Enterprise Content and AI Security

You can’t talk to a business customer today without AI coming up. While most people seem to have embraced the power of public generative AI tools like OpenAI’s ChatGPT or Google’s Gemini, there’s a lot of hesitation when it comes to using generative AI on enterprise content. The one concern that comes up again and again? 

Security.

Rightfully so. Public AI tools don’t have to worry about security. They’re gobbling up all the data on the public internet with the motto: “Train first, worry about intellectual property rights later.” Technically, nothing is stopping them from doing that, and their models are fed by scrapers and crawlers that grab everything they can find.

In an enterprise, however, that doesn’t work. Enterprise data is privileged, confidential, and subject to privacy laws. The data cannot be shared with everyone, and AI models must respect that. It means two users must receive different answers to the same question, depending on the data they’re authorized to access.

The problem is, if your content isn’t well secured and governed in the first place, AI will expose those holes quickly. You may have been able to hide some data behind cryptic file names, but that won’t stop the AI models. Having solid data governance with granular, clean permissions is imperative. Otherwise, it’s “bad security in, bad security out,” to paraphrase Fuechsel’s Law ("garbage in, garbage out").

It also means you need to bring AI tools to your content rather than trying to bring your content to the AI tools. It’s hard enough to secure your content in the first place, and the idea of copying a snapshot into a separate container for AI would obliterate any of that security.

Don’t expect public AI vendors like OpenAI, Google, Anthropic, Meta, or DeepSeek to solve this problem. Enterprise content is a different animal—one they neither understand nor care to understand. None of these vendors has any enterprise DNA. Security is not their concern, and their models aren’t built with the assumption that data access should vary by user.

To illustrate this point, let me remind you of what happened with enterprise search. Web search, which we all use many times a day, is based on an index created by crawlers that scour the internet to deliver the best content match for your keywords—the same results for everyone. That’s what Google does in simplest terms. But in the enterprise, that approach doesn’t work. Enter enterprise search.

About 20 years ago, Google—the heavyweight search champion—entered the enterprise search space with a bright yellow, rack-mounted Google Search Appliance, drawing a lot of attention with its promise that managing content wasn’t necessary: "Wherever it is, you can find it with Google". Or something like that.

It sounded great—except it didn’t work. Google eventually discontinued the product after a decade of trying. Interestingly, other major players in enterprise search met similar fates. There was FAST, which Microsoft acquired in 2008—only to discover a year later that FAST had been cooking the books. And then there was Autonomy, which HP acquired in 2011, only to eventually sue the CEO and CFO for—you guessed it—cooking the books. The Hollywood-worthy Autonomy saga ended with the CFO in jail and the CEO dying in a freak boating accident. (I described that story in more detail last year in “Mike Lynch, Autonomy, and Incredible Coincidences”.)

Today, search is provided by the companies that own the data. Enterprise search is hard, and usually, only the company that built the repository has a chance of doing it well. On the web, Google finds content that wants to be found—literally. Millions of companies spend billions of dollars each year on SEO to make their content easily discoverable. And there’s no security to worry about.

Enterprise content is different. It’s not optimized for search engines, and security is not optional. This is hard to get right. Eventually, the open-source Apache Lucene solved the problem well enough, and that’s what many enterprise applications use today. Still, you rarely hear anyone say, “Wow, this search is amazing”—because it doesn't match Google’s web search, which sets the expectations bar.

Now, let’s come back to AI. The vector databases at the heart of enterprise AI models must respect data security, just like search indexes do. That’s incredibly difficult for anyone other than the companies that hold the data. Only they understand the data structures, the users, and their permissions. For any external application, sure, it’s possible, but it's really hard to make that work. If you don’t believe me, think back to enterprise search.

AI in the context of enterprise data will be extremely valuable, with the potential to dramatically boost productivity—whether it’s through assistants, agents, or whatever comes next. But in an enterprise, the first rule will always be: respect the data’s security. 

And that makes it hard.

Subscription Fatigue and the Need for Meta-Subscriptions

There is a lot of talk about subscription fatigue today. As more and more companies provide streaming video and high-value content as a subscription, consumers are being asked to subscribe to more and more content sources.  

