Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Securing the Middle Market: Cyber Risk, Agentic AI, and the New Digital Reality
31 Plays5 hours ago
In this episode, Doug Farren sits down with Tony Pietrocola, Co-Founder and President of AgileBlue, to explore how agentic AI is reshaping cybersecurity, and why middle market companies are now prime targets. They discuss rising threats like deepfakes, accelerated vulnerability exploitation, and “shadow AI,” along with the growing need for standalone cyber budgets and stronger governance.
Tony also shares lessons from building and scaling tech companies, offering guidance for leaders navigating today’s fast-moving digital risk landscape.
For more on AgileBlue, visit: agileblue.com
Recommended
Transcript
Introduction to 'The Market that Moves America'
00:00:02
Speaker
Welcome to the Market that Moves America, a podcast from the National Center for the Middle Market. The center is the leading source of knowledge, leadership and innovative research on the middle market economy. Throughout our podcast, we will feature middle market leaders and stakeholders to hear their real world perspectives on trends and emerging issues.
00:00:24
Speaker
Welcome to the market that
Meet Doug Farron, Executive Director
00:00:26
Speaker
moves America. My name is Doug Farron, executive director of the National Center for the Middle Market, located at The Ohio State University Fisher College of Business.
00:00:35
Speaker
Today, I'm joined by Tony Petricola, co-founder and president of Agile Blue.
Introducing Tony Petricola from Agile Blue
00:00:41
Speaker
Agile Blue is a company that sits in the cybersecurity space, but they also have a lot of focus on the middle market.
00:00:48
Speaker
And we're going to have a chance today to talk about ah both of those topics. So, Tony, welcome to the podcast. It's great having you. Doug, thanks for having me and go Bucs. Awesome.
How does Agile Blue's AI-native Platform Work?
00:01:00
Speaker
So for those who aren't familiar with Agile Blue, don't you just tell us a little bit about your company and kind of the journey leading into how you started it?
00:01:09
Speaker
Yeah, no, appreciate that, Doug. So ah look, we are headquartered in the lovely Cleveland, Ohio. So just a couple hours north of where you are. And we really are very focused in what we do. We've created a um ah AI native security operations platform. And all that means with all that fancy AI talk is we have technology that autonomously investigates ah A potential cyber attack makes a decision if it is a cyber attack or not, and then has the ability to autonomously respond while bringing in a human being to do everything we can to make sure our customers don't get breached.
00:01:45
Speaker
So I guess in this world of AI versus AI and human versus human, we're there securing our customers, which are mid-market organizations. That's great. um I want to talk to you at some point in our conversation about your journey as an entrepreneur. So we'll get to that in a bit.
00:02:04
Speaker
ah But let's start with a little bit about this topic of cybersecurity and technology in general. We we are seeing in a lot of our research data that this is becoming you know the
Why is Cybersecurity Crucial for Middle Market Companies?
00:02:15
Speaker
number one issue. Of course, everyone's talking about it, but for middle market companies in particular, it's become so much more important than it was even just a year ago.
00:02:24
Speaker
So, um you know, the the place I want to start is talking a bit more about agentic AI. I think people hear that term, but they may not be all that familiar with with what exactly that is.
00:02:37
Speaker
And I believe Agile Blue kind of works in that but space. So give us in your words, like, how do you define that? And then how is it different maybe some from some of the other AI tools that people may have played around with or experimented with?
00:02:51
Speaker
Sure. You know, it's a great question. Because look, at the end of the day, there's so much with AI out there, right? Everything's AI. um it's It's pretty wild. um You know, we started with um generative, um you know, when when when Chat Shippity came out a couple of years ago.
00:03:06
Speaker
I started getting that in everybody's lexicon. And then right before everybody started getting a little bit comfortable with that, then they start throwing around a jet ticket. It's like, my goodness, what does that mean? So I guess it could mean a couple of things, but here's what it means to us and what it means to our customers.
