Transcript
My name is Adam Boynton, as always joined by my colleague Elmo. Hello. Hello, Ron. And today we have another very special guest and I know you're not supposed to have favourites but Rob is definitely in my top one of jams that I work with. So a man who probably doesn't need much of an introduction, but for those that don't know you, Rob, maybe if you could say hello and introduce yourself. Hi, yeah, my name is Rob Potvin, I work as a consulting engineer at Jamf and humbled. Thanks. Yeah. Thank you. Don't know what to say to that. I've done the impossible and made Rob speechless for a period. So today's topic is something that's really, really relevant and hot off the press, if on the 30th of June, Jamf announced our latest capability known as AI Governance. So before we get into how it works, and we will, there's some really cool demos are going to be shown in the next few minutes. Let's just step back and cover why this capability exists. So we know that Mac is the kind of platform that is enabling AI at scale. There is a challenge that we see customers facing when it comes to AI adoption. And we've actually done a survey, our own Jamf AI Governance survey, and found some very interesting stats or statistics on, as you can see, the fact that AI adoption has maybe outrun AI governance. So the kind of problem that we're seeing a lot of businesses face is that these AI tools are running natively on Mac, they're reaching enterprise data through MCP servers. There's potentially a lot of data that could be exposed. Now a lot of organizations are wanting to encourage and enable the adoption of these AI tools. But you need to be able to govern them. And I think governance is about being able to say yes, confidently to these requests and these business cases. Maybe Rob or Elmo, from your perspective, how do you see the challenge, what we're trying to solve here with AI governance? Well, I think part of the stats you showed, Adam, highlight that a lot of organizations know that they're deploying AI or are trying to deploy and manage AI. But also there's a lot of organizations that maybe have no idea what AI is in use and unapproved within the org. So that's also something that we can really highlight with our AI governance and visibility tooling is giving that visibility in terms of not just, hey, here's what you want to deploy and here's the settings that you want to deploy for that AI tool or agent. But rather looking at it as a whole and saying, look, here's everything that's going on with your devices, whether you know it or not. And now you can actually go on and more easily make policies to, let's say, block certain AI tools, allow others. Yeah, I think the Mac is a pretty robust ecosystem. A lot of developers are using these in the organizations and we want to encourage agentic development and a lot of the companies are using these tools. I think what it is, is more of like just visibility. I think the biggest thing is visibility on that one. We used to call it shadow IT, now we're calling it just shadow AI because it's tools that are on the device. They run great. They're not taking a bunch of resource, everything else. They get the job done. They're helping so much. But just what is running within the organization, right? Even before we want to restrict things or put a bunch of network blocking or whatever it is, just having that visibility standpoint and taking a step back and trying to understand what it is your organization is trying to do, what areas is this shadow AI happening in and what we as an organization say, okay, well, these tools are being used a lot. What does it offer more than what we're offering our developers? And maybe having those conversations to make sure that things are more enabled for them and maybe less restricted because sometimes the more you restrict, the more that shadow AI happens. So this is giving that visibility first off, I think, the biggest thing. Yeah, and I mean, obviously, like I said, we announced this the 30th of June, but actually we technically announced it a few weeks earlier at Jamf Nation Live in London and then the subsequent Jamf Nation Live in Berlin after that. And certainly from my experience, I know you were both there as well, speaking to the customers. This is definitely a common challenge that a lot of businesses face. There was a lot of excitement in the audience from participants wanting to learn more about this and actually get access to the tool itself. So I guess that's a good sort of framing and a nice sort of covering of the why AI governance. But let's now get into what people are here to see and look at the how element. So Rob, you're about to show us some really cool demos of the tool. And I think there's really a number of different outcomes we're trying to help customers achieve with this capability. And the first one, as you've already alluded to, is getting visibility over what AI tools are running. So maybe let's start with that. Yeah, I think Jamf is in a unique position because we do basically have the tools already in place to gather this kind of visibility for most organizations. One of the things is a robust elementary that we can get out of macOS devices. With leveraging things like the endpoint security framework from Apple, we can really pull in what kind of processes are running on a device, but on top of that, what those processes are running themselves. So a good example, if you take a look here, is the visibility we're getting is cloud code. Where is it running from? What commands it's using? But then potentially risky commands. Now this could differ between organization to organization, but really it's commands that could change or do harm, right? Doing an LS, which just listing out the directory, that's not really going to do any harm. But then doing an RM or something like OSA script, what is