In this episode of Software Spotlight, Michael Bernzweig sits down with Mike McNeil, co-founder of Fleet Device Management, to explore the winding path of entrepreneurship and innovation. From his start in a university computer lab to creating an open-source solution for device management, Mike shares valuable insights into the challenges and triumphs of building a tech company. Recorded live at the Software Oasis AI Summit, this episode delves into why open-source is central to Fleet's mission and how it addresses modern tech challenges.
Introduction
Interview
Presentation
Panel Q&A
[MICHAEL]: You know, sometimes the path to innovation is anything but straightforward. Mike McNeil, co-founder of Fleet Device Management, started his journey in a university computer lab in Austin. From there, it was a whirlwind of startups, open-source development, and even a stint at Y Combinator. By the end of this episode, you'll understand exactly why Mike believes open-source is the future of device management. I'm your host, Michael Bernzweig, and this is Software Spotlight.
--- INTERVIEW ---
[MIKE]: I know a lot of individuals that are listening into the podcast this week have had their own journey, be it entrepreneurial or with other aspects of their career.
[MIKE]: And it's not always a straight path to success.
[MIKE]: So I was hoping you could share a little bit of your journey prior to co-founding Fleet.
[MIKE]: Yeah, I was one of these people that ended up being a founder pretty early in my life.
[MIKE]: And it kind of started where I was at UT in Austin.
[MIKE]: And I worked in a computer lab.
[MIKE]: I was actually doing a little bit of IT at the time.
[MIKE]: And I ripped off those pieces of paper on the wall where they have those little strips.
[MIKE]: And I ripped off a strip that was for this program called Three Day Startup, which is sort of like a lock-in.
[MIKE]: And that was a really impactful start.
[MICHAEL]: I ended up meeting some people that I founded a company with sort of part-time, right?
[MIKE]: It was like, I will pay you, you'll work part-time for us, and then we can work on the startup together on the side.
[MIKE]: And without getting into too much detail there, because it went on a while where I kept trying different ideas.
[MIKE]: We obviously wasn't making very much money, and just sort of focused on finding something that would work, getting users.
[MIKE]: And that, in about, I guess, six, 12 months later, we were like, okay, this isn't working.
[MIKE]: And they're like, hey, Mike, you can come work here full-time if you want.
[MIKE]: So that's kind of how I ended up in my first job.
[MIKE]: And about nine months later, I kind of had this itch.
[MIKE]: I really wanted to, I figured out I could build a website for these lawyers for 3,000 bucks.
[MIKE]: Started doing that, and I kind of stumbled on this deal.
[MIKE]: I was at this party, and there was this guy that was saying, hey, I want to build Dropbox for the private cloud.
[MIKE]: And talked more and more, and it turned out he was gonna pay me $50,000, which at the time I was like, wow!
[MIKE]: So anyways, that was kind of when I ended up telling my employer, like, hey, I can go part-time, I can help you guys with some more of this.
[MICHAEL]: And they were like, how about you go no time?
[MIKE]: And then I was unemployed, and I was fully a founder, and I kind of never stopped from there.
[MICHAEL]: Interesting start, and nothing like jumping out of the plane with, maybe, or not a parachute on, huh?
[MIKE]: It was, yeah, there was some times, there was six out of 12 months, I think, the next two years, I couldn't make payroll, and had to not pay myself, and then sort of, I borrowed some money from my ex-girlfriend's dad to pay rent, I learned about enterprise billing cycles, like we would check the mailbox every day.
[MIKE]: I hired my old shift supervisor from Starbucks to try to sell more professional services deals with me, and then, it was a riot, but eventually, sort of figured it out, built an open-source framework, and then got into Y Combinator in 2015.
[MICHAEL]: Now, what year was that initial startup, and what was the original idea?
[MICHAEL]: Was it really just building sites and coding for others, or what was it?
[MIKE]: No, it was 2010, and it was, the other guy's idea was a social TV app called Blinktop, and at the time, there was this idea of the third screen, so everybody wanted to have their smartphone and be watching the TV, and so, what we did is we pulled in tweets about the channel you were on, we pulled in TV channel data, and then, you would be in an area, you would get your location, it would show you the live TV channels, and you'd pick the channel, and you would see all the tweets, and didn't get the adoption we wanted.
[MIKE]: We didn't really raise any money.
[MIKE]: And really, then, I tried a lot of things.
[MIKE]: This thing called Two Hour Commitment, which is sort of an impulse volunteering site, and that was actually the place where I started realizing I could do some professional services to make money, because I realized all these non-profits, they didn't want to pay for our service.
[MIKE]: What they wanted was just someone to fix their tech landscape for them, and they had a really, really rough time finding people that could do that, and that was when it kind of turned me on to like, okay, this isn't gonna be a scalable business model, but while I'm figuring things out, services can work.
[MIKE]: Absolutely, and beneficial on both ends.
[MICHAEL]: So, how did you make the transition to Fleet?
[MICHAEL]: How did, where did the idea come from, and what was the origin story?
[MIKE]: So, when I was in Y Combinator in 2015, I met this guy, Sidsy Brandy, and he, so they don't let you bring your significant others to the dinners that YC does, and so my girlfriend at the time, his wife, would hang out with some other folks, and they knew each other.
[MIKE]: They actually kind of brokered this, but there was a bunch of desks that we had, so we actually sold our office furniture to Sid.
[MIKE]: His company was GitLab, which was very small at the time, now, you know, on the stock exchange.
[MIKE]: Sure.
[MIKE]: And it was, really, we didn't even talk that much.
[MIKE]: Our, kind of, our partners were talking more, but we were the most, like, open source forward founders in our batch, and so we sort of looked for ways to work together over the next few years.
[MIKE]: Sid gave me some really, really good advice on how to monetize open source, and how not to, and I didn't listen, and then my company at the time, I was in YC for, actually, ran out of money.
[MIKE]: We started doing services to pump some life back into it, built the bank account back up to 100K.
[MIKE]: Unfortunately, we was living in a house that had a flea problem, and so I was having my employees come into work, and there'd be fleas jumping on them, and it was like this.
[MIKE]: Oh, terrible.
[MIKE]: This is crazy.
[MIKE]: Should have done remote, but at the time, it was pretty hard to do remote work.
[MIKE]: Sid was amazing for figuring it out.
[MICHAEL]: Well, a couple years later, it became very easy to do remote, huh?
[MIKE]: Yeah, so we do today, a fleet, so we're 100% open, all remote company, 70 people all around the world, so it's great.
[MIKE]: We'd never go back.
[MICHAEL]: Yeah, let me, just pivoting back, that original decision to take on some funding through YC, and make that original funding decision, how did you come to that versus some other options?
[MICHAEL]: Because you have a lot of options early on, and obviously, there's a lot of other value that YC provides to founders, but what made that decision an easy one?
[MICHAEL]: It wasn't easy, to be fair.
[MIKE]: So we'd gotten an office the year before, like in 2013, which I thought was just so cool.
[MIKE]: We put a lot of work into it, beautiful office, small.
[MIKE]: We had these blue walls.
[MIKE]: We've customized it a lot.
[MIKE]: It was important for bringing clients in, and we had a lease.
[MIKE]: We didn't really, you had to move to California to do YC.
[MIKE]: I never would have honestly thought about it, but a guy who was a consultant working for me at the time, Scott, his girlfriend worked at Techstars, and was like, hey, you guys should do this.
[MIKE]: And was like, hey, you guys should apply to one of these things.
[MIKE]: So we applied to both.
[MIKE]: We got into both, and honestly, I had no idea that people raised money after YC.
[MIKE]: I just knew that it was like $120,000 after 7%.
[MIKE]: And it was kind of like, that's a couple of deals.
[MIKE]: That's three months to work on our open source project.
[MIKE]: Let's do it.
[MIKE]: So it was a big surprise when Demo Day happened, and we had like 90 investor likes, and I had no idea what I was doing, but had some really, really helpful people guide me through that process, and we ended up raising about 700K.
[MICHAEL]: Now, from that original idea to what you launched at that time with YC to where you are today, what was the original idea, and what was the pivot that got you to where you are?
[MIKE]: Or pivots, I'm sure, quite a few.
[MICHAEL]: Yeah, so different companies, right?
[MIKE]: At YC, it was a thing called Treeline, which we, due to a trademark issue, we had to rename later, and to the sales company.
[MIKE]: So I built this open source framework.
[MIKE]: Treeline was basically a no-code tool that could generate code.
[MIKE]: Very similar to like maybe what a lovable is today, but pre-AI, so you had to kind of design the flows in a kind of Wysiwyg sort of thing.
