Stop Security Disasters Before They Start: Security in the AI era.

AI is transforming the way we process information, but what about our privacy? Join me as I discuss Cloak Works with its' developer, Chris Carter. Cloak Works is a tool designed to protect your data and enhance your AI interactions. AI security is a must. You will not want to miss this conversation. #AIFuture #SecurityFirst

Transcript

Ed Drozda 0:10

​Welcome to The Water Trough, where we can't make you drink, but we will make you think. My name is Ed Drozda, The Small Business Doctor, and I'm really excited you chose to join me here as we discuss topics that are important for small business folks just like you. If you're looking for ideas, inspiration, and possibility, you've come to the right place. Join us as we take steps to help you create the healthy business that you've always wanted. Good morning folks. This is Ed Drozda, The Small Business Doctor, and I want to welcome you to The Water Trough where I'm joined today by Chris Carter. Chris is the founder of MugatuAI, the company behind Cloak Works. They have finally solved the false choice between data power and data privacy. Traditionally, to get value from AI you had to decrypt your data, which created significant cybersecurity risks and compliance failures. Cloak Works changes that by providing a secure foundation for the next generation of enterprise AI, enabling computation on data that never leaves its' encrypted state. They've built this entire foundation as an agentic native, one-person company proving that autonomous power can scale to meet a trillion dollar market opportunity. Chris, welcome.

Chris Carter 1:34

Hi Ed, thanks for having me, and as a fellow Milwaukeean I am glad that we could be on together.

Ed Drozda 1:40

I only wish that Marquette or Wisconsin were playing in the final Four.

Chris Carter 1:45

Oh, yes I would've loved to have seen Marquette get back there again. They've had some injuries this past year that kind of put them down the chain, but I have a feeling they'll be back. They're doing some really good things at the university.

Ed Drozda 1:56

I was there in 1977 when we won it all. Let me just say it was fascinating. 40,000 people marching down Wisconsin Avenue. I think you get the idea. Oh, yes sir. Yes, sir. It was beautiful. So, MugatuAI. Let's start with the false choice between data power and data privacy. Expand upon that please.

Chris Carter 2:17

Yeah, if I bring it down to my level so I understand it, really it's a security tool. It's a security tool for corporations who want to use AI or for individuals who want to use AI. The reason I thought of this, and this has been my side hustle for literally 11 months, I saw one of my customers in one of my accounts. They had a 22 tabbed Excel document. Now mind you Ed, a 22 tab Excel document is gross first of all. Nobody should be making those. But their team uploaded it into chat GPT, and it had financial data of all their employees. It had their social security numbers, it had their 401k data, and I just thought what are you people doing? And they said well, you know I just did it, I didn't even think about it, blah, blah, blah. And I thought we're the cog, the humans are the, I'm gonna call us the fools or the idiots, or we're the dummies in the equation. We throw up data all day long. We email data all day long to these AI tools or use them. And I thought God, there's gotta be some way to stop that. And literally I just went out and I started brainstorming and creating in Gemini, and NotebookLM, and Chrome. I just kept going and going and going, and I became enthralled with it, and I built Cloak Works and Signal and it's literally a tool for us to be stopped from making stupid decisions with our AI data in those activities. At the end of the day that's what we gotta stop, and that's what I did.

Ed Drozda 3:51

So basically it's as the terms imply. Privacy of data while utilizing the power of data management in AI.

Chris Carter 4:01

Yes sir, absolutely.

Ed Drozda 4:04

And when you put things into AI, information is picked up in the ether to become fodder for other AI's to do their thing. Is that correct?

Chris Carter 4:14

That is absolutely correct. So when you upload to ChatGPT or any AI, you send it up into the world. You are now giving it to them, and literally their terms of service. That's why I was so upset with my clients. You put all this information up into ChatGPT, they now own it and because they own it and they have terms and conditions that state they own it, anybody and everybody has full access to that information. It's crazy.

Ed Drozda 4:43

Open source social security numbers. Open source addresses, phone numbers, email, blah, blah, pass, whatever.

Chris Carter 4:51

You could go out to any of those tools right now, pull up ChatGPT on a website and say, hey please find me this information on this individual. You find their home address, their work address. If it's out there on the web or in any type of a database, they've got it and, it's literally Terminator 2026 coming to fruition.

Ed Drozda 5:12

So, why is it that in order to upload to AI you had to decrypt your data in order to get it there? Why couldn't the AI accept it in its native state?