Understanding Agentic AI
00:03:20
Speaker
We have the ability with an agentic agent to act and then more importantly, make a decision. So using learned data, using patterns, using predictive recognition, and then of course, the data that the agent's actually seeing right now, what the heck is happening right now at this moment, it's going to be able to make a decision very much like a human being would, but faster and also removing the bias. you know when When people make decisions,
00:03:48
Speaker
Even if it's something as simple as you and wife deciding if you want Chinese or do you want Italian, right? um Hey, i'm I'm an Italian guy, so I'm always going to go on on the Italian side. Let's take that bias out. Let's make a decision both with the data we're seeing and from that that learned experience, that learned data that we have. And that's the way we look at Agentic. Can it make a decision with a high degree of confidence if our customers look like there's a potential cyber attack about to hit them?
00:04:16
Speaker
Yeah. Can you give us an example? i mean, it can be very generic. We don't need the names or the the customer specific details, but like give us an example of how that works real world for like an agile blue product.
Examples of Cyber Threats Facing Middle Market Companies
00:04:29
Speaker
Yeah. and and And look, at the end of the day, you you said something that's important. you know The mid-market's getting hit pretty good these days, and here's why. The big guys are spending so much money on cyber, right? They're spending a lot of money, and they have a lot of great tools, but they still get hit.
00:04:43
Speaker
The mid-market, let's ah let's just look, man, they got less budget. but they also have less people, right? Less people to implement, right? And it doesn't matter if you have a or a r AI or not, it does take people to implement AI, right? So when you think about a potential cyber attack um using AI, think about deepfakes these days.
00:05:03
Speaker
Are you getting a video or audio from your CEO or VP, whatever, with a command to do something? It's funny, one of our lead engineers the other day got a text and an audio message from my co-founder. There was two of us who started this this company many... ah but Six years ago now.
00:05:22
Speaker
And it said, hey, I need you to do some stuff for me. I'm out of town. It's funny. AI tends to know where you are if you post things to LinkedIn. And it created something ah that could went out there. So I'm giving you an example for our own company. AI is not discerning. AI learns and then unfortunately can make things happen pretty darn quick, right? And that's one of the problems with social. Sometimes you think you're being marketing-driven and you're saying, hey, we're at this event today. Come by and see us. Well, the bad guys with using AI can pick that stuff up too. And if I had guess, Doug, a lot of mid-market companies are seeing deep fakes, really good put together phishing emails. And that stuff is where AI can definitely hit a mid-market firm.
00:06:04
Speaker
Yeah. So those are some i mean good examples of hackers and kind of bad actors using this to maybe exploit some of the vulnerabilities. Because we've seen this play out time and time again where You know, years ago, middle market leadership, as you were saying, felt like, well, we're too small to be a target. Like they're going after the enterprise companies and the fortune.
00:06:26
Speaker
Like we're not even on the radar, but we've we found that most of them are highly exposed because they just don't have the resources, to your point. um Are there other types of attacks? i mean, you mentioned deep fakes, maybe phishing.
00:06:39
Speaker
What other things are you guys seeing that are more common, especially as it applies to like middle market companies? um Definitely those. I'll tell you what else too.
00:06:51
Speaker
And again, everybody keeps talking about ah mythos, um however you want to say it, methos mythos, mythos, that was released by Anthropic that is throttled by the US government.
00:07:01
Speaker
But a lot of people believe that that that could be out in the wild in some form. And vulnerabilities that maybe you were taking a year or six months ah can now be exploited a lot faster, days, weeks, whatever it might be.
00:07:15
Speaker
So now those vulnerabilities that were out there or just not gotten to yet by the mid-market companies, ah they're they're seeing a lot of that, number one. Number two, phishing emails are really good these days. like They are good. They they generally are customized.