[MICHAEL]: And the pivots probably get more interesting in Fleet, because I think with Fleet, really, we set out to build open source version of a tool like Jamf, right?
[MIKE]: That you would understand where your data's going, all those benefits, and I talked about it in the presentation, but what actually happened is when we started the company, I remember I was at the gym, because before I had kids, I would go to the gym.
[MIKE]: And I had to go out to my car, because the CEO of GitLab is like sending me all these messages and saying, call, because we had this lead come in from my co-founder, Zach, of a previous consulting client, and it was a security team that wanted to use Fleet to manage hundreds of thousands of servers at a large financial services company.
[MIKE]: And I was like, holy crap.
[MIKE]: And then another one came in, and then from a global telecommunications company, and then another one came in from a transportation company, and then another one- And you were following your nose, basically, iterating.
[MIKE]: Yeah.
[MIKE]: And it had nothing to do with device management.
[MIKE]: Yeah.
[MIKE]: And that was our, and then, you know, the first one closed of those in February of 2021, and we ended up having a half-million-dollar quarter, which was punctuated with the birth of my first kid.
[MIKE]: So I was actually- There you go.
[MIKE]: We closed, and I was out.
[MIKE]: I'll share with you, you know, it never gets easier, and the gym is never close enough.
[MIKE]: You know, if it's downstairs when you have two kids, that's perfect.
[MIKE]: But yeah, at the end of the day, you know, it sounds like you didn't have to get hit over the head to find the real solution that clients were looking for.
[MIKE]: So obviously, it was an evolution, and, you know, you were listening to your customers.
[MICHAEL]: Absolutely, and I think what got hard, like, and the thing I think a lot of, I didn't even realize at the time how common this problem is for B2B founders, but you'll hit a point where you'll tap into some pent-up demand, right?
[MIKE]: And then you'll be like, okay, we just added half a million dollars in a quarter.
[MIKE]: It's our first bit of revenue, and then you're sort of like, I don't understand how to repeat that, and I don't understand how this product roadmap should evolve so all you can do is listen to customers, which is great.
[MIKE]: And you do that, and you do that, and you do that, and then you never really do, like, the market research or the business plan piece, and to the extent that that's diverged from where the customers pull you, like, that stuff's gotta keep up to date.
[MIKE]: So I think our biggest pivot was in 2022.
[MICHAEL]: We were like, okay, how do we get back to the original plan for this company?
[MICHAEL]: Like, this has been awesome, and there's a lot of really cool use cases with this tech that, honestly, are gonna serve us really well.
[MICHAEL]: So, like, how do we make this roadmap get us to the direction we wanna go in?
[MIKE]: Which, in our case, it was in a lot, we had to cross over departments.
[MIKE]: We had to find a different buyer.
[MIKE]: And, yeah, I think it was, I think I'm really proud of how it turned out, but a lot of it just involved, sometimes you gotta stop, and you gotta go, and first principles, you know, for me, I made a list of 100 people.
[MIKE]: I talked to each one for my own network, and I kept doing that and asking them for who I should talk to, LinkedIn Outbound, and I just went out and got an understanding of the market that way.
[MIKE]: Yeah, and it's interesting, you know, any startup, you know, at the beginning, you were pushing the business along, up a hill with a bag of rocks on your back, and then at one point, it starts to pull you along, and you really, as an executive, need to push the business in the direction that you know that it needs to go on, because you can't do everything, and do everything well, so it's interesting.
[MICHAEL]: So that other decision you made, co-founder, versus being a solo founder, what was the impetus for bringing on a co-founder, and what is your thought?
[MICHAEL]: How is that journey going?
[MICHAEL]: Yeah, so like, in this case, Sid, it was his idea, this company, right?
[MICHAEL]: And so, because he lived it, right?
[MICHAEL]: He'd experienced what it's like to, you know, if you hadn't bought enterprise device management, it's hard to understand that firsthand.
[MICHAEL]: And so, one of the cool things about Sid and his model for how he thinks about the world is, he looks at like, what open source project is out there that already kind of does part of this?
[MIKE]: And there's this thing out there called OS Query, and my co-founder, Zach, he built OS Query at Facebook back in 2014, and what it is, is like, before, in the old days, you had to write a script for Mac, you know, and then you have to write a script for Windows, which is like a PowerShell script.
[MIKE]: You might have to write a slightly different variation for Linux, but really, all you're trying to do is get some basic compliance information.
[MIKE]: So the idea is like, OS Query is a way you can pull that with a kind of standard query language from all those different operating systems in a unified way.
[MIKE]: And that's a pretty good head start when you think about device management.
[MIKE]: You got to know what, you got to have the read and the write.
[MIKE]: Yeah, so really having that foundational layer, that initial building block to customize and build on sounds like a very important starting point.
[MIKE]: Yeah, you couldn't do it without Zach and the work he did there.
[MIKE]: And I think that he'd actually, there's a whole other kind of part of this that I'll simplify, but like, he built Fleet as well, the server to receive that data from OS Query, the agent.
[MIKE]: And really both of those pieces were super, super impactful.
[MIKE]: So we were able to start from something that already existed.
[MIKE]: And obviously that's Zach's baby.
[MIKE]: He kind of co-created OS Query with Mike Arpaia, his manager at the time.
[MIKE]: He's actually one of our investors now.
[MIKE]: And a ton of really, really smart contributors and people from big companies all over the world.
[MIKE]: So it's like that kind of community, that kind of just technical advantage, like already scaling to hundreds of thousands of machines.
[MIKE]: It's like, that's amazing.
[MIKE]: And this is absolutely as much Zach's company as it is mine.
[MIKE]: Now, servers, workstations, Mac, PC, Linux, all the different, you name it.
[MIKE]: But, and that's been the environment for many years, but then you throw in mobile devices to manage and you throw in AI.
[MIKE]: Now it becomes all that much more complex.
[MIKE]: And I'm not gonna say that you were there at the beginning, but you were there early on, but there were a lot of other organizations in the space before that were really built for that legacy environment.
[MIKE]: Starting when you started and obviously having a co-founder who really built the foundational layer.
[MICHAEL]: How did that make things different as you entered this next phase?
[MICHAEL]: Well, the world looks at a company like, not even like fleet, like any company, right?
[MIKE]: I think if you've, anyone listening, if you've founded something before, like when you first start out, you get a lot of like disbelief, a lot of positivity from some folks, but then a lot of sort of like, eh, okay.
[MICHAEL]: And I think that the normal startup journey that we went on as that grew, the thing that's been interesting is like, the modern landscape of devices, which you just called out, Michael, like now there's even a clause, right?
[MICHAEL]: There's, you know, there's VDIs that humans use, and then there's virtualized computers that agents can use.
[MICHAEL]: This is gonna become the way to do a lot of things.
[MIKE]: And so it's like, if you think about any given problem that would come up, some of the decisions that we had made early on, like being API first, really focusing on having good documentation, being open source, which forces us to have like firm release dates every three weeks, where we follow semantic versioning, and we don't break things.
[MIKE]: We support self-hosting.
[MIKE]: So, you know, when all of the data residency stuff started changing in the last few years, and some of the geopolitical climate has gotten more complicated, all those become like unexpected advantages.
[MIKE]: Like the infrared code thing, well, now you can generate code with AI, and now it's like, there's a second order advantage.
[MIKE]: So I think you end up looking a lot smarter than maybe we look a lot smarter than we are, just by picking the right tech for the time.
[MIKE]: Yeah.
[MIKE]: Now, as you're working with enterprises and highly regulated industries, you know, security and compliance, and, you know, you throw in what you mentioned there, now it's not only, you know, defending against humans, but also against AI, you know, that is trying to get in or around or through, you know, a lot of these different platforms.
[MIKE]: You're sitting in a very important space in between an organization and their network and their clients.
[MICHAEL]: How do things differ when you're working with a highly regulated industry?
[MICHAEL]: Security is a word people say all the time, right?
[MICHAEL]: There's such a difference in what security means when you have a thousand people than when you have 10.
[MICHAEL]: And I think the underappreciated part of this is just the probabilities involved, right?
[MICHAEL]: So the risk every time you add a human goes up.
[MICHAEL]: So 100 people, 200 people, there's psychological risk.
[MICHAEL]: You never know when someone can kind of go rogue.
[MICHAEL]: There's insider threat risk, right?
[MICHAEL]: There is, someone's gonna get phished.
[MICHAEL]: You know, someone's gonna not update and they're gonna go to a crappy website that has bad ads.
[MICHAEL]: And those ads are gonna exploit a browser vulnerability and now you have a key logger.