Chris Carter 5:24

They can't do an encryption because once it becomes encrypted, it doesn't have the encryption keys or the backend code. So whatever the passwords, the IDs, it doesn't have the ability to be able to do that. When I started building Cloak Works it couldn't do any of those activities, because it was still encrypted and it's an encrypted state with a 222 key password or whatever the case may be. With Cloak Works, we're using homomorphic encryption and it's encrypted at the source. We don't give it the keys, but we give it the ability to be able to understand the data. We don't give it the data, but we let it understand the data, read the data. It cannot capture the data, where if you upload that information into ChatGPT you are giving them the data. We never give them the data to be able to source. It's only reading, we let it understand the data.

Ed Drozda 6:22

In a practical sense how would I use that? Data that has been processed through Cloak Works is uploaded to an AI agent somewhere, right? How do I utilize it once it's there?

Chris Carter 6:36

Sure. So I'm gonna step back one step. When you wanna upload any of that information, no matter if you want to send it as an email or if you wanna upload it to ChatGPT, Gemini, or whatever the case may be, as you're doing it, within about a hundred to 150 milliseconds, Cloak Works will tell you and it will give you a security score and say hey Ed, this shouldn't really be uploaded into ChatGPT or it shouldn't be mailed. Do you want to use a link? Do you wanna send this to somebody? And if it's doing it via email it will also show you what the route for your email's gonna be, if it's in a hot spot or good spot. First and foremost it tells you a security score. If you go forward from there it will use our Cloak Works homomorphic encryption to encrypt that data, then be able to put it up so it can read it, not store it. That's a huge piece 'cause as I was making a reference a moment ago, if you store the data and give it to them, it's part of their terms and conditions for everybody to see. But if it's still encrypted for them to only see the data, then they can't store it, and then they can't share it, and then nobody else on the planet can have it except for you. And it'll still be able to understand what you've done because it allows you to read it, not store it.

Ed Drozda 7:58

But once it's there in this AI environment, only you, the creator, can work with it, correct?

Chris Carter 8:07

Yes. Only I can access my information and view it, nobody else. If you went out there and you wanted to gather the same information it would say that that data is not available for you to utilize in whatever manner that you were trying to do that with.

Ed Drozda 8:23

What I'm hearing is those who have proprietary, confidential, or some other kind of protected data who want to take advantage of AI and its ability to process that data can put the data out into AI in such a fashion that it will not be extracted by someone else, process it and then take it back. Cloak Works is like an intermediary that allows you to use AI safely.

Chris Carter 8:57

Mm-hmm. It's a safe and secure format for you to use your proprietary data only for yourself rather than giving it up to the masses.

Ed Drozda 9:06

Probably the large majority of people these days are putting information out there into AI, manipulating it and unaware, I'd imagine. If it goes out there in the native state and you're playing with it out there, it's the property of ChatGPT, Gemini, Claude, or whoever, right?

Chris Carter 9:31

Yes, if you strictly upload it on your own accord and you put it up there, it's theirs because of their terms and conditions. But if you're utilizing it through us from a security standpoint, we do not allow them to store and keep your data for anybody else to utilize.

Ed Drozda 9:49

It's just the kind of thing that people have to know, should know, but I'm getting the impression that they don't.

Chris Carter 9:55

They really don't. The problem is AI is so new to most people. When we started playing on our first computers we would ratchet computers together for speed, power, and access for machine learning. Then ChatGPT put a nice pretty wrapper around it as an open source and said hey, put all your data up there, we're scouring the internet, we're gonna be able to give you all the answers. We thought that was Google, but found out that it wasn't just Google, Google capabilities. And so everybody just kept throwing it up there not understanding the consequences of all this data they were putting up there. People were starting to realize that first and foremost, wait that's my corporate data. That's my personal data. That's my healthcare data. I don't want that out there. And then second of all, they were starting to come to realize that the machines we're taking that information and they're like, well if he's got that and she's got that, maybe they'll have this. And it started coming up with assumptions and ideas based upon your data because you uploaded it to the worldwide web and said, hey take it away. Now all of a sudden people are coming back and going, wait a second, I don't want anything in regards to my personal data, I don't want any data in any way, shape, or form up into these systems 'cause that's me, that's who I am.

Ed Drozda 11:15

I am kind of shocked that this is the state of AI right now, and again I can't imagine that the vast majority of people have a clue. They're just putting this stuff up there.

