GAEA Talks

This is the first episode in our Forrester Technology and Innovation Forum series, recorded live in Austin, Texas. Over the coming months we will be sitting down with Forrester analysts and their clients at the Forums in Austin, London and New York.Graeme Scott opens the series with Alla Valente, Principal Analyst on Forrester's security and risk team, who covers governance, risk and compliance, third party risk, contract lifecycle management and, increasingly, all of the above as they collide with AI.Alla is asked the question every board is asking, which is whether AI is simply the next emerging technology. Her answer is no, and the reason is specific. With SaaS and cloud, organisations chose whether to adopt, when, where in the business and who got access. That choice no longer exists. AI is already inside your organisation whether you have a strategy for it or not. As she puts it, not having an AI strategy is a strategy. It is just not a very good one.From there she draws a distinction most organisations have not yet made. AI governance is a function. It is your policy, your charter, your process for deciding which use cases are acceptable. Governing AI is the execution of that, and it happens through compliance, risk management, security and responsible AI. Organisations reached for governance first because enterprise risk management was not mature enough to move at the speed AI demanded, and the gap between the document and the delivery is where the exposure sits.She is equally direct on third party risk. Almost nobody is building their own models. You are buying foundation models, buying data, using open source, which is also a third party. AI arrives through the ecosystem, and third party risk management in most organisations is deprioritised, federated and underfunded compared with enterprise risk.The section enterprise leaders should sit up for is contracts and concentration. Organisations are using AI to contract faster, but they have not contracted for AI. Most contracts still say nothing about model training, data access, who is responsible when there is an incident, who fixes it and what the recourse is. Her line on this is the sharpest in the episode: contracts are your AI guardrails that have teeth, and they are the only ones that do. Alongside it sits concentration risk. If your business runs on one provider's model and something makes that model unusable, how long is the disruption and how much can you absorb? Map it before the crisis, not after.

This week on GAEA Talks, Graeme Scott sits down with Aarti Samani, founder and CEO of Shreem Growth Partners and one of the leading voices on deepfake-enabled fraud and human manipulation resilience.Aarti spent over twelve years in investment banking, bringing one of the first automated algorithmic trading systems to the City of London. She moved into high growth technology and took two companies through exits, one to Microsoft and one to Medtronic, before joining a face biometric verification business where she scaled revenue twenty fold. That work put her opposite government and security customers, and it is where she started watching deepfake attacks being built in real time against systems she was helping defend. She holds an honours degree in Mathematics from Durham, teaches at MIT and Cambridge, and is a regular AI commentator for the BBC.Her argument is blunt. The cost of creating a convincing fake has collapsed, and so has the technical skill required to make one. Meanwhile the security perimeter has been built higher and higher. So attackers stopped going through the technology and started going through people, because the human line of defence is the one thing organisations never invested in.She walks through the cases in detail. The British engineering firm whose Hong Kong finance team lost twenty five million dollars after a video call on which every face was synthetic except the victim's. The UK retailers hit last summer through nothing more sophisticated than someone phoning the IT helpdesk pretending to be an employee. The Italian fashion houses who received a cloned voice note from their defence minister, timed against a real hostage story from days earlier.The idea that will stay with enterprise leaders is what she calls the trust tax. When a company has been hit, people stop responding. An email arrives from the chief executive and it takes five days, three checks and an IT ticket before anyone acts on it. That cost appears on no balance sheet and nobody is measuring it. The security KPIs all look excellent. The organisation has quietly ground to a halt.

