Aaron Philipp, founder of VisibleARC and former partner at Ernst & Young, brings decades of cybersecurity and graph expertise to the challenge of implementing agentic AI in an enterprise security context. His company uses diffusion models to create synthetic network environments—in factories, hospitals, IoT systems—that serve as sophisticated decoys for large multinationals and government organizations.

I first met Aaron when both of us were at PwC in the 2010s. Aaron back then was a director in the firm’s cybersecurity practice. He was using innovative, large scale graph database technology for analytics back then. 

To this day, Aaron’s still using graphs in creative ways in the solutions he designs. In this episode, he notes that while large language models (LLMs) operate in Euclidean space—discrete, linear, and grid-oriented—cybersecurity threats exist in non-Euclidean problem spaces. Graph structures naturally capture network architectures, risk pools, and threat patterns in ways transformers cannot. 

During the interview, Aaron notes that 91% of enterprise AI deployments fail. The primary culprit isn’t the technology itself, but an inadequate data foundation. 

Aaron’s diagnosis here is that companies lack proper data strategies, process understanding, and the overall data maturity necessary to harness the power of generative and agentic AI. He draws parallels to the big data era of the 2010s and the typical data lake as data swamp, noting that without structure, “if you throw a RAG system at a SharePoint site with unstructured documents, you’ve created a hallucination machine.”

Interestingly, Aaron points out that organizations that invested in robotic process automation (RPA) will likely be surprisingly well-positioned for agentic AI. Even if RPA implementations were “failures” in terms of automation goals, the process documentation and organizational understanding gained provide critical context that can accelerate AI agent deployment and significantly reduce costs.

So many insights like these in the interview that follows. Hope you enjoy it.

Edited Transcript

Alan Morrison: Hey everybody, it’s Alan Morrison with another episode of the GraphRAG Curator podcast. I’m delighted to have Aaron Philipp with us today. Aaron is someone I’ve known from my PwC days. Back then he was a director in the cybersecurity consulting practice and a sharp guy when it comes to graphs and, nowadays, agents and how to take advantage of emerging technologies. 

Aaron has a fantastic background. He was a partner at Ernst & Young, and lately he’s launched a new venture as founder of VisibleARC, which helps with decoys and harnesses the power of generative AI in constructing those decoys. Aaron, welcome.

Aaron Philipp: Thank you for having me. It’s great to be here, and congrats on all the success with the podcast, my friend.

Alan Morrison: Thank you. I’m going to be tapping your brain today. For those who don’t know you, tell us about your background and how you got into this field.

Aaron Philipp: I’ve been a computer scientist my entire life. Starting way back, I did some novel fractal cryptography work when I was young. I studied computer science at the University of Texas, where I intersected with the very end of Dijkstra’s [i.e., Edsger W. Dijkstra, a Turing award winner who taught at UT Austin] career—he was obviously formative in graph theory. 

That’s where I was first introduced to graph theory, and I’ve carried that through my entire career. I’ve written a few books in my domain expertise of cybersecurity—on computer forensics and hacker techniques. I’ve run large global practices. When you and I first met at PwC, I was building out platforms that would do large-scale security analytics. We partnered with Google and Palantir, focusing on how to use scale and apply graphs to solve interesting problems. From there I went to EY, and now I’m at VisibleARC. 

As you mentioned, we’re using diffusion models not to create new images, but to create synthetic networks on the fly—factories, IoT systems, OT systems, hospitals, any bespoke environment. We’ve also developed custom ICs, small edge devices where we miniaturize the diffusion model to run at the edge as mini pods of deception for data sovereignty and regional needs.

Alan Morrison: You mentioned edge computing. What kind of customers are you talking to right now?

Aaron Philipp: It’s mainly large multinationals and governmental organizations. Whenever you talk about deception, there’s always governmental interest. We’re focused on organizations that already have fairly mature security models and have data sovereignty issues with distributed sites. 

That’s where the tool shines because it feeds back into their instrumentation, allowing them to better understand what’s coming next—the tactics, tools, and processes the adversary may use. Unfortunately, the target isn’t SMB-type companies. It may move into a managed service at some point as an information collection platform for threat intelligence, but right now it’s focused on more mature customers.

Alan Morrison: When you’re talking with customers, I know one of the services you offer is maturity assessment. What process do you use to evaluate their maturity and see if there’s a fit?

Aaron Philipp: There’s the standard Capability Maturity Model—the CMMC—which is the meat and potatoes assessment. You’re looking for fairly high scores on that. But we also look at risk profiles—organizations that have a higher targeted profile than typical, either because of where they do business, what they make, or where they’re positioned in the industry.