00:07:31
Speaker
personalized, and they're taking things to that next level. And people are just clicking through. And it's not that they're clicking through in a bad way. Think about this. You might be running through the through the airport to get to ah to a flight, and you see something that looks really, really good. ah Not like you're trying to buy a TV for 53 bucks, but something that looks good from business, right?
00:07:50
Speaker
And all of a sudden, you're going to click on it. This happened to me with an ah ah set with with my um SIM card um but two holidays ago. course, I buy i buy late.
00:08:01
Speaker
I'm one of those guys. and I was running through the airport. internationally, I got a text that said, your package is going to be delayed. Click here to reroute it. And I'm like, you know, SOB.
00:08:12
Speaker
I click on it and my SIM card. So Mr. Cybersecurity was actually, i have my SIM card. Now granted, I have really good security. I had MFA on everything. So nothing happened.
00:08:23
Speaker
But I did to spend about six hours working with AT&T to get my SIM card reestablished and working again. So these things hit because they are looking really good these days. Yeah. Wow. What a story.
00:08:35
Speaker
And what like what are some of the things that are most vulnerable? Is it like protecting data, like customer information? you know, yeah yeah like I read about in the news about, you know going after social security numbers and birth dates and all. So then that then that information can be used to open accounts. Like, is is that the most significant vulnerability or is it just is it just anything that's within the four walls of the business could be at stake?
Risks of Business Disruption and Data Protection
00:09:04
Speaker
Well, it is, but let me just define it a little bit further. And this is a total cliche, what I'm about to say. Data is the new lifeblood of an organization, right? Okay, so data is really, really important. No one's going to argue that.
00:09:16
Speaker
If a bad guy steals it, okay, that's going to be bad. But what if a bad guy just locks it up? What if a bad guy disrupts your business? And then what if that bad guy is like, hey, you want this? Because obviously you can't operate your business right now.
00:09:30
Speaker
I need $2 million dollars in Bitcoin. So is the decision, hey, we have good backups and we can restore? The problem is some companies do, some companies don't.
00:09:41
Speaker
Some companies think they do. They just don't run annual tabletop and incident response tests to know that they do or don't. And that puts them in a really bad position. So I will say this.
00:09:52
Speaker
Business disruption is huge. And think about the money that might cost someone regardless of paying a Bitcoin ransom. Yeah, exactly. And so as you think about how this evolves so rapidly, you know, can you think of or share like in the future?
00:10:10
Speaker
Like we have today's threats, but then what do you see as being like prominent threats in the next couple of years?
What Future Cybersecurity Threats Should We Anticipate?
00:10:17
Speaker
there that Is that too hard to predict? Oh my God, if I predict that I'm going to either be wrong or way off. But I will say this, in a non-cyber way, I was at rein the Reindustrialize conference in um ah Detroit last week, you know all you know pretty much all mid-market companies. um I saw a dog, a robot dog that can either be strapped with ammunition or welding supplies to weld because there's 100,000 welders that are in demand in the US. So we went from piece welding to our our new dog warriors.
00:10:49
Speaker
um And if you think about it, when you think about advanced manufacturing, drones, welding, shooting dogs, um I would have to think that you're going to see more security driven towards those autonomous types of applications, even take it a step further.
00:11:06
Speaker
Think about self-driving cars. Think about getting into a Waymo ah that has no ah people in it. I think security is going to be so ramped up for those things because obviously that starts to become a life and death. Life and death in very easy ways of just hopping into a potential car. I was in an Uber just the other day um and he had FSD mode on the whole way to the airport in DC.
00:11:29
Speaker
And it's wild. The guy's talking to me, looking at me and the car's just driving. It's Tesla, it's Elon, he's doing great. You still got to assume the cyber protections that go into at that level will start coming down to mid-markets and no matter what we do. And I think you're going to start seeing really hardcore things, not just attacking email, but going after the hardware aspect of things from robots to drones, but into manufacturing facilities and whatnot.
