Sponsored: Island's expansion to SASE and enterprise AI

0:05Catalin Cimpanu: Hello, this is Catalin Cimpanu and this is a Risky Business Sponsored interview with Michael Leland, Field CDO at Enterprise Browser Maker Ireland. Welcome, Michael. Thank you, Catalin. Michael, the last time I spoke with someone at Ireland, the company was just an Enterprise Browser Maker. You're now much more than that, and you have expanded into SaaS or secure access service edge in enterprise AI. What was the thinking behind this expansion? I can see Alan providing AI browser agents, but how can an enterprise browser handle SaaS? That's a really good question. I think it starts from our founding members set out to create an enterprise application service delivery platform.

0:50We identified the fact that the majority of knowledge workers were using a consumer browser to access business applications and data. And nowhere else in the enterprise do you use consumer technologies, right? If you were opening up a new branch office, you wouldn't go to Best Buy and buy a Linksys router or switch, right? You'd buy an enterprise class switch for an enterprise feature. And yet we've been using consumer browsers for years. So our original goal was to build a browser built specifically for the enterprise, right? It was built with security in mind. It was built secure by design. It has a single policy and control plane.

1:29It improves data protection. It improves intelligent network routing and steering. It reduces cost and complexity as well as tech debt, and it improves the end user experience. We've been doing that for six years, right? We forked the Chromium project six years ago. we took all of the consumer-grade code out and replaced it with enterprise-grade capabilities. We then expanded because not every customer wants to deploy a brand new browser. They tell us they still have Edge and Chrome and Safari and Firefox in their fleet. So of course, we introduced the island extension. But about three years ago, customers started asking us, you know, we love what you're doing for us inside the browser.

2:03We love the data protection and the traffic steering, but we have a long tail of thick apps. But what they meant three years ago was I've got Word.exe and Outlook.exe and various PWAs and maybe Visual Studio. But today, because most of those applications have long gone to the cloud, right? The great sassification of desktop apps. But in the last six or nine months, we've seen the exact opposite thing happen with AI. AI, whose natural habitat used to be the browser, has now come to us in forms of Claude Copilot and Gemini CLI, Cursor. You've got various AI assistant plugins to your IDEs. And you've got thick applications that also need their traffic steered toward an appropriate destination that may sit back behind your corporate firewall, which used to be the purview of a VPN or a ZT &A agent.

2:57So what Island did is we introduced something called Island Desktop. Island Desktop is a background service that lives outside the browser. It lives at the kernel level, which means it has visibility and enforcement over file system activity, network activity. But it also has the ability to expand our data protection coverage outside of the browser and into thick apps. And largely those thick apps today are the AI tools. So in order to provide both shadow AI visibility as well as AI governance and policy enforcement over how users engage with AI, both inside the browser and out, we've introduced the Island desktop.

3:38Catalin Cimpanu: How are you handling all this AI-related activity? Is it as hectic as I'm imagining it? Or is there some specific patterns emerging that you can latch on now? Because initially, there was a lot of confusion about how all these agents are going to work. Now, we're like one or two, three years into their adoption. Do we know exactly what are they doing? Or is it still just as crazy as people think it is? So it is the Wild West out there with respect to AI. Any vendor playing in the space is kind of facing a moving target. They don't know where the next AI tool will pop up. They don't know how AI will be used by the end users.

4:22And of course, anytime you tell an employee, no, you can't use this kind of AI, they find a way around it. They're like, I'll install this browser. I'll install this plugin. I'll download this application. And because the different modalities of AI are so broad, you've got generative AI, which is largely chat-based. You've got agentic AI, which is machines doing the work of the humans. And with the advent of tools like Claude Code and with models like Mythos, you're starting to see these AIs become loose cannons, right? They're doing things on behalf of the user that were never instructed. They're finding novel ways around obstacles, right?

