Neil Serebryany came to security through a problem, not an industry. He wanted to use AI at a scale no team of people could match, and he learned early that anything you depend on is something someone else will try to break.
“if you’re using a technology, you have to assume that someone else is trying to figure out how to disrupt your use of that technology.”
Neil Serebryany, at 3:05
Neil founded CalypsoAI in September 2018 and led it as founder and chief executive until August 2024 (LinkedIn). The company described itself as “Founded in Silicon Valley in 2018,” backed by Paladin Capital Group, Lockheed Martin Ventures, Lightspeed Venture Partners, 8VC, Hakluyt Capital and Empros Capital (LinkedIn). Its platform secured the way companies use AI models at the point where people and applications talk to them, which the company called the inference layer (F5).
Jon McLachlan and Sasha Sinkevich hosted. The conversation was recorded on July 8, 2024, and aired on December 4, 2024, as episode 59, with a single paragraph of show notes. In between, Neil’s run as chief executive ended, California’s governor vetoed the frontier AI bill then before the legislature, and the EU’s AI Act came into force. In September 2025, F5 announced it would buy CalypsoAI.
This page is the rest of it: a section for each part of the conversation with the sources beside it, eleven figures, twenty clips from the tape, the full transcript, and four tools: a quiz, a scorecard for how well your AI deployments are guarded, a calculator for how fast detection work multiplies across data types and languages, and a timeline from Edison’s first power plant to F5 AI Guardrails.
Assume someone is trying to disrupt it
Jon asked the show’s first question, how Neil got into security. The answer started with AI. Neil had always been interested in what mimicking the human brain on GPUs could do for society, because a human brain’s capacity is fixed and a machine’s can be copied again and again. That interest took him to the National Geospatial-Intelligence Agency.
“And they had this mission to see and understand the world.”
Neil Serebryany, at 2:41
The NGA is a combat support agency inside the Department of Defense whose job is collecting, analyzing and distributing geospatial intelligence. It was founded in 1996 as the National Imagery and Mapping Agency, took its current name in 2003, and has its headquarters in Springfield, Virginia (Wikipedia). Neil’s LinkedIn lists a 2018 innovation role at the Department of Defense in Virginia, the year he founded CalypsoAI (LinkedIn).
As Neil put it, the entire world produces an enormous amount of data.
“they had no way to be able to analyze it at scale without leveraging AI.”
Neil Serebryany, at 2:56
Once an agency depends on AI to do that work, the AI becomes a target. That’s where security came in, and the question Neil said he started with is still the right one for any company adopting AI today.
“How do I leverage this technology in a secure way where I understand what my risks are?”
Neil Serebryany, at 3:18
Risk reduction, not perfection
Jon asked what secure AI means, since everyone brings a different idea to it. Neil started where security always starts. There’s no such thing as a perfectly secure system.
“Just like everything else in security, it’s really about risk reduction”
Neil Serebryany, at 3:51
At its most basic, he said, secure AI is the same discipline applied to a new kind of system.
“it’s really just having a system of controls and potentially technology in place to enable you to better monitor and control for AI-specific risks.”
Neil Serebryany, at 4:16
Two places to protect
Sasha pushed on that. AI still runs on infrastructure that has to be protected, and on data that has to be protected.
“the security in the AI is not different from the core concepts of the security as we know them in the existing systems.”
Sasha Sinkevich, at 4:32
So what’s new? Neil said the new protection goes in two places. The first is the model itself.
“One is on the underlying model side of the house, where you need a different set of techniques in order to be able to protect against people poisoning your data”
Neil Serebryany, at 5:15
Data poisoning means slipping bad examples into the data a model learns from, so the model learns the wrong thing. It’s one of the attack classes in adversarial machine learning, and NIST’s taxonomy of these attacks, published in January 2024, puts poisoning beside evasion and privacy attacks (NIST). Two of that report’s four authors were from Robust Intelligence, co-founded by Yaron Singer, who was our guest on episode 65.
