What's Up with Tech?

The episode delivers concrete architectural and operational insights (zero-trust micro-segmentation, AI factory governance models, CVE-analyzer with real-time mitigation, dynamic SLM scaling) that a security leader would find immediately applicable. However, it mixes substantive technical depth with some repetitive framing and marketing language ('game changer,' 'blockbuster approach') that dilutes density. The guest avoids obvious platitudes in favor of specific implementation details, but pacing meanders and some claims lack supporting metrics.

“we ripped out our wide area networks, we ripped out our local area networks, and we have actually zero lateral movement capabilities within the organization today”

“we created ingestion models to ingest any type of log, any type of net flow, and any type of packet capture. Then we created operators that actually review, given AI analysis on any event that's notable”

The episode presents genuinely non-obvious approaches - operator siloing in AI systems to prevent over-permissiveness, dynamic per-host SLM models that retrain every 100 events, and the decision to remove WAN/LAN entirely rather than defend perimeters. These contradict common industry playbooks. However, the zero-trust and AI governance frameworks themselves are not new; the originality lies in GTT's specific implementation choices rather than foundational thinking.

“we found that operators they love to talk, they love to tell each other what they do, how they do it. And what they do is they start training each other so that you now have an operator that was intended to do one thing and now it's over permissive”

“every subsequent 100 events learned from that host, the model retunes and retrains. So if you have 10,000 hosts in your environment, you'll have 10,000 SLM models running within our platform”

James Karimi is a rare guest: CIO/CISO for a tier-one telecom operator (third largest globally) with real P&L accountability, 44 M&A integrations, and a decade-plus tenure. He speaks from deep operational scale - 16 Gbps telemetry, 10,000+ hosts, global regulatory constraints - not theory. His credibility is strengthened by NVIDIA and partner validation. This is a practicing infrastructure operator, not a consultant or thought-leader.

“I'm James Karimi. I am the CIO and CISO for GTT Communications. GTT is now the third largest tier one internet operator in the world”

“I've been here at GTT for well over a decade”

The episode includes concrete numbers and technical specifics: 16 Gbps telemetry ingestion, 32-64 GPUs per AI factory, 32% noise reduction, two-week cash-app processing reduced to minutes, six months of data documentation, 10,000+ SLM models per host, 10-14 week faster onboarding. However, many claims lack supporting data - 'high 90s accuracy' is vague, revenue impact metrics are mentioned but not detailed, and some architectural decisions lack quantified justification. Salt Typhoon example adds credibility but is illustrative rather than evidential.

“our telemetry data alone is somewhere in the realm of 16 gigabits per second uh all the time”

“we've probably cut out about 32% of noise at the last uh check we made”

Evan asks competent setup questions and follows on AI governance and architecture, but rarely pushes back, asks for supporting data, or probes inconsistencies. When James makes claims (e.g., 'one of few non-hyperscalers doing this successfully'), Evan accepts without challenge. There are no sharp follow-ups on failure cases, trade-offs, or cost-benefit tradeoffs. The host enables a fluent narrative but doesn't create productive friction or test claims rigorously. Questions are softball invitations to expand, not pressure tests.

“Yeah, it's an amazing proposition”

“Fantastic. Uh, love the insider perspective here”