Every crisis is an opportunity

Announcer:
Ready to explore the extraordinary world of tech. Welcome to the XTech Podcast, where we connect you with the sharpest minds and leading voices in the global tech community. Join us as we cut through the complexity to give you a clear picture of the ideas, innovations and insight that are shaping our future.

Debbie Forster MBE:
Hello and welcome to XTech Podcast by Fox Agency. I’m your host, Debbie Forster MBE. I’m a tech portfolio consultant and an advocate and campaigner for diversity, inclusion and innovation in the tech industry. I’m delighted to be working with Fox Agency as the host for the XTech podcast and as a curator for the XTech community.

And today, I am really delighted to be joined by Gaurav Kapoor. He’s the Vice Chairman, Co-founder and board member at MetricStream. Welcome, Gaurav.

Gaurav Kapoor:
Thank you, Debbie. Very delighted to be on your podcast.

Debbie Forster MBE:
So, Gaurav, I had a lot of fun researching for this discussion and you’ve had a really interesting journey at MetricStream, but I like to take a step further. I love to figure out how guests found themselves in the world of tech. Some born with a laptop in hand, others wake up with surprise and realise they’re in tech. How did it happen for you?

Gaurav Kapoor:
So, Debbie, I truly think that it’s been an interesting journey. I actually started my career India and started with Citi. And Citi at that time was a very happening, young, quote unquote, at heart company, very innovative. We were one of the first companies to launch the consumer products like credit cards and home loans and auto loans and stuff India, mortgages, etc. In fact, were one of the first ones to actually bring international mutual funds into the country as well as a distributor initially. So when all that was happening, you know, somewhere in the mid-90s, the Internet happened because were Citi, were, you know, helping the US groups as well in terms of how the overall kind of Internet would work. We were one of the first companies India to get onto the Internet bandwagon.

While this was happening, there was a very high interest in launching a set of products that could actually tap into the whole international consumer remittance business, if you will. As you know, multi billions go out from the US to other developing countries. And at that time, India was still developing. And that’s when the company and I took the call to move to the US basically. Literally, I was in New York for seven days before they said, go to Silicon Valley. That’s where all the tech stuff is happening. And I moved to Silicon Valley and launched. You know, this is pre PayPal, essentially an international consumer product which actually allowed Internet based remittances. And when I came to Silicon Valley a lot was happening. This was the, you know, early heydays of tech, if you will, or not tech, but at least the Internet.

And that guided me towards tying up with one of the entrepreneurs in the valley to start a boutique venture fund essentially. And while were looking at that, the whole idea of governance came in. 9/11, Enron, MCI, all that stuff was happening and we saw an opportunity. So interestingly, on a personal level, when I was running the consumer remittance business, the last guys we really wanted to talk to was risk compliance audit executives. Because we always used to think that they’re the breakers, if you will, they are the policing force. Not realising that the rest of my life I’m going to be spending creating a company or helping create a company that is going to be focused on risk compliance and governance.

Debbie Forster MBE:
And I think what’s really interesting to me is you were getting into fintech before the word fintech was even a concept. And when you allude to something, a lot of times we talk about great innovation coming through some new discovery, some new innovation, but when you talk about things like 9/11, when you talk about bubbles and crashes, et cetera, that’s tech and innovation coming through crisis. And you’ve really had to navigate through that, haven’t you?

Gaurav Kapoor:
It is. And see every crisis, as they say, is an opportunity, clearly. And what we realised is that many of the failures had certain patterns, if you will. And I’m not just talking about the big kind of failures we just talked about, but even smaller failures. And later on the financial crisis of 2008, 9. Right. A lot of these, you start to pattern and see what is common to these. And what is common is that one part of the organisation wasn’t talking to the other part of the organisation. As simple as that, right? In a bank you have groups like Operational Risk, Audit Compliance and there’s a lot of data intelligence sitting, you know, across these groups. But if you don’t bring it together, okay, that’s when either simple tactical failures happen or more seismic failures happen.

Where if you can bring all this together, then the opportunity for the organisation to see risk holistically changes the paradigm overall. So absolutely. I mean we obviously never want to celebrate crisis, but the biggest opportunities also come from the crisis essentially.