The second place is deployment, and that’s where Neil spent most of his time. A company won’t have one model. It will have several, plus the applications and agents built on them.
“you need some way to be able to have visibility across that entire kind of potential attack surface, some way to control the kind of data ingress and egress”
Neil Serebryany, at 6:06
The last piece he named was compliance, which he expected to become an increasingly large part of the AI surface.
The regulatory footprint you already have
Sasha asked which regulations to watch. Neil’s first answer was that companies already live under AI rules, because AI runs on data and data is already regulated.
“you already have your kind of existing regulatory footprint”
Neil Serebryany, at 7:02
He named Europe’s GDPR, California’s consumer privacy law (the California Consumer Privacy Act), and the privacy rules in Canada and Japan. Then he predicted how the new rules would arrive in the US.
“In the US, it’s likely that we’re going to be legislating in the same way as we have for privacy, on a state-by-state level, before we do anything on a federal level.”
Neil Serebryany, at 7:34
He also pointed to a broader trend he called AI nationalism, with legislation in Japan, Canada, the UK, India and China.
The California bill
Sasha asked about the new California act Neil had mentioned. He didn’t name it, but the bill moving through Sacramento that summer that matches his description is SB 1047, the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act. Neil separated the companies that build foundation models from the companies that fine-tune or use them. For the builders, he listed the obligations.
“they have to effectively do kind of safety testing of these models prior to deploying them into production.”
Neil Serebryany, at 9:21
He called the testing AI red teaming, and added the ability to shut a model down and protections for whistleblowers.
“They have to have the ability to shut down their AI system, and they have to effectively have whistleblower protections in place for these foundation model companies.”
Neil Serebryany, at 9:38
The bill would have applied to models that cost more than $100 million to train, to any AI company doing business in California, and it would have required risk assessments before release along with whistleblower protections (Wikipedia). On the day we recorded, it had passed the state Senate 32 to 1 on May 21, 2024. The Assembly passed it 48 to 16 on August 28, and Governor Gavin Newsom vetoed it on September 29, 2024 (California Legislature).
California came back to the idea a year later. SB 53, the Transparency in Frontier Artificial Intelligence Act, was introduced by Senator Scott Wiener in January 2025 (Wikipedia) and approved by the governor on September 29, 2025, as Chapter 138 of the Statutes of 2025 (California Legislature). It applies mainly to the largest developers, asks them for transparency about catastrophic risks, and sets up whistleblower protections and a way to report critical safety incidents to the state (Wikipedia).
The EU AI Act, and telling people it’s AI
In Europe, Neil said, the new law sorts AI systems by risk.
“In Europe, you have the new kind of EU AI Act, and you have different sets of restrictions based on high risk, medium risk, low risk systems.”
Neil Serebryany, at 7:54
Sasha added one rule every company that ships a chatbot should know.
“one of the requirements is to disclose the fact that the user is communicating with the system that is powered by AI.”
Sasha Sinkevich, at 8:19
The Artificial Intelligence Act was proposed in April 2021, passed the European Parliament on March 13, 2024, and was approved by the EU Council on May 21, 2024. It entered into force on August 1, 2024, three weeks after we recorded, with its provisions phasing in over the following 6 to 36 months. Unacceptable-risk uses are banned, high-risk applications must meet security, transparency and quality obligations and pass conformity assessments, and limited-risk systems carry transparency duties, “ensuring users are informed that they are interacting with an AI system” (Wikipedia). That last one is the rule Sasha described.
One command footprint
Jon asked where CalypsoAI fits and what it does better than anyone else. Neil’s answer was about not knowing the future.
“We allow you to prepare for this AI future.”
Neil Serebryany, at 10:26
A company doesn’t know which model it will use going forward, which agents, or how much AI sprawl it will have across countries with different rules. What it can have is one place to watch all of it.
