EP235 The Autonomous Frontier: Governing AI Agents from Code to Courtroom

Security running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Detection, UEBA, and Risk in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of our Cloud Security Podcast listeners all on the Google Cloud Security Community page. Anton, this is an agentic and legal episode, and you recorded it without me. So listeners, don't worry, I'm not leaving the show. He just sometimes sneaks off and records without me.

Yeah, I can probably put it this way. Yes, even though my temporary co-host that you would meet in a moment would disagree, But I think that it's the funny part is that I had hesitations because I wanted the first episode on agentic AI to be hardcore about parsing MCP packets and technical stuff. Sorry for being slightly snide remarks about technology. But our first agentic episode is actually with a lawyer, and this is quite fascinating.

Isn't our temporary co-host for this episode also formerly a lawyer?

Correct. Correct.

This is an episode, I think, with 2 lawyers. Yeah.

In essence, we almost have 2 lawyers on the same show, and one of me. and none of you, so it means they outnumber us 2 to 1. But it is a very interesting and sort of insightful episode for a very broad category of listeners, not just technologists, not just lawyers, not just cloud people, not just AI people. It kind of, it almost touches on some things that are societal in implication.

Really?

Which is really quite cool, yes.

Yeah, we don't do that too often. I feel like the last time we had a societal episode was when we had my old professor on the show.

I think so, yeah. That was like the, of course, cyber war and a few other things ventured into societal impact territory, which admittedly we tend to probably stay away from because most people's day jobs don't have societal implications, right?

No, usually not. And I feel like the more we talk about societal implications, the more, well, additional lawyer cats will fall out of the ceiling and tell us to go back to talking about cloud security.

Right. Go back to the name of the podcast.

Yes, go back to the name of the podcast. Well, listeners, we won't go back to the name of the podcast today, but I hope you stick with us For what is indeed a very fun episode. And without further ado, let's turn things over to today's guests.

Today's guest is Anna Gressel, partner at Paul Weiss and one of their leaders of their AI practice. Welcome to the show, Anna.

Thank you so much for having me. I'm just thrilled to be here.

So it's going to be a little bit weird because our first podcast on AI agents is not with an engineer who would debate MCP versus A2A in painful details, but with a lawyer. And I feel like that indicates a societal impact of what we are talking about. So I'm kind of excited about this. Maybe it's unnatural. I don't know.

I mean, Anton, I could debate that with you if you wanted to, but I appreciate that we'll talk about some other issues today. And I think AI agents are just front of mind, actually, for us. They've been front of mind for a while and for many of our clients, because this is where AI is going. There's a huge imperative to get to the effective and responsible deployment of agentic AI. But from a legal perspective, they raise all kinds of fascinating issues. So instead of just, you know, issue spotting, we can talk a little bit too about like, how do you solve for those issues in practice? And why is solving them so important? So I think this is just the direction of travel the whole industry is going in. And lawyers are one part of that much, much, much larger conversation.

I do want to issue spot a little bit, because at times we have people who show up with those long lists of risks. And if you show them to business leaders, They get drowned because they think, well, does risk number 17 matter? So if you think of agents and their kind of autonomous decision-making and learning and memories— some of them have long memories, I hear— what are some of the key areas of concern? And by key, I really mean it. Like, what keeps you up at night? What keeps your clients up at night? Hopefully, it's not a top 30 list, but more like a top 3 or 4.

It's fascinating you asked that, actually, because I was just on a call this morning with someone talking about that question. We were like, what if you had to bubble up all of the most important agentic risks, and you weren't just saying, here's the litany of things that could come up. And where we landed is I actually think it might be a bit different based on industry, actually. And part of this is because agents actually amplify some of the concerns that are really core to certain industries. They just make those risks bigger and in some respects more challenging to solve. But let me give you some examples of that. In certain industries, agents are being deployed, and we should talk a little bit about what an agent is maybe, but agents are being deployed to do things like actually work on oil pipelines or manage energy grids. And this is like a big practical, really operational deployment of agents. And there, things like health and safety and security are going to be really paramount because you have agents taking actions on real-world physical systems and making sure that they're deployed safely in even a very traditional sense is going to be key. And then we have other industries like defence or pharma where working with sensitive information is really important. And so there we have this concern about like, what if agents can access really confidential information and combine that confidential information together, potentially use it in ways that humans would know to not use it or move it to places humans would know to not move it. And there we have risks around really, you know, trade secrets.