Just look at streaming – most consumers subscribe to Netflix, Hulu, Amazon Prime, Disney+, and HBOmax. You may also consider subscribing to FuboTV, SlingTV, or YouTubeTV and the TV networks with Peacock, CBS, and ESPN+.  Or perhaps you like NBA League Pass, NHL.TV, NFL Game Pass, the Tennis Channel, the Golf Channel, or DAZN. There are now hundreds of providers offering interesting content and you can’t subscribe to them all.  

Herein lies the problem. We want to consume the content and are willing to pay for it, but the way it is packaged today makes it impossible to access it all. That's what’s really behind the subscription fatigue. Consumers are getting increasingly frustrated with subscription offerings that don’t give them what they want. What’s missing are meta-subscription services that would offer an aggregation of content from across the different content providers.  

The same is true for news publishers – you can’t possibly subscribe to all the publications to read the articles that your like-minded friends share with you on social media. Again, what’s missing is a meta-subscription that you could subscribe to, perhaps based on a particular area of interest. 

The meta-subscription idea is not new. We have them already for music: Spotify, Amazon Music, Apple Music – those are all meta-subscriptions that allow you to listen to any music, no matter which label has created them. The meta-subscription provider takes over the complexity of the industry so that the consumers don’t have to subscribe to each label individually. So why has it worked for music and yet it seems to be so difficult for news and video?

  

The main reason is the complexity of distribution rights common in film, TV, and print and the distribution rights have been enabled by the dependence on language. 

Music has very low dependence on language. There’s classic which doesn’t use lyrics at all and there is opera that is nowadays always produced in the original language (and trust me, sometimes it’s funny to listen to Americans at the San Francisco Opera singing Janacek in Czech). Rock, pop, and other modern music rely on lyrics more, but the kids in Germany and Italy are listening to songs in English just like the kids in California. 

Singing erases even accents within the same language. U2 are from Ireland, Sia from Australia, Lorde from New Zealand, Ed Sheeran from England, and Ariana Grande from Florida, and yet most audiences can’t tell their accents when they sing. And while Americans hardly ever listen to non-English music, French, Italian, Spanish, and German audiences are much more accustomed to hearing each other's songs. It’s relatively rare that a music act would change their language for commercial purposes (The Scorpions and Celine Dion come to mind, but that’s been a while ago). Language doesn’t matter that much for music. 

Not so in film, TV, and publishing. Books are always being translated, often into many languages. Magazines get translated and often localized. The Runner’s World Magazine, for example, is published in 18 countries. Movies are usually dubbed or at least sub-titled when distributed aboard. While British accents are currently very chic in the US, most English-native actors have to learn to speak with an American accent if they want to make it in Hollywood (think of Nicole Kidman, Russell Crowe, Charlize Theron, etc.). Similarly, Arnold Schwarzenegger's strong Austrian accent wasn’t acceptable for German audiences and his roles had to be dubbed by a German actor Thomas Danneberg. Language is a big deal for film, TV, and print. 

All this language complexity somewhat increases the cost of the content production, but it gives producers a very effective way of enforcing distribution rights for each country. Those distribution rights have been increasing the profits but they are also making it really hard for anyone to create a meta-subscription for content. Spotify had to negotiate contracts with all the labels to make music available and that wasn’t easy. But a Spotify for films would have to negotiate with every studio for every country. 

Yes, there are distribution barriers in the music world. There are occasionally a few famous hold-outs such as the Beatles and Taylor Swift in the past. Don’t expect to find every German, Italian or French song from your US account. But those barriers seem more a function of supply-and-demand dynamics than deliberate limitations. 

What the audiences want are meta-subscriptions. The current trend where every studio is creating their subscription service is completely unsustainable. If you are a sports fan, you can’t possibly be happy having to sign up for ESPN+, the NHL, the NFL, Formula 1, the Tennis Channel, and yet not be able to watch the Olympics because the IOC signed a deal with NBC. It makes no sense. 

Similarly, the Internet and social media make it easy to share articles about your areas of interest but you can’t possibly subscribe to all the newspapers and magazines that your friends are sharing with you. I wrote recently about how frustrating that experience is becoming on social media. Again, what you want are meta-subscriptions that allow you to sign up for any article on your chosen set of topics, no matter where they are published.   