“you need one place to be able to have visibility across all of that AI usage”
Neil Serebryany, at 10:48
From that one place, he said, a company should be able to change out the model underneath, control which data flows into and out of its models, and block AI-specific attacks such as prompt injection, where someone hides instructions in content the model reads.
“And so we give you that command place, or that command footprint, to be able to understand what you’re doing across your AI usage, to be able to govern and secure it.”
Neil Serebryany, at 11:16
OWASP’s list of the top risks for large language model applications puts prompt injection first in its 2025 edition, defined as “when user prompts alter the LLM’s behavior or output in unintended ways” (OWASP).
Productivity is the prize
Jon asked what success looks like for CalypsoAI, as far into the future as Neil liked. Neil answered with economics. In his telling, labor productivity has stagnated in the US for a couple of decades and has been falling in the EU since COVID, and productivity is what global wealth has been built on since the post-Malthusian era, when economies broke out of the pattern Thomas Malthus described, in which population growth caught up with every gain in output.
“it’s really been based on labor productivity, much more so than like the determinants of land.”
Neil Serebryany, at 12:19
AI is a technology that can raise productivity, so the goal is to let companies use any vendor and any model while keeping control over all of it.
“success for us is really enabling as much AI adoption as possible”
Neil Serebryany, at 13:01
Sasha came back to the point later in the episode, saying US productivity levels are the lowest since the Second World War, and that AI could help people get through daily work faster and with more accuracy. The Bureau of Labor Statistics publishes the official US productivity measures if you’d like to check the trend yourself (BLS).
Process change first
Sasha asked about the biggest pain point for a company trying to adopt AI, while granting there’s no such thing as an average company. Neil gave a non-technical answer and a technical one. The non-technical one came first.
“the non-technical answer is really process change inside of this organization.”
Neil Serebryany, at 13:55
To get the full benefit of AI, he said, and “most organizations are not there today,” a company has to rethink what jobs and processes look like, knowing an AI system will only do part of any one job. The technical answer was to be clear about which use cases come first, and to be able to swap or modernize the infrastructure underneath as AI keeps changing. That’s the same argument our own Art and Zen of Adopting AI makes about where AI’s value gets lost.
Three layers
Jon laid out the market as he saw it in 2024. At the bottom, a few big companies build the core models, because it takes a lot of resources. In the middle, task-specific companies build services on top of those models, things like code completion and little helper coaches. At the top sits the rest of the economy, traditional companies such as Toyota, food companies and agricultural companies that consume those services. Where does CalypsoAI fit?
Neil’s answer was the two layers that use models, not the one that builds them. Protecting the foundation models themselves, he said,
“is not really going to exist at scale, and is not a space that necessarily needs companies like ours.”
Neil Serebryany, at 17:13
Most of the need for security, as he saw it, comes from organizations fine-tuning or using models that already exist.
Invention and innovation
Neil tied that choice to an old argument about where the money in a new technology goes.
“most of the economic reward of any new technology really comes from innovation associated with that technology, rather than the kind of general invention of the technology in the first place.”
Neil Serebryany, at 17:55
Jon asked him to explain the difference for listeners. Neil cast himself, for a moment, as the inventor of electric light.
“The invention of light in and of itself is incredibly valuable, of course, but the innovations related to that, from actually being able to produce light at scale, to the energy that’s necessary in order to be able to power that”
Neil Serebryany, at 18:33
The history fits. Historians Robert Friedel and Paul Israel list inventors of incandescent lamps who came before Joseph Swan and Thomas Edison, and Edison bought the rights to one earlier patent in 1879 (Wikipedia). What changed daily life was the system around the bulb. Edison’s Pearl Street Station in Manhattan started generating electricity on September 4, 1882, serving 400 lamps for 82 customers, and by 1884 it served 508 customers with 10,164 lamps (Wikipedia).
For AI security, Neil’s version of that lesson is that the value, and the risk, show up where companies put models to work.