Debbie Forster MBE:
And I think it is because what you’re talking about there, and we often see this, we know there’s a problem or we know there’s an opportunity, but people don’t necessarily want to hear that at that point in time. And the secret is one of my favourite quotes Winston Churchill talks about, never waste a good crisis. And those crisis points, if you’ve been doing your homework, if you know this space is the time to lean in, that’s where you institute change, because people really have no choice. And you can push through and move forward in ways that people might be really resistant beforehand. And you’ve clearly built that in as part of your whole MO in looking at that.

And I really love the journey of going on GRC, going from being the bad guys, the headache, the ones that slow you down, to being something at the engine house of what you do.

Gaurav Kapoor:
And Debbie, the one thing I’ll add is not just at the foundation when the company was being thought through on how and what to attack and what problem to solve, but right through the last 15 plus years, there have been quite significant changes in the market. If you look at some of the early cyber attacks that people were not able to decipher where it’s coming from and why it’s coming, you know, that was a crisis situation.

I mean, whether it was state sponsored or it was massive infrastructural cyber attacks that was coming and after that cyber became real, if you know what I mean, right. Then you had the biggest possible, I would say, crisis in the last decade, which is the COVID, and that created a whole new opportunity and problem around digitisation, which was people who were working from home, they had to digitise a lot of stuff. But that came with a set of risks and crisis opportunities, if you will. Right. Then you get into the world of AI more recently. Now, that’s a massive opportunity, clearly the tech disruptions, et cetera. But it also comes with a very large canvas of risks as well, if it’s not managed well. So you’ve got to be at it.

So for us, we’ve had to stay ahead of the curve, if you will, right through the journey, not just the initial quote, unquote crisis opportunity spectrum, if you will.

Debbie Forster MBE:
I completely get that. And I think it is understanding, I think was a time when companies could convince themselves if they understood risk, they would avoid crises, whereas we need to now understand that’s a regular part of the landscape. And I love, you know, let’s look at that. You’ve been driving MetricStream through an AI first transformation and what triggered that, because there’s a lot of companies still bolting it on or sitting at the sidelines waiting for that. How did you drive that through MetricStream?

Gaurav Kapoor:
Debbie that’s a very interesting question, especially in the world of GRC, because GRC – you know AI has been there for decades, accelerated a little more in the last five years and now significantly in the last couple of years. So if you look at GRC, one of the reasons GRC trailed other functions like sales and marketing, or even finance, et cetera, was because most GRC practitioners, risk executives and compliance executives were very fearful that they can’t afford to miss something. It’s fantastic to be, you know, 90% accurate on sales and marketing, if you will. It’s not okay to be 90% accurate in risk management because one or two failures that pass through your agentic engine or generative engine can cause a billion dollar fine to a bank or to a large corporate as an example, right? So people were fearful.

But what has changed the last couple of years is that the markets are shifting where, you know, customer behaviours are changing, it’s no longer imperative. Primarily, the canvas of coverage of risk has dramatically enhanced. Today, you know, risk is coming not just from cyber. It could be a geopolitical shift, a supply chain shift, it could because of internal fraudulent activities, because of high hyper digitalisation, if you will. All that has actually expanded quite a bit and there is no option but for risk executives to tame the canvas of information, you know, using AI, different aspects, and then augment what the practitioners are doing, essentially.

I don’t know if you’re aware or maybe you are, that in the world of GRC, there are 500 million people in the world who touch GRC every day in some capacity as employees, as practitioners, as regulators, as consultants, as, you know, the extended supply chain, all of that. So 500 million people, that’s multiple countries baked into one. Now what we realised is after looking at, you know, where the real pain points are, we realised that, yes, we can, we’re sitting in Silicon Valley, we can talk all day long about LLMs and SLMs and MCPs, but really where we hinged on is what is the real pain that our market or people in our space are going through. And it boiled down to really two things. Here they are overloaded with actionable work that they have to do.

I mean, look at us as well as independents. I’m sure you have to, as part of your company, you’ve got to fill up security questionnaires, you know, you’ve got to fill up compliance questionnaires, right? You’ve got to do risk and control assessments all day long, right? And there are literally thousands of people in a single organisation that are doing this day to day. So what we said is that let’s simplify their lives here. Let’s use AI to automate the rote work that they do every day, while still allowing them the intelligence that they have around their own business, around the market to be projected further, but allow AI to use that. And the second thing was that administrators of GRC programmes are also equally pained because large enterprise products, et cetera, they require maintenance, they require a lot of work, all of that stuff.