Challenges in Cybersecurity Budgets and Resources
00:11:58
Speaker
So what what are some of the challenges that mid-market companies face when they may not have you know I mentioned a little earlier, like the resources can be highly constrained. So they may not have a CIO, let alone a CISO. They don't have these positions or leadership roles in place.
00:12:17
Speaker
Their IT department may be two or three people. So does that mean that they have to rely more heavily on outside partners to help with that? It does, but I will say this, and of course I'm going to say this, otherwise people in my industry would say I'm a moron.
00:12:32
Speaker
Obviously, we don't believe cyber budgets are are where they should be appropriated. Generally, they're a piece of the IT budget, which which to a lot of people makes sense, but shouldn't it be its own budget?
00:12:45
Speaker
um How in this world should cyber potentially be cut because the IT budget is is getting too large in terms of a percentage of revenue? And a consultant comes in and says, i think you're just spending too much money here. Not understanding that cyber wraps up into it.
00:13:00
Speaker
yeah If cyber is the only defense you have digitally, the cloud, your mobile devices, your applications, how on God's green earth can that not have the most utmost either A, attention and B, budget? And it's funny how you can see those budgets squeezed. Now, there's a lot of research. Last thing I'll say, Gartner did a really nice research report recently that said the mid-market is actually expanding their cyber budget these days because they do see that as the number one threat to their business.
00:13:29
Speaker
over AI, over um employment, over inflation right now. I think people know it's a real problem for their business. Yeah, absolutely. That's interesting.
00:13:40
Speaker
um Kind of on a related note, do you see any differences when you think about industry sectors in the middle market? Because we look at a lot of our data. We have the ability to look at you know some of the bigger ones, whether it's manufacturing or B2B services or retail.
00:13:57
Speaker
I mean, are you seeing differences across those and in how these things are being treated or addressed or the focus or, to your point, the budget? I think so. I think when you look at industries that are way more regulated sectors like financial services and healthcare, care um especially when there's a compliance component to it, whether that's SOC 2 or ISO or whatever it might be, um ah GDPR, things like that, um you're definitely seeing them forced to spend and spend a little bit more. And I think the ones...
00:14:29
Speaker
Even though advanced manufacturing, um and you think about the importance of that and the disruptions in that supply chain, you're going to see spend less generally. I love when you talk to folks and they're like, well, if they if if we get hacked, what are they going to do to us? What data do we have?
00:14:46
Speaker
And we'll say, what if they shut down your operations for a week? Well, that'd be bad. Like, you know, we'd lose x amount of money per day. Like, yeah, that's the point. Sometimes the bad guys don't want to steal data. Sometimes of bad guys are just ornery want to shut people down because they can't.
00:15:00
Speaker
Yeah, yeah, absolutely. Well, let's zoom out a bit then going from some of the more specifics to thinking about how leaders should view this topic.
00:15:10
Speaker
So... You know, we have a lot of listeners who are either running mid-market companies or maybe they're advisors to them as a as a service provider or maybe a board member even.
00:15:21
Speaker
So for those who aren't like technically expert at the at these things, what are some questions that you would advise them to ask of their teams if they've, you know, maybe this is keeping them up at night and they don't know where to start.
00:15:34
Speaker
Like what should they be talking about internally to address some of these cybersecurity issues? I mean, whether it's a board to
How Should Leaders Approach Cybersecurity Investments?
00:15:42
Speaker
the C-suite or even ah you know the CEO to the CIO or CISO, or like you said, maybe it's just a director. they Maybe they don't even have a CIO.
00:15:51
Speaker
ah The question needs to be, have we given the proper budget to properly defend ourselves? I think that needs to be the first question. Probably not, hey, we gave you X dollars. Why would you need more? It probably needs to be reversed and say, do you have what you need?
00:16:06
Speaker
Number one. Number two, i think the second question needs to be, and this is probably where boards might be a little over their skis on this one. Hey, with all this stuff, advanced new technologies, AI we keep hearing about. you know I read the Wall Street Journal every day.