that AI tool doing? So it's giving some of the visibility in there. So first off, it's more of the whole view, getting an understanding of what tools are running within the organization. You can get a different cadence from 7, 14, and 30 days. We're getting a ton of information from all these host computers. And we're doing all the hard work of processing all that information, all that telemetry information into digestible chunks of what's running, where they're running from, and what potential risk commands these tools are running. So it's giving you that really deep visibility. You can even go a little bit further, dive in, and take a look into the product itself over 7, 14, or 30 days, and really get an understanding of just the top 10, 25 results, and so forth. But just that visibility you really want in the organization. You can't really do anything until you know what's going on, right? Just to chime in here, Rob, as well, a lot of organizations, they might not be experts in AI. They might even think maybe, hey, we don't really use AI within our organization. Yes, we manage our Macs. We have some security tools on our Macs from Jamf. But, you know, AI is very different to traditional apps if we think of the way we've deployed them through management previously, right? An organization might say, you know, hey, we have a managed browser that we've deployed through our MDM. AI works in a pretty different way in terms of how you can interact with it. So like you said, Rob, the launchers are the ways that people are actually interacting with that AI. But also some subcomponents of AI. Are there additional tools or things that are present that users are interacting with that maybe we didn't know about or haven't been aware of? But I think just to highlight, you don't have to be an expert in all things AI to be able to grasp some of the details within these reports, right? Exactly. You're basically just getting that visibility to know what's going on. And then from there, make those educated decisions from this visibility report on what's needed. And with more and more, I'd say, regulations in the industry that things are moving very fast, having an understanding of what is running within your organization just makes kind of adhering to those regulations a lot easier. Yeah, I was actually going to mention that it's a moving sort of target in terms of different regulations, different regions. But the main common theme across these regulations is you need visibility of the AI that is running within your estate. So regardless of what you do after that visibility, that's kind of the most important step to be able to see what's going on. Yeah. And again, we're in the unique position here at Jamf to offer those mobile device management capabilities with our tools. Having our agents on the device, there's nothing new to be installed here. This is just part of Jamf for Mac within Jamf. So with that running on the devices you already own, you're going to get all this information once it's turned on, right? Maybe covering that backend side a bit as well, you know, Jamf Account has been recently a big point of interest for Jamf customers. I think it's actually a nice idea that we've got this in Jamf Account because the individuals in an org that might be interested in looking at this AI visibility might be completely different from those who are managing devices, those who are in Jamf Pro or maybe security teams or SOC teams that are in Jamf Protect, all those pieces that make up Jamf for Mac. But it's actually a nice feature to be able to have this in Jamf Account because of those privilege options and controls that you can have that are very granular to who can actually go and see this, who can interact with it, and so on. Yeah, exactly. So in the organizations where you might have somebody that is responsible for AI or just maybe the security officer, he or she will be able to log into Jamf Account, have access to AI visibility, maybe setting up policies, and then your administrator or Mac administrator would be able to then deploy those policies separately within Jamf Pro. So maybe we should look at more of the tech stack because first off is the visibility aspect of it. So just kind of getting an understanding of what's happening within your organization when it comes to shadow AI or just what AI tools are running. But the next step we need to look at is maybe the AI policies. Yeah, Rob, that visibility that we talked about is really key. Let's maybe now look at how we can start to configure and apply policies to that visibility piece that we've now received. Yeah, so basically just under our AI visibility, we have the ability to do AI policies, and we just create a new policy. Now, currently, we have Cloud Code, Cloud Desktop, and OpenAI. We're working with these organizations, Anthropic and OpenAI, to basically gather all the enterprise controls that they're offering for their tools. We're verifying to make sure these enterprise controls are actually working within the applications and kind of presenting them in a way where it's a little bit easier to decipher and understand. So let's create a policy for Cloud Code. We'll hit next here. Now, one of the biggest things is there's multiple ways of running your AI in an organization. You could be connecting directly to Anthropic and authenticating. The way I look at this is who you're paying for your tokens. So in this case, it's like I'm paying directly to Anthropic, so I'm going to be connected from there. So here we can decide how we're going to authenticate specifically OAuth. Maybe we have something else in here, but it gives the ability to kind of create a very easy way of managing that authentication scheme. If anyone's out there who's ever tried to manage Bedrock and the authentication that's needed there, this would be your first step here. When