Yeah.

Leaking of confidential information, combination of confidential information that could lead to misuse of classified data. And so it's kind of an information system set of problems. And of course, running through this, and you guys, you know, know more about this than anyone, are concerns about cybersecurity vulnerabilities of agents. You know, are these systems capable of being compromised in new and novel ways? And that's just, I would say, like a top 3 list. Some of the things that we hear the most about. But really, we could go on. I mean, we could go on for quite a while because almost every legal area is going to be affected in a new way by agents in the same way that AI itself affects almost every single legal area. And so as a lawyer, you're constantly looking across different legal domains and thinking, you know, issue spotting in almost every single legal bucket, like regulatory risks, IP risks, cyber risks, privacy risks, you know, liability risks. They're all relevant. And that's true for agents too, for sure.

So let me drill down very quickly into one angle because when I'm trying to summarize the answer and I still keep hearing more data/information system risks, maybe over real-world risks, at least at this time. Is that a fair assessment? Like it still is mostly the IT domain risks, not agents being connected to physical systems. So real-world risks today.

I think it's a mix. I think it's a real question of where companies are using agents in practice and many are using agents do research or sit in digital systems and summarise things and kind of automate digital workflows that are really about documents and moving information from place to place and making things easier for humans in kind of back office functions. I think there you're right, those are generally IT risks. But we do have some companies that are actually really trying to think about deploying agents with respect to physical systems. And there, You know, for that might be a much smaller subset of companies at the moment, but there, I think the physical system risk has to be thought of very early and has to be solved for very early.

Well, that actually brings us to an interesting point because I think as we're trying to wrap our arms around this topic and regulators certainly, and legislators are as well, we're seeing a lot of frameworks coming out, right? So there's definitely, there's like the NIST AI RMF to try to have a structured way of evaluating some of the risks when it comes to AI. There's the EU AI Act. There's various state legislations in the US. And I'm curious for your perspective on how you see the evolution of these regulatory requirements or expectations, as well as industry standards evolving, and how you see them impacting AI and agentic AI.

It's a great question. I mean, I think to answer that, it helps to look back a little bit to where we came from to understand where we're going. I mean, many of these frameworks were proposed And Marina, you've been in the space for, you know, as long as I have. They were proposed with traditional machine learning in mind. And so many of the original regulatory frameworks were really focused on regulating use cases and not the technology themselves. They were use case specific and kind of like highly pinpointed. And then with the release of ChatGPT and generative AI more generally, we saw those frameworks really have to flex. And some people ask the question, should we actually be regulating general purpose AI models? And so you see that concept got baked into the EU AI Act. And there were a number of efforts at the state level in the US to regulate general purpose, you know, really frontier AI technologies, the most powerful AI technologies, as well as at the state, you know, at the federal level. But now what I think we're seeing is a question mark around how any of those really apply to agentic AI. Agentic AI does different things. It's kind of, it is a general purpose.

Yeah.

AI tool, but it's not really the same as ChatGPT. It doesn't work in the same way as traditional generative models, even though it's kind of built on top of them and scaffolded around them. It does different things. And so there, I think, are really interesting questions coming down the road about whether the current regulatory frameworks are fit for purpose, and if not, how to regulate agentic tools when they are so diverse and you can deploy them in so many different environments. So, you know, I think there'll be some debate about that coming down the road, but right now, you know, You know, there are no regulations really that are about agentic AI that we're aware of, at least at this moment. And so we'll see what the regulatory reaction to them is. Although I will say right now, we are kind of at a moment where there has been some resistance to increased regulation of AI, at least in the US, in part because some of those regulations are really unwieldy and they really do slow down growth. And so the question is, how do you create regulatory frameworks while still fostering, you know, an open and innovative environment. So I think that's really the question as we move forward.

And arguably it's a point that's going to continue to be difficult and may actually become increasingly more difficult because of the pace of innovation that we're seeing in the space. So similar to what we saw with the EU AI Act, it took so many years just to get to where we are. And where we are doesn't cover agentic AI.

Where we are. Yeah. Where we really are. Yeah.