Chris Carter 11:26

Remember too, we aren't even playing baseball yet. I make this reference and I've equated it back and forth. At this point in time in the AI journey, I literally just walked into the clubhouse and I started changing into my pre-game batting routine, jersey, and pants to go out there and hit some ground balls and a catch. We haven't even started a baseball game yet, and if people think about it, all these different activities that have gone on to date, we're only at version 4.6 in Claude. We're at what, Gemini is now five one or five two. Everything has been changing so rapidly that nobody's really gravitating to that. As a matter of fact I'm going to the Google Next event in Las Vegas, the end of this month, and I'm talking all about this. I'm showcasing it because I literally built everything on Google. Now I'm not promoting Google for people, but I did it all on there 'cause I could do it all in one nice clean area and do testing with my bots and everything. But people, when they look at these different tools, they don't know what version they're on. They don't know if they've updated their chat hubs or ChatGPTs and variations you gotta pay extra for. Some people have it, some people don't. You know my dad, it's funny, we were talking off air about podcasting. My father has a cell phone, it's an Apple phone and it's got apple on it. He hit it one day and he had no idea what it was. And I said, well dad if you talk to it it will answer and do things. Well, he did it one day and it said do you want to go to the web or do you want to use ChatGPT for your answer? And he just stopped it and he called me, he goes what is it asking me to do now? And I said, dad don't do it again. If it says that just say go to the web. Go to the web. Those are things people don't understand 'cause it's so brand new. I have a mother-in-law who's 90 now. She doesn't touch it. She has no desire, no need, no wants. She doesn't want any of her information out there. And I don't blame her. I don't want my medical history out there. I don't want people knowing that I've broken arms, broken bones, have surgeries, fake neck bones. They don't need to know that.

Ed Drozda 13:38

No they don't, and it could be manipulated against you.

Chris Carter 13:41

Exactly. I broke my neck several years ago. I've got two carbon fibers, titanium, plus a bunch of metal in here. If that information was out on ChatGPT and an insurance company is running my specs to give me more insurance, well I've already had a major injury. I've already been hospitalized... How is my premium gonna go? So all of a sudden, if you've got bots going in there and saying, hey go through all these people who have had surgery in the last five years. I want to equate their medical procedures and medical history to each other. Man, I could come up with a hell of a prompt for that.

Ed Drozda 14:16

I admit I'm relatively ill-informed about AI. However, I'm a very cautious person when it comes to AI as well. I don't really imagine that protects me, but the information that you've provided certainly gives me greater and deeper insight than I've had before. I can also imagine the people who are listening to this are gonna go, "Are you kidding me?" Most of us take for granted that AI is gonna do what we ask it to do, and the truth is we often don't have a clue what it's doing or what impact it has.

Chris Carter 15:01

And think about it from a small business perspective. I'm a small business. I'm starting to have comfort that my staff members use this in finance and HR and stuff, but I'm also having them only use it on our data. My finance team only uses QuickBooks with the finance from our QuickBooks and doesn't go outside. If we're writing job descriptions, sure we might put information and ask for a job description and then have our team tweak it and modify it. But I also tell them every single day, if you're using it none of our data goes into any of those environments. Second, use this. God gave you a brain with two eyes to be able to see. Don't take it for granted. Ask your AI, where did you get that information from? Who are you referencing? Why are you giving me that back? I'm an IT company, or I'm in HR. Really ask it questions and if sometimes you have to, you gotta smack it on the hand. You're the boss, not it.

Ed Drozda 15:58

Right. Don't let it run amuck as it were.

Chris Carter 16:01

Exactly.

Ed Drozda 16:02

We're not looking for HAL from 2001: Space Odyssey.

Chris Carter 16:05

Oh my gosh. I love this one.

Ed Drozda 16:08

Yeah, we're not gonna go there. You mentioned that Cloak Works revolves around encryption. So is this applicable to small people, small businesses as well as to larger businesses? Enterprise only. Where does this fit in?

Chris Carter 16:22

Everybody's starting to play with AI in one way, shape, or form. Every software company's starting to build their software around it and saying, hey I've got AI baked in. I'm using this. A lot of people are using Copilot. It's built into Microsoft Word. Different companies have got different tools. So in one way, shape, or form over the next, I've been saying the next 10 years, you've got this younger generation, these teens, and you got twenties and thirties, thirties and forties. They're all starting to use these tools and as they get more mature and they get to be our ages, they're gonna continue to use it and they're gonna continue to teach the people below us. We are teaching our younger interns and folks about the different AI based tools and which one works for what and how you utilize them. So I really see this becoming more and more prevalent 'cause we're small businesses, we run this country. If it wasn't for small business entities, you know you can't just rely on the Googles, the mega seven, or the big seven, or whatever that is. This country's built on the backs of a small business as one entrepreneur at a time. And so we all want to figure out how to save time, save money, do the best we can, and be able to grow. And we're not gonna grow by 5000000% overnight, but we're gonna grow by 5%, 7%, 3%, and these tools are out there helping us. Just QuickBooks alone. Think of how many people run QuickBooks as small businesses. And I'm using their tool so it automates my billing process so I don't have to go in there every month and I know what my contracts are, I know that they're gonna go out, and I do the visual check after. It has saved me hours of time of inputting it manually. All I have to do is review from last month to this month to make sure, and that's just one tool.