00:16:20
Speaker
ah he keep hearing about AI and all this stuff. Do we need to bring in different expertise to understand what we're doing here? So I'll give you an example, Doug. Shadow AI is becoming a huge concept.
00:16:32
Speaker
You walk into an organization, people are using AI, they're installing agents on their networks, they're loading data into ChatGPT, and not being malicious, but they are being negligent.
00:16:45
Speaker
Installing things, dropping data in, whatever, they don't know where that's going. Shadow ai is now about a 50% problem. It's actually 49%. of organization, mid-market organizations, do not know what AI has been unleashed in their organization.
00:17:00
Speaker
And the reason it's not over 49% is just a lot of mid-market companies. They're not answering the question, probably. So a question needs to be asked from the from the from the board or the C-suite, how do we defend against this new stuff? Like, we don't even know what we're doing with the old stuff, where we need to be with the new stuff. And I don't think those two questions are being asked at all.
00:17:20
Speaker
Are there tools like... I don't know, like a technology audit or a scorecard or something like that that can be used in an assessment. I mean, there's lots of tools that can be used in assessment. The answer is absolutely both external and internal because you a lot of attacks will begin on the external side. So you got to understand your external surface attack and you got to know what's going on internally because generally internally has got some bumps and issues too, right? So it's both of those.
00:17:48
Speaker
um And organizations that are forward-thinking and proactive are good with that. They want to know. And organizations that want to just say, let's see what happens. Or they say, we have cyber insurance.
00:18:00
Speaker
ah We're good to go. something happens, we're good to go. um Those are the ones who maybe shy away because maybe they're just a little afraid to to address the exposure. Right. I want to go back to that data point about 49% not knowing what AI has been unleashed. So we are seeing here at the center, you know there's a lot of friction between CEOs and leadership that's saying, okay, all my peers are using AI. Like we just have to go do something. Like they want to do something and they don't know necessarily what that is. they They lack kind of a roadmap. So like in your eyes, what would be like a place to start or advice that you give? Like this is something that you should definitely be focusing on.
00:18:46
Speaker
But here's some things you should also avoid. Well, I mean, think about this most subtle case. When you go into a Zoom meeting these days, because we're all on Zoom meetings, there's like nine different note takers already on before any human jumps on. Like, what the heck is happening here? How do we know those are sanctioned and should be okay? Or did something happen and an agent got unleashed that's recording us and going to use that that recording in some way, right?
00:19:10
Speaker
ah So that's crazy. I think number one, and I am not necessarily an AI governance guy, but
Steps for Managing AI in Organizations
00:19:16
Speaker
I will say this. Number one, an organization probably needs to make a decision. Are we using ah Claude, ChatGPT, Gemini here, coppilot Microsoft Copilot, two of those, one of those? What are we using here? let' let Let's start getting our arms around at least what we're using from a LLM-GPT perspective, number one. Number two, here's the types of data that can go in.
00:19:37
Speaker
And there are types of data that need to be redacted or anonymized, or you better not put it in. And then number three, if you are going to install an agent, it has to go through some type of process of understanding if that agent is open source, is secure, what it's doing when it's on our network. Those are the three things right now that somebody needs to figure out.
00:19:58
Speaker
And by the way, do these mid-markets have the talent for either of those three things? Maybe not. Maybe they do. The ones that don't probably need to bring in a consultant, unfortunately, but think about this.
00:20:08
Speaker
Isn't that those dollars worth it? Or do you just want agents all over your network and your data all over the place? yeah Yeah, that is a terrific point. um So I mentioned, I want to go back to a little bit to your career because you've had a really interesting journey, you know, kind of starting SaaS companies and building them and So as you kind of think back about your journey, if you could share like maybe a one key lesson you've learned across starting, scaling, and maybe exiting a company, which, by the way, happens to be another big topic
Tony’s Entrepreneurial Insights and Market Gaps
00:20:43
Speaker
in the middle market. We're seeing a huge, you know, tidal wave of potential ownership transfer in the next two years as a lot of founders kind of you know reach retirement age and want to get out.