The right data, not more data
Sasha asked about data tagging. Companies have an abundance of data and don’t always know which data sets matter for the work AI could do. Neil didn’t think more data was the answer.
“It’s much more of a question of what is the right type of data relative to the example or the use case that you have”
Neil Serebryany, at 20:22
He saw room for data aggregators who can pull a broader set of data for one industry or use case. He also saw an opening, and a warning, for consulting firms working out their place as newer models improve.
“the value of traditional consulting, to some degree, declines”
Neil Serebryany, at 21:02
The scanner wars
Sasha asked where the industry was heading on data protection, from models that leak data to the controls around them. Neil started with where it had been.
“we were really in the, what I would describe as, scanner wars for the last period of time.”
Neil Serebryany, at 22:07
The scanners were machine learning models trained to spot one kind of thing: personally identifiable information (PII), payment card data of the kind the PCI DSS standard protects, or prompt injection attacks. Vendors curated data sets, built scanners, and competed over who had more of them. Neil said the problem was twofold. First, it never ended, because there were always more data types, more geographies to cover and more attacks. Second was what he called the language problem.
“Most AI-specific attacks, particularly those that target language, are possible not just in English, but in other languages as well.”
Neil Serebryany, at 23:00
“And everyone’s scanners really were English-centric.”
Neil Serebryany, at 23:09
OWASP lists the same weakness among its 2025 prompt injection scenarios, a “Multilingual/Obfuscated Attack” in which an attacker “uses multiple languages or encodes malicious instructions” to get past filters (OWASP). The calculator below shows how fast one detector per type per language adds up.
The scanner to rule them all
CalypsoAI’s answer was to use a language model as the scanner.
“what we came out with was the first LLM-powered scanner, the scanner to rule them all”
Neil Serebryany, at 23:13
Because a language model reads many languages, one scanner could be pointed at a new data type or threat, in any jurisdiction, with a single request. Neil’s example was a data type outside the usual English-language set.
“covering Japanese driver’s license data types with a single kind of line or request to your model.”
Neil Serebryany, at 23:33
Where was everyone going next? Agents.
“it’s really within the kind of agentic AI space.”
Neil Serebryany, at 23:49
By March 2025 CalypsoAI’s platform had three parts, Inference Red-Team for finding weaknesses with agentic testing, Inference Defend for blocking threats and protecting data in real time, and Inference Observe for visibility and compliance oversight (F5). When F5 announced the acquisition, it said CalypsoAI’s red teaming tested against more than 10,000 new attack prompts each month (F5). Today calypsoai.com leads to F5 AI Guardrails, which F5 says “secures AI models and agents against malicious threats, prompt injection, data leakage” (F5).
Crossing the chasm
Jon asked for the best day of the founder journey. Neil picked the first large-scale production customer.
“we finally felt like we crossed that chasm”
Neil Serebryany, at 24:35
In enterprise sales, he said, that day stands on many others.
“by the time you actually make it into a large-scale production release at a major kind of Fortune 500-style company, it’s a day that, by implication, has had many previous days that have needed to go right.”
Neil Serebryany, at 24:59
Jon asked whether he’d recommend the book. Crossing the Chasm is Geoffrey A. Moore’s 1991 book about the adoption gap between early adopters and the mainstream market (Wikipedia). Neil’s answer went to another classic of startup reading.
“Clayton Christensen is one of those authors that pretty much everyone in startup land is probably familiar with.”
Neil Serebryany, at 25:21
Clayton Christensen wrote The Innovator’s Dilemma, first published in 1997 (Wikipedia). Neil’s own recommendation was Technological Revolutions and Financial Capital, Carlota Perez’s 2002 book on how technology revolutions and financial bubbles shape the economy (Wikipedia).
The Defense Department first
Jon asked who that first customer was.
“It was actually the Department of Defense.”
Neil Serebryany, at 29:57
Jon guessed it must have been an uphill battle. Neil talked about what it gave the company instead.