Right. And we don't know where we'll be. But that's— I think it's a really interesting area to see develop from a regulatory perspective. I'm curious if we can actually pivot to the legal aspects as well. I've been doing a lot of reading and actually listening to your podcast, Anna, which is fantastic, Waking Up with AI. And I know that you discussed some of the legal aspects there too. And so there's these components of traditional tort law that might apply. There's product liability. There's evidentiary rules. How are you seeing those legal aspects developing with respect to GenAI and potentially agentic AI? Like, where are you seeing the changes really being made?

I mean, I definitely think that we're beginning to see cases, although many of these issues remain unsolved. So, you know, when we think about regulation of AI, I would bucket things into a few different categories. One is new laws dealing with AI specifically. So they're kind of AI-specific regulations, and we've talked a little bit about the EU AI Act. We've talked a bit about state regulation. We've certainly seen regulations come up around things like digital replicas. You know, those are technologies that might reproduce someone's voice or image or likeness in some way, and those are getting regulated. There are all different kinds of, you know, regulations around deepfakes at the state level. So we're seeing, you know, kind of a proliferation of laws, but they tend to be on really interesting and specific topics. They're not necessarily kind of broad gauge, at least in the US. Then we also see courts and regulators try to apply existing laws to new technologies. And that might be, you know, consumer protection laws or existing privacy laws. And so that is a whole exercise. IP is a great example of this. You know, there are many courts right now grappling with how to apply IP law to generative AI, including copyright law, which of course is, you know, not written to deal with AI specifically. So, Right now we're seeing all of this activity, but much of it is not definitive. Those court cases, we're waiting for them to resolve, and it takes years for cases to go through the court system, much less result in some sort of definitive decision that gives some finality and clarity to companies. So usually companies in emerging spaces are operating against some amount of uncertainty, and certainly our clients deal with this, but like Real true uncertainty about where those cases are going to land, and they have to kind of move forward because that can take years. Now, if you think about agents coming into the scene, agents are completely new. And they challenge all of these existing legal concepts and frameworks, even like traditional tort law. I mean, for the lawyers on the line, the question of whether, you know, an employee is acting within the scope of their employment relationship, or if they're on a frolic or detour doing their own little errand on the side of their job. I mean, that's like a really traditional concept. Concept in tort law to figure out whether that company should be liable for something an employee, its employee does, right? You know, that's kind of a cornerstone concept. Now imagine an agent. So the agent is like working for the employee. And what if the agent goes off on some frolic and detour? I mean, we have these hilarious examples of agents that are browsing the internet that pause and they like look at pictures of Yosemite on the side, but they might be doing something else on the side. They might be like sending documents outside of The organisation, I'm just saying hypothetically, not like we have real examples of this, but hypothetically, they could be like, you know, booking me a ticket to the wrong destination or spending the corporation's money. Again, this is all like just kind of joking hypotheticals, but there are really interesting questions that may come up about who should be responsible for that. Is that the employee's responsibility? Is it the company's responsibility? Is it the agent's responsibility? So we're going to have all this complexity. It's going to challenge like all of these. core and fundamental questions, but the time horizon to really resolve that is quite far in the future. And that's sometimes when we see people come in with those AI-specific regulations to try to, you know, shortcut the traditional, you know, legal process and come up with a really, really specific legal framework to regulate. But sometimes those regulations, as you mentioned, Marina, like they're almost immediately out of date once they're passed. So it's, you know, it's a bit of a cat and mouse in terms of getting ahead, but then falling behind.

It kind of makes me nervous from a very strange point of view is that some of these AI developments are measured in months, if not weeks. There was a brief situation here when we were talking about comparison of protocols, and I kind of go to bed with a slide deck. I wake up the next day, and there's a new protocol that I did not know about, which I guess we need to mention. But court cases take years. So, at this point, I'm almost like going off script and thinking, What are the implications of that part, which if tech changes by weeks and court cases take 2 years, we may discover some truth as an outcome of some case by 2027, but the tech reality behind it would change by July 2025. Like, how would the universe even function? Well, how would civilization function? Not universe. Universe is probably fine.