00:20:55
Speaker
So talk us through that a little bit. Starting, scaling, exiting, kind of your big lesson from those each of those journeys. Yeah, you know, was it was lucky enough. I'm old, as you can see. So lucky enough to start a few companies. First one was exited a long time ago in 2008. And that was ah a wonderful experience.
00:21:14
Speaker
And how do you start something? You identify, in my opinion, you identify a hole in the market. Back then, meaning 2001, you websites were starting to get big. The internet was starting to say, this thing is going to be amazing. That's old. And we created a company to develop websites and e-commerce sites and and technology to assist in those.
00:21:31
Speaker
um Great market for that. Worked out really, really well. With Agile Blue, we we spun it up in 2019, really went to market in 2020. We identified that the mid-market did not have security operations, or if they did, it was very manual. And how's manual going to beat technologies like machine learning, which is the predecessor, of course, to to AI?
00:21:52
Speaker
So we identified that hole in the market, created a company, and now we're developing it. um you know When you think about growing a company, you grow it smart. You grow it P&L focused, people focused, and you invest.
00:22:06
Speaker
or or Or a great quote that i that i that I read a long time ago that is tattooed on my brain, when you have conviction, bet big. And when you do, it probably works out, right? um Agile Blue was lucky enough to take in an investment from a great partner in HIG about a year ago. So we have a great ah growth potential for this organization and we're looking to continue to exploit it.
00:22:31
Speaker
And, you know, look, if you build a great company with great people, Doug, and and you know this and and and your members know this, um whatever happens, happens. Whether you you're here for 30 years or you build such an amazing place that somebody wants to come in and, and and you know, offer you something for it. um you know Those things work themselves out if you're building a great company. And you're right, I'll tell you, an organization, um and this is not a competitor to the the Ohio State University, and I have daughter at the Ohio State University, so you know where my allegiance is, ah and and also as an alumni. um case has a great Case here in Cleveland has a great entrepreneurship through acquisition.
00:23:07
Speaker
And one of the reasons that is you're seeing a lot of older people want younger people to come in and take over their businesses and give them that runway out. And um you know starting up a new idea is everybody's biggest problem outside of capital.
00:23:19
Speaker
And if they have this entrepreneurship through acquisition, which I know Ohio State dabbles in as well, can really be a great thing to get some of these businesses. So I agree with you. And I think you're starting to see a lot of movement. As people age out, younger people come in, but how do you have that new fresh idea? Maybe you don't, but maybe you can take a great idea and a start of something and make it even better down the road.
00:23:40
Speaker
Yeah, yeah. I mean, we're trying to do some of those things here at Ohio State because I think you're that spot on. It's like in this rapidly evolving workforce, the way that you and I used to think about starting and building a career like it's rapidly changing. So we need to kind of offer these different avenues. And yeah, it's awesome. So ah Tony, this has been great. Like really enjoyed the conversation. i Appreciate you sharing your insights. And so if our listeners want to learn more about you or about Agile Blue, where can they find you?
Learn More About Agile Blue
00:24:12
Speaker
Just go to a web browser and type in agileblue.com. Pretty simple stuff. That's all I got. Simple enough. I love it. Well, ah hey, thanks again. We appreciate your time. And I think our listeners are really going to enjoy you know hearing about this because it is such a timely topic. So again, thanks for being on.
00:24:31
Speaker
That it is. Thank you, Doug, for having me. I appreciate it Okay. Thank you. We'll talk to you all again soon.
00:24:38
Speaker
Thank you for listening to The Market That Moves America. Never miss a new episode by subscribing anywhere podcasts can be found. You can also subscribe to our email newsletter at middlemarketcenter.org.