Ep. 226 – What is Actually Running Inside Your Customer’s Building? with Josh Lupresto

Josh Lupresto (00:00)
So there’s a robot dog out there patrolling somewhere in a parking lot in America right now. It’s cute. It’s got four legs, does backflips. you know, you’ve seen the videos. a police department bought it, actually. Maybe it’s out there, it’s clearing buildings before the officers walk in, doing some good stuff like that. Maybe it’s rolling around a housing complex. And every five minutes or so, quietly, it is phoning home to a little server in China. Now, this is not.

Conspiracy theory. security researchers actually documented this one. So the most popular robot dog on earth shipped with a hidden back door, a little tunnel that connects to Chinese servers the second it touches the internet. Hands over the camera feed, and it gives anyone with the key remote control. so this was found running inside networks at MIT, at Princeton, Carnegie Mellon, Congress sent a letter. The FCC just moved to ban them.

So here’s the question I want to sit on for today. Who was the advisor in the room when that thing got plugged in and said, Wait, where does the data go? Because that question right there is one of the biggest opportunities I think in front of you this year. Let’s get into it.

Welcome back to Next Level Biz Tech. I am your host, Josh Lupresto SVP of Sales Engineering at Telarus Today’s episode is titled, What is Actually Running Inside Your Customer’s Building? That is the million dollar question. So let’s talk about part one here. We alluded to it in the beginning. Let’s call it the robot dog that phones home, right? We’ve all seen these Boston Dynamics dogs, right? I really want to talk about something. It’s not really about robots, it’s not all about China.

it’s just about what it means to be a person that the customer actually trusts when this technology walking into their environment is a black box. in this case, it was a dog. So let’s start with the robot dog, for example. I I think this is a perfect example. So the company is called Unitry. This is a Chinese manufacturer and makes these genuinely impressive quadruped and some of these humanoid robots, sells them for a few thousand bucks.

Way cheaper than anything you can get you know, domestically. These things went viral. universities bought them, police departments bought them, and some ended near some defense installations on paper, an incredible deal, right? We’re we’re all excited when these new technologies come out. And then some of the researchers started looking, and what they found was kind of a nightmare. You imagine looking at that, going, no.

that that that that can’t be right. I’ve I’ve I’ve been inside of equipment and I’ve seen some of these things and I’ve watched these attacks happen real time and you go, wait a minute, this can’t actually be happening. So what they found first, it was just a backdoor, the thing that I mentioned, it’s it’s an undocumented tunnel, little service that’s baked into the firmware that then dials out to a Chinese platform in this instance, and it let a remote operator see through the robot’s cameras and take control.

So it’s got a formal critical, critical vulnerability, right? So second, a wireless exploit. this one was called Unipon. If that gets within Bluetooth range, you can root the thing and it’s wormable. What that means is one affected robot hunts down and and and immediately affects the other robots. This is kind of how botnets spread. it’s actually a self-spreading robot botnet, right? Who’d who’d have thought?

we’d be talking about that in real feel like something off of Terminator. Unfortunately, it is real and it is real right now. So third, and I’m kind of the structural side of this thing, even these things sitting here behaving normally, these units were confirmed to be transmitting telemetry back to servers in China every few minutes. So here’s the kicker. here’s the part that I think matters most for your customers. As of the latest reporting, there is no real fix. Munitree acknowledged it.

So they’re working on it. and and months later the underlying architecture was still there. So these researchers pointed out that you are stuck in a trap. To block the back door, you’d essentially have to root the robot yourself and never take another firmware update again. Isn’t that kind of defeat the purpose of some of the great technology these days, right? It’s all pushed. you know, the updates come in the cars, right? Tesla always gets the software updates, so you get the latest and greatest thing.

Because if you did take that in in in this instance specifically, if you did take that next firmware update, then it could immediately overwrite and then officially update the official update would just turn it right back on. So think about what this actually means in the real world. A device with cameras and microphones and full run of the building, you know, because people sometimes in you know

Petroleum environments or or pipeline environments. That’s kind of the point of some of these dogs, right? Sending it out, inspecting the pipes, looking for tears, looking for leaks, looking for water, all of those things that takes a person forever to do. And you can’t do 24-7 if you don’t have the staff. So you think about that. You’ve got this thing with all those cameras and and and you know, all the things we talked about. You can’t patch it. It’s sitting inside of your customer’s network. It’s not a gadget problem, right? The gadget did the gadget thing. This is a

Who in the world vetted this before it got inside of our walls problem? And most of the time, the honest answer is probably nobody.