It's such a good question. And that is the argument that people have traditionally made about regulating use cases and not the technology. So if you're regulating the use case, the argument is like, it doesn't really matter what the technology is that's like whizzing and whirring under the hood. What matters is someone trading a stock or engaging in accounting fraud or, you know, not complying with their corporation's code of conduct, right? There's a certain way of regulating actually the function or the effect without needing to regulate actually, you know, the difference between GenAI or an agent. I mean, there are moments when that doesn't work and there are things that become out of date and you have to kind of really look at new concepts. But there is a real argument for saying, actually, we're going to take a pretty use case specific approach and we're going to let financial services, for example, regulate financial services. So that's the traditional way to think about that. At the same time that, you know, you can't prevent the cases from happening and they do, law does, at least in the US, evolve over time. So we are going to see some natural evolution. That happens because some cases will get litigated. But technology's going to proceed no matter what. I mean, I think that's like, that's really where we are. And I do agree with you, the pace of change. We used to tell people, I think, I don't know, Marina, if you and I have had this conversation before, but I feel like you used to tell people, you know, every year, every 9 months, there's going to be some sort of, you know, change and you should look at your governance again and you should make sure that you're kind of Keeping up to date, you know, that you've done a refresh, etc. Now it's like, I think it's 6 months on the outside and many changes happen even more frequently with that. And certainly on agents, we're seeing just this incredible development curve as everyone is taking on this challenge kind of in parallel. And there's so many different ways in which that technology is evolving, whether it's, you know, major developers or application providers. We're finding new ways of developing protocols for agents to communicate and be supervised and coordinate. And of course, it's all necessary. Right? We're building a whole ecosystem. And so I think it's like this idea that the whole ecosystem is evolving together. And so there are so many new ways in which like all of this change is happening kind of in parallel. It's not just one step change, it's ecosystem level change.

I wanna pick on one thread you mentioned about liability and who did something, because it's like your example of employee doing something versus their agent is doing something. That is one of the issues that does keep me up at night because I always think about, like, if my agent is buying airline tickets and then it buys something wrong, airline would say, well, it's your credentials. We don't know anything about any agent. You logged in and it's your fault. And I would tend to think differently about it. And I would think maybe the technology did it or maybe the airline. So, I'm really torn about this because, of course, people who do futurism, they assume there would be specific agentic way of doing things. But in today's world, there isn't. Agents would be thrown in the human world and would have to act in the human world. So can you help us? A very broad question. Like, what are the choices even? Like, who's responsible, who's accountable, and what are the useful ways to think about it?

I mean, I think there are many different ways to break down that question. One could be, you know, were there terms that told you that actually answer that question? Because of course private parties can come together and make contracts and they can decide, hey, if you use my service, you're going to agree that if you use an agent, this is your responsibility for using an agent, right? There are going to be different kinds of norms. Societal norms actually play like a huge role in who we think of as responsible for different actions. If you think about open banking, right? Open banking could have been something that was shut down, but instead We actually said, and I think kind of like more broadly, you know what? We're going to actually let fintechs come into this space, and we're going to let people share, you know, potentially share credentials. Maybe we'll come up with like a more secure way to do that, so that we're not compromising those credentials. But we want some information flow between banks and fintechs to facilitate kind of an innovation economy. We're not going to stop that, though of course there's a whole question of how you regulate that. That's like. Putting that to the side. And then of course, there could be totally new ways of regulating agents to say, anytime something happens, this should be the result. And that would be somewhat of a blunter way of approaching it. But you could imagine a state saying, here's the way we're going to regulate agents in our state. And so the regulation itself prescribes that, and it's no longer a matter necessarily of the private parties just making that agreement between themselves through terms of service or other contracts. But those are different ways of thinking about it. I think the The way that we have thought quite a lot about this is that a lot of people are going to come together to create both technologies and terms, and those are all going to have to move in transit together. But right now, you're identifying a lot of really interesting legal questions, like who's responsible if there's just an unintentional communication failure between an agent of one company and an agent of another company, or a human in another company? Some of that, the reason that's hard to answer is because we don't have any norms for that. Like, we just don't have a way of thinking about that naturally. Like, well, obviously it should be that the agent corrects itself or that someone's checking the agent. And those questions actually get easier over time once you build technology that helps with that. Like, if there's an error, here's how we correct the error. Here's how— You know, if there are 2 agents and they're in conflict with each other, here's how they resolve the conflict. Do they have to go back to their, you know, their humans and get clarification, or do they just forge ahead? And so those kinds of, I would think of them as like a combination of protocols, like we talked about this earlier, communication protocols and potentially dispute resolution mechanisms that are really meant to make that whole system work. And the idea is like, the better the norms we have, the better the communication. systems we have, the better this whole system, the whole kind of ecosystem will work. But an easy way, an easy example of this is like cars on a highway. And so if every agent is a car and we're building cars, the whole system works better if like the cars have roads to go on. And if the roads have signals and we understand what the signals mean, like they can't have random signals. We have to agree that a stop sign's a stop sign. And, you know, like a yield sign's a yield sign. We have to actually understand that. And then we have to train people to drive the cars and understand the signals. And so this whole ecosystem relies on those communication norms. And again, these dispute resolution norms, like a red light means you stop, I go. And right now we're still working on that. I think that's still a work in progress. So as that becomes solidified, I think, Anton, to your question, it'll help with the legal. answers because the norms will be there and we'll be able to say, oh, okay, but this kind of would make sense for this to be the answer rather than taking it in like a legal vacuum.