So just boiling it down to simplifying. And that’s why we took the call, we changed our tagline about six months ago, calling it GRC Simplified, Outcomes Amplified. So the focus on amplification and that’s the journey we are going through, or I mean, this is not a short term journey, but this transformation is a very critical part because in the next couple of years the customer behaviour is also changing quite rapidly where they want AI to be used for their efficiency, for their effectiveness and even the foresight and prediction capabilities. So that’s been the transformation.

Debbie Forster MBE:
Again, I’m loving the journey that you’re talking about there because it’s not just doing it because we can do it’s really understanding that user. And you and I both know the minute you started talking about anyone in Risk, you know, they’re the worried, sweaty person in the past and you had the business case, you had the numbers. But what I like is you’ve been agile enough that when the tipping point comes where it becomes there’s, it becomes inevitable, this is too big, that it can overcome the fear, it can overcome the resistance, because the problem space is becoming impossible. That’s the point at which you can lean in and make that real pivot and take your users with you too early, they’re going to have reasons to not engage with you. Too late, somebody else is in there.

It’s that keeping that agility, which you’ve managed to do. So that’s fascinating now that AI is leaning in and becoming so much important part of the GRC space. Looking ahead, is AI going to replace the GRC professionals or maybe just augment them? What do you think?

Gaurav Kapoor:
So, Debbie, this is the billion dollar question right on everybody’s mind in every company across the world. It’s a tricky question, but let me actually start with an example. I was speaking with the chief auditor of one of the largest, you know, oil and gas companies in the world recently and I asked him the question. You’ve got hundreds of auditors and thousands of people who are actually responding to these audits. Right? What do you think is going to happen? What is your foresight? And he basically said that in one sentence that I will need more auditors. So I was surprised and I asked him, why do you say that? He said, see, two things.

People think that, you know, these auditors are going to be replaced, but these are the auditors who actually are the brain trust of the company because they know the business from left to right to left, top to bottom. Because they are the people who are looking at everything from their oil rigs to their internal financial processes to, you know, what’s happening with clean energy, all of that stuff, right? So he said, my aim and desire is to ensure that all the rote work that they do day to day filling up those audit execution forms and all of that stuff can be automated. And I want them to be focused on essentially higher, more intellectual and more, you know, domain centric work that they do.

So I asked him like, but is, doesn’t that mean that you’re going to reduce the number of auditors because a lot of that will be automated? He said, no, I want to increase the canvas of coverage that I see significantly more today. We do sample testing, etc. I want to do entirely 100% population testing. I want to be auditing things that I could not audit earlier. Not from an assurance perspective alone, but looking at, you know, where the unknowns could be coming in from. And these are the people who actually know this inside out. So why would I actually replace them? This is my brain trust of the company, right? So the way I look at it is we have this assist, augment and delegate model.

And I feel that GRC will start with assist and, or has started with assist, it’ll go into augment. But finally, the delegate model where things can be automated will take some time. As the models become more predictable, they become more smart, they have a lot of intel that comes in. But at the end, Debbie, let me also tell you that AI, it’ll be imprudent to say that GRC professionals will not be replaced by agents as an example. However, if the skill set of these professionals keeps expanding more and more into the domain areas they’re experts on, then they will not be replaced. They’ll actually do more strategic work.

Debbie Forster MBE:
And I think two main points that I love what you’re saying is on two levels, it’s pragmatic, it knows that things are going to change. So if I’m sitting here worried about my job, is AI coming from my job? If I keep the same skills, the same outlook, the same ways of working, yes, my job will be eaten by AI. However, if I or my company upskill in such a way and have that mindset that I become more and more skilled at using it for those three levels, then there will be a place for me. But I think there’s also a growth. This will also be the difference, I think between good companies and great companies because some companies are just looking at I can make efficiencies. I can make cuts, I can cut headcount, short term savings.

What I like is that we’re hearing some companies saying actually this allows me to really fine tune my workforce to do better, to do more, increase impact, reach those sorts of things. And I think in the same way that there’s going to be a dividing line for professionals, I think there’s going to be a dividing line for companies that genuinely take that long term view of how do we get better at this, not just let’s fix Q1 and cut some savings.