Okay, so let’s let let’s talk about part two here. I don’t think it’s it’s it’s not just the robots, it’s kind of the whole stack got a little messy. So let’s let’s zoom out just a little bit. Cause this is where the robot dog is just kind of the most cinematic part of this problem that is now everywhere in your customers’ environments. So let’s give you a bigger one that’s kind of dominating the headlines right now. So another

another model came out in you know back to the spirit of all the different AI models. And there’s a cost race. The US does some, China does some, different countries does some do some. this summer, a Chinese company called Moonshot released, you may have heard of it, released an AI model called Kimi K3. Open weights, meaning anyone can download it for free, right? I’m a big fan of open source. I love that. anybody can download it for free, run it on their own servers, and it performs

Kind of within striking distance of these best American models at a fraction of a cost. And that’s what gets everybody. If you’ve listened to the last couple episodes, we talked about kind of that sprawling cost, right? So this landed mid-July and it genuinely rattled, you know, think about DC and Silicon Valley and all those things, right? So why does this matter to a business? I I think in part because

The price and the performance are so good that your customers, developers that aren’t thinking about this are absolutely gonna be tempted to build on it. Right? I I would, right, if I was in that shoes and and I wasn’t this super paranoid security guy that I am. I think sometimes without even anyone in leadership knowing, you’re like, I got good developers, I trust my people, they’re gonna be cost optimized and they’re gonna build cool stuff. End of story, right? not quite. So now.

Look at the whiplash that’s kind of happening above their heads. So you’ve got the US administration kind of weighing in on potential restrictions on Chinese models like Kimi and Deepseq and things like that. At the same time, you’ve got China reporting its considering its own export controls on these same models. You’ve got the Defense Department already barred from using Deep Seek themselves, one of the earlier models. So you’ve got

Companies that sell into government supply chains where the rules following the model’s origin, not where you’re running it. That is a little bit of the tricky part. So picture your customer here. Their team quietly builds a workflow on a cheap, powerful model this quarter. Next quarter, it’s restricted, or the biggest government contract now prohibits it. That’s not a tech problem anymore. That is a business continuity problem. It’s a

compliance problem and I suppose potentially a lost contract problem.

this is the pattern I want you to see. Whether it’s a robot, it’s an AI model, it’s a security camera, it’s a network switch, a solar inverter, or just some piece of free software. This this modern environment is now full of powerful, cheap, capable technology. Where the honest questions are: where does the data actually go? Who controls it?

Could this thing get banned or could it even get bricked and kind of be unusable? Is it even real? Or is it just you know, like we’ve seen, is it vaporware with some great demo?

Your customers cannot answer those questions on their own. I’m sorry, but they can’t. There’s too much going on. They do not have the time. They don’t have the the vantage point, and and the vendor selling it sure is i i is not gonna volunteer some of this bad news, right? That’s the gap. Again, the whole reason the advisor exists, right?

Okay, let’s talk part three. you’ve you’ve heard this theme a little bit? It’s talking about vaporware. Is it unsafe? Is it real? How do we know? So let me give you the let me give you the frame that I think is the the real opportunity here. Every piece of technology walking into your customer’s environment right now falls into one of three buckets. And helping them kind of sort it out, I think, is one of the most valuable things that you can do.

Okay, so bucket number one, vaporware. We mentioned this is the stuff, awesome demo, beautiful keynote, but it doesn’t actually work in production. Or the company won’t exist in 18 months because it turns out you gotta sell stuff and make money to be around. So we’re in probably the single most hype saturated moment in the history of this industry. Everything is AI powered. This mouse is AI powered. This

Whatever, this camera is AI powered. half of it is a wrapper with slick UI. That’s it. Your customer is just getting pitched ten of these a week. They probably read more of those every night, and genuinely they cannot tell the real platform from just something that’s somebody’s science project, right? you can, that is the value.