I think that's such a fantastic answer, Anna. And I'm just looking at Anton right now and thinking, you know, when we were, when we were chatting about inviting you to the podcast, I was like, Anton, we have to do this. She's one of the premier experts on this topic. She's going to be a great speaker. Let's have her. her over. So you're proving me right, and I appreciate that.

Yes.

Oh, you guys.

I think, though, it's clearly like there's so much uncertainty. And I think 2 years ago, at least what I was seeing with the industry and some of the folks we were speaking with, 2 years ago, there was so much reticence in terms of moving forward. Like, GenAI had come out. Folks were really excited. But at the same time, from an enterprise use case perspective, there was a lot of hesitation. And certainly within financial services, you know, one of the main areas of concern that we heard was regulatory uncertainty and fragmentation at a global level for firms that are operating on an international scale. And fast forward to today, and we're seeing so many organizations using GenAI in various different use cases. So they got comfortable, right? They kind of, with Irrespective of the regulatory uncertainty, which to a large extent remains, as does the fragmentation, folks got comfortable and kind of started to move forward and are taking risk-based approaches. So my question is, as we're looking back on GenAI somewhat at least and looking forward to truly agentic AI, from my perspective, a lot of this comes back down to governance, right? And kind of taking into account many of the considerations that you've called out. And so I'm curious if you can share with us, if you had to kind of define, like, what— distill the main components of that governance, like, what are the must-haves for firms to, at the very least, start considering how to move forward with agentic? What are those, like, foundational hygiene elements they need to have in place?

Ooh, I love this question. It's fascinating because actually one of the things we're thinking about a lot today is What needs to change about governance in an age of agentic AI? Is that different from traditional governance? And if you think about kind of traditional AI governance, it's often scaffolded around, you know, a cross-functional committee, a set of principles or guidelines, and then a risk-based approach to evaluating AI tools and systems and models against that risk-based approach. And that risk-based approach has to be aligned with the company's risk appetite. It has to be consistent with the company's principles writ large. And then that risk-based approach has to be, generally speaking, well effectuated. So people have to have the time and the resources to devote to it. So that, I think, is in many ways, there's more to say, but that's the traditional model. When we think about governance for agentic AI, I think one of the things that we really are focused on is, A, of course, the risk profile is going to change a little bit. And so you're going to have to think about your risks and think about whether those Need to be a little bit different or tweaked, or your review process needs to be tweaked. Certainly that, you know, around third-party tools, you have to even understand what are you, what are you procuring here? Like, what is the agent? How do you pressure test that? Is it, is it snake oil? Is it just a claim or is it really agentic AI? And making sure that people are educated about how to do that, that's probably, you know, step one in this. But the other thing is, much like the move from machine learning to GenAI, We're going to have a similar shift between GenAI and agentic AI, which is that your employees are going to have to themselves take on a certain amount of a risk management role. And with GenAI, that looked a lot like making sure that you had the right enterprise technology so that your employees were not just like sticking things in public models and potentially putting them out into the world. So there was a creation of technology that was fit for purpose at the enterprise level, and then a training of people to actually look at the outputs and supervise the outputs in practice and kind of decide, use like judgment and how they were going to use those. With agentic AI, it's more like, I think, workflow supervision. So it's less about just reading an output, and it's more about understanding that what you're supervising is an entire workflow from kind of A through Z. And the employee's not going to have oversight at every single step of the workflow, or in fact, that would Defeat the purpose of the agent, right? You want an agent or agents to come in and kind of be able to work really seamlessly.