[MICHAEL]: Someone's gonna install Axios for a personal project they're working on on their computer in the bad window and they're gonna end up getting exposed to a supply chain issue where a bad version of that package has been inserted.
[MICHAEL]: Like all those things that can happen, well, you add more and more people and they start to happen.
[MIKE]: So I think at Fleet, being four enterprises from day one, we kind of had to live that reality ourselves.
[MIKE]: So even when we were only three people, two people, all that stuff mattered.
[MIKE]: Like we had password managers tightly involved from day one.
[MIKE]: Before we got full SSO, it took a little while like because you don't even know what departments you have yet and stuff like that.
[MIKE]: But just a lot of like at the code side especially, we really, really had to go kind of like above and beyond from day one.
[MIKE]: If you're talking to a global company with tens of thousands of employees, like they gotta believe that this isn't a mistake if they're putting the software on their laptops.
[MIKE]: And the open source part really helps too because it's like, look, even if you're not gonna read it, it's out there, we're gonna stand behind it and it's been scrutinized by a lot of hungry attackers.
[MIKE]: You can see every line of that code.
[MIKE]: So at the end of the day, once you have, you know, worked with such a large number of organizations, I mean, you mentioned millions of individual users, you've probably seen most everything.
[MICHAEL]: You know, I'm sure that every day you see some new things that you never expected, but, you know, does building up the muscle to defend against that and to really put the best practices forward for each of your existing users make the whole ecosystem more resilient for new users that are coming aboard?
[MIKE]: I mean, you've already done a lot of these things.
[MIKE]: Yeah, but in a way that's, it's more like whittling, if you will, or more like doing an ice sculpture than it is adding more content.
[MIKE]: So I think that's a big part of it.
[MIKE]: It's more like doing an ice sculpture than it is adding more ice.
[MIKE]: I think that's a thing that's a really, really tempting direction to go in is people want features.
[MIKE]: People want, people run into a problem and you react and you solve that problem.
[MIKE]: And you run into a point very quickly where you call it technical debt, UX debt, whatever, truly you lose the intentionality.
[MIKE]: So I think that the, yes, the more voices, the more contributions coming in, open source makes this like way easier.
[MICHAEL]: So important, right?
[MIKE]: But I think you also have to have the mouthpiece on that to be able to use it and have the intentionality that comes from kind of doing the design work.
[MIKE]: Makes a lot of sense.
[MIKE]: And, you know, especially in highly regulated industries, you know, there are certain table stakes, compliance, you know, protocols that you need to have in place for a large number of organizations.
[MIKE]: So once you've gone through the process for one, it makes it easier for others.
[MICHAEL]: But do you still see new types of compliance in industries that you had not seen in the past?
[MICHAEL]: Or is it pretty much at this point you've seen most?
[MIKE]: Yeah, it's, you know, I would just say it's not even just compliance.
[MIKE]: This is true for whether it's certificate management, formats, file formats, like Apple has something called Pickle, for example.
[MIKE]: There is, there's like, there's one side of it where there's all these new things you hear about, but maybe are exciting, maybe not the thing people are gonna adopt and stick with.
[MIKE]: And then there's kind of like a center, you learn this very quickly from what deals close and what customers need.
[MIKE]: It's like, you have to have these, these mission critical integration or compliance frameworks.
[MIKE]: And then there's kind of this long tail of things that people have, but maybe care less about.
[MICHAEL]: So if you think about like on the spectrum of caring versus not, and then like mission criticality versus not, chasing mission criticality, right?
[MIKE]: And then we try to pick out all the things we could care about.
[MIKE]: One of the things that are the most important and people see is like, this is what we're getting from Fleet, which for us is a kind of openness.
[MIKE]: So Fleet always lets you integrate any compliance framework you want, if you're gonna go in and build it yourself.
[MIKE]: But then we also package the mission critical kind of out of the box, like the CIS benchmarks for Mac and Windows.
[MIKE]: Yeah, I mean, at the end of the day, you can't build everything for everyone and have a commercially viable solution and a team to support it.
[MIKE]: So that makes a lot of sense.
[MICHAEL]: So let me ask you, sitting where you sit, which is in a very unique space and a very, very large market, looking towards the future with everything that's coming at us between all of the different things in the area, what do you find exciting as we're looking towards the next few years as some of the opportunities in the space?
[MIKE]: Well, I'm really excited about one, this is more just selfish, I guess, about getting through more of those mission critical things we've been talking about, because I've gotten to get more involved in design again, and there's a lot of like jewelry and cool stuff we've been wanting to add to the product for a while that we just hadn't gotten to yet.
[MIKE]: So again, very internally focused, but we just added dark mode, which I know a lot of people are pretty stoked about.
[MIKE]: We've added some mobile web support so you can like lock a device when you're in a snowsuit or whatever.
[MIKE]: But I think in big picture, industry-wise, there is this mythos thing, GPT 5.5 and all the variations coming next, like, yeah, it can be scary, and yeah, everyone's starting to kind of talk about it, it's becoming like a thing that vendors say.
[MIKE]: Dario said it's all gonna be fine, so don't worry about it.
[MIKE]: Right.
[MICHAEL]: Yeah, I mean, I think the other side of this is that all these tools are gonna be available for people who make software too, right?
[MIKE]: So our continuous integration now runs, like a lot of people, AI-driven pull requests.
[MIKE]: And a lot of that stuff that you just never would have gotten around to is now available to help you prevent vulnerabilities in the first place.
[MIKE]: So I think that it may take a little bit, but software quality is gonna benefit from these changes, not the vibe coding per se, but about like the work that can be done for you without having to do it yourself.
[MICHAEL]: And I think there's a lot of interesting things happening in the fundamental computing layer, right?
[MICHAEL]: Like NVIDIA just announced a new type of CPU for Windows computers, which by the way, Fleet supports on day one, thanks to some arm work from people in the community.
[MICHAEL]: I think that there's a big question around like, what is it gonna look like in a couple of years?
[MICHAEL]: Like, it's looking like there's gonna be a lot of Apple computers in the enterprise.
[MICHAEL]: There's gonna be more Linux, probably not that much more Linux, but it's almost like, what's the next Windows?
[MICHAEL]: It is really exciting.
[MIKE]: And on that note, I really appreciate your joining us on the podcast this week.
[MIKE]: I think we covered a lot of exciting things, but it's interesting to see where Fleet is a couple of years out from now with everything that's going on.
[MIKE]: Thanks for having me.
[MIKE]: Thank you.
[MICHAEL]: Mike just took us through his early beginnings, from a chance encounter at a startup event to navigating the ups and downs of entrepreneurship. Now, he's going to walk us through how Fleet was born from these experiences and why open-source is central to its mission. It's a fascinating continuation of his journey towards creating a more transparent tech future.
--- PRESENTATION ---
[MIKE]: organizations securely manage and monitor devices with transparency and control.
[MIKE]: With that, Mike, we're thrilled to have you at the live event today, and I am very much looking forward to your presentation.
[MIKE]: Thank you.
[MIKE]: Glad to be here, Michael.
[MIKE]: So Fleet is a company I started, gosh, six years ago now with a guy named Zach Wasserman and a guy named Sid C.
[MIKE]: Brandy from GitLab.
[MIKE]: And we saw a really complicated world of device management software.
[MIKE]: Back in, you know, at that time, it was 2020.
[MIKE]: The tech was already almost 20 years old.
[MIKE]: Like Jamf was created in 2002.
[MIKE]: Workspace ONE, which is a popular, or especially when it was AirWatch, kind of a cross-platform device management tool for Windows and Mac.
[MIKE]: That was 2003.
[MIKE]: At the time, it was the biggest Series A investment ever.
[MIKE]: Kind of crazy if you look back.
[MIKE]: And then seven years later, Microsoft Intune came out, which is a mostly Microsoft-focused but multi-platform solution for managing devices.
[MIKE]: And if you're in that world, like Sid was in around 2020, where you got a company that's about to go public, of course, where you already have maybe thousands of computers, maybe you have tens of thousands, hundreds of thousands of computers and smartphones, it's, you don't have a ton of great options.
[MIKE]: And a lot of times people end up with more than one tool.
[MIKE]: And also, you know, there's really important data on these computers.
[MIKE]: People are typing their passwords, they're typing important confidential customer information, and all kinds of PII.
[MIKE]: And you want to understand where that data is going.
[MIKE]: And Sid, at the time, being an open source guy, and having founded GitLab, right, he was like, man, this should really be open source.
[MIKE]: So we started the company, we really set out to kind of achieve that, like, how can we build a world where the devices that are running are being monitored by open source software?