“one of the biggest advantages of working with customers like that is how they put you through your paces”
Neil Serebryany, at 30:07
The company kept that footing. By 2025 it described its platform as trusted by Fortune 500 companies and national security agencies (F5). Palantir, a partner since November 2023, became a customer in June 2024 and built CalypsoAI’s security features into its AI platform (F5).
The contract that didn’t come in
Jon asked the converse question, the most challenging day. Neil went back to a stretch before AI was a topic everyone talked about, when the company was between two changes and counting on one deal.
“we had been expecting this really large contract that was really going to make the company, and it didn’t end up coming in.”
Neil Serebryany, at 30:44
Jon asked whether the customer ever said no, or whether the team was dragged through the mud until it had to admit the deal wasn’t happening. “Correct,” Neil said. Sasha said days like that test a founder’s character, and that companies that persist and keep delivering value tend to come through. Jon put it in one line.
“It’s not a failure unless you give up.”
Jon McLachlan, at 31:56
Don’t build for one shiny customer
Sasha asked what was hardest about closing large institutions that care about data, and whether CalypsoAI had to change the product, for example to run on premises. Neil’s answer was a lesson about focus.
“to not orient yourself towards an individual specific customer, no matter how shiny that customer is”
Neil Serebryany, at 32:33
The temptation is real, he said, because a big customer’s money is hard to turn down early on.
“that kind of incremental ARR boost during your perhaps early days looks really appealing and really shiny”
Neil Serebryany, at 32:52
ARR is annual recurring revenue. If that revenue takes the company off course from its broader mission, Neil said, it isn’t worth doing. Sasha framed it as weighing benefit against cost, especially early on, and Jon added that the same goes for investors, who bring their own expectations, and that he’d seen investors out of line with a founder’s vision in a few companies in past lives.
Who buys AI security
Sasha asked what an average CalypsoAI customer looks like and what problem brings them in.
“the average customer for us is a really large institution”
Neil Serebryany, at 33:55
They leaned toward technology, financial services and insurance at the time, though the company sold across many verticals. The buyer usually came from the security side of the organization, and the problem was concrete. A team was deploying AI as a chatbot, an agent or an application.
“we need a system to be able to help secure that deployment.”
Neil Serebryany, at 34:33
Sasha asked whether they came to secure the whole application or the integrity of the model. Neil said it was the exposure, a model put in front of users through an application, an agent or a direct connection, inside or outside the company.
“we need to be able to have visibility and guardrails over the usage of that application or that agent or that kind of access point into the model.”
Neil Serebryany, at 35:17
Four reinsurers
Jon asked whether CalypsoAI worked with cyber insurers, so that customers who reduce their AI risk could get a better rate. Neil said it was an area the company had thought about, and pointed to how concentrated the insurance world is.
“how much of the world’s risk is really reinsured by four companies”
Neil Serebryany, at 36:26
He named Munich Re, Swiss Re, SCOR and Hannover Re, and said the policies of any one of them flow downstream to the primary carriers that sell insurance to companies. Munich Re is the world’s largest reinsurer and Hannover Re the third-largest reinsurance group, Swiss Re was founded in Zürich in 1863, and SCOR, based in France, is one of the leading reinsurers in the world. That was Neil’s point. When a reinsurer changes how it prices a risk, the change reaches the carriers downstream.
Managers of AI agents
Sasha asked how AI will change culture, society and the way people work day to day. Neil expected the short- to medium-term change to be in how jobs are designed, starting from what AI does well.
“AI systems are really good today at data synthesis”
Neil Serebryany, at 26:46
“we are going to have increased AI system human teaming”
Neil Serebryany, at 26:58
His example was a business analyst who uses several AI agents for parts of the work and supervises how it comes together. Further out, he doubted the usual story about a post-AGI future, and bet that the extra resources AI brings would help people reach Mars on a similar timeline.