Alan Morrison: When you talk to execs at those companies, what are they thinking about most? What pain points are they bringing to you?

Aaron Philipp: Everyone’s head is spinning right now regarding AI. It’s important to note that 91% of AI deployments have failed in the enterprise environment. Right now, every major corporation is going through an optimization play, trying to do more with less. They’re making big bets that AI will allow them to do that, but they don’t fully have a construct for ensuring they’re part of the 9% rather than the 91%. 

From my perspective, you and I started talking during the big data hype wave [during the mid-2010s], and the rules are exactly the same now as they were then: have your fundamentals in place, understand your data strategy, understand your business deeply and structurally, then move forward with these initiatives so you can bear fruit. 

Otherwise, back then if you just built a data lake, congratulations—you had a data lake you couldn’t fish in. Now, if you throw a RAG system at a SharePoint site that has unstructured documents, congratulations—you’ve created a hallucination machine that will pump out whatever it wants.

Alan Morrison: The SharePoint example is interesting because so many companies have abandoned SharePoint sites or struggle with search.How do you help clients get beyond that struggle?

Aaron Philipp: This isn’t new. I remember 15 years ago we were dropping Google search appliances in the enterprise because those were going to be the key—we’d have Google tech inside our walls. But that didn’t really work. These things aren’t panaceas. 

At the end of the day, the transformer, the LLM system, is a statistical inference machine. It’s going to infer in response to whatever you give it. If you don’t give it structure, it will make best guesses based on whatever bits happen to be flipping that day. 

The hardware—and this is tricky because it doesn’t hit marketing material since it’s boring and expensive with a long cycle—but it’s the hygiene. It’s putting together the actual structure: what does our organization do, how do we do it? 

Companies that went through RPA [robotic process automation] and were successful with it are actually well positioned because they have a process understanding that no agent is going to give you. The tech’s not there yet. 

Companies like Microsoft, Nvidia, and Palantir are pushing hard to automate some of that ontology generation, but as it stands today, I’d guess the majority of those 91% failures occur because the organizational understanding isn’t there as a prerequisite.

Alan Morrison: RPA is an interesting example. I read your blog post about that. We went through the RPA hype—I was still at PwC when that started. All the banks were interested, talking about reducing headcount. For those unfamiliar with RPA, it’s a very rule-based orientation with bots, a pretty rigid approach to task automation that can be brittle. But as you point out, there’s detail in that RPA code that you can mine for context. Is that true?

Aaron Philipp: Absolutely. Not only that, but the exercise of building that brittle code and making it work, even if it only worked 80% of the time—that’s organizational insight and understanding that will have a multiplicative effect when you take that into agentic AI. 

The AI isn’t as brilliant—it can round those corners out a bit, but it still needs someone to point it in the right direction. Even if RPA promised big things at the top of the hype cycle and was a “failure” from an implementation standpoint in hitting those goals, it put the organization way ahead in understanding what’s happening inside its four walls. That’s a massive leap forward.

 Anytime you’re doing agentic AI within the organization, you need to look back at your RPA rolodex and ask, “Was this something we looked at? Were these processes we examined?” That will be a massive accelerator and cost saver going forward.

Alan Morrison: Are there other sources that come to mind? RPA is obviously a rich one, but what other sources are you helping companies tap for the context needed to drive an agentic approach?

Aaron Philipp: I think it splits into two structures or frameworks. On one side, you have the automation side where agentic AI fulfills the promise RPA made 10 years ago. On the other side is the knowledge side. It’s useful to structurally separate these because one is a knowledge management problem and the other is an organizational process optimization problem. 

For agentic AI to work at scale inside the organization, you need both. But that doesn’t mean you can’t run it in very targeted, high-need areas—whether you’re operating in a region where you don’t have talent, can’t hire or bring talent in, or face data sovereignty laws. Those small-scope tasks are perfect because it’s a scoped problem set with a small data set that solves a massive need. 

Go after those problems first versus trying to reorient customer service, for example. That’s going to be a heavy lift. You’ll need an organization that wants to replace people because they’ve already got everything else finely tuned. 

For the rest, you’ll have AI hallucinating back to customers, security issues, broken processes, the AI getting jailbroken with someone giving the wrong prompt—suddenly it gives a $20,000 refund. These things happen if you don’t have structure. 

There’s nothing stopping a human from giving a $20,000 refund today either, other than process. For those bigger oceans, start with small, high-need stuff first. Prove you can make it work in the organization and truly understand the friction cost and how much process re-engineering, process understanding, data re-engineering, or data mining you’ll need to do.