Ed Drozda 18:15

Right. So you envision that Cloak Works and things like it will become mainstream, that this will be a first line of defense in the human-AI relationship.

Chris Carter 18:26

I really believe from a security standpoint you have to. You start at the operating system and you work your way up through the applications, 'cause we don't wanna be the missing piece of the security cog. And we hope that these organizations that are building applications have built security, but at the end of the day, before you mail it out, before you start uploading it, before you have those activities, it goes through that process of being validated by Cloak Works.

Ed Drozda 18:54

Are you playing a role in the education of the public about this?

Chris Carter 18:58

Oh, absolutely. I speak all over the planet. Last year I did close to 50 speeches. I talked at universities, I talked at trade shows, events, and I specifically talk to them about security of AI. We bypassed the true AI security to this point, and that's why I think this is so important for everybody If we had started at that operating system layer and went up, think of all the applications that, well, my laptop, my desktop, I've got probably 20, 30 applications on here, and I'm constantly sending data around to staff and people. Now I've got a tool that says, hey why don't you use SharePoint? Or why don't you send a link through Dropbox or send a link through Box.com? In the past I was just eh, I'll send it over to HR, send it over to finance. Now it literally warns me and I get my daily and each time I get a security score on it. I think that's important for people, even if it's just in the background. Every once in a while I'll send something and I'll look over to it and be like okay, it was a 97. I did good this time. So even me, I'm a human. I'm fallible. I make mistakes. I've uploaded things just outta the blue. I'm typing away and I grab something from my Dropbox or something. I put it in there and within 150 milliseconds of hitting the send button a popup goes there's sensitive data. I'm looking at what I did. I'm like oh yes, I did do that. Okay. Go back to my little SharePoint, grab the link and put that in there, and away it goes. But we're humans. We make mistakes. Thank God my wife forgives me though.

Ed Drozda 20:33

There's always the hope for something like that. How is the education process going? Are you encountering resistance? Are you encountering like myself, the what? Are you kidding?

Chris Carter 20:45

A lot of ooh, I didn't realize that. A lot of holy cow, really? Are you kidding me? Where is this going? And I will literally show them where it's going, how it's going. I will break the chain so they can see that it wouldn't have gone out, this is where it was hitting. This is the email chain, the servers that goes out. It's interesting, I get a lot of people after my presentations and we sit and we have conversations, how can we fix this in my company? I'm a small business. I'm doing this. Can I do these things? And I'm like yeah, it's super easy to be able to do. I'm charging a dollar per person during this testing phase. Go and install it, utilize it, test it, make sure your people are understanding and watch it stop that information going out your doors. It's funny I did a speech at University of Tennessee-Chattanooga. Great group of people, I had about 50 to 60 people in the room, and we just didn't stop. We asked if we could borrow a room so they put us in the room next door and we all went over there and we started having deeper dialogue and conversation around ethics, around security, about how do I help my people? How do I train them? How do I show them the best benefits of this? Or how do I just show them not to do this? And I always say look, 75% of it's gonna be great, but it's that 25%. If you're a business and all of a sudden you send out that information and you are hacked, and lo and behold I kid you not Ed, 24 hours later I got a letter in the mail from one of my healthcare providers that they were hacked. I wish that I would've been there 24 hours earlier.

Ed Drozda 22:24

You've created a tool that obviously has a tremendous purpose. Do you think that the tool is meant to be enhanced or is it to further engage people in the conversation and the understanding about this? Of course, from a strict sales perspective people have to understand why they wanna buy this thing, so my question might seem kind of simplistic. What I'm trying to say is, is it more about that tool evolving or is it about educating, 'cause right now it seems that there's too darn many people that don't get it anyway.

