EPISODE 262: Marketer of the Month Podcast with Toby Scales

The Big Questions!

Saksham Sharda: That sounds very recent indeed. What is the single biggest threat facing the media and entertainment industry today? 

Toby Scales: So, it is open weight models that have been obliterated. It is bad guys armed with AI that will be able to find not just open doors, but will be able to pry open doors that we thought were locked. 

Saksham Sharda: Do most executives even know that this exists? 

Toby Scales: Yes, but in media in particular, I think most media executives have other things on their mind right now, understandably. 

Saksham Sharda: What’s the scary stuff happening behind the scenes in Hollywood that regular people have no clue about? 

Toby Scales: The scary stuff happening behind the scenes, I think most people don’t realize how frequently we are actively being attacked by Chinese and Iranian and North Korean and Russian actors. So, I like to say, there’s a hot war in cyberspace. 

Saksham Sharda: Has a leak or a hack ever completely changed how a studio does business? 

Toby Scales: A leak or a hack has definitely… Yes, I would say definitely. And certainly, any leak or hack, as it should do, engenders a lot of introspection on the part of the infrastructure team. 

Saksham Sharda: What recent AI developments do you think should have gotten more attention? 

Toby Scales: The release of  ZAI’s new open weights model. It’s very close to frontier capability. The Hugging Face incident, which has gotten a fair amount of attention, but I think people haven’t read the details to understand that these agents were coordinating in a very unexpected way, and humans had no idea it was happening for way too long. Probably those. 

Saksham Sharda: What changes now that people actually understand this?

Toby Scales: Maybe we are close to a slowdown, because you have all of the frontier labs saying, “Slow down. We have to slow down.” Alignment is far from a solved problem, and I think people don’t understand how dangerous that actually is.

Saksham Sharda: How do organizations like TPN and the GCSC work together to shape the industry conversation around security? 

Toby Scales: So, the TPN and the GCSC work hand-in-hand to create a range of security best practices and security requirements across the entire supply chain, as well as allowing, creating a space for all of the participants in the supply chain to come together and share security information, vulnerability information, in a manner that keeps everyone’s businesses safe, that is legally allowed, and allows us to join forces and fight against the bad guys as a team, rather than trying to compete individually and keep the bad guys out on our own. 

Saksham Sharda: And are there moments when their priorities actually clash instead of align? 

Toby Scales: I think that there are some overlaps, but for the most part, certainly in the GCSC, what we try to do is play in the space that makes the most sense and fill in the gaps wherever we see them. And we partner very closely with TPN to make sure that we’re not duplicating efforts. I don’t think there’s any time for us to be duplicating efforts at this point. 

Saksham Sharda: As Chair of the GC-SC, where do you see that organization being able to contribute positively to the security conversation in Hollywood?  

Toby Scales: So, we just launched Collective Defense, which is an information sharing initiative from GC-SC. We launched it here at IBC and just made the announcement earlier today. And that is really our biggest contribution to the TPN’s Fix It or Risk It program, which is all about how do we start to address these security challenges in the production life cycle, because it’s only going to get worse. 

Saksham Sharda: Five years from now, then, what would success look like for the GC-SC?  

Toby Scales: Five years from now is a long time to imagine into the future. I think five years from now, if we have a, what I call a shared consciousness among the various participants in the media supply chain, where we can communicate and coordinate effectively to respond to hacking attempts, leaks, et cetera, but we’ve gotten so used to coordinating across multiple vendors because we’ve done practice, because we know what our comms plan is, we know how to respond to incidents, that will be success for GCSC. 

Saksham Sharda: What two steps can leaders take today, then, to shore up their infrastructure against AI-powered attackers? 

Toby Scales: Reduce the attack surface. So, take as many things offline as can be taken offline, meaning taking them away from having any internet exposure. Number two, I think it’s about architecting for failure and architecting in a resilient way, so that when systems do get hit and do get attacked by these AI-powered attackers, that you have a network which is able to continue to operate, or a media supply chain that is able to continue operating even while it’s under attack. 