Without meta-subscriptions, consumers will be becoming very frustrated with the complexity of accessing their content of choice. Subscription fatigue is one of the results – people will cancel subscriptions that are not giving them what they want. Because what they want are meta-subscriptions. 

After all, it works pretty well for music! 

 

Is It Time to Revive Knowledge Management?

This blog post has been originally posted on the Big Men on Content blog:

Back in the 90s, Knowledge Management was being heralded as one of the best use cases for content management. The goal of Knowledge Management was to effectively capture and reuse an organization’s knowledge. That’s a lofty goal and it’s not a surprise that most Knowledge Management failed miserably.

There were many cultural, organizational, and process reasons for the failures of Knowledge Management but one of the main reasons was the technology.  Back in the 90s, the technology to capture, manipulate, share, and reuse content was still in its infancy. In fact, most vendors indirectly admitted as much when they stopped marketing Knowledge Management as one of their offerings.

But the customers haven’t given up on it.

In fact, I keep running into customers and prospects with “Knowledge Management” on their business cards. And, rightfully so! There are some major demographic related issues that drive the demand for Knowledge Management.

Many customers I meet face the problem of an aging workforce. According to the Bureau of Labor Statics, there are numerous industries with a median workforce age over 50. I’ve seen organizations with an average workforce age over 55. In fact, the Stanford Center on Longevity predicts that by the year 2020, the 55+ years old workers will represent 25% of the workforce!

This is a workforce that is not Internet natives. They are not millennials. They didn’t grow up digital. A lot of their knowledge and expertise is not in a corporate repository. It is in the decades of notes stored on paper and in their heads. In a few years, those employees will retire and their knowledge will leave the organization. Often, this knowledge is mission critical and it has to be captured, processed, shared, and reused.

Does that sound familiar?

Yes, that’s exactly what Knowledge Management is supposed to be all about. Knowledge Management is needed more than ever before and, finally, the technology has advanced mightily since the 90s. Today, our ability to capture information in the form of paper, voice, images, drawings, video, and other content is very powerful. So is our ability to ingest, index, and manipulate the content. We have structured and unstructured data analytics which help to make sense of all that information. Finally, we have compelling responsive experience, mobile devices, and cloud environments that help us share and consume the information effectively.

Knowledge Management is needed and increasingly, Knowledge Management is possible. Maybe, it’s time to start promoting Knowledge Management again. Because this time, it might actually work.

The Need for Content Curation

This blog post has been originally published on the Big Men on Content blog. 

Most content libraries start great. You pick a repository, populate it with some initial content, include decent metadata, establish ways for people to add more content, set some expiration policies, and voilà – you have your sales library, your marketing assets library, or your library of product information.

The library is easy to use and navigate. It was built by a small group of people who had a clear, shared concept of how to organize it. The users can find what they need and everybody is happy. We have another content management success story under our belt!

Now, let’s fast-forward a few months. People are regularly contributing additional artifacts to the library and the library’s growing. The team that has built the library has moved on to build something else. But that’s OK; they have done their work. The library is still well organized and everyone can find what they need, when they need it. This is content management at its best. Everybody is still happy.

A couple of years later, the library has grown substantially. Nobody really remembers the original structure or how content was to be stored, tagged, and classified. People are saving artifacts based on their view of the structure and everyone has a different view. Nobody has time to add proper metadata to content assets – most content is stored without metadata or with “lazy” metadata. The original project team has had the foresight to set default expiration rules for content but when content assets come up for review, there is no time for it and everything is being kept without ever deleting anything.

The library is no longer well organized. Nobody can easily navigate it and every search yields pages and pages of results. Hardly anyone is happy with the library. The library is now seen as this dreaded place where content goes to die. The users need something better to be productive. They need something simple, easy to navigate, not this bloated repository full of junk. The business blames IT and IT blames the vendor.

Eventually, they decide to build a new library…

What has gone wrong? Well, it wasn’t the content management system, no matter which vendor you chose. It was the process. More precisely, it was the lack of process. The library was built without a content curation process in place. Curation would ensure that somebody decides what to keep in the library and what not. Curation would also ensure that every new artifact is added the right way – in the right location and with the right metadata. Curation would also ensure that the structure, rules, metadata, and policies are evolving to keep up with the changing requirements of the organization.