“a species that exists on multiple planets, or a multi-planetary species.”
Neil Serebryany, at 29:20
Jon brought it back to the office.
“it sounded almost like everyone with a white-collar job could be promoted to manager. And then what you’re managing is you’re managing your AI minions.”
Jon McLachlan, at 29:31
Beyond token prediction
Jon asked what advice Neil would give his younger self.
“be confident in your own abilities and steadfast in your own convictions.”
Neil Serebryany, at 37:28
Then Sasha asked what tool Neil would build with unlimited time. Neil’s answer started with the limits of today’s models. As the AI safety debates go on, he said, it looks increasingly likely that today’s transformer models won’t be the ones that get there.
“rather than just doing word prediction, you’re going to need models that have the ability to actually interpret the world around them”
Neil Serebryany, at 38:22
Models like that would open new work, he said. One area is cross-cultural understanding, where psychology research finds that conformist and individualistic societies lead to very different results. Another is security, because a model that understands, rather than predicts, changes what securing it means. A third is the future of work itself.
Sasha saw a chance for AI to repair communication between people and across borders, after years that, in Sasha’s view, had broken a lot of it. Jon pictured a backseat-driver AI that could see the road and say turn left here, watch out for the pedestrian. Sasha closed on trust.
“this is where we as a user of the system have to trust the system that it does the right thing.”
Sasha Sinkevich, at 40:42
What happened after the tape
When we recorded. The conversation was recorded on July 8, 2024, and aired on December 4, 2024. The episode title calls Neil founder and CEO. His LinkedIn shows his time as chief executive ending in August 2024, a month after the recording, and still lists him as CalypsoAI’s founder (LinkedIn). Three weeks after the recording, CalypsoAI announced an integration with IBM’s watsonx.ai (F5).
The laws Neil described. The EU AI Act came into force on August 1, 2024 (Wikipedia). California’s SB 1047 was vetoed on September 29, 2024, and SB 53 became law a year later to the day (California Legislature).
The taxonomy. NIST published a new edition of its adversarial machine learning taxonomy on March 24, 2025, with authors from Cisco, the UK AI Security Institute and the US AI Safety Institute (NIST).
The company. By 2025, CalypsoAI’s chief executive was Donnchadh Casey, it had raised more than $40 million, and it had been a top-two finalist in the RSAC 2025 Innovation Sandbox contest and one of Fast Company’s Most Innovative Companies in AI for 2025 (F5). It signed resellers and partners in South Korea, the UK and Turkey (F5, F5, F5).
F5. On September 11, 2025, F5 announced it would acquire CalypsoAI, “a private company with major operations in Dublin, Ireland,” for $180 million, financed mostly with cash. F5 said the platform brought “real-time threat defense, red teaming at scale, and data security” (F5). At the end of the month, CalypsoAI said it had joined.
💡 The next chapter begins ✨
CalypsoAI (@calypsoai) · September 29, 2025
We have officially joined @F5 and are taking our mission to make #AI secure for every enterprise to the next level.
Proud of what we’ve built since 2018 - and excited for what’s ahead. Follow @F5 to stay with us on the journey.
#AISecurity #GenAI
Today calypsoai.com leads to F5 AI Guardrails, and the company’s LinkedIn page reads “Acquired by F5” (LinkedIn).
Neil. Since January 2025, Neil’s LinkedIn lists him as the founder of Hyperion Horizons Group, and since 2024 as a venture partner at Flex Capital (LinkedIn).
The part of the conversation that aged best is the plainest. A company can’t secure AI it can’t see, and it can’t see AI it hasn’t listed, model by model, agent by agent and language by language.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each question, then check your score.
-
Where did Neil spend time before CalypsoAI, on the problem that led him to AI security?
- The National Security Agency
- The National Geospatial-Intelligence Agency
- A university research lab
b. "I ended up spending some time at the National Geospatial-Intelligence Agency." Transcript, 2:36.