Gaurav Kapoor:
Very well put, Debbie. And that’s why I come back that, you know, there are many words you can put, but efficiency is one of the words. Okay. Or one of the areas that, and there’s a high intensity right now in creating efficiencies because of shareholder pressure, because of market pressures, etc. But the real companies that are going to actually make this work are people who increase the effectiveness and also the ability to predict risk better. Because if you can do that, what comes out in terms of both cost saving but also revenue accretion or growth is going to be substantially offsetting the cost reduction that you might be doing. Right. So AI and GRC is also about growth.

It’s about strategic risk management where the good companies I’m talking to right now are thinking about with all this data, can I actually take more risk in certain areas versus lesser risk? And that’s where when we started the company, that was the vision that how do you get onto the growth side versus risk being just a defensive function. And we are starting to see that with AI because the processing power, we are starting to see that as well.

Debbie Forster MBE:
I’ve looked at the positive side. There are some concerns, aren’t there, when we think about ethical considerations with AI and governance. Can you walk me through it from your perspective?

Gaurav Kapoor:
So Debbie, I think I’m going to expand that a little bit if you’re okay. One is the ethical considerations there are in the world of GRC, there’s a couple of more things. So if you look at, you know, how companies are governed, okay, there is also this whole question about answerability, about traceability, because regulators, when you build models, for example, to do something, the regulators are going to be after you to make sure that they understand how that model was built, you know, and what is the answer ability, what is the traceability? What is the, you know, what is the privacy concerns? Okay, what is the data security concerns? And it’s not just internal hygiene. Regulators in our world are going to be looking at that very carefully. So if you’re providing an audit report to the bank of England as an example, right.

A bank is providing that, they’re going to be looking at not just the audit report, because they know that things are changing. They’re going to ask about, how did you build that model, how did you come up with that answer? A lot more with high scrutiny. So governance or the ethical considerations are extremely important. And what I would say is if I break down just the ethical considerations as well, that’s where, you know, the domain expertise starts to come in very strongly. Now. Models can build it, but, you know, people who are living and breathing can start to see that, okay, there are issues here in the ethics of the information. And ethics could be biased, it could be profiling, it could be the volume of data you’re pulling in from one aspect, from the other aspect, all of that stuff, right.

So the whole balancing, and that’s where the concept of eval comes in, where the models can spit out answers. But you’ve got to ensure you have really deep understanding of the parameters that those answers are coming from. That’s going to be very deeply understood. And then you’ve got privacy, security. But one thing that most people don’t talk about, I’m going to highlight this, is the culture and the tone from the top on ethical considerations here. So if the CEO or the Chief AI Officer says that, yes, I’m looking for efficiency from this, but I’m going to be absolutely brutal about the fact that you guys are considering every aspect of ethical consideration here, then the culture is going to be very different than somebody who’s more aggressive saying that, let’s create the models and create the efficiency, if you will.

So the culture is something that sometimes miss because that translates to the whole organisation on how they’re building these models, how they’re getting these answers and how they’re validating, if that makes sense.

Debbie Forster MBE:
And that requires really leaders who truly are grappling with these concepts, not Just bolting on, not just jumping on the bandwagon of things. But I think what’s interesting and what you’re trying to do. I’m hearing more and more people talking about the leader needs to drive the why in how we use AI. But I really like what you’re talking about. It’s the culture on how are we going to be using it, what are the do’s, what are we willing to do, what are we not willing to do? And not just do a break things fast and fix them later. We have to start thinking ahead because these are going to be big issues that have huge ramifications for companies and society, aren’t they?

Gaurav Kapoor:
They are, they are. I mean, you know, there’s a whole spectrum of people that are trying to slow down AI, as you know. And we’ve seen what’s happening in fairly significant dialogues at OpenAI, at Meta, at Google, at Microsoft, where leaders are grappling with, you know, the pace of change versus what you should not be doing at all, right? And you got these civil rights groups who are also coming at it from the other side saying that this is actually creating a different kind of acceleration than we’d hoped for. But at the end of the day, I feel that this whole balancing of innovation and trust, it has to happen with a fierce force.