Some of the curation processes can be automated and some of them may require manual work. But without curation, a successful content management deployment can quickly become a digital landfill.

If Scotland votes ‘Yes’ to independence in the referendum, what will happen to our data?

The following article originally appeared in the IT Pro Portal on September 18, 2014:

Scotland goes to the polls today to vote on independence from the Union. If a ‘Yes’ vote is passed, it will throw into question the massive issue of data sovereignty.

It’s a curious notion, and one that both Whitehall and Holyrood have not publicly answered. If we consider the consequences from a data protection perspective, they are incredibly complex. Especially as the EU Data Protection Directive mandates that data cannot be transferred outside of the 28-member states territory. This means that organisations need to prove where their data is at all times. Scotland, as part of the UK, is presently an EU member but this could quickly change, as only last night the Telegraph reported that Spain’s European Foreign Affairs Minister said that a separate Scotland would need to wait five years for EU membership and join the single currency.

The next wave of EU data protection reforms will introduce further enforcements around information crossing borders. The fact that the majority of business communications are digital by nature – such as email and productivity tools like Microsoft Word and Excel – and are effectively borderless, these carry more problems for data sovereignty compliance. When these reforms were first suggested last year, the Direct Marketing Association said it was ‘”strict and unworkable” and claimed that it would cost UK businesses an eye-watering £47 billion in lost sales and regulatory costs.

Today your data may be based in the UK, but tomorrow, will it be in England or Scotland? The key is allowing companies from either country to pick where they want their data to live and guarantee that it resides there.

A ‘Yes’ vote will mean that the data will have to be migrated. But to where at this stage can only be speculated. What we do know is that for companies that want to move their data from Scotland to England, capacity and power availability within the Greater London M25 belt will be under extreme pressure. If Scottish data needs to head north, then perhaps the challenge isn’t quite so unwieldy. Scotland’s climate is well-suited for cooling power-hungry server farms. It boasts a thriving data centre economy, with substantial investment pumped into the hundreds across the country, with some areas even building new locally-generated renewable energy-based data centres, which are expected to go online next year. Scotland’s digital sector is worth around £3 billion to the economy and boasts over 73,000 jobs. For a population of just over five million, it’s certainly a healthy industry.

The nationalist campaigners suggest they could transfer Scotland’s data from Whitehall systems by 2018, but this is likely to result in considerable disruption to public services, not to mention commercial implications for organisations that own or host from data centres based there. Over time, these issues will have to be remedied. The result will be that data sovereignty will become a board issue and part of future business and legal operations as principle. But this is not necessarily a bad thing.

The recent spotlight on data sovereignty originates from the much-reported WikiLeaks and Snowden affairs and the US’ National Security Agency spying revelations. These stories have created such a wake that, according to ResearchNow, a quarter of UK companies are now expected to pull their data out of US data centres. Protecting the integrity of data is definitely at the top of the corporate agenda and it requires sovereignty and security embedded by design.

If Scotland does separate form the UK and takes a while to decide how it wants to pursue its membership with the EU, it will mean that all data housed in Scotland from another country’s origin would need to move inside the EU. An alternative is that a provision could be made for its own data protection regulation but this would need to be written and ratified – a pretty costly and complicated exercise, never mind the process of data migration.

Given that both England and Scotland speak the same language means that the information doesn’t need to be translated, but that also makes it more difficult to separate Scottish data from English data. The challenge will be organising and sorting through Petabytes of data and establishing whether it originates from England or Scotland. There are obvious clues, such as place names and cultural references, that will help with labelling but in reality this particular job is for humans who unfortunately are inherently unreliable when it comes to organising information. Auto-classification tools on the other hand typically deliver 80–90 per cent accuracy, as opposed to human classification, that on average results in 60 per cent of information being properly classified.

For the whole of the United Kingdom to adhere to data protection laws and deal with the sovereignty of data requires a strategic view when it comes to managing enterprise information. As far as Scottish, Welsh and English borders are concerned, the task of migrating so much information will be a tremendous undertaking. Let’s hope we don’t get to that stage.

Call to Arms: Bring Down the Tyranny of Excessive Copyrights!