Chris Carter 23:01

So it is a twofold path. It's about educating folks on the security side and how to build that. On our side, I would love to see this app, now this is pie in the sky. This is Apple being curated in a garage. This is Google being created at a college in California. It's this type of security, and if it's not Cloak Works, somebody else's come to the table. When you order your laptop, your desktop, Dell automatically installed Copilot. When you order Microsoft products, Copilot is already there. I think that they should have a layer, a Cloak Works layer that is right there on top of the operating system. So this helps individuals. And then while that process is going on and we're securing the AI based world, humans are starting to learn why it's so important to not be uploading all these types of data streams, but only be able to view them, not save them up into the nethers of the Worldwide Web. That's why I travel so much. Last year I did 50 universities. I did 107 podcasts. Just simply talking and trying to help educate folks on everything, because even if you're a solopreneur and you're using these tools, once you lose that data, you've lost your data, that's somebody else's, and it now comes back to your company. There are restrictions now on finance, HR, HIPAA, all these regulations. You put it up there and now you're in violation of those acts. And I don't wanna see any solopreneur, entrepreneur, anyone have to deal with those activities.

Ed Drozda 24:41

I think It's important for people to realize that when we talk about security that's one thing, for example Cloak Works won't stop ransomware because that is a distinct entity. That is a bad actor who is using a malicious tool to get into your system. Cloak Works on the other hand, is as you said about data privacy, data security. They both have a place. And I surmise that a lot of people think I'm secure because I've got all these antivirus and this anti that, and therefore I'm fine.

Chris Carter 25:14

Unfortunately not. That is, as you stated specifically for the ransomware attacks and these bad actors that are trying to steal your data from your laptop. They get in through the different ports, the CrowdStrike of the world, they're not dealing with the AI layer. They're not dealing with the data that you are sending out or the data that you couldn't send out. It's viewing what you have from a system-wide perspective, but it's not doing anything in regards to when you're going out or emailing. Norton has this email virus thing. All it does is it checks to make sure there's no virus attached to the email and sends it out. So that 22 tabbed Excel document just went out to whoever you're sending it to because it didn't have the virus on top of it. It's these bad actors making these viruses that will sit there for years and years and then all of a sudden when you do an upgrade to a specific app then it gets launched. So you always gotta be ahead. That's why I created my red bot so he could destroy and try to do things. It's so much fun. I love reading my logs in the morning of what it was trying to do, what it did, what it didn't do, and how the others were trying to fix what he was trying to destroy.

Ed Drozda 26:25

The Red Bot. Tell me more about it.

Chris Carter 26:27

MugatuAI is created after one of my favorite all time villains. And as part of that villain, Mugatu, I needed to have a red bot that would try to destroy the application, try to get into it, try to make sure that anything that you were doing. So I've got a group of five or six bots that are continuously updating, fixing, doing activities around it. The red bot is constantly trying to destroy, and trying to get into and try to hamper the activities that are in it. It's failed most of the time. Sometimes it's got a succession, and we, myself and the bots go in and fix it and then push it out with the fixes.

Ed Drozda 27:06

It's an ongoing QA tool

Chris Carter 27:08

Absolutely is. Yes.

Ed Drozda 27:09

Yeah. Interesting. This whole thing is fascinating. You know, don't get me wrong, it begs more questions than it answers. I hope you understand what I mean.

Chris Carter 27:17

Oh, yes. Absolutely does. Every time I'm out having conversations, it's more and more it's between security and activities. Absolutely.

Ed Drozda 27:26

As long as you understand what I mean. I've learned a lot, but there's still so many more questions to be posed. It's like, okay.

Chris Carter 27:33

And again, like I said we haven't even gotten into the second inning. We haven't even gotten to the first bat of the first pitch of the baseball game.

Ed Drozda 27:41

Yeah. Well Chris, our time has rapidly gone by. Before we go, I'd like to know if there's any thing you'd like to leave us with.

Chris Carter 27:49

You know, yeah there is, and thank you for that. I want everybody to know that AI is a great tool. It's fantastic for solopreneurs, entrepreneurs, enterprises and such, but it's how we use it, manage it, secure it, and at the end of the day, remember it is a tool that we use. I consider it to be a part of the Infinity Loop. You always need to have you as the human, as a part of that entity. So use your eyes and use this beautiful brain God gave us and make sure you are the final endpoint for that. Always be a part of it. Don't let it just run wild and run rough shod over you, and you'll be fantastic.

Ed Drozda 28:35

Thank you for that My guest today again Chris Carter, the founder of MugatuAI, the company behind Cloak Works. I have found this conversation to be fascinating as I hope you have also. I want to thank you for joining us today and here at The Water Trough I want to wish you as always, a healthy business.