-
What did Neil say security for AI is really about?
- Risk reduction
- Reaching perfect security
- Passing an audit
a. "it's really about risk reduction" Transcript, 3:53.
-
Where did Neil say AI needs new kinds of protection?
- Only at the network edge
- Only in employee training
- On the model side and on the deployment side
c. "the protection really needs to come in one of two places." Transcript, 5:11.
-
What was the language problem with the first AI scanners?
- They only worked on source code
- They were built for English
- They needed a human translator
b. "And everyone's scanners really were English-centric." Transcript, 23:09.
-
Who was CalypsoAI's first customer?
- A large bank
- An insurance company
- The Department of Defense
c. "It was actually the Department of Defense." Transcript, 29:57.
-
How many companies did Neil say reinsure much of the world's risk?
- Four
- Ten
- Two
a. "how much of the world's risk is really reinsured by four companies" Transcript, 36:26.
Are your AI deployments guarded?
Eight questions for a company that runs AI in front of its users or its staff, drawn from what Neil, Sasha and Jon covered. Each one links the part of the episode it comes from.
Scorecard · eight questions
Are your AI deployments guarded?
Answer for every model, agent and AI application your company runs today. If two answers fit, pick the lower one.
-
Can you list every model, agent and AI application your company runs, and who owns each one?
- No
- Roughly
- Yes, with an owner for each
"you need one place to be able to have visibility across all of that AI usage" See One command footprint.
-
Do you control what data goes into your models and what comes out?
- No
- For some deployments
- Yes, for every deployment
"some way to control the kind of data ingress and egress" See Two places to protect.
-
Do your prompt injection and data checks work in every language your users write in?
- English only
- Some languages
- Every language we serve
"And everyone's scanners really were English-centric." See The scanner wars.
-
Do you red team each AI system before it goes into production?
- Never
- Once, at launch
- Before launch and after every major change
"they have to effectively do kind of safety testing of these models prior to deploying them into production." See The California bill.
-
Could you swap the model under an application without rebuilding its controls?
- No
- With some rework
- Yes
"the ability to be able to change out the underlying part of your AI stack that you're using" See One command footprint.
-
Do you know which AI rules apply in each place you operate?
- No
- For our home market
- Yes, for each jurisdiction
"different sets of restrictions based on high risk, medium risk, low risk systems." See The EU AI Act, and telling people it's AI.
-
Do people know when they're talking to an AI system?
- No
- Sometimes
- Always, it's labeled
"one of the requirements is to disclose the fact that the user is communicating with the system that is powered by AI." See The EU AI Act, and telling people it's AI.
-
Does your security team own the security of your AI deployments?
- Nobody does
- It's shared, and unclear
- Yes, with a named owner
"They're often someone that has or comes from the security part of the organization." See Who buys AI security.
Your AI is running without much watching it. List every model, agent and AI application with an owner, then put a check on the data going in and out of the busiest one.
Some deployments are covered and some aren't. Test in every language your users write in, red team before launch, and map the rules where you operate.
You can see and steer your AI use. Keep it that way as models change, retest after every major change, and keep telling people when they're talking to AI.
How many scanners would you need?
How fast detection work multiplies when every data type and every attack needs its own detector in every language, next to the number of instructions one multilingual scanner would need. Change the numbers to your own.
Calculator
How many scanners would you need?
Four estimates: how many data types you need to catch, how many attack types you need to block, how many languages your users write in, and the hours a year it takes to keep one detector current.
One detector per type per language means 90 detectors and 3,600 h of upkeep every year, about 1.8 full-time people. Written once as instructions to a multilingual scanner, the same coverage is 15 instructions.
This is the arithmetic behind the two problems Neil described in The scanner wars, not a benchmark, and the defaults are examples rather than measurements, so put in your own counts. CalypsoAI, now part of F5, sold the single-scanner approach. Whichever way you go, test each language you rely on before you trust a scanner with it.
