How Corona Tackled AI’s Visibility Problem

When it comes to AI, one of the more prominent themes repeated in conversations with IT and cybersecurity leaders is that of visibility. Government technologists know these tools are in use and parsing through their data but seldom have a full picture of the extent of their reach.

Sanctioned CoPilot and enterprise ChatGPT or Claude tools are no surprise to IT shops, but the ones the employees choose for themselves or that are built into unsanctioned apps are a reason for concern.

In the best circumstances, these tools pose no real threat, helping draft an email or a report, but in the worst cases, they are foundational threats with access to sensitive government data sets.

In Corona, Calif., CIO Chris McMasters has been working to get ahead of — or at least catch up to — the AI onslaught with the help of Darwin AI’s Govern. The platform offers users a 360-degree view of all AI tools in use within their environment while providing insights into potential high-risk behaviors and policy compliance gaps.

“For us, it was a way to look at AI and say, how can we create an environment that is safe for people to use that technology, but also is something that users don’t have to think about a lot,” McMasters said.

In the early days of the AI craze, McMasters said many of the conversations around the technology revolved around developing the “perfect set of policies” before anyone could use it. His approach was an effort to understand who in his city was using AI at work, how often, and whether they were afraid it was coming for their jobs.

“Most people were curious, and so that was kind of our launching point to say, ‘OK, it's in the organization already, whether we like it or not, whether we have a policy or not. People are using it, and they’re going to continue to use it. So how do we embrace their inventiveness in how they’re using it, and can we harness that in some way safely, right?’” he said.

Enter Govern. The platform offers a holistic look across an organization’s environment to answer fundamental questions about what’s in use, the kind of information being shared and whether it complies with existing policies.

The city has all of the telemetry data it could ever need to sort through the applications and tools plugged into its environment; what it lacks is the staff needed to actually do that work.

“I think that every city is the same way. Yeah, I have lots of stuff, and it’s producing lots of data. It doesn’t mean I have people who have time to look at that,” McMasters said.

The Darwin platform has changed that game for McMasters’ team, giving them unprecedented visibility into the tools city staff rely on, but also the potential risk vectors they present.

For example, McMasters said the team can see when sensitive data is shared outside of policy and take corrective action to make sure it doesn’t happen again.

The security aspect is not the only area where McMasters has seen benefits. He points to licensing as another area where the platform gave him new visibility, working with the Darwin team to hone licensing cost calculations across the tools being used by various departments.

“Obviously, I don’t want to spend too much, but I want to spend the right amount. But I also want to spend it on the right things,” he said, adding that he can see which departments are power users, which tools they prefer and the like.

Darwin CEO Noam Maital sees his company as a provider of critical insights and guardrails for organizations that might otherwise never get the full picture of their increasingly AI-saturated environments.

“The problem is that right now, any software, literally any software tool that you deploy, is going to have some embedded AI in it,” Maital said. “And so it becomes kind of burdensome and unwieldy for them to even try and think about how they track that, but even more so, how do they enable it?”

While it’s undeniable that unchecked AI tools pose risks for governments of all sizes, Maital said the technology is also introducing new opportunities for smaller organizations that are used to watching their larger peers from the sidelines.

“You’re starting to see that within cities like Corona and others that they’re able to do that not on a shoestring budget, but definitely in budgets that fit their means and still get similar impact, if not better than some of the bigger cities because they’re able to be more nimble ...,” he said.