E. Delacroix: Liberty leading the People

I am re-reading Lawrence Lessig’s book Free Culture which I consider one of the best business books of all times. Professor Lessig very eloquently explains the idiosyncrasy and – yes – idiocy of the current copyright laws. This is an area of great interest to me as it directly impacts the use of content which is what I do for a living. I also feel very strongly about the freedom of speech, uncensored culture, free enterprise, and consumer rights. And all those things are being mangled by the current copyrights and content distribution rights.

The book isn’t old but it was published in 2004 which was the pre-Facebook era. Reading the book in the times of social media has put the copyright problems discussed in the book into a new perspective. In short, social media adds a new dimension to the copyright problems today. Let me give you an example.

The LEGO Group, the Danish toy powerhouse, is very interested in having their users share their ideas about how to build various toys out of their blocks. The users are kids and kids have no idea about copyrights. Kids want to build spaceships and structures that they draw upon from popular culture that they are exposed to. Star Wars and Star Trek are a big hit in the popular culture of 6-10 year old boys and so they build Star Wars and Star Trek space ships and characters made from the Lego blocks. So far so good.

Lego encourages its users (remember they are kids) to share their creations via digital models and pictures on their social media site MyLego Network. Lego is of course keenly interested in this kind of engagement since it indirectly stimulates brand loyalty, usage and incremental purchases of their products. But here comes the conundrum.

Lego has signed an agreement with Lucasfilm Ltd. and so discussions about Star Wars space ships and characters are licensed use of copyrighted material. In fact, Lego sells a galore of toys under the Star Wars brand and everybody is happy. But, as far as I know, Lego does not have any agreement with CBS Studios which owns the copyrights for Star Trek. That means that when my son posts a picture of his rendition of Luke Skywalker’s Starfighter in the Lego network, it is perfectly legal.

However, if he posts a picture of his take on Starship Enterprise, he technically violates the CBC copyrights for non-authorized creation and distribution of derivative work. Yes, the copyrights today no longer allow free creation of derivative work based on copyrighted material. And in fact, Lego can be held liable if the picture is shared on a community they sponsor because they effectively profit from it. 

Well, I say, this is nonsense. Like it or not, dear Lucasfilm and CBS, your work is part of our cultural heritage and as such, the use of cultural good has to be accessible to people and serve as source of learning, inspiration, and criticism. I agree that the creator of content should get paid and I agree that a copyright should protect the creation for a reasonable time. But 95 years [basically indefinite] is not a reasonable time - patents are being granted for max 20 years! I also know that the Internet has made it easier for your content to be distributed without a payment. But the excessively paranoid copyright protection you and the rest of Big Media have put in place is not only becoming absurd, it is damaging our culture.

It is a great privilege to become part of any culture. Almost all authors wish they would make it. Most of them create – at least initially – for idealistic reasons such as inspiration or the need to share a story. They don’t start with the need to protect their copyrights. That comes when the money becomes a topic - a topic that you, Big Media, introduce to the artists. You have used your position of strength to make Congress modify the copyright laws to serve your profits and not the interest of the society which the copyrights were originally created for. And you did it out of denial and fear because the world around you has evolved. 

The new technology is threatening your old business models and you have enacted laws that deprecate and ignore that technology. Today, you are the dinosaurs and if you don’t evolve you might become extinct. If you produce content, you need to be part of the culture with everything that distinction carries with it. You have to adapt to the environmental changes and embrace the technology because if you don’t, WE WILL do it for you.

We, the People, have now a new weapon that didn’t exist a few years ago. A weapon that has proven to be so powerful that it can not only put the most powerful man in the world into his office but also overthrow dictators who lost the touch with their people. That weapon is social media – Facebook and Twitter and YouTube and Slideshare. And this weapon will soon be aimed at you, Big Media. Millions of people around the world will organize, coordinate, and speak out jointly their will to overthrow the laws that so conveniently protect you.

The copyright and distribution laws have been enacted out of your position of strength because until now, it was you - multi-billion dollar corporations - against the little man. Soon, it will be you against the will of the People. And People have the power to change the laws or even the lawmakers if they are unhappy. No amount of lobby dollars will help you stem this revolution. Don’t wait for that to happen because there is no country of exile for overthrown Big Media dictators.