Alan Morrison: Thinking about a Big Four firm with RPA experience—in EY’s case, they have a good KM shop with a knowledgehub where they have much more reuse of documents. It seems you have the opportunity to tap these sources and bring them together for the agentic AI problem. Would it help to think about a use case? Is there an example where someone’s just starting this process but has the maturity and capability?

Aaron Philipp: Let’s take the consulting angle. The amount of time that goes into getting things into PowerPoints and refining them—not just the strategic viewpoint, but the actual pixel-level adjustments. 

Where I see these things playing out—I’ll give you two examples. One is those types of tasks. I think we’re just starting to scratch the surface of what generative AI can do to solve those problems, where you give it an outline and it gives you back the ideal PowerPoint with graphics and everything else. I think that’s going to be huge. You’re seeing this now in web frontend development. The “vibe coding” stuff is an interesting offshoot going after that segment hard because frontend is difficult. 

Frontend developers are few and far between, and people want something to create a pretty frontend for what they do. Whether startups or corporations, they’re pouring huge amounts of money into tokens for frontend work that they wouldn’t for other development tasks, because even though it’s not perfect, it’s pretty good and gets you there. I think for organizations, it’s going to be those types of things where you’re spending an inordinate amount of time dealing with it—like consulting firms and PowerPoints. 

It’s silly to have someone billing at $250 an hour to format a PowerPoint. That’s unsustainable and has to change. Similarly, having startups with good ideas held back because they don’t have the best brand is problematic. By stepping into that gap and giving—if you look at full-stack developers, they kind of stop at the reactive frontend side. They can do it, but that’s still a bit of voodoo. Having something that plugs that gap is enormously helpful, a huge accelerator, and a scoped task. 

You can draw it out in Figma or on paper, put the picture in, and it gets reasonably close, then you refine from there. I know these aren’t huge groundbreaking, “we need to change our entire process system,” but they’re proofs of concept. They’re fairly low risk and show really interesting results.

Alan Morrison: Thinking back to what I know about this, when I interviewed Adam Kimball earlier this year—Adam’s a deep technologist like you—he said, “Yeah, I’m using Gen AI a lot and it’s really helping me in my work.”

Aaron Philipp: I’m the same. Just to be clear, I very rarely write code that’s not AI-assisted at this point.

Alan Morrison: Right. But you have the awareness that helps you ascertain what to ask for and what’s right or wrong. 

Contrast that with someone who’s a novice or just out of school—they don’t have your experience and insights into what constitutes good code. In the case of a good PowerPoint, the people hassling with PowerPoints most, spending the most time on it—would they help you most in getting an agent up and running? Might those people think they’re in threat of losing their jobs by teaching the agents?

Aaron Philipp: It’s unsustainable. You can’t continue to ask people to pay $5,000 to $10,000 to format a PowerPoint. That’s not right. 

From an ethics standpoint, I’d argue—and I think it’s the right argument—that if you’re billing someone out at that rate, you’re billing them because they bring something special to the table. They should spend their time building out that special capability, not on PowerPoints. Now, the unethical side is, “Well, we’ll just cut them and make more profit.” I don’t think—I mean, that’s a decision for each company to make. I lean more towards building people up, but I understand both sides.

Alan Morrison: The point I was trying to get to is you need to match the capability to the talent. You have talented people whose capability you want to unleash. In the data management space, people spend 80% of their time just cleaning up data. You want to tackle that problem for them so you can use them for more important things than data cleanup.

Aaron Philipp: The challenge—and this is non-obvious, something I learned from the big data stuff—is that some people really like cleaning up data. When you say, “Hey, I need you to move aside,” they say, “No, I just want to focus on getting the data in the ETL. That’s what I want to do.” 

That was weird to me. I’d ask, “Why don’t you just build a clustering algorithm or something?” And they’d say, “No, that sounds intimidating. I’ll just stay here.” So there’s organizational change you have to do to get that whipped around. But that’s an organizational change problem, not an “AI is costing us jobs” problem.

Alan Morrison: That raises a good question. You’ve been in and around so many different things, and organizational change always takes longer than adopting a technology. Let’s say you have a certain level of maturity and can adopt the technology at hand, but you know there are nagging organizational problems that will burden whatever innovation the company wants to aspire to with AI. Is there a way to think about organizational change differently now with this new technology, or is it still the same approach to improving the pace of change?

Aaron Philipp: I don’t think it’s the technology necessarily driving a change in mindset. I’d say the lack of free money is changing the mindset. 

There was a time when interest rates were low and debt was basically free—companies didn’t have incentive to shift out of the muck they were in. 