From Pearl Street to F5 AI Guardrails
Everything on this page sits on one timeline, from Edison’s first power plant to CalypsoAI’s place inside F5. Filter it by thread.
Timeline · 1879 to 2026
From Pearl Street to F5 AI Guardrails
Filter by thread. Dates are from the public record except where marked as part of this show.
- A lamp patent
Edison buys the rights to an earlier incandescent lamp patent (Wikipedia, on this show).
- Pearl Street
Edison's first commercial power plant starts generating, with 400 lamps for 82 customers (Wikipedia, on this show).
- Crossing the Chasm
Geoffrey A. Moore's book on the gap between early adopters and the mainstream (Wikipedia, on this show).
- NIMA
The National Imagery and Mapping Agency is founded, renamed the National Geospatial-Intelligence Agency in 2003 (Wikipedia, on this show).
- The Innovator's Dilemma
Clayton Christensen's book on how new technologies cause great firms to fail (Wikipedia, on this show).
- Technological revolutions
Carlota Perez's book on technology waves and financial bubbles, Neil's pick (Wikipedia, on this show).
- Defense innovation
Neil works in innovation at the Department of Defense in Virginia (LinkedIn, on this show).
- CalypsoAI
Neil founds the company and leads it as chief executive (LinkedIn).
- Palantir partnership
The partnership with Palantir begins (F5).
- NIST's taxonomy
NIST publishes its taxonomy of adversarial machine learning attacks, poisoning included (NIST, on this show).
- SB 1047
California's frontier AI bill is introduced (California Legislature, on this show).
- The AI Act passes
The European Parliament adopts the AI Act (Wikipedia, on this show).
- One day, two votes
SB 1047 passes California's Senate 32 to 1, and the EU Council approves the AI Act (California Legislature, Wikipedia).
- Palantir
Palantir becomes a customer and builds CalypsoAI's security features into its AI platform (F5).
- Recorded
Neil, Jon and Sasha record the episode (on this show).
- IBM watsonx
CalypsoAI announces an integration with IBM's watsonx.ai (F5).
- In force
The EU AI Act enters into force, with its rules phasing in over 6 to 36 months (Wikipedia).
- Founder
Neil's time as chief executive ends, and he stays on as founder (LinkedIn).
- Veto
Governor Gavin Newsom vetoes SB 1047 (California Legislature, on this show).
- Episode 59
The episode airs (transcript).
- Hyperion Horizons
Neil founds Hyperion Horizons Group (LinkedIn).
- Red-Team, Defend, Observe
CalypsoAI's platform now has three parts, sold in South Korea through CloudShift (F5, on this show).
- NIST updates
A new edition of the adversarial machine learning taxonomy (NIST).
- RSAC 2025
CalypsoAI wraps a week at the conference where it was a top-two finalist in the Innovation Sandbox (X, F5).
- F5
F5 announces it will acquire CalypsoAI for $180 million (F5).
- Joined F5
CalypsoAI says it has officially joined F5 (X).
- SB 53
California's frontier AI transparency law is approved, a year to the day after the veto (California Legislature, on this show).
- F5 AI Guardrails
calypsoai.com leads to F5's AI Guardrails product (F5).
What to do this week
Five things, in the order Neil’s argument suggests.
- List every model, agent and AI application you run. Give each one an owner and note which data it touches. The scorecard above shows where else you stand.
- Put a check on the data going in and out. Start with the deployment that handles your most sensitive data, and keep a record of what it sees.
- Test in every language your users write in. Prompt injection and data checks that only work in English miss everything else. Run the calculator to see how fast one-detector-per-language coverage grows.
- Red team before launch, and again after every major change. Keep the report, and write down how many attempts and which techniques it covered.
- Map the rules where you operate, and tell people when they’re talking to AI. The EU AI Act’s transparency duty is the easiest one to meet. If you’d like help testing your AI product, our AI red teaming team can help, and you can book 15 minutes with us.