5:05What we saw recently with OpenAI and the sandbox escape with Hugging Face. No one predicted that an AI would go off on its own and find ways around the intended purpose. Another great example, you know, that is not malicious in nature. You know, a user decides to ask his AI assistant to perform a task. And the AI decides the best way to do that is not to use the tools that you've given him, but to spawn a process, open up a shell prompt, write a Python script that then curls an NPM package from a source that you don't trust. So you gave AI a goal, you gave it certain intent, but it didn't follow the guardrails.

5:48It didn't follow the rules. And the way we like to point out, AI agents are not employees. These are not people you've hired, that you've onboarded. They've never signed an acceptable use policy. They don't adhere to HR governance restrictions. They do what they're allowed to do. And if you don't put them in a guardrailed environment, you run the risk of those same agents that are equally beneficial and helpful for improving workforce productivity and efficiency and accuracy. You run the risk of them also acting on their behalf that could potentially put your sensitive data at risk. So is it a known goal for this entire industry about how we should deploy it, adopt it, protect it?

6:35No. But that's also why you need so many enforcement points along the path of where AI could be used.

6:43Catalin Cimpanu: You mentioned that example. I remember you published this month a blog post on some research you did into malicious GitHub repositories that or hosting malware disguised as AI-related tools. I presume that came from your experience with dealing with all these crazy agents that are not following the rules. But that also kind of made me realize your team has now been publishing a lot of great research lately, great cybersecurity research on malware hunting. Should we understand you now have a dedicated security team that goes through all the island data to hunt threats? So our security team is leveraging their expertise in a number of areas.

7:24One, in looking at the telemetry that's being collected by our customers through our product and interpreting that as potential risk and then bubbling that up to our users and saying, this is suspicious activity that you should be aware of. But most importantly, it's in building our own AI tools to do risk assessment of the very tools and plugins and skills that our users may be deploying. The blog research pointed to the fact that there were GitHub repositories that people were going to downloading by the millions. And there were certain chapters of that content that were clearly performing malicious tasks.

8:07Now, that is a known threat actor who's publishing content in a public forum like GitHub, knowing that some unsuspecting user will download this package because of the benefits that it promises, not knowing that the underlying code inside of it is going to do malicious harm. The same risk, by the way, applies to the non-malicious activity, but just a user who thinks that connecting their co-pilot to their email and contacts list is going to be completely benign. And I love pointing out a consumer use case first, because Agentic AI started feeling like a cool thing to consumers. Let's say I, as a consumer, decided that I wanted to buy four tickets to a movie this Friday and invite three of my friends.

8:57And I asked AI to do that for me. Now, what have I given AI control to do? I gave it access to my browser to be able to search for movie times. I gave it access to my contacts to know who I'm going to invite. And maybe I gave it access to my credit card to be able to buy four tickets, right? I have just blurred that trust boundary between me and the machine by giving access to a supposedly trusted authority. Now, in the consumer world, that is a huge risk. But in the enterprise, you know, the weight of that risk is much higher, right? I'm giving it access to my Salesforce instance, my customer data, my purchasing power.

9:38There was a vendor at an event, I believe it was Black Hat three years ago, and their T-shirts read, my agent has purchasing authority. And if you think about the risk of giving a machine the ability to hit process this credit card transaction, send this invoice, all of a sudden we're losing the human in the loop by asking these AI tools to automate much of this work. So not only is the threat research team looking at what the behaviors of potentially malicious packages are, we're also looking at potentially benign packages that could be put to use by legitimate users, but in the wrong way, right?

10:21Every package that has the wrong permissions has the ability to perform a task which could be negative to the organization. I firmly believe that in the next six months, there will be some public disclosure of a Cambridge analytic size breach. And I wouldn't even use the word breach. It could be malicious in nature, or it could just be an unsuspecting user who has improperly configured a data path through an MCP server, a model context protocol. They did everything they thought they should. They connected the packages appropriately. but one misconfiguration exposes that entire data stream to places they never intended.