Debbie Forster MBE:
And I like what you said, because it’s trust, because there’s not a truth, is there? There’s not a right and wrong, it is how are we creating. And we’re seeing some great thinkers in tech starting to return to that concept of what creates trust, how do we create trust rather than just what can tech do and why wouldn’t we do that? I think it has that. Let me spin that slightly because, you know, you are in GRC, etc. But how do you govern AI when AI is actually doing the governing?

Gaurav Kapoor:
So, Debbie, the concept of governance has been there for a long time in things like model management. If you look at financial services firms, they had model management for years, right? They had models they were building, they had to validate the models and they had a centralised repository of these models that everybody had to do. Now if you go back to the core principles, right, simple first principles that we talk about, right at the end, you know, governing AI is very similar. Okay, so you still have to have. I mean, there’s a lot of shadow AI happening in the companies, there’s a lot of innovation happening in companies, but at the end of the day, if an organisation looked at it and said that, here’s my repository of where my AI models and AI work is happening.

Here’s the 10 things I have got to make sure that nothing leaks through this. And EU has come up with a very standard practise or standard act that actually defines what governance should look like, essentially. And you follow those principles, okay? It is no different from any other area of risk. The big difference is pace, the velocity, the pace of investments, of creation of shadow AI, as I call it, of IT creating new models or business creating models now, not IT, has changed dramatically. And that’s what essentially companies have to figure out how to keep the velocity and pace and the automation a lot more than the past principles that we had talked about, by the way. Cyber created the same thing.

Debbie Forster MBE:
Exactly.

Gaurav Kapoor:
And now cyber is a lot more tame. Doesn’t mean the cyber risk doesn’t exist. But people are not worried about, you know, how. It’s not the technology. Right, it’s not the technology. It’s really the, you know, the whole foundation of how you manage the principles, essentially.

Debbie Forster MBE:
And I want to come to Cyber in just a moment, but I think what you’re saying, I just find is key to so much that’s happening in AI. Insofar as, you know, we have been through innovation, we have been through significant innovation before and worked out principles on how companies can do that strategically, ethically, with governance. But as you said, it’s the speed, the velocity and I’d add the sheer scale of money going through the system right now. Tech is losing its mind sometimes because it is all of that. And it just, there’s that British phrase of keep calm and carry on. There’s just sometimes I want to say that and take just everybody take a breath. Everybody take a breath.

Gaurav Kapoor:
Yes.

Debbie Forster MBE:
And do what we know how to do. Right. Go back to first principles. I’d agree that. But cyber, oh God, we can’t have this without talking about cyber. You see this as well as I do. Supply chain attacks, third party breaches are just surging. Why? Why do you think that’s happening?

Gaurav Kapoor:
So, Debbie, I touched upon a little bit earlier that, you know, the pace of digitisation, technology disruptions that are happening across, whether it’s cryptos, regular digitisation, the whole thing that’s happening with AI, also state sponsored attacks, you know, the geopolitical world is very different. And last thing I’d say is shadow IT, okay? The need for speed has created a whole, you know, kind of new risk because everybody’s trying to create their own apps. I’m not even talking about AI here. Right. Even other things here. Right. So that’s the core kind of foundation reasons why this has happened. But I will tell you that since you mentioned more about supply chain and cyber attacks in the same breath, what has happened is the attackers have really shifted from breaching the fortress to infiltrating the ecosystem.

So the fortresses have strengthened, but the ecosystems have weakened because there’s a whole ecosystem that works. Everybody has partners, and partners have partners. Okay? And so that’s the primary thing. The dependency is very high. I’m going to just finish with an example here. You know, one of the largest payment networks in the world, they got breached a couple of years ago. You know, they are supremely focused on cyber security. They have their own cyber security products. They’ve got the best minds in the world, you know, working on the cyber security. But there was a small store Indonesia from where the attack came from. Okay. And it got compromised and it basically created a risk that could have taken down the entire financial system. They stopped it in time, but it took them time to recover. So that’s the reason. Okay. So it could come from anywhere, basically.

Debbie Forster MBE:
And this is, I think this is what we always need to think about when we’re thinking about cyber. The obvious places are shored up and they’re safe now because they’re obvious places. And for every company, we are only as strong as our weakest point. And that comes down to a little shop Indonesia, somebody that’s using a smart kettle down the corner. It is thinking through all ramifications of that rather than just, let’s keep doubling down on the front door. They’re coming in the side door, they’re coming in the back door in that respect. And that’s when we need to start looking.