Saksham Sharda: Is there a step people obsess over that doesn’t actually matter much? 

Toby Scales: I think right now, we talk a lot about identity and access control, and that’s because that has been how the hackers have gotten in for the past 10 years. Right now, that has flipped, and it’s actually about vulnerability management. So, in some ways, I think we’re still over-indexed on identity and access control and not paying enough attention to the vulnerability management side of the house. We’re mitigating those vulnerabilities through other controls. 

Saksham Sharda: So one could say for an entertainment brand, trust might be the entire business. How do you convince people you are the trustworthy one in a world full of fakes? 

Toby Scales: So, I think this is why we’re big supporters at Google of the C2PA, and at GCSC, we’re spinning up a C2PA working group to try to bring some of the great work that’s happening here in Europe back to the US. Because that is an area where I think Europe is actually further ahead than the US in terms of the adoption maturity of C2PA and building actual C2PA pipelines and things like that. So that to me is the way that you do it, is you have to start to expect provenance data.

Saksham Sharda: You mentioned the cyber world is holding its breath waiting for the next big shakeup after this year’s major breakthrough. What has you the most on edge right now? 

Toby Scales: So we are in this moment right now where Z AI’s open weights model, which is said to be Mythos-level capabilities, has been released. Within 48 hours, it was obliterated, meaning all of the guardrails were taken out. So, now we know that that model is in the hands of extraordinarily sophisticated, extraordinarily well-resourced cyber hacking teams in China, in North Korea, in Russia, and Iran. And we’re waiting. We’re waiting to see what happens when you arm an already sophisticated adversary with an AI that powerful. 

Saksham Sharda: So if someone wanted to seriously mince with the studio today, what would that kind of attack look like? 

Toby Scales: Oh. I’m not going to help the bad guys there. They got to figure that part out on their own.  

Saksham Sharda: All right, then. Where does this fight between Hollywood and hackers end up at five years? 

Toby Scales: Well, we have a saying in Google that we’re short-term pessimistic, long-term optimistic. We actually do believe that we can get to an era where all of the code that is in existence in the world is perfect code, error-free, no memory overruns, et cetera. So I think, particularly given the pace of change, five years is not too far out to imagine that that might be the case. And in that world, you have to also imagine that the integration and the juncture points in the media supply chain will be the targets and the last remaining sort of way for the bad guys to get in. So, best to start shoring those up now. 

Saksham Sharda: So what does your typical day at work look like? You wake up in the morning and then what? 

Toby Scales: Well, usually I bike into work on my e-bike, which I love, and have a nice breakfast in the Google office, sit down, and I’m generally in back-to-back meetings. If I’m not in back-to-back meetings, I’ll be reviewing a strategy document or, more and more, spinning up an AI agent to tackle some question that I’ve been mulling over or to do a little research for me on some topic that I need to get smart on very quickly. So yeah, something like that. 

Saksham Sharda: And what kind of talent are you looking to, is your department or your field looking to hire in today’s economy? 

Toby Scales: I think right now, anyone that is comfortable using AI tools to get their work done is in a better place than folks that are not comfortable with that. I would say that’s the, I’ll date myself, but it’s the equivalent of sort of having Microsoft Office skills 30 years ago, is having those AI skills that you’re comfortable using. 

Saksham Sharda: What’s the last question for you is of a personal kind. What would you be doing in your life if not this? 

Toby Scales: I’d be a filmmaker.

Let’s Conclude!

Saksham Sharda: Thanks, everyone for joining us for this month’s episode of Outgrow’s Marketer of the Month. That was Toby Scales, who is the Chief Information Security Officer, Media & Entertainment at Google.

Toby Scales: Great to be here. Thank you.

Saksham Sharda: Check out the website for more details and we’ll see you once again next month with another marketer of the month.