[MIKE]: And it's kind of nifty, because then employees can understand, hey, this is exactly what's running on my device, which if you've ever had maybe an engineer running a Linux computer, that doesn't want their device to be managed, you can probably understand where I'm coming from.
[MIKE]: So that was where we started.
[MIKE]: Kind of since then, I think I'll just back up a slide.
[MIKE]: So you can see since where we're at today, fleet has grown to manage 2 million devices in 90 countries.
[MIKE]: And the reason for that is kind of multi, there's more than one reason.
[MIKE]: But the strongest reason is that it's really hard to go in and deal with what's changed in the meantime, with tech that was built kind of over here on the west side of this timeline.
[MIKE]: And these vendors have evolved.
[MIKE]: They're smart people, great people who worked on these products and continue to work on these products.
[MIKE]: But it's hard, right, with kind of the competing incentives for there to really be a single open solution that can work across every device.
[MIKE]: Like these tools are really built to teach people how to manage devices.
[MIKE]: Like in 2002, really, people didn't know what the heck to do with, with Macs, let alone what was about to come next, which is the wave of smartphones.
[MIKE]: Meanwhile, like by the time we got to 2020, COVID hits, remote work is blowing up, and everybody's having to figure out how to manage remote laptops.
[MIKE]: And that's about when Fleet was born.
[MIKE]: So kind of from day one, we set out to say, how can we how can we solve this problem with kind of the modern era, and the benefit of hindsight about everything that's changed over the past 20 years.
[MIKE]: But one of the things that's changed even now, like in the last year or so, has been AI and really AI picking up in a way that not only can help engineers, like write code faster, but can also help like bots and attackers be able to exploit vulnerabilities a lot, lot faster.
[MIKE]: So meanwhile, the world is still passionately updating computers in a matter of months, but these new vulnerability bots are being exploited in hours.
[MIKE]: So in Fleet, one of the things that ended up being really fortunate about this, about this trend, I guess, that's emerged in the last year is because Fleet was built in a modern kind of timeframe, there's a lot of decisions that were made in the product that made it really, really easy to take advantage of AI as someone that manages devices too.
[MIKE]: So not just a bot, not just an attacker, but the person on the other end.
[MIKE]: So there's this thing called infrastructure as code, where you can take basically a GitHub repo or a GitLab repo, and you have a few files in there, just some simple YAML files that say things like setup experience, true, or install these apps of the first time someone boots up their laptop.
[MIKE]: Or we're going to have a zero touch experience where we send laptops to the person's door, they open it up, they go through a simple flow that we've kind of carefully controlled.
[MIKE]: We put our logo in there, we've made that experience really, really nice.
[MIKE]: And we've eliminated a lot of the friction that can happen in onboarding.
[MIKE]: Instead of doing all of that in the user interface, which you still can in Fleet, you can also check that in to that repo.
[MIKE]: Same thing for compliance, monitoring, compliance rules, profiles on the computer that are basically presets to lock down certain settings.
[MIKE]: And you can do all of that again, in the UI, where you click click around, or since you already know what you're doing.
[MIKE]: And again, you know, most of the most of the folks in that have hundreds or 1000s or 10s of 1000s of devices, they've done this before, right?
[MIKE]: So what that means is, if there's a way to go faster, right, and a way to be more precise and reduce some of that operational risk, where you know, somebody breaks your Citrix environment during Thanksgiving, right, and you're having to come back into the office, that's pretty cool.
[MIKE]: So a lot of teams are already doing this, you'll hear called GitOps, configuration is code, infrastructure is code.
[MIKE]: And on servers, people have been doing this for a really long time, right?
[MIKE]: But the cool thing about this, beyond just the big piece, which is you make a pull request, you can see all the history, right, someone else approves that pull request, you can undo, you can roll back that pull request, if that change was was the culprit and broke something.
[MIKE]: And that whole history is very, very clear.
[MIKE]: All that's great.
[MIKE]: But that can sound like a lot of learning that you have to do, right?
[MIKE]: Like if you've got people that a lot of people in the device management community, really taught themselves, maybe they were Best Buy geek squad people, or they were Apple geniuses, they went and got their TIA certification.
[MIKE]: And now maybe three, four or five years later, they're in an organization, and they're controlling all the laptops, right?
[MIKE]: They're like making everything run, they're maintaining Mark Zuckerberg's laptop, right there.
[MIKE]: They've got a lot to do, and they need to do it pretty fast.
[MIKE]: Who has time to do this extra layer of approvals, right?
[MIKE]: Especially since Git can be kind of scary.
[MIKE]: Well, you know, one of the things that we set out to do, because just me personally, in a past life, I taught a few, think about 12 different people to kind of code from scratch, like working in fast food, working in delivery.
[MIKE]: And what I learned is that it's actually one of the hardest parts for people is really getting over that hurdle of like contributing from the beginning.
[MIKE]: You don't need to write code really to do any of these things we've been talking about in device management, you will have to do some scripting from time to time.
[MIKE]: But when it comes to the actual contributions and being able to see like, okay, like, Lena just made a pull request, let me just go check that real quick.
[MIKE]: Let me approve it.
[MIKE]: Okay, all that's fine.
[MIKE]: You can just click around and do it.
[MIKE]: But just that word Git scared a lot of people.
[MIKE]: So what we found is that if you get into a workshop, and we've done about 50 of these now around the world, and you sit people down and you sort of walk them through, here's how you do this, not with a terminal, you know, not with a fancy code editor, you can do all those things if you want, just with the with the mouse and clicking the pencil button and changing these little keys, and then seeing if it works.
[MIKE]: And what we've seen is that people with zero Git experience can become proficient in less than four hours and are able to kind of take that and run with it.
[MIKE]: And today, about 50% of fleets customers use this approach infrastructure as code.
[MIKE]: Now, something that happened just in the last couple of months is I don't know if you if you followed kind of the AI news, there's when Opus 4.6 came out from Entropic, there was a big change in terms of the capability for generating code with AI.
[MIKE]: So one of the cool things about infrastructure as code is that it also means you can use all of those AI coding tools, which already exist.
[MIKE]: And really, if you want to use those AI coding tools, the only way to really do that safely is if you can review what they've created first.
[MIKE]: So another thing you can do is kind of skip having to write these configs having to write this these scripts altogether.
[MIKE]: And you can also just say, talk to a slack bot or go into cloud and say, Hey, I need all of my endpoints to the ISO, you know, 2701 compliant, which is a big ask, by the way.
[MIKE]: So that one takes a while to run.
[MIKE]: If you do that, you can say, you know, patch this CDE 2026, so on and so forth.
[MIKE]: You can also say, like, make sure that all of our browsers are up to date, automatically make sure that our OS stays up to date in a reasonable timeframe.
[MIKE]: And that's kind of the level of abstraction you can get to and it does pretty decent job as long as you review it.
[MIKE]: So that's probably one of the most exciting things about fleet.
[MIKE]: The thing I'll point out is more like an everyday victory that we hear from a lot of folks is you can actually go to any device, check the live data, the live state of that device.
[MIKE]: And instead of waiting, like, four hours, six hours, or even an hour, you're able to get that information right away.
[MIKE]: And of course, if the if the device is off, or it's dead, and it's not going to be, there's no battery, it's never coming back for four months, you're still going to have access to the state from before.
[MIKE]: So it's a pretty different model.
[MIKE]: And the effect of this is that, you know, going back to where we were on this timeline, there's a lot of pressure, not just from this patching need that's emerging, right from vulnerability exploitation is happening so fast.
[MIKE]: But just from new compliance rules, like, you know, you have multiple countries often where you have people with computers, you may have to deal with labor boards, in some cases, you know, Germany, Austria, etc.
[MIKE]: And there's a lot of reporting you got to do.
[MIKE]: And there's a lot of automation that you can do to do it more efficiently.
[MIKE]: I think as a lot of people know, there's not a there's not a ton of money to add headcount right now to to get around these things.
[MIKE]: So it's like, how can we automate faster.
[MIKE]: So if you're not going to three, two different systems, that helps if you're not waiting four hours to see what the script you wrote works, that helps.
[MIKE]: Another thing that that is a pretty big focus for fleet, and it's been important to us from the beginning, just kind of coming from more of like an engineering background is, man, it's so annoying, when you have to deal with 1000s of computers, some of them are going to be offline, right.
[MIKE]: And there's going to be weird things people have done to put their computer or even on their phone in a weird state, even servers, actually, we can also work on servers.
[MIKE]: But one of the biggest problems in device management is you don't always get a really good look about exactly what's happening under the hood.
[MIKE]: It's kind of a black box.
[MIKE]: And fleet, of course, is open source.
