it. I love it. I'll end with this. I'll say for those that are struggling, because everybody is, there is an answer and there's models that can be deployed to help you be more successful at deploying AI and building the proper governance.

[00:23:13] People are figuring it out. So if you want answers, you want to participate in a community, if I can help you in any way, just reach out. That's awesome, Eddie. Really appreciate that offer. Folks, take Eddie up on it. We'll leave his LinkedIn in the show notes as well as the LinkedIn, as well as the information for Syaira. So check that out. If you have a friend or a colleague in the business that could use it, forward this episode to them. That's how we make change happen. Thank you all for tuning in.

[00:23:41] And Eddie, thank you so much for being with us. It's all. It's my pleasure. Thank you for the opportunity. Great chatting with you. Thank you.