This week on GAEA Talks, Graeme Scott sits down with Pip White, who leads Anthropic across the UK, Ireland, Israel and the Nordics.Pip did not set out for a career in technology. She started in advertising, then spent nearly fourteen years at HP across software, hardware and services, which she describes as her long-term PhD in everything technology. Leadership roles at Salesforce, Slack and Google Cloud followed, along with advisory work with scale-ups. She joined Anthropic almost exactly a year ago. She is also a mother of two teenage boys, one of whom has just finished his A levels and is working out what any of this means for the career choices ahead of him.Filmed in our London studio, this is a conversation about what AI adoption actually looks like inside large, complicated, hundred-year-old organisations, from someone who spends nearly all of her time in the room with the people making those decisions.The line at the centre of it is the one every board should hear. This is not a technology project. It does not sit in IT. It is not something a CIO can roll out the way they rolled out a SaaS platform or a cloud migration. It is a fundamental question about how an organisation works, and the companies making real progress are the ones where the chief executive has taken personal ownership of it.Pip is unusually candid about what she is hearing from customers. Chief executives are asking her whether their organisations will survive. Not whether they will save fifteen percent on a process, but whether a business that has been successful for a century remains relevant at all. That is a conversation she says she has never had before in her career.She is equally clear about what failure looks like. A million proofs of concept, all sitting inside IT, none of them going anywhere. Success looks like a single mandate from the top, in one meaningful area, that builds skills, literacy and confidence across the organisation.

This week on GAEA Talks, Graeme Scott sits down with Danny Johns of OpenWeather and The Weather Foundation, for a conversation about the part of the weather nobody measures: what it does to us.Danny joined the Met Office at nineteen as an observer and worked his way up to operational forecaster, on the bench, on shifts, producing forecasts for just about every industry you can name, from pigeon racing to hot air balloons to energy production. He became the first of what the Met Office then called Public Weather Service consultants, working with local resilience forums and first responders. He spent five months in the Falklands launching weather balloons, then moved to Vaisala and road meteorology, before joining OpenWeather and The Weather Foundation.The idea at the centre of this episode is what he calls the iceberg effect. Above the surface is severe weather, the thing that makes us notice something unusual is happening. Below the surface is everything else, the constant and mostly invisible way the weather shapes how we move, what we buy and where we go. We have spent our entire history trying to build our way out of caring about it, and we still respond to it every single day.The research he is doing with The Weather Foundation, the London School of Economics and Imperial College is starting to quantify it. Total transport volume across a city stays remarkably static in bad weather, because people do not stop travelling, they swap how they travel and where they get off. Commuters are barely weather sensitive, because the train runs and you still have to go to work. Discretionary travel is where it all shows up. And persistence matters more than peaks. A single hot day moves nothing. Three consecutive hot days, on the right days of the week, moves everything.The other half is what AI is doing to forecasting. Model resolution was twelve to eighteen kilometres when Danny started. Operationally it is now one to two kilometres. Imperial are working at one metre. That is personalised weather, a new forecast point every step you take. Which raises the question he keeps returning to: with two synoptic stations in London and 2,500 forecast points across Hyde Park alone, how would you ever know if any of it is right?

This week on GAEA Talks, Graeme Scott sits down with William Wright, an ethical hacker and offensive security specialist whose career has taken him from IT help desks to aircraft carriers, submarines and the UK nuclear deterrent. This is one of the most directly useful and quietly alarming conversations we have recorded.William started in general IT, answering phones and resetting passwords, and worked his way into infrastructure and networking for large organisations. That took him to BAE Systems, working on Ministry of Defence projects including aircraft carriers and minesweepers, then to QinetiQ working on the nuclear deterrent and submarines. He moved to NATO and was cut within a week when they let all contractors go. He landed as lead penetration tester at Unipart, was made redundant again, and decided to build his own company instead. He now runs an offensive security firm from the Hebrides in Scotland, and has just had an agentic offensive security capability accredited.His central argument is that the security landscape has split into two separate worlds. AI versus technology, where machines attack machines at speeds no human can match. And humans versus humans, where social engineering still works exactly as it always has, because people are people. AI versus humans, in his view, is not really happening yet. And that split is the most useful mental model any leader can take away from this episode.The urgent part is what vibe coding is doing. He describes an e-commerce client whose original developer-built application had flaws serious enough to let his team take over the entire company. That same team then vibe coded a replacement, and it was worse. He is now seeing finance databases published to the open web, entire company datasets pushed to public GitHub repositories, and secret keys scattered across the internet at a rate that has forced GitHub to build detection for it. He believes this is heading toward a technological crash within a few years.