this declaration is then deployed to the devices, it's just a lot less work to get that working on the device. In this case, we'll just go Anthropic Cloud Code. Next here, yeah, as you can see, we have multiple options here. Now, we have things like the models, identity, the whole kind of works, but just a lot to go through. We're just going to touch on a few of them. I would say maybe the first thing is restricted models. Maybe we want to just have Haiku and Sonnet available. Opus is a big spender, and now Sonnet 5 is great, so let's use that. And then here, when we start up, we'll just say, hey, let's start up with Sonnet. Reasoning level also gets pretty high, so we could basically say that we want medium or let it be managed itself, but you can really get into the weeds here and really decide what's going on. If you don't want larger context windows, so forth and so forth. These EnterpriseControls.com are just a gobbledygook of a lot of just JSON or whatever else. We're trying to hone this in to give it a little bit more presentability and understanding so that it's easier for people to manage. I like to go down to just organizational defaults and do that startup announcement here, where I can go in and just say things like, welcome to Cloud Code at your org here. And then we'll just add that. So when someone starts up Cloud Code on a device, they'll get a little startup announcement with those Enterprise Controls about the models. Maybe the last thing we want to do is update some version. We also say, when we're going to update, we're not going to go into beta channels or anything else. We're just going to stick with follow the stable channel. And then here at the very end, we can describe it. So Cloud Code policy. And then we can download an overview of what's going on, have a kind of a look of what we just did here, but it kind of gives you an understanding, a quick overview. And then we're going to create a policy and publish the changes. Now, for anyone unfamiliar with Jamf, what does that mean? Well, it's published, but we still need to scope and deploy this. But that is not a AI governance thing. That's more of a where we manage the max thing. So jumping over to our Jamf Pro instance here, we can then go into here, log in. While you log in, Rob, I'm at least not a good typer and talker at the same time. But building out these policies in our AI governance, it's really not that dissimilar to if you're an IT admin and you're used to building configuration profiles with custom values or really any kind of, like you said, Rob, any kind of custom JSON. So it really is just making it easier and simpler to know what those values are, putting them in one place for you to go and know what you can control, what you can configure without having to dig through the weeds. Yeah, so I logged into Jamf Pro. And again, these could be separate roles. And then I would just create a blueprint with my new policy here. I can just search for it. And it's just going to be under the cloud. There it is, the cloud code governance that we just created within AI governance. Again, these are linked. So AI governance knows what's Pro instance and so forth. So it's kind of all connected here. And then here, we click that cloud code policy that we named it here. We can click this to go back and view the policy. And we have specific versions. So if we go back to our AI governance, change something or add something, this will then be saved as a version 2. We have to redeploy that version 2. And then we would select version 2. In this case, we just have one version. You can see some of the changes here we can add. And then we have to give it a scope. So we can just scope to all managed clients and save and give it a name, cloud code policy and deploy. And then we deploy it. And then it comes down as declarative blueprint, like so declarative device management. Just a quick take on declarative. These settings are going to be on an OS level. So even if someone tries to change any of this, this is protected by a security SIP. What does it stand for again? System Integrity Protection. Yes, I always forget that. Yeah, but System Integrity Protection. So you're not going to be able to change these files. Or cloud's not going to be able to change these files. So yeah, it's going to adhere to that policy that you wanted. So a little bit of a harness there, but all good. And here we scope to all managed clients. But of course, nothing's stopping you from creating multiple different policies within Jamf Accounts AI guidance. And hey, the marketing team gets this, the engineering team gets that. Different set of presets or even different access to, like you showed us, Rob, different models. So the more technical teams get access to maybe the more token-heavy, cost-heavy models and so on. Yeah, we could go in and create a cloud desktop because maybe our developers are using cloud code, but then cloud desktop's used by different members of our organization, right? So in here, we can decide, again, who are we paying for our tokens or who is going to be the authentication end, if it's Bedrock or so forth. And then here, it's about the desktop application, right? But it could be that we don't want co-work, right? Because again, co-work is different than just regular chat. Co-work has a lot of integrations. Maybe we're not there yet in our organization to have those integrations in place. We just want the quick enterprise chat to help our employees. So here, you could do some very specific things, right? You can also set privileges of what is allowed, what is not allowed. Again, connectors, you can specify. We've talked about MCP servers, right? But really, it's like having your own custom connector. So yeah, you've approved the confluence connector, but someone can have an MCP server to connect to something else. Maybe you don't