All right, bucket number two. what’s unsafe? And this is subjective to each of your customers, right? in in the earlier example, this is the robot dog. This is the Chinese model that could get restricted, whether we liked it or not. I love a low cost, but if there’s a genuine security problem here and it gets restricted, there’s not a lot we can do about it. So this is the cheap camera, phoning home. It’s the free tool that’s harvesting data.

it’s that it’s that great deal that just then you know kind of unknowingly turns into a breach or some kind of compliance violation. it works, but that’s kind of what makes it dangerous, I suppose. It’s attractive to to everybody because it’s just cheap and capable. But here, the the advisor who catches this before it’s inside the walls.

Just save the customer from a headline. They turned it into a nothing burger, right? You cannot put a price on that. And your customers need to understand that. Have them think like that and push them into this conversation.

all right. bucket number three. This is real, safe, and worth doing. Because here’s the part that I never want to lose. This is not about being the department of no. I know we as engineers sometimes get that rap. most technology is good, right? most people have a a nice positive intent. Most of it is just it’s a genuine opportunity.

The whole point of sorting out the vaporware and the unsafe stuff is just so your customer can move fast with confidence on the real things. You’re not the person that kills these projects. You’re the person who lets them say yes without lying awake at night wondering if if data’s being leaked off.

So think think about how powerful that positioning is. Every vendor your customer talks to is in exactly one bucket. It’s their own product, right? they’re paid to say, buy mine, buy mine, buy mine. You are the one, you’re the only person in this whole equation who can look across all three buckets and tell the truth. This neutrality is the single thing that a vendor can never copy.

And I think it’s probably worth more today than it’s ever been. because the environment has never been this murky, right? It is just harder and harder to tell what’s real. So let me be let me be clear about some of this opportunity, right? this is not charity, this is business. Every one of these conversations is a doorway. You come in to vet the risky thing.

You leave having kind of mapped that environment, you found three other gaps, and you become the person that they call before they buy anything. That is how a vetting conversation becomes a relationship and the relationship becomes the next five deals. I was just out with a bunch of a advisors this week and I watched this exact same thing happen. Once they understand and they the the end customer has some understanding of it, then okay, yeah, you you help me with that. You introduce this new thing. What about this other

You know, this this other thing. All right. Let’s go part four, because you know we like to leave you with some questions. let’s let’s leave you with some questions here that they kind of open the door in into kind of what we’re talking about here. So let’s make this practical because I think you can turn in you know you can turn into real conversations with some of these questions. So so jot these down. Feel free to pause, come back, however you want to do this.

So start with the inventory. Ask, do you have a full list of every connected device and every piece of AI or e every piece of software in your environment? And do you know where each one sends its data? This is kind of like, This is kinda like back in the day when we said, do you have a good backup data plan when cloud and DR and backup as a service came out? And they go, Yeah, yeah, we do. cool. Have you tested it? Did it work? well.

I like we think it will. what we think it will isn’t really a plan. So to this software in the environment question. you know, almost anybody can say yes to that or hardware in the environment. The moment they hesitate, you have found an opening because you can’t secure or trust what you can’t even see. All right. We’ve we’ve we’ve done this. What what do the kids put on the network? What are all these things with these different MAC addresses? my gosh, I didn’t even know that thing was connected. Get that thing out of here, right?

And then I think you kinda go to this, just as a natural next question set here. for the newest I asked them this. For the newest tech that you brought in this year, let’s call it the cameras, the sensors, the AI tools, the the the the robots, does anyone know or actually know who makes it and where the data lives? This is really important.

This is where you’ve got some major supply chain risk. you could in in this example we gave with Kimmy K two, there’s a major supply chain risk in there. That’s a total blind spot. If you’re not doing a a packet capture on the environment and you’re watching where this API call goes, then you have no idea that it’s going to Beijing or to w some other country or to what. It’s mind blowing. I’ve watched plenty of these packet captures and to see where that actually goes, did you know? so I think that’s a great question.

