Emil Lassen says Benjamin Franklin formed the first fire brigade in Philadelphia as part of responding to fires from early electricity.
“so Benjamin Franklin, uh, formed the 1st fire brigade, uh, in Philadelphia.”
Person
Emil Lassen
1 episodes · 23 quoted claims
Lassen says Benjamin Franklin codified building codes and then developed the first mutual insurance company, the first appearance of the standards, audits and insurance flywheel.
“He started codifying building codes, uh, so that we basically took what we knew around how to build safer houses, the standards part, and then he developed the 1st mutual insurance company.”
Lassen says car safety standards such as airbags and seatbelts came from industry itself, not from government demands.
“so it was industry standards that also led us to airbags and seatbelts and some of the other things that now make cars safer.”
The Artificial Intelligence Underwriting Company audits against its standards together with third-party auditors such as Schellman and Coalfire.
“audit against those standards in collaboration with 3rd party auditors like Shellman, Coal fire, the companies who really know how to go deep and validate that the standards are actually followed.”
Lassen says AIUC works with ElevenLabs, Fin and UiPath, and that Fin was acquired by Salesforce for 3.6 billion.
“companies like Eleven Labs, companies like Fin that just got acquired for 3.6 billion by Salesforce, companies like UiPath, who've set the standards within their categories.”
Lassen says AIUC's red teaming has found cases where particular adversarial attacks raise an agent's hallucination rate.
“Sometimes it's the hallucination rate where we realize that a specific type of adversarial attack will bring up the, uh, the hallucination rate.”
AIUC has published crosswalks mapping its standard against about ten other frameworks, publicly available on its website.
“you'll find that we've done crosswalks. I think it's about ten different frameworks now that they're transparently available”
ISO published 42001, a management system certification for AI systems, roughly three years before the recording.
“ISO then, about three years ago, now published the 42001, which is the management system certification for AI systems.”
Lassen says the NIST AI Risk Management Framework and the Cloud Security Alliance AI Controls Matrix are voluntary guidance and cannot be audited against.
“The issue with both of those frameworks is that their guidance, their voluntary frameworks. You decide which controls you implement, you decide whether you like how you implement them”
Six of the 40 mandatory requirements in AIUC-1 concern red teaming, meaning testing whether technical controls hold up under pressure.
“six of the 40 mandatory requirements in AIUC-1 have to do with red teaming, actually testing that these technical controls and hold up under pressure.”
AIUC has gathered a consortium of about 250 security leaders, including CISOs at Fortune 1000 companies, to update its standard.
“we've gathered now a consortium of 250 security leaders. Some of them are CISOs at Fortune 1000 companies, some of them are security engineers, architects, GRC managers”
Lassen says AIUC-1's most recent quarterly update prioritized risks from MCP, a way for agents to connect to tools and exchange information.
“Last quarter, it was MCP risk, for example, which has really come up as agents start not just operating in isolation, but exchanging information.”
AIUC runs its certification red teaming in two rounds because the first round often turns up problems the company can fix.
“We do the red teaming in two rounds because we often do find things in the 1st round.”
Companies get roughly one to four weeks between red-team rounds to mitigate findings, depending on how serious they are.
“depending on the magnitude of the findings, your team will have between, say, one and four weeks to mitigate these things”
The final AIUC-1 audit report is between 60 and 100 pages long and is meant to help unblock enterprise deals.
“It's between 60 and 100 pages long, and it's an asset you can really unblock those enterprise deals with.”
AIUC re-runs its red-team tests every quarter, and passing them is a requirement to keep the AIUC-1 certification.
“And we do that every single quarter, and that's a requirement to maintain the certification.”
Under AIUC-1 grading, a company cannot pass if red teaming finds any P0 or P1 vulnerabilities, the two most severe levels.
“you cannot pass AC one if you have any P zero or P one vulnerabilities identified, you have to mitigate those.”
Companies that obtain an AIUC certificate gain access to buy insurance for their AI agents.
“And the companies that then obtain a certificate gets access to to buy insurance of their agents.”
Lassen says both a three-person Y Combinator startup and the publicly traded company UiPath have gone through AIUC-1 certification.
“I will mention at this point, we've had a three person Y Combinator startup go through this. We've had Ui path that is publicly traded go through this.”
Lassen says AIUC was certifying its first coding agents, including Lovable, which he expected to be certified by the time the episode aired.
“We're certifying our first coding agents right now, and we are certifying both a well lovable, which I think will be certified when this process comes, this episode comes out.”
Lassen says White Circle's monitoring and filtering tools have helped companies meet many safety requirements in AIUC-1, though AIUC does not work with White Circle.
“Their monitoring and filtering work is really good and has helped companies meet a lot of the safety requirements in our standard.”
Lassen spent four years building a Danish real estate company with four co-founders that now manages about 400 million.
“spent four years building up a real estate company that today is is managing about 400 million together with with four other co founders.”
Before joining AIUC, Lassen spent two years as a fellow at Harvard University's Kennedy School in Cambridge, Massachusetts.
“going to Cambridge, Massachusetts. So Harvard University, where I spent two years as a fellow at the Kennedy School.”