want that. You can then disable the user level local MCP server so that cloud desktop won't connect to those, right? Now that we've deployed that blueprint from Jamf Pro, we can just actually double check to see if it's on there. But I know it is, but we can show you where to look. And that'd be under device management. And then we go down to our MDM profile. Now, remember, this is not a config profile, so you won't see it in the list here. You need to double click the MDM profile, and then you get to see the declarative states. So in here, you can then see the device declarations. And here is our cloud code governance. Now, remember, we did say that we wanted only two models. And we start off with SONET, but it will also have this welcome to cloud code, your org here, just because I was being original. It's a lot of fun, right? Maybe we could have made a different company name. But now let's just launch Claude and see what happens. For those who wonder why I said Claude, that's how you say it in French. And my brother's name is Claude, so. So as you can see, there we go. Rob, Jamf SE's organization. Welcome to cloud code, your org here. If I double check my model availability, if I go like this, you can see I only have SONET and HYCU. And I've started up on SONET 5. So from the visibility aspect and getting an understanding of what is available with the organization or what is being used in your organization, so to speak, from then setting up a policy, deploying it, and governing some of the AI that's there. Awesome. So the final element, Rob, is the kind of prove it. And I know if we can request one last demo from you. And have a look at the kind of reporting and governance element within the AI governance tool. Yeah, so yeah, if we want to get a little bit more visibility here, we have a full report. Now, full report will give you exactly that, a whole report of everything that's happening. You do have the option as well to get reports on a per tool level as well. Clicking that will then download a PDF, which I'll open for you, and we'll take a look. Here is a report that you can export from AI governance, and it gives you that full visibility that you're wanting. So you get a kind of look at everything that's happening and any command overview that's risky commands. But yeah, you can hand that to some of the people that are asking questions with an organization or just needed that for visibility. It's all on PDF. Managers, auditors, you know, those who are responsible for kind of risk audits. I guess this would be useful rather than giving them access to Jamf account. Exactly. And then trying to figure out where to go or what to do or accidentally doing something, even though we've got the permissions in there to stop people doing things that we don't want them to, but still easier. Hey, Rob, can I get the latest report on what's going on with our AI? Yes, here it is. So yeah, hopefully that has whetted your appetite for what AI governance is capable of. I guess just to recap, for those of you that are an existing Jamf customer, this is part of the Jamf for Mac licensing. I think Rob mentioned earlier how you kind of go about getting access to this. But maybe, Rob, if you wouldn't mind just reconfirming what an existing Jamf customer needs, apart from obviously having the Jamf for Mac license to get access to this tool. Yeah, basically log into account.jamf.com, head over and click under AI visibility, join the waitlist. You can also just see an example dashboard of what's going on just to show some people in your organization if they're interested. Once you join the waitlist, we're trying our best to go through that all. But you need to have Jamf Pro, of course, devices managed by Jamf Pro, and Jamf Protect deployed. Now, if it's an issue where you pay for Jamf for Mac, but you just are using Jamf Pro and not Protect, we can work with you to make sure that Protect is deployed in a way to get the telemetry you need. You don't need to have it step over Defender or anything else as well. It's more, again, that endpoint security framework that we want to leverage and the telemetry we can get off of it from Jamf Protect. And yeah, for those that aren't a Jamf customer, hopefully this is something to consider and think about. So if you are interested in learning more about this, we will include any relevant links below in the description of this episode. So just to recap the why and the how for Jamf's AI governance, really quite simple. It's allowing you to say yes to AI tooling. It allows you to see what is happening across your Mac estate, configure and apply controls to manage it, and improve it to anyone who needs it. As simple as that, really. So Rob, as always, it's an absolute pleasure to have you join us and speaking with you. For those that are interested, where can people find any other work you're doing? I know maybe you wouldn't mind sharing your LinkedIn and whether you're going to be at things like JNUC and then anything else later this year. Yeah, actually, we're talking about AI visibility and such coming up here at JNUC this year in Kansas City, Missouri, me and Dan McLaughlin, also a very, very smart dude. A pleasure to work with him. And yeah, I love VMs. So if you want to read more about VMs to motionbug.com, I have a bunch of stuff in there about virtual machines and especially about the new Mac OS 27 kind of testing and virtualization. We don't all have test hardware to install it on our production Mac. So it's nice to have it in a VM to have a play with it. So and oh, yeah, Adam, if you are a Jamf Pro customer and you want to look at that, then I would say talk to your sales rep or customer success representative about what Jamf for Mac can offer. Perfect. Absolutely. Rob, thank you very much, mate. And to you as well, Elmo. And we'll see you. Thanks, guys. Bye. Bye.