[MIKE]: But that's not going to help you see what error happened on a one of your 1000s of devices.
[MIKE]: What helps you there is, we kind of took that principle of open source and basically squeeze that into every aspect of the product.
[MIKE]: So when you're going in, and you're seeing, hey, I had to send a lock to that device, because we offload that person, they're going to mail their laptop back.
[MIKE]: You know, here's the shipping label.
[MIKE]: That lock command sends an MDM command, which is a piece of XML, basically sends it over the Apple push notification service for Apple devices.
[MIKE]: There's a different way to do it for Microsoft, there's actually no way to do it for Linux, which is growing, it's up to about 5% of market share at this point for desktop Linux.
[MIKE]: And so we built one.
[MIKE]: So we built remote lock for Linux, we built our own remote wipe for Linux, but behind the scenes, like what's happening, right?
[MIKE]: And in traditional device management tools, you don't have that visibility, which is annoying, especially when you're trying to figure out why something didn't work.
[MIKE]: So in fleet, you have that for every script you run, every MDM command you run, every app you install, every app that auto patches, you have the full activity feed, you have exactly the output from your scripts, you have exactly the error that failed.
[MIKE]: And it's a lot more like working in a DevOps kind of a world where you have, even if you're not using infrastructure as code, you have kind of that CI CD experience where you can see exactly what went wrong and when it started working again.
[MIKE]: So yeah, like if you, if you can imagine kind of where you're at today, and whether these things would be possible, there's always a way to get there.
[MIKE]: And I encourage you to take a look at the tools you have at your disposal right now and sort of say, like, how can we take advantage of some of this stuff?
[MIKE]: You know, I think there's a lot of evidence that shows that fleet is a really, really efficient way to get to these outcomes.
[MIKE]: But the important thing is that we get to these outcomes, right?
[MIKE]: Like, there's gonna be auto update, it's gonna have to exist.
[MIKE]: We're gonna have to deal with all of the considerations about patching and not kicking the CEO out of a board meeting, right?
[MIKE]: To do an OS update.
[MIKE]: We don't want to kick traders moving trillions of dollars off of a Bloomberg terminal.
[MIKE]: All that stuff is still problems we have to solve.
[MIKE]: But meanwhile, we got to patch faster.
[MIKE]: So one way or the other, you got to get there.
[MIKE]: Fleet makes it really easy to do.
[MIKE]: If we're going to use AI to move faster, we've got to have a human sign off on it.
[MIKE]: So whether you're using infrastructures code or some other way, I haven't seen another way that really does it efficiently yet.
[MIKE]: But I'm sure a lot of different ideas will come out in the next few years.
[MIKE]: But if you're using AI now, or if you want to use AI anytime in the next year or two years, infrastructures code is the ticket.
[MIKE]: And then the other thing is, how do we make sure we don't break every computer or cause problems?
[MIKE]: And being able to review each other's changes really reduces operational risk.
[MIKE]: So however you get there, I think that's the path.
[MIKE]: Got a little formatting issue here.
[MIKE]: But as you can see, moving MDMs has gotten a lot easier as well.
[MIKE]: So whether you're moving to Fleet or moving to something else, more than ever this year and about a little bit of last year, Apple's made it much, much easier to get Apple devices and move them between solutions.
[MIKE]: So if that was blocking you before, I'd also encourage you to take a fresh look.
[MIKE]: Thanks for listening.
[MIKE]: Mike, fantastic.
[MIKE]: And I know we have quite a few individual organizations in the audience that are wondering how all of this impacts their organization.
[MIKE]: And I am sure that we'll have quite a few questions coming in for you.
[MIKE]: So for everybody that's listening, in front of you, you have a Q&A box.
[MIKE]: Type your questions into that Q&A box.
[MIKE]: Mike will be joining us on this very next Q&A panel coming up live in just a few minutes.
[MICHAEL]: Mike's presentation highlighted the power of open-source in solving modern device management challenges. Now, we move into the live panel from our recent Software Oasis AI Summit, where real audience questions dig deeper into this theme. It's a chance to see how these insights apply to broader challenges our listeners face.
[MICHAEL — CHECKPOINT]: So Mike's presentation made one thing clear: open-source offers a unique edge in device management by fostering transparency. You might be wondering how this translates to practical tools or what challenges still exist in implementation. And that's exactly what this audience brought to the table, with questions that push these ideas further.
--- Q&A PANEL ---
[MIKE]: I'd like to welcome everyone to our second panel of the event today.
[MIKE]: For everyone that's been with us since 8 a.m., I hope you're enjoying the event so far.
[MIKE]: This next panel proves to be a great one.
[MIKE]: We're actually joined by all of the speakers that you've heard over the last couple of hours, and we have quite a few different questions that have come in, so let me jump right to the top.
[MIKE]: I want to start by introducing the panel.
[MIKE]: We have Mike McNeil.
[MIKE]: He's the CEO over at Fleet Device Management.
[MIKE]: Welcome, Mike.
[MIKE]: Hey.
[MIKE]: Thanks for having me.
[MIKE]: Matt Brown.
[MIKE]: He is the founder and CEO over at WearFor.
[MIKE]: Welcome, Matt.
[MIKE]: Adnan Masood.
[MIKE]: He's a Ph.D.
[MIKE]: and chief A.I.
[MIKE]: architect.
[MIKE]: I want to welcome you, Adnan.
[MIKE]: Thank you.
[MIKE]: Glad to be here.
[MIKE]: And Joanna Henkel.
[MIKE]: She is the director, A.I.
[MIKE]: and automation solutions over at Toshiba Global Commerce Solutions.
[MIKE]: Welcome, Joanna.
[MIKE]: Thank you.
[MIKE]: Hello, everyone.
[MIKE]: And Adnan is with UST.
[MIKE]: I just wanted to make sure we recognized that.
[MIKE]: And Trevor is the CISO over at TrustNet.
[MIKE]: Welcome, Trevor.
[MIKE]: Thank you, Michael.
[MIKE]: Pleasure to be here.
[MIKE]: So why don't we just start at the top.
[MIKE]: Let me see.
[MIKE]: It looks like the first questions came in for Joanna.
[MIKE]: And let me just jump in here.
[MIKE]: The first question comes to us from Megan from Allentown, Pennsylvania, right here in the U.S.
[MIKE]: Joanna, Megan is asking, when your A.I.
[MICHAEL]: product scales from a few pilot stores to thousands, what specific signals tell you that distance from real users is starting to hurt the experience and it's time to step back in?
[MICHAEL]: That's a very good question.
[MIKE]: And I will not claim to know the exact answer.
[MIKE]: I think that's part of the trick here.
[MIKE]: You will hear feedback from your users that I think the first signals are when it really doesn't line up with your data, which seems very counterintuitive.
[MIKE]: You think data is king.
[MIKE]: If we have all of the usage metrics, we know exactly how the models are working.
[MICHAEL]: How can the data lie?
[MICHAEL]: But your users are the ones that are touching it every day.
[MICHAEL]: They're feeling it every day.
[MICHAEL]: And they're giving you that qualitative feedback that sometimes the data can overlook.
[MICHAEL]: In some ways, it's those biggest gaps with your real power users when you need to go look and question, are you measuring the right thing?
[MIKE]: That's kind of where we've really found it's that moment where you're like, oh, huh, I don't think that's right.
[MIKE]: But I trust that person.
[MIKE]: I trust that user.
[MIKE]: I trust that voice.
[MIKE]: And that's when you really need to dig in.
[MIKE]: Fantastic.
[MIKE]: Trevor, the next question came in for you.
[MIKE]: It's right here in the U.S.
[MIKE]: from Danielle, who is just outside of Dayton, Ohio.
[MICHAEL]: And Danielle is asking, for organizations with no clear AI inventory today, what's the most practical first step you recommend to discover where AI is already embedded in systems and vendors?
[MICHAEL]: Great question.
[MIKE]: I would start with the users.
[MIKE]: Ask them to do some surveys about what tools they're using as a starting point.
[MIKE]: And that would be like an initial guide.
[MIKE]: Then look at your vendors and also send out surveys to them where they're embedding AI into their products, into their services.
[MICHAEL]: Has it been included in any SLAs or contracts with regards to privacy?
[MICHAEL]: Maybe the legal team as well would be a team to consult with as well.
[MIKE]: I would start with those two areas.
[MIKE]: Sounds like a good foundational first step.
[MIKE]: Matt, the next question came in for you, and I'm going to spin the globe a little bit and include some of our international attendees.
[MIKE]: This is from Hugo, who is in Coimbra, Portugal.