All right. And then a little bit around let’s let’s play into the hype here, just for a second. So let’s ask this. How many AI tools have your teams started using in the last six months? Yeah, that’s its own question right there. But take take part two of that. Once they give you that, it’s probably I don’t know. It’s a great place to start. But ask after that, ask, did any of them go through a real evaluation or do they just kind of show up? I think that’s so hard, right? Shadow adoption,

calling it it’s just it’s rampant with with with with all of these things that everybody can write as software now it’s just more and more powerful free tools walking in the door and nobody is checking the bucket that they belong in back to our buckets thread earlier let’s go let’s go to continuity right let’s let’s let’s let’s ask them this one if a tool that your team depends on gets banned or that vendor vanished

What would break? And do you have a plan B? So with this earlier, you know, this earlier situation with the China thing, right? If you’re putting a lot of it’s a great model, it’s sharp, it’s as good as anthropic, it’s as good as open AI. But if something weird happens that we can’t control and that model gets banned and we can’t use it, that question is it’s not hypothetical anymore. It’s real, and I think that can change maybe how the customer thinks about every purchase. Okay, so back up for a second.

Think about what all four of those questions do, right? You’re seeing a theme in this. If you’ve listened to the last few episodes, you are not selling a product. You’re just helping them in this instance see risk, maybe see some blind spots they didn’t know that they had. And the the the beautiful part in that is separating the vaporware from the unsafe, from the real, is really hard.

And it’s technical work, which is exactly the moment you don’t have to go it alone, right? We are always here to help you. So let’s talk about that a little bit. in in in one of these final parts here, right? So let’s talk about part five. You bring in some of the trust, and and and you get to that spot, we will help you obviously with with some of the additional depth. Because here’s the here’s the truth. You’re not expected to personally reverse engineer

somebody’s robot dogs firmware. If you did, I want to get you on the show and I want to talk to you because that’s cool. but you’re also not expected to audit this, I think the the Chinese model is like two trillion parameters. I think it’s crazy. That’s not your job. Your job is to spot the risk, ask the questions, and crush it and own that relationship. that deep technical vetting, okay? Always shameless plug.

you know, that that device phoning home, model compliance, all all of that stuff. Is this real? Is it vaporware? That’s exactly what our sales engineering team is here for. Okay. When a customer says, my gosh, yes, all of those things are important. We don’t know how to tackle those. And can you actually help us figure that out? Hey, that’s your cue. that’s where you can help bring in additional resources. We’ll go as you know, as as deep as that takes on security architecture.

prospective suppliers, all all of those, right? There’s always an avenue there. Just remember

You are the trusted advisor who knew to ask the question. We’re just the engineering horsepower that helps answer some of those. Together, I think that’s one that’s one thing that a a slick vendor demo and some cheap price tag cannot give the customer. It’s the truth from somebody else on the other side of the table. And that’s probably seeing a lot of these conversations, I think that’s probably part of it is.

I was just in one of these yesterday with a customer and and a TA. I just don’t think the customers always realize, wow, you you really are on our side of the table, right? Once the vendors kind of step out of the room, like let’s let’s get to the real truth of it. Okay, we’re getting to the end here. So let me bring all of what we talked about. Let me let me let me bring it home. Okay. so somewhere out there, there’s a robot dog phoning home to a

server.

On the other side of the planet, and the people who brought it have who who bought it have absolutely no idea. Clueless. Okay. That’s not a story about a robot. It’s just a story about powerful technology, it’s cheaper, it’s more available, and nobody is asking the questions before it gets plugged in because that is hard. That’s the opportunity. Not fear, it’s real, it’s the opportunity because in a world

This noisy, this fast, all the things that we’ve been talking about in the last few episodes in this podcast. The person that can walk in and help sort out the vaporware from the unsafe, from the genuinely great technologies, that y you are worth more than ever. That person is you, the advisor. So let’s help these customers. as we look ahead a little bit, just

We love watching the news and and watching the moves on these models, watching the FCC’s ban, maybe expands, goes to robots, goes to cameras, goes to inverters, who knows? and just watch how much of this AI revolution turns out to be real, and what was a demo. It’s just gonna keep getting murkier, which means you are all getting more and more valuable. I love waking up to some of this news because it just means, my gosh.

We have even more areas to help people. Okay. So this week, what’s your job? It is to pick one customer and ask the first question. Do you actually know everything that is connected in your environment and where it sends its data? And just watch their face. Look for the pause. Okay? That’s it. That’s the show for today. it look, hopefully this gave you.

One customer to go call. If it did, go do it. Okay. I am Josh Lupresto SVP of sales engineering at Telarus and this has been Next Level BizTech. We’ll see you on the next one. What’s actually running in your customers environment?

This is