11:04Catalin Cimpanu: Since we're now talking about AI agents, and I mentioned that you pivoted into enterprise AI, does your product act as a security layer for other AI agents, or do you also provide your own AI agents to customers? Like for specific tasks, you can use our agent instead of others. That's a great question. We actually do both, right? We built our own agentic solution to learn what the layers needed to be to both enable and protect agentic activities. But we also expanded the footprint of our control points, right? Where once our control points were the browser, we then introduced Island Desktop, which again brings us outside the browser-only realm and allows us to provide the same level of visibility and enforcement to thick apps.

11:52We introduced Island SASE, our Secure Access Service Edge, which allows us to securely route traffic between a remote device and either a web destination or an internal destination. Those four components have been around now for the better part of six years. What's new in the AI world for Island is an MCP gateway. That means that we can be in the path of all conversations that either our agents or third-party agents are using to connect a device or an application to a data set. We introduced LLM gateway integration with people like Portkey and Light and Kong. We also introduced the compliance API implementations.

12:38Those allow us to hook into various desktop and web applications using APIs provided by the large AI providers. And lastly, we implemented something called OTEL or open telemetry. This gives us kind of top-down visibility into cost utilization, performance metrics, AI adoption rates. Customers need more now than ever to have a clear understanding of what AI is going to cost them in real dollars, token burn, utilization and performance, but also about the cost from a potential data risk. And so we have now visibility across all of these various control points so that any mechanism or means that a user is implementing to access AI, AI in the browser via the URL, AI in the browser via an extension, AI in the desktop with Cloud Code or Gemini or Cursor, or even AI assistance in various IDEs.

13:37All of those are now visible from a shadow AI perspective. And all of those can now be enforced with a runtime policy, regardless of how the user is engaging with AI.

13:48Catalin Cimpanu: So you mentioned all these ways in which you're interposing yourself in the company's AI traffic. What are the main threats you're seeing in there? Like, is it most of the time just the AI agent not following its guardrails? What do you mainly see there? So I think there's two classes of threat. There's the threat or risk of data loss, right? That is the improper usage of an AI tool with, let's say, sensitive data in an unsanctioned AI, right? That is one risk. And so the guardrails have to make sure that you're utilizing both content and context in a way that aligns the appropriate business policy to the action.

14:29And then there's the other risk, the malicious risk, right? And for that, the things we're seeing most revolve around things like indirect prompt injection, jailbreak attempts, but even to the point of things like content moderation, monitoring for things like toxicity and bias and harassment, right? We're seeing all of these things. When you have visibility to the entire audit trail of AI activity, you see everything from the question that was asked to the response that was received. Because we operate at also the presentation layer, how data is being entered into prompts or returned from prompts, we can also do more granular redaction of information.

15:14If I ask a question of an LLM, summarize my current page, and that page has credit card numbers on it, I need to ensure that those credit card numbers aren't handed off to the LLM for summarization. Because that would put that PII potentially, you know, at risk, especially if it's a public LLM and not my private one. But if you think about all of the way users interact with AI, they're typing data in, they're copying and pasting data in, they're uploading files in. And at every one of these stages, we need to align the appropriate data protection and classification model to make sure that we're keeping sensitive data in its guardrail, while also enabling the user to leverage these AI tools for, you know, more banal tasks.

15:59One of the important things that we're finding is that, you know, AI is not one size fits all. Sometimes you need to steer a user toward the appropriate provider and model based upon their persona. Your developers, they probably prefer Anthropic. Your lawyers, they're going to live in the world of LexisNexis and Harvey. Your general purpose AI consumers can probably get by with ChatGPT or Copilot or Gemini. But why would you want to burn down your expensive tokens on the latest models when you're delivering that to a novice user asking novel questions of AI? Wouldn't you want to use the less expensive models for those users and reserve the high cost models for your more mature experts of AI.

16:43So being able to steer users toward those models also helps on cost containment.

16:48Catalin Cimpanu: Michael, I think that's a great way to end it. Thank you very much. Thank you, Ketlin.