[MICHAEL]: And Hugo is asking, for manufacturers tempted to let AI handle everything, how do you explain where you deliberately keep humans in the loop so quality, traceability, and audits stay rock solid?
[MICHAEL]: Well, yeah, that's interesting.
[MIKE]: I would say one of the challenges I would say with AI currently is this idea of hallucinating.
[MIKE]: When you're thinking about traceability and manufacturing a product, you don't want to happen as something hallucinates that some ingredient or component went into your product when you made it.
[MIKE]: So if you're thinking about using AI in a manufacturing space, probably a good place for humans to play would be in the compliance side.
[MIKE]: So maybe okay to have AI produce or formulate products, but have humans do a secondary or quality check at every stage of the process so that you have that human eyes on the stages and you have the confidence to be able to say, okay, that's exactly what went into my product and somebody signed off on it.
[MIKE]: It's all good.
[MIKE]: Adnan, this question came in from a few different attendees, so I'm going to pick one.
[MIKE]: This one is from Daniel who is in Galway, Ireland.
[MICHAEL]: Daniel is asking, for leaders designing AI governance, how can your three-layer model, technical, operational, and regulatory that you spoke about be turned into a concrete checklist they can execute against this year?
[MICHAEL]: Very specific question.
[MICHAEL]: Great question, by the way.
[MIKE]: I think it's when you are thinking about the models, especially when it comes to governance, you probably want to think about the loop of what your use case is, what kind of governance framework you are planning to use.
[MICHAEL]: So for instance, if it's NSU or the EU AI Act or NIST RMF framework or it's your own internal compliance thing, if you're using ISO 42001, based on that, what controls do you need to put in place?
[MICHAEL]: That's essentially the mental model you will start with.
[MICHAEL]: And now, based on that, you can create a checklist.
[MICHAEL]: And essentially, a checklist gets created for you based on how your use case applies to that.
[MICHAEL]: So if you think about a concrete checklist, that comes out of your model of how the risk triage is happening.
[MICHAEL]: Some of these use cases will have a high risk, so that checklist will be much longer.
[MIKE]: Some of this will be actually like, I'm going to summarize a Word document.
[MIKE]: Like, OK, fine.
[MIKE]: In that case, your list will be just really small.
[MIKE]: It doesn't have PHI, PII data.
[MIKE]: So there is no one checklist.
[MIKE]: There's no one size fits all.
[MIKE]: Essentially, it will depend on the use case, the regulation you are following, and the controls you have to put in place.
[MIKE]: I hope that kind of answers your question.
[MIKE]: And Michael, if I could just add on to that.
[MIKE]: Another idea would be to start off and do overall risk assessment.
[MIKE]: And that risk assessment should guide where the focus should be.
[MIKE]: So that includes doing things like identifying what the assets are.
[MIKE]: Look at the risk factors associated with each of those different assets.
[MICHAEL]: Who do they belong to?
[MICHAEL]: The nature of the process that's taking place.
[MICHAEL]: And that can be a great starting point to focus.
[MICHAEL]: And then to kind of add on to what Adnan said, then use your frameworks as the basis for determining what controls should be in place to mitigate the risks associated with that risk assessment.
[MICHAEL]: The next question came in for Mike.
[MICHAEL]: And this is from Carlos, who's just outside of, looks like right in Waukesha, Wisconsin.
[MICHAEL]: And Carlos is asking, how do you help admins who grew up on GUI tools get comfortable approving Git-based policy changes without needing to become full-time developers?
[MICHAEL]: Yeah, really good question.
[MICHAEL]: I think a lot of people hear Git and they think of that time where they tried to follow a tutorial, or they did some Googling, and they got these confusing terminal commands and they got their repo in a tangle, and they got merged conflicts somehow they didn't even mean to, right?
[MIKE]: I think Git's got a bad reputation because, understandably, it's been a low-level tool.
[MIKE]: And I think there's sometimes a little bit too much pushing people out and trying to say, the only real way to do this is on the command line.
[MIKE]: But what I've seen, partly I learned this teaching people to code years ago, is that you can take someone who's a barista, and you can sit down with them for a couple hours, and you can get them competent in the GitHub UI.
[MICHAEL]: You can get to where they can understand that the output from the CICD job, I mean, does it say error or not, right?
[MICHAEL]: And if it says error, you have to do something.
[MICHAEL]: And then it'll usually tell you what to do.
[MICHAEL]: At least in Fleet, that's something that we really obsess over, is making that experience meaningful, right?
[MIKE]: What I've seen is people go to one of the, we do, I'll plug it, we have certification workshops, they're free, you can have dinner there, and we do them locally.
[MIKE]: About 10, 15 people usually.
[MIKE]: And a lot of folks there learned for the very first time to use Git.
[MICHAEL]: We've had people with 30-year-old IT estates, mostly Windows, come in, sit down, figure out how to do the basics in terms of, I can be a participant in this, I can approve things, I can see if they failed, right?
[MIKE]: I'm like, hey, you should change this.
[MIKE]: I can see the diff.
[MIKE]: From there, it's really just going in and using Cloud or using another tool to basically get it to create the changes for you.
[MIKE]: Because even if you don't know how to do the exact YAML structure, that's where I think just the tooling is so, so important.
[MIKE]: But yeah, confidence.
[MIKE]: Confidence is hard to come by in that world, but it is really, it has gotten a lot easier than if you tried Git maybe 10 years ago.
[MIKE]: GitHub Desktop makes it incredibly easy.
[MIKE]: I recommend giving it a go.
[MICHAEL]: So should we be introducing barista experience into all of our job descriptions?
[MIKE]: You know, I do a fun interview every time.
[MICHAEL]: And one of the questions is, hey, have you ever had a customer service position?
[MICHAEL]: Because it's always nice to know.
[MIKE]: I think your point about confidence is important, too.
[MIKE]: Everyone likes to be comfortable with, and they're already an expert.
[MIKE]: And when it's time to go and learn something new, you just have to get rid of that mystique and the unfamiliar.
[MIKE]: Give them that entry point, give them some confidence, and then they can run with it.
[MIKE]: And it sounds like you're doing a lot of those things with those workshops.
[MIKE]: Joanna, the next question actually came in for you.
[MIKE]: So I'll just jump right in.
[MIKE]: This is from Carlos, who's in Mobile, Alabama.
[MIKE]: And let's see here.
[MIKE]: Carlos, I'm hearing a little bit of feedback.
[MIKE]: I don't know if someone might need to be muted.
[MICHAEL]: How do you keep your engineering and innovation teams in regular contact with store associates and managers so that feedback reaches you before it's filtered through layers of dashboards and reports?
[MICHAEL]: That's a great question.
[MICHAEL]: Definitely a challenge.
[MIKE]: My team that I lead, we're in the product management space, and that really is our role, that we are that connection between the users and the needs and that true voice of the customer and coming back to our engineers.
[MIKE]: We absolutely sometimes will have those engineers talk to those users as well.
[MIKE]: But I think it goes back to the point of never forgetting that your users are important.
[MIKE]: You can have different layers and roles to communicate.
[MIKE]: But the thing is, just don't trust the dashboards always.
[MIKE]: We always go out, we speak to our customers.
[MIKE]: In our profession and the retail world as well, there's a lot of people out there, and everyone in our world will go talk to all of those users, whether they want to talk to us or not.
[MIKE]: We reach out to our customers.
[MIKE]: And so I think even back to the switching tools and confidence, it's just do it.
[MIKE]: Just go have those conversations.
[MIKE]: Have those relationships with those people and are constantly reaching out.
[MIKE]: And that will also then make them comfortable with us so they know, hey, if I have something, I'm not going to hold it within.
[MIKE]: They know how to reach us and find us and how to give that feedback.
[MIKE]: And we always have to work very closely, product and technology, engineering, innovation teams, there's always those feedback loops because those engineers, if they don't understand what we do about the users and about the problems being solved, then they are limited in their ability.
[MIKE]: They're problem solvers.
[MIKE]: They want to know what the things they're building are actually doing.
[MIKE]: So it's always really important for us to keep our teams really at the forefront, understanding it, and bringing it back every day and talking to those engineers.
[MIKE]: Great advice.
[MIKE]: And I think a lot of the different executives that are at the event today realize that that's important no matter what area of tech you're responsible for.
[MIKE]: Getting that firsthand user advice and feedback is key.
[MIKE]: Trevor, the next question came in for you and it's from Josh who's in Peoria, Illinois.
[MIKE]: And Josh is asking, you stressed in your presentation that AI failures start with governance, not tech.
[MICHAEL]: What's the very first ownership decision a leadership team should make to change that trajectory?
[MIKE]: Your Honor, I would like to take the fifth.