Now, with all the downward pressure, you can use that as the cudgel and say, “Look, AI is going to get you there, but only if you change these things about how you work.” It’s a balance—you can’t have the prerequisite to AI cost be so prohibitive that they just ignore it or don’t do it. You have to find ways to go in with a scalpel and say, “Do these four or five things, and your chance of success goes from 30% to 80%.” 

It’s a confluence of events more than any technology shift. Companies are just trying to figure out how to keep things moving right now.

Alan Morrison: At the same time, it seems the security space has gotten more challenging because vulnerabilities are increasing exponentially. Am I looking at it correctly from the outside, or how are you interpreting this?

Aaron Philipp: Yes. There’s a real issue right now. The keyword in security is tools rationalization. At big conferences, they’re talking about AI and tools rationalization. Organizations have bought 70, 100, 200, 300, 400 solutions to go after the cybersecurity problem. Each has its own inertia, dashboards, and often its own tooling. 

You have a one-two punch where the threat itself is shifting—we’re starting to see true AI-based attacks with implications around speed and scale—while organizations have incrementally pieced tools together over the past 15 years without an integration strategy. 

They kind of dump it all into a Splunk-type apparatus or some SIEM. Right now they’re finding themselves stuck, asking, “Where do I cut cost? How do I reallocate capital? How do I defend against all this new stuff when I’ve got all this legacy stuff?” We’re probably in year one of a three- or four-year cycle where you’ll see a lot of movement back to platforms and, interestingly, open ecosystems in the security space.

Alan Morrison: When you and I first met, we were talking about security and graphs, and you were building big graphs. Can you tell us specifically how graphs are going to help with the circumstance you just described?

Aaron Philipp: This is something the semantic web and semantic graph people have been fighting for 20 or 30 years. If you look at AI as it stands today, all the LLMs and transformers operate on what’s known as—I don’t want to get too mathematical, but I’ll dive down and come back up—Euclidean space. It’s very discrete, grid-oriented, linear—you can predict what’s going to happen next. 

Graph structures, network infrastructures, network architectures, network threats are inherently non-Euclidean problems, and the graph is extraordinarily well-structured to deal with that non-Euclidean problem set. Yes, you have 40,000 endpoints, but there are two doing the majority of communication. 

Being able to understand where that risk pool sits—not just from a technology standpoint, but from business and geopolitical standpoints—the combination of network graphs and semantic graphs are real accelerators in understanding that problem set.

At VisibleARC, we use a diffusion model that operates on graphs—the same models that generate images and songs. We didn’t go with an LLM because it simply cannot comprehend and statistically understand the structure of a network the way you can capture it in a graph. 

There’s information capture, structure capture, and normalization that occurs in a way that can’t occur otherwise. You can do it a bit with an adjacency matrix or sparse matrix, but the graph is the most natural, cleanest way to represent that data set. That data set permeates throughout all security, computer networks, and architecture. 

For me, it was a natural progression to look at graphs. As it turned out, that wasn’t where the industry was, although it seems to be rotating there slowly over the past 10 years.

Alan Morrison: So it’s a similar situation in security as exists across the enterprise with enterprise software in general—graphs are useful, but underutilized, and there’s a focus on application-centric approaches to security that could be improved with visibility at the data layer through graphs.

Aaron Philipp: Correct. The industry challenge right now is to give up on the concept of any one vendor owning that graph. That graph needs to be open to the entire enterprise and all tools across it. Otherwise, you end up in another walled garden situation where you’re stuck in somebody else’s ecosystem. From an industry standpoint, that’s a real challenge we continue to fight.

Alan Morrison: Companies have been investing in cloud services for almost 20 years now. When I was talking to security people at the firm you and I were with, they’d say, “We’ve got duplicate tool sets—the bespoke stuff we were used to using and the off-the-shelf stuff from the cloud service provider that seems to do many of the same things.” 

You have to rationalize your tool chain. But the cloud service provider is essentially a walled garden in terms of ultimate security goals. Some companies are quite concerned about security for good reason. How are they approaching this?

Aaron Philipp: There are two fundamental approaches. The first is to drag all their legacy tools up into the cloud, virtualize them, and run them that way—essentially using the cloud as another data center. There are issues with that around transformation and modernization. If you’re just using the cloud to run VMs, why not just run in a data center? 

But the cloud providers aren’t making it easy. The other side is dealing with it as two separate worlds—the on-prem stuff and the cloud stuff. If you look at Amazon’s Fargate or—a good friend runs Microsoft Azure Container Apps—there are tools they’re building that allow you to move workloads from on-prem to off-prem and back, shifting things transparently.

