KBKAST

There are pockets of useful practitioner insight - distinguishing SLMs from frontier models for cost routing, framing governance as a live orchestration layer rather than a static policy, and separating 'putting cyber into AI' from 'putting AI into cyber' as two distinct workstreams. However, these sit amid substantial padding, repetition, and predictable points that any follower of the AI/security discourse would already know.

“there's two distinct things here around putting cyber into the AI process and then putting AI into the cyber processes. They're two, they're two work streams.”

“you don't need to be pushing out to frontier models for. I just need to aggregate these finance numbers. There's other models that are. You don't need to, you know, crunch your tokens down”

The episode largely recycles widely-circulated arguments - shadow AI from over-restriction, cloud adoption as a precedent, governance-as-policy-is-useless - and even the guest explicitly acknowledges he is rehashing familiar material. The SLM routing and local architecture discussion is the only moderately fresh angle, but it lacks the depth needed to be truly contrarian or first-principles.

“we know what happens here. We did it with when the cloud, everyone understands this. But I just, I'll just regurgitate the same information”

“everybody's starting to shift to that. And the financial obligation is on the business to, well, people within the business to understand what that's going to look like”

Mark Jones is an active deployed engineer co-founding an AI company and genuinely working in front of CISOs and boards, giving him real field credibility. However, he is primarily a consultant/founder rather than a practitioner who has run security at scale, and no significant named career achievements or org-level outcomes are cited to elevate his standing above a knowledgeable peer.

“from the field. Australia is definitely behind in adoption. And I'm not m saying every. Every place, but certainly just looking at the last four or five weeks that we've been out in front of a, uh, lot of CISOs and security leaders”

“we've pivoted probably three times in the last four weeks about what we're seeing. And this isn't our theory, this is what is actually happening in the market”

Every company example is anonymised ('I won't say his name,' 'I'm not going to name them'), no actual metrics, revenue figures, or breach/cost data are cited, and the research Mark references is described as 'about to publish' but not shared. The one concrete detail - a large Australian company with 'two floors of AI teams' - is vivid but unverifiable and stands nearly alone.

“a large company in Australia yesterday and they've got two floors of AI teams, engineers, structured groups, work Sprint groups”

“we can measure, you know, by the minute, by the hour, our token consumption across all our agents, across all the models”

The host occasionally lands a genuinely useful forcing question - the binary A-vs-B scenario and the 'AI costing 2.5x a human' counterpoint are the strongest moments - but most questions are long, leading, and contain the answer within them, and bold predictions ('every team will change in two years') are accepted without meaningful pushback.

“Is it A, better to just let's try the AI stuff internally and there's no restrictions, I mean like within reason and see how we go. If there's an issue, then we sort it out, or is it B, better to try to restrict it”

“people are saying it's costing two, two and a half times a human being in the role. So is it counterintuitive?”