[MIKE]: I love it.
[MIKE]: That's a great question.
[MIKE]: Looking at governance and what's the first decision point.
[MIKE]: It goes back to executive leadership.
[MIKE]: A lot of education, particularly around the non-deterministic nature of AI.
[MIKE]: And I think that's something that needs to be really pounded when it comes to educating the C-level.
[MIKE]: Because your traditional way about thinking of systems where you have a purely deterministic output based on a consistent set of criteria changes the nature of how we need to address risks and allowing and enabling the C-level and executive level to understand this is the nature of the risks associated with introducing AI into environments.
[MIKE]: A panel had made a comment earlier about the hallucination that occurs within AI systems.
[MIKE]: And that's a risk factor that not a lot of executives appreciate because this technology is so new.
[MIKE]: Clearly over time we will see systems become more and more accurate and there'll be less hallucination and there'll be more accuracy.
[MIKE]: But most likely we'll never eliminate that.
[MIKE]: And that's something that really needs to be factored in when it comes to understanding and appreciating the governance factor.
[MIKE]: Makes good sense.
[MIKE]: I wanted to add on top of that that people are now getting more comfortable with the latent space.
[MIKE]: So there's a latent space and then deterministic space.
[MIKE]: I feel like more executives are getting because of the whole frontier capabilities becoming a mainstream thing.
[MIKE]: And I think as engineers, as scientists, as leaders, we have to push the envelope a little bit more to bring in those capabilities because otherwise we lose on our big frontier capability edge.
[MIKE]: Capability overhang is there for us to really exploit and I think that alpha really resides between that difference between where the organizations are and where the capability of these models are.
[MIKE]: Matt, the next question came in for you from Tyler, who's just outside of Boise, Idaho.
[MICHAEL]: You're in the US and Tyler is asking, for a midsize food or cosmetics manufacturer such as ourselves, which single process do you suggest they apply your AI-assisted test to and control point approach to first see quick value?
[MICHAEL]: Great process question.
[MICHAEL]: So it's going to be unique to every company and every type of product that you make.
[MIKE]: But I would say in general, the ones that people tend to skip or forget the most.
[MIKE]: So in other words, get AI to jump in and enforce discipline about the most tedious tests, the ones that require the most reminders or memory to make sure you do them.
[MIKE]: Computers are graded, repetitive, tedious tasks.
[MIKE]: So if you start there, that helps your team reduce the tedium of their job and they might start to see more value and it kind of replicates.
[MIKE]: So once I get the AI doing my hardest work, then I start to see I can use this in other places and really start to enjoy the process more.
[MIKE]: So I would say start there.
[MIKE]: Adnan, a question for you, this one from the US.
[MIKE]: This is from Dustin, who's in, let's see, Fresno, California.
[MICHAEL]: And Dustin is asking for teams used to classic software development life cycles, what's the smallest first step you recommend to start operating in an AI development life cycle without overwhelming them or their team?
[MIKE]: I guess the smallest one would be to get a startup that Cloud or Codex, depending on the poison of your choice.
[MIKE]: I feel like we are in an area where our sales folks, our HR folks are building applications.
[MIKE]: It's completely democratized in that area.
[MIKE]: It's become such, that's a great thing.
[MIKE]: It's not a bad thing.
[MIKE]: It's not a great thing that people are talking to the databases.
[MIKE]: The natural language has become the way we communicate with machines.
[MIKE]: So the first smallest step you can take, instead of starting to read up on how to do Azure Client, or how to create algorithms around this, start just by doing.
[MIKE]: Just like you do today with your chat GPTs.
[MIKE]: So as you build upon that foundation of using Cloud Code or using chat GPT, Codex, or even just get Cursor installed and start playing with the three models.
[MIKE]: It will give you the foundational element of what you need.
[MICHAEL]: And from there you can build upon, how do I prompt here?
[MICHAEL]: How do I create a better harness?
[MICHAEL]: How do I actually get a good result?
[MICHAEL]: How do I create agent groups?
[MICHAEL]: How do I create emails?
[MICHAEL]: But if you start with all of that, that barrier to entry is not there anymore.
[MICHAEL]: You can start building applications today.
[MICHAEL]: So utilize that opportunity and start with small, Cursor, Codex, or a pod.
[MIKE]: And that will get you, I guess, 90% there.
[MIKE]: I think that inertia, if you overcome that inertia, then the sky's the limit.
[MIKE]: Mike, this next question comes to us from Olivia, who's in Sioux Falls, South Dakota.
[MIKE]: And I think this is something that absolutely applies to many of the enterprises in attendance today with many systems in their arsenal.
[MIKE]: So what Olivia is asking is, you mentioned patching in hours while fleets still patch in months.
[MICHAEL]: What combination of live queries and automation do you see actually making that shift a reality in practice?
[MICHAEL]: Yeah, so if you're in an organization that has a patch SLA today, there's likely some corner of machines that you've prioritized to be the most important, right?
[MICHAEL]: Like your critical assets or ones that are in a particular regulated environment.
[MIKE]: When you go out and look at what you're doing today to achieve that patching goal, or really even maybe not getting there, maybe it's happening once a month and you want to kind of do it faster as a security initiative, I think the key is kind of first scope, scope where you get the biggest bang for your buck, or where you're already doing the work so you can immediately start saving some productive hours from humans that are already doing it.
[MIKE]: It is really easy to start just auto-patching kind of everything that you wouldn't have spent time on before, because if you have like 1,000 apps off the shelf, you can just kind of turn it on and it's great.
[MIKE]: The other side of that coin is the user experience.
[MICHAEL]: So I think that like when you're trying to think of like, how do I go and achieve this in a smart way?
[MIKE]: I think usually you're thinking about it on a per app basis and you're thinking about what's the most risk.
[MICHAEL]: So I probably don't want to kill the browser, right?
[MICHAEL]: First of all, Chrome has a great built-in piece of functionality where you can set a date when a little thing pops up in the top right corner and says like, ready for update.
[MICHAEL]: And there's a managed UI there.
[MICHAEL]: You don't need to go build anything.
[MIKE]: I've also seen people use like Uman and go even because you can do that for any app and you can say wait till the user doesn't have it open and then try to do the update.
[MIKE]: So you can achieve that with scripts.
[MIKE]: You can use live queries.
[MIKE]: In this case, if you're going to do automations, they're not really live queries, they're in a policy, but you can write a policy that says, hey, when this process stops running, write basically.
[MIKE]: You can use as well if you have a, this is kind of like, I guess going a little bit further, but if you wanted to sort of see more from a supply chain perspective as well beyond just vulnerabilities like, hey, like every time a particular version of an app or any app really gets installed, go ahead and write that to the data lake.
[MIKE]: So also from like a security perspective, you can have in your SOC like records of all the software installs that occurred on the computer.
[MIKE]: And you can get that from your EDR depending on your organization, what team owns that can matter too.
[MIKE]: So I would kind of think about it from first principles and just actually kind of to Matt's point from before, like focus on where you're going to save the most, get the most value first and then apply it there.
[MIKE]: On the fleet side, one thing we're doing that's kind of unique is six times a day, we're looking at all of the new patches that came through.
[MICHAEL]: We just, I think had another record patch Tuesday, not at fleet, I just mean on earth, right?
[MICHAEL]: In terms of just stuff that had to be patched.
[MICHAEL]: So one thing you can kind of benefit from there is you know that everything's basically been vetted at least six times a day.
[MICHAEL]: Joanna, next question came in for you from Priya who's in Rochester, New York.
[MICHAEL]: And Priya is asking, when stakeholders in a large retailer all want different AI features, how do you protect the core use cases that made the product successful in the first place from getting diluted?
[MICHAEL]: This is at the core of every product manager's life.
[MIKE]: I think that frankly, it's not different than that topic for non AI use cases.
[MICHAEL]: You're always having to understand a wide variety of needs and figure out, talking about the biggest bang for the buck, it's the same thing here that you look at where are the common needs?
[MICHAEL]: What is the biggest problem to solve?
[MICHAEL]: What is the most urgent problem to solve?
[MIKE]: And every single time is that use case, is that problem something that fits into my vision to what my portfolio is, to what our core space is.
[MIKE]: And a very important capability to have in there is the ability to redirect.
[MIKE]: Sometimes you have to not say no, but say, well, this is the solution belongs here and this is how we solve your other problem in another way.
[MIKE]: I think when you have a lot of different stakeholders at retailers asking for different things, if you can really get into it, they all still have the same core problem they're trying to solve.
[MIKE]: So you can always also look at, well, maybe you don't give them exactly what they're asking for because it's not in line, it might dilute the core product.