They’re trying to blur those lines, but there’s not a good solution. This goes back to the issue with 70 to 100-plus tools—many are bespoke things that cloud providers (assuming you’re at a single cloud, not multicloud) are providing as telemetry. All of that to say, there are attempts to go after that problem, but the ones having the most success are treating them as two different environments and dealing with the tool complexity of monitoring and managing them separately.

Alan Morrison: There’s a book called Software Wasteland that one of my mentors wrote back in the 2010s. He unpacked this whole issue of complexity and how problematic it was becoming—overwhelming in terms of budget absorption by underutilized applications, custom development that’s orders of magnitude more expensive than it needs to be. 

In the case of governments spending too much on IT, the book talked about Healthcare.gov as a poster child, and HealthSherpa as an example of how you could develop a clean running app for much less. 

This complexity issue continues to loom, and we keep pushing it down the road. Is it going to become a huge security issue because of agentic AI? What are your thoughts?

Aaron Philipp: It’s already a huge security issue even without agentic AI. The trust that exists across substrates between these different silos—once you get one silo, you get all of them. That structure is deeply problematic. 

I think we’ve been asking people to altruistically solve this problem for the past 15 years, and the message that’s come back has been “no.” 

Altruism isn’t going to be the driving function anymore—it’s going to be budget cuts. It’s going to be really interesting as those budgets get cut. Does that become the forcing function where people just bet on AI, or does it actually become a forcing function to simplify and tighten up the environment?

Alan Morrison: I’m tempted to think, “Let’s just have a tabula rasa—clear the slate and start over” because there’s so much confusion, old legacy architecture blended with new stuff that needs to be unleashed to solve these problems.

Aaron Philipp: That’s what we were arguing for ten years ago with the cloud—this is the clean slate, the clean table. Before you move things to the cloud, transform them, modernize them, clean them up, then put them up there. And everyone was like, “Cool, I’m going to get my antivirus working in the cloud.” It was a missed window. 

We keep having these opportunities. I hope it has to be a cost forcing function first, where there’s some externality driving this, because if we just ask people to do it because it’s good hygiene, I don’t think they have the bandwidth—they’re dealing with everyday problems. They’re not looking at how to completely fundamentally transform their security infrastructure.

Alan Morrison: What’s happening in terms of your planning for 2026? Where’s your company, VisibleARC, headed?

Aaron Philipp: I think the two keys for 2026 in security are going to be modernization, cost rationalization, and how to actually implement and bring in AI to help with that. 

The issue with AI for 2026 is that people are realizing the data problem is much harder than they initially gave it credit for. I spent the past two years building out the model and proving it works. I think there are two things going forward. 

One is how we pivot from a luxury nice-to-have for the top of the industry to something that can enable upskilling of talent, enable some novel defense techniques against new threats that don’t have a defense today, or help save the organization money by collapsing other tool sets. 

Going into 2026, the focus is how we not just have this cool AI that does this interesting thing—building synthetic environments—but how we fit that into the ecosystem that exists today. How do we not just get the top five customers, but make it relevant for security organizations and part of their transformation and modernization story?

Alan Morrison: When it comes to security, who do you follow? Who are you reading?

Aaron Philipp: I follow quite a few people. It’s funny—I check in with Brian Krebs and security domain experts, but I’d say I’m much more focused on three things:

One, what’s happening geopolitically, understanding the give and take there, because that ultimately drives security—that’s where the biggest threats emerge. 

Two, understanding what the regulatory environment is going to look like, which plays a huge role. I’m focusing not just on the US side but the EU, countries like Malaysia and Singapore that have really strict data laws, because those are going to drive a lot of decisions made in business-level AI over the next year. 

Lastly, what’s actually happening in the broader AI ecosystem outside of image, text, and music generators. Even agentic process AI is a text-generating AI at the end of the day. What’s happening outside of that to help see around corners and see where there might be gaps that could be filled. You have to translate it down a couple layers. 

Looking at the geopolitical, regulatory, and frontier AI environments isn’t exactly the way to have someone write a check for you, but you have to realize there’s a three- to six-month lag between when they start writing about that and when you can actually commercialize it. It’s better to be up front about that and prepare for it rather than trying to chase the agentic AI stuff everyone else is doing right now.

Alan Morrison: That makes a lot of sense. We’ve covered a lot of ground today. I appreciate the time, Aaron.

Aaron Philipp: It’s been great connecting with you again.

Alan Morrison: People can reach out to you at the VisibleARC site or via LinkedIn where you’re blogging, right?

Aaron Philipp: Absolutely. Feel free.

Alan Morrison: You’re a great guy to talk to. Thanks again, and we’ll sign off for today.

---

See Aaron’s LinkedIn blog for more insights like these.