Automation, right? You don't want—

Exactly. You are automating it. You want the human out of the loop in certain respects, but there are going to be key moments when you're going to want your human to actually make a decision or say yes and accept some risk or accept some outcome. And the human has to be involved. So the question is where? And it's about designing that kind of architecture for that and the decision architecture for that, and then training people to do that. They're really operators in a different kind of way. And so governance is going to have to account for the fact that that's really a whole education shift, and it's going to require tools, and it's going to require kind of the right mode of supervising agents. But, you know, I think, Marina, to your point, like, that's a conversation that happens. At the level of the company, where the company itself is going to have to ask as part of its governance, what tools do we need to supervise the supervisors? What do we need to make sure that we're monitoring this correctly and that this is actually working in practice? And then there's going to be a conversation with the people developing the tech saying, hey, actually, I think to make this work on an enterprise level, we need A, B, C, and D. And remember, there was like that whole period of time when Everyone was figuring out how to architect the enterprise versions of GenAI products. And that was a whole period before most of those issues were basically solved. And so we're kind of in that same moment with agentic AI, where everyone's trying to figure out how do we row together on this? And it's actually, I think it is a really productive conversation to have, but it's to get to that point where, you know, you can do that kind of next level governance, you can have employees in that kind of next level role, but the first step is recognizing that there's a change that's going to have to happen.

Yeah, that makes sense. And I think that it's nuanced and dynamic at the same time, which I guess makes some people uncomfortable, but that's also life. So you can't really, it's really hard to argue with this because it's, again, it's clearly grounded in reality.

It's life. And that's the point of governance too, right? That it should be agile. It should be able to live and breathe. It should move faster than the regulation, right?

Right.

You know, we had that whole conversation about how slow regulation is, but when governance is well done, it should be able to kind of live and breathe and iterate and keep up to date. And that's when, you know, your governance is working really well, is when it hums along really quite quickly and it can adjust to these changes as they happen. So, you know, not everyone is there. It's a hard thing to get right. I don't mean to say it's easy, but ideally that's kind of the conversation that you can have. So if you're in one of those governance groups, having that conversation about agentic AI now, even if you're not doing the adoption, Or you're just beginning to think about it, just, you know, make sure that you're not storing it for too far down the road. Because to, you know, to our earlier point, things— this— it's moving much, much faster than many people realize.

So, I hate to do this, but it's almost time to close. We typically close the episodes with— by asking the guest 2 questions. Give us one tip on this. You know, people have takeaways. You provided a lot of very useful takeaways, but give us one tip that's like top of your mind. And give us some reading materials, listening materials. Of course, you run a podcast, so it's very fair if you mention that, but one tip and one resource.

I would say the tip is remember that it is moving. And so, you're really building for what is going to be in place 6 months from now and 9 months from now, and not what you heard yesterday. You know, that's going to be old news pretty quickly. So, stay on top of it, stay ahead of it. It's so exciting. This is like breaking open. A whole new set of possibilities in terms of like how people work together in the workplace. So it's an exciting thing to take on if you're up for it. And then just, you know, digesting some of the information that's out there, there's actually a lot. I would recommend our podcast. I think it's fun. It's 7 minutes to like 15 usually, and we try to cover new tech developments. But in terms of agents, there's really interesting research coming out of most of the major developers. developers on agentic AI. And I think it's just cool to actually get yourself on YouTube, watch some demos. Even if you don't have these deployed in your environment, it doesn't mean you can't see how they work in practice. So like, go watch the bajillion YouTubers out there that, you know, do these almost like video game walkthroughs of what's possible with agents. And it's fun and you'll learn a ton. And then, you know, you can bring those conversations into your office.

Perfect. Thank you very much for this. This was quite fun. Now I feel slightly embarrassed that we could not do it in 7 to 15 minutes because it feels like—

Well, we try. We don't always succeed, but we have our coffee and we try to kind of like finish the podcast by the time we finish our cup. So it's called Waking Up with AI. And, but thank you guys for having me on your podcast. This is such a pleasure and honour to join you both. And what a great conversation.

Thank you so much, Anna.

And now we are out of time. Thank you very much for listening, and of course, for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcasts. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.