[MICHAEL]: But if you can deeply understand that problem, you can at least look at, well, where can this solution and where can our core use cases or updates still help address that core problem?
[MIKE]: So I think that's always a way to reroute and make sure that you are addressing the need, even when you're not able to do exactly what the ask is.
[MIKE]: I'm going to spin the globe and grab a question from another part of the world.
[MIKE]: So let's see.
[MIKE]: We have Sophia who's joining us from Cork, Ireland, and this is for Trevor.
[MICHAEL]: Sophia is asking, let me make sure I get this right, for companies already juggling SOC 2, ISO 27001 and PCI, how do you layer AI-specific controls on top without overwhelming your existing compliance program?
[MICHAEL]: Oh, nice question.
[MIKE]: I think a lot of this comes down to, firstly, understanding the nature of what's changed overall in the cybersecurity realm with AI, and the fundamentals haven't dramatically changed.
[MIKE]: Things like access controls and logging and monitoring and governance overall hasn't really changed.
[MIKE]: Those principles remain the same.
[MIKE]: What's changed is the scale and speed.
[MIKE]: Those have dramatically changed.
[MIKE]: So when it comes to adding on new criteria, you need to have some ability to map controls across different frameworks.
[MIKE]: And if you're really dealing with things like ISO and SOC 2 and PCI, there are controls that are common across boundaries.
[MIKE]: Now, not all of the controls are unified, and they're not all in sync.
[MIKE]: So you may have controls for one particular requirement, say for PCI, it has some strict requirements, and then maybe for a SOC 2, they have less strict requirements.
[MIKE]: SOC 2s are more based on objectives, whereas PCI, as an example, is based on specific requirements.
[MIKE]: PCI will actually tell you how many characters, at a minimum, you have to have in your password.
[MIKE]: SOC 2 does not say that.
[MIKE]: It just says you need to have appropriate controls.
[MIKE]: So when you layer on the AI-specific controls on top of that, you need some ability to map them across those boundaries.
[MIKE]: I think, again, the things that have changed are not so much the fundamentals.
[MIKE]: It's more of the edge cases.
[MIKE]: And back to my earlier point about the non-deterministic nature of AI, that's an area where a lot of the frameworks don't actually address them directly, particularly the ones that you mentioned.
[MIKE]: And that's where the real work has to happen in mapping those controls across those boundaries.
[MIKE]: Matt, this next question comes for you, and I love this question.
[MIKE]: I think a lot of individuals in the audience can probably identify with this.
[MIKE]: This one is from Marcus, who's in Des Moines, Iowa.
[MIKE]: And I've actually been to Des Moines.
[MIKE]: Shout out to everyone there.
[MICHAEL]: How do you reassure cautious clients that using AI for test definitions and control points won't leak formulas or sensitive specs into external models?
[MIKE]: Yeah, this is something we think about, struggle with, and worry about quite a bit.
[MIKE]: That is a key concern for anybody that makes a product.
[MICHAEL]: How do I keep my competitors or just my special knowledge about that product from leaking out of my company?
[MIKE]: One of the things we're doing in terms of using AI is making sure we're putting guardrails around it wherever we can, checking terms of service with Gemini or Claude is first step.
[MIKE]: Second step is putting guardrails in with your prompts and your back-end programming to make sure that you're not giving it access to stuff it should not have.
[MIKE]: And also letting people turn it on or off is important, too.
[MIKE]: So I think a lot of...
[MIKE]: There's a Russian software to use it, to build features with it, to give it to users.
[MIKE]: A lot of that could be really good.
[MICHAEL]: I do worry sometimes about who's really paying attention to what data is going where and who's getting that data and where is it landing?
[MIKE]: So I think for our customers, we're conscious about giving them choices when it comes to AI.
[MIKE]: Some people are less concerned about their formulas.
[MIKE]: Others are more concerned.
[MIKE]: So I think giving them the option to go traditional manual way or AI way is going to be our approach to that for the near future.
[MIKE]: This stuff changes fast, however, and I think eventually there will be some...
[MIKE]: I don't know if it's going to be case law or something, but there will be some situations with AI that are going to start to, I think, define data privacy and protection and who owns what.
[MIKE]: And I think that is yet to come, unfortunately.
[MIKE]: Yeah, really, really tough challenges.
[MIKE]: And I think that's why everyone's here today.
[MIKE]: There's so many real questions.
[MIKE]: Mark, if I could add just one other comment.
[MIKE]: Yeah, absolutely.
[MIKE]: I think this is an area we see in the cybersecurity realm that's been going on for some time.
[MIKE]: A lot of organisations have a big tech deficit in terms of not taking data classification seriously.
[MIKE]: Data classification has been the red-headed stepchild for a long, long time.
[MIKE]: No one likes to do it.
[MIKE]: It's a difficult process, and for companies that haven't done that appropriately, when it comes to the type of controls that Matt's talking about, it becomes extremely difficult because you don't really even know where is the sensitive data, what does it look like, and what data is not sensitive.
[MICHAEL]: Is this private?
[MICHAEL]: Is this confidential?
[MICHAEL]: What does that classification even look like?
[MICHAEL]: And that's an area, again, that's going to need a lot of attention as they start to roll out more and more tools that have access to extremely sensitive data.
[MICHAEL]: Just identification process itself is a major leap.
[MIKE]: As we're coming to the end of this panel, I'm going to send this last question out to Adnan.
[MIKE]: So this question is from Aaron, who's in Lincoln, Nebraska.
[MICHAEL]: And Aaron's asking, in regulated industries like healthcare and finance, how do you balance rapid AI feature delivery with the fairness, transparency, and human alignment checks you described in your talk?
[MICHAEL]: In one word, risk-tearing, to what Trevor was talking about earlier.
[MICHAEL]: It's like if you tear these things down in these different risk tiers, if you classify them, hopefully you have a good data foundation and you have risk-tearing built in there, which means if you're working with a regulated industry, the majority of the risk comes from the processes and data.
[MICHAEL]: Those are the two major areas.
[MICHAEL]: So if your business process, which you are trying to automate or trying to make it smarter, try to make it better and more efficient, is a low-risk process, it doesn't have to be a low-impact process, but it's a low-risk process, then you can easily expedite that and go through that much faster.
[MICHAEL]: As compared to if there's something which requires like 50 different guardrails to go through and it's a high-risk process, then it will take longer because of the human in the loop and essentially just going through the governance process is usually painful, right?
[MICHAEL]: The bureaucracy associated with that.
[MIKE]: So what I have found working with different leaders is that they try to stratify that between different tiers.
[MIKE]: So risk tiering will help you really expedite the things much faster.
[MIKE]: Try to still have the ROI associated with that.
[MIKE]: So it doesn't mean that low-risk doesn't mean trivial use cases because triviality wouldn't get you buy-in from stakeholders.
[MIKE]: So make sure they are actually value-generation use cases and you can streamline them and make them fast-track as long as you don't lose their value.
[MIKE]: There will be friction when it comes to the governance-specific use cases, and that's by design.
[MIKE]: And for that, you can automate a lot of it.
[MIKE]: I think that's the shortest answer I can give on this topic.
[MIKE]: There you go.
[MIKE]: Well, as we're wrapping up, Erin, next month, our summit is on governance, risk, and compliance.
[MIKE]: So that might be a great day to attend.
[MIKE]: Anyway, I'd like to let everyone know that if you would like to reach out to any of the speakers you've heard on this panel or throughout the event, up at the top of the site, you're going to see a big orange button.
[MIKE]: Just press that button.
[MIKE]: We'll get you connected.
[MIKE]: And Mike, Matt, Adnan, Joanna, Trevor, I'd like to thank everyone for the fantastic presentations today and for taking the time out to answer a few of the questions that we had come in from the audience, and I think that was a great panel.
[MIKE]: Thank you so much.
[MIKE]: Thank you very much.
[MIKE]: Appreciate it.
[MIKE]: Thanks, Michael.
[MIKE]: Bye-bye.
[MICHAEL]: So, a few key takeaways from today's episode: First, Mike's journey shows the power of perseverance and adaptation in tech entrepreneurship. Second, open-source is not just a philosophy but a practical solution for modern device management. And third, the landscape of tech is continuously evolving, and staying ahead requires embracing change. By the end of this episode, I hope it's clear why transparency and adaptability are crucial. A big thank you to Mike for joining us. Be sure to connect with him on LinkedIn if you're curious to learn more. And if you haven't already, come join us over at softwareoasis.com — that's where all of this really comes together. If you enjoyed this episode, consider subscribing and leaving a review. Thanks for listening, I'm Michael Bernzweig.