Okay, so we’ve, we’ve covered all the things that can go wrong and all the things that can go right. I want to finish with back, with you as a human. What’s on the horizon that grabs your interest at the moment? It could be part of your day job or more widely, what is capturing you?

Gaurav Kapoor:
So, Debbie, this is a very interesting question because there’s so much change happening right now that you could get flustered and you could think about 10 different things, you know, not sleep at night. But if you go back to the core principle, I think the biggest thing on top of my mind is am I going to be able to and our company be able to keep pace with the product market fit that’s constantly changing, customer requirements are changing, and new Technologies are emerging, but at the end of it, the most important thing for a company to thrive and to keep innovating is to ensure that they’re very close to what the product market fit is.

What that means is tying customer needs in the spectrum of our target market and ensuring that we are ahead of the curve, we’re not lagging, we are leading them into this journey. And that’s what my time goes in. And I spend a lot of time with my customers day in and day out, just trying to understand and also helping them pattern what other organisations are doing so that we can lead them and not necessarily be led by them.

Debbie Forster MBE:
And I think part of that greatness, because Gaurav, I have to say that’s a fantastic way of seeing it. I think you’ve managed to hold on to that entrepreneur that started in the journey back India, because what you’re talking about is that start-up mentality, isn’t it? It is that product, client, user fit. It’s not what is – it’s cutting through all the noise on what is the latest innovation. What is every but just understanding a razor close understanding of what is my client, my user, my customer want or need and are we meeting that need? If you do that, it filters the noise and the direction. So again, it’s that going back to first principles, isn’t it? That is where success is going to be.

Gaurav Kapoor:
Yes.

Debbie Forster MBE:
Okay, look, we’ve been everywhere. Fascinated with how you’re going to tackle this. I love hearing from our guests. What are they reading, watching, listening to that they would recommend to us. That charge the batteries, that keep us thinking, what is it you’re reading or watching or listening to?

Gaurav Kapoor:
So, Debbie, I’m going to give you two answers. You know, the first answer is I’m really reading my inbox and it’s a storey. It’s a thriller, it’s a mystery, it’s comedic and occasionally horror. Okay, so that’s the first thing. Okay, so.

Debbie Forster MBE:
And I wish it was fiction. I wish my inbox was fiction and not non fiction, isn’t it?

Gaurav Kapoor:
Yeah, true. So that’s one. The other thing I think that I’m reading or I have gone back to reading, is an author, Nicholas Taleb, who wrote the book Black Swan and Antifragility. And I had the opportunity of actually interviewing him one of our summits where were on stage together. And a lot of the concept of antifragility is coming back. So the whole concept of antifragility is about creating simulated shocks in the system. Okay. So that when the real thing happens. Okay, you. You said it earlier, right? You said it earlier that you can’t avoid risk, you can’t avoid crisis is how you handle it. And antifragility gives a very good framework. Okay. And I’m not talking about theoretical framework.

It’s more philosophical on how to think about creating simulated shocks in the system so that when the real one comes, you’re really prepared and best prepared. So I would almost urge people to go back and, you know, at least read an excerpt of that, because that concept is 15 years old or 20 years old, but even more, you know, with all the space innovation we’re talking about.

Debbie Forster MBE:
Oh, I was going to say what must have seen right out there and just, you know, planning for the what if 15 years ago. Nowadays it’s preparing for what happens Tuesday, you know, not some dim distant future.

Gaurav Kapoor:
Exactly. Exactly.

Debbie Forster MBE:
Super. Okay, look, this has been fantastic. Thank you so much for joining us, Gaurav. Today, I really enjoyed talking to you on this episode of XTech.

Gaurav Kapoor:
Thank you, Debbie. Pleasure to talk to you. And, you know, your style and your way of questioning has been awesome. And thank you for having me here.

Debbie Forster MBE:
And thank you to all of you for joining us on this episode of XTech. If you’d like to appear as a guest on the show, don’t waste a minute. Email us now at [email protected]. I’d like to thank our whole team of tech experts at Fox Agency for making this podcast possible. I’m Debbie Foerster, and you’ve been listening to XTech.

Announcer:
Keep exploring the world of tech, subscribe to our podcast and never miss an episode. To discover more opportunities for global B2B tech brands, visit Fox Agency today.