The Building Blocks of AI Sovereignty: Lessons from the MVP Group and Palo Alto Networks

In this episode, we sit down with Sir Jojo Gendrano, President and CEO of Kayana Solutions (part of the Philippines’ MVP Group), and Siddharth Deshpande, Director of Industry Solutions, JAPAC at Palo Alto Networks.

The conversation explores the critical path toward AI sovereignty in the Philippines and the essential role of executive sponsorship in driving large-scale digital transformation. They dive into the "Secure AI by Design" framework, discussing how organizations can balance "unhinged" innovation with uncompromising governance to stay ahead of machine-speed threats.

Tune in to learn how Philippine leaders are turning cybersecurity from a defensive necessity into a top-line growth engine for the AI era.

Kayana Solutions is a data-powered digital experience company and a strategic subsidiary of the MVP Group, one of the Philippines' largest and most diversified conglomerates. Backed by the combined infrastructure of PLDT, Meralco, and Metro Pacific Investments Corporation, Kayana harnesses massive multi-sectoral data assets to deliver hyper-personalized customer experiences. By integrating Gen AI, payments, and identity management, the company is spearheading a "digital factory" approach to bridge the digital divide and drive generational progress for millions of Filipinos.

Palo Alto Networks is the world’s leading cybersecurity partner, dedicated to protecting the digital way of life in an increasingly complex threat landscape. Through its "Secure AI by Design" framework, the company provides global enterprises with the visibility and governance necessary to innovate at "machine speed" while remaining resilient against AI-driven attacks. By platformizing security across cloud, network, and operations, Palo Alto Networks enables organizations across ASEAN to navigate the risks of the AI era with home-turf advantage and uncompromising safety standards.

Transcript

Copy Transcript Copied

YY - AIBP: 0:00

Hello and welcome to the ASEAN B2B growth podcast, where we sit down with individuals responsible for driving growth within their organizations here in Asia. Today, we are here really exploring a very interesting paradox. How do you accelerate dramatically while upholding uncompromising security standards? My name is YY, and today we are joined by the President and CEO of Kayana Solutions, Sir Jojo Gendrano, who is redefining the digital landscape for the MVP group. And also joining us is Mr. Siddharth Deshpande, or we call him Sid, from Palo Alto Networks, who is helping global leaders navigate the machine speed threats of the AI era. Sir Jojo and Sid, welcome. Well, I guess the first question that I have is really around, how do you look at innovation right now, especially with the new AI era. So you are, sir JoJo building at a massive scale. Tell us a little bit more about your role at Kayana, and what are some of the innovation projects that you're working on.

Jojo - Kayana: 1:13

Sure, if I can take a minute or two first to talk about what we do, right? So Kayana is a fairly new entrant to the MVP Group of Companies. We are part of a diversified conglomerate of very large companies, mostly regulated companies, and our mission is to really find value through shared assets of the group that normally that the group by them, the vertical by themselves, will not, given that they're so focused on their core business. It's our mission to really accelerate, start off like a fringe case, but then build scale. So then when we talk about innovation, it's really delivering value based on the common access of the group. And a lot of times, those intersections take us through two areas, data and payments. The massive data that the group generates, the massive payments and flow of commerce and transactions between the companies, generates a lot of opportunities to create value for the industry, to serve our companies better. So it's really our mission to really dig deep and understand what the opportunities that are uncovered when we you know, when you look at a 360 view of the customer, that you are a telco customer, you're a utility customer, a tollways customer, so behaviorally, it's understanding so that we can serve them better, right? So then how that ties to innovation for us then? Given that, at the end of the day, we are a trust business. Trust, right? So we are a trusted custodian for the MVP group for its data, and our ability to generate value, really is the crux of the innovation that we are focused on. So beyond ROI, the innovation that I try to look for, that I you know that we work within the companies, really, how do we understand the pain points of the verticals? So for a telco, how do we, for example, reduce their cost of acquisition, how to help reduce churn, how do you help generate more quality leads? There are also cases then, where we work with the score scoring and the lending community for Financial Inclusion. How are we able to, you know, just, you know, use data to really improve our ability to provide the ability of the industry to provide services and lower the risk. So it's really innovating around understanding the verticals that we partner with and creating value for them is the crux of what we do, right? And that's where a big part of our innovation comes from. There's also an area that we in well, so that's one, but also the geek in me sometimes would think about, you know, what is the lowest? How do we build the platform to have the lowest cost per transaction, the lowest cost per token and such, we will eventually get there, especially in this age of AI, where essentially we have to be really brave in understanding what it does, teaching our people, enlightening our people, making our people feel uncomfortable at times that we are embarking, that, you know, the rest of the world is embarking, really into new ground. So how are we able to build that confidence to just jump in, weigh in, and then, how do you build a a fairly aligned governance layer to be able to ensure that we're still able to deliver outcomes, is also very important.

YY - AIBP: 4:41

That actually sounds quite challenging, because the traditional industries that you talk about under the MVP group, it will include, like the utilities, it will include healthcare, includes the telco. But right now, you are really adopting more of a startup mindset when it comes to innovation and looking at it over governance. Well, Sid, we've heard from Sir JoJo with regards to how he's chasing innovation. In your role, how do you then help to really look at helping companies like Kayana, where they have to have a good approach and an aggressive approach to rapid innovation, but still involve security beyond maybe the traditional security metrics that enterprises look at?

Sid - Palo Alto: 5:28

Thanks, YY. I might take 30 seconds to talk about what we do as well. So at Palo Alto Networks, our mission statement is to protect our digital way of life, and as the leading cyber security company in the world, what that translates into is, us having to innovate on behalf of our customers, from a cyber security and risk perspective, so that we are able to help them innovate and stay ahead of the attackers. So if you talk about all the new paradigms that are coming out around AI and agentic, and the idea that attackers are able to shrink their attack windows from days to weeks to minutes to hours. It's a very important responsibility we have, to work with our customers across the world and here in the Philippines as well, to arm them with the frameworks, design principles and platforms so that they can innovate securely. And if you just talk about AI, that's one of the big innovation fulcrums today, isn't it? Like a lot of organizations are experimenting various ways of embedding AI and machine learning into their business workflows, and to a large extent, Kayana is doing a lot of that for the conglomerate. We as defenders need to fight AI with AI. So as long as the design principle is that we can fight AI with AI, we're in good space. And I actually think as defenders we can, we have a lot more advantages from AI and the developments in AI than attackers. Why? Because we own the environment. We know what our enterprise environment looks like. We know what our business workflows are. We know what potential business logic flaws might creep in and what the human and the machine vulnerabilities could be. So if we apply AI smartly in our cyber defense strategies, we have the home turf advantage, whereas the attackers are trying to figure out how to get in, right? So if you're smart about it, and if we consolidate our security defenses and put a defensible security strategy in place that leverages AI, we can actually turbocharge innovation significantly.

Jojo - Kayana: 7:46

And if I may just add to that definitely, you know what you said Sid definitely resonates with me. It's immensely important that you know, you know, that you know. And I'm happy that Palo Alto is really embracing the this new world in in a big way, because a lot of the industries needed, and especially for the more established companies where we're all, a lot of them are really focused into the future. While that may put what you have currently or what you've had in the past, your legacy systems at risk and the ability to catch up and secure that is also immensely important, because it may be a threat factor that will never get touch or get fixed unless you know we have tools such as agents that are able to really scour the scour the environment so that large corporations, especially established ones, can catch up.

Sid - Palo Alto: 8:42

Yeah, that's a great, great point Sir Jojo. You've been in the enterprise space, and you you've led extremely large and, you know, complex cyber security programs successfully. So you know that enterprise security has, it's a mixture of different types of workflows, assets, right? There's legacy things, like you said, old data. So we need to take all of that along while addressing the new paradigm. So it becomes very important for us to maintain context awareness of how we got here, as well as address the newer paradigm. So, you know, there's a lot of buzz around generative AI, of course, but it's not just generative AI. We've been doing machine learning and predictive AI for more than a decade in our industry. So it's really about machine learning, automation and generative AI, all the new things, combining all of that to give an outcome, right? That's what we're really trying to drive for.

YY - AIBP: 9:36

And I love how, Sid, you've mentioned that Sir Jojo wears many hats. In his role at MVP group, you have actually held many different roles, both looking at innovation, pushing the envelope, the boundaries, when it comes to innovation and technology, but also looking at it from a CISO angle, looking at the cyber security around it. And I believe maybe there are some paradoxes or some balances that you have to make in your role in order to do both at the same time. How do you navigate that?

Jojo - Kayana: 10:08

Ah, great question. Tough question. I wish I had a canned answer for that.

YY - AIBP: 10:13

No magic formula.

Jojo - Kayana: 10:14

No magic formula. It's all case by case basis. It's, you know, you know, there's, there's times when we just jump in head first and catch up in in other areas, but there are times when we have to say, we have to take a step back and really understand. But I think the key, if there was something that was common to I guess, how we should look at governance and risk and decision making moving forward is really we have to be plugged in. We can't just rely on agents, on on junior people, on documentation, to get us through our ability to understand what's going on, to have the visibility, to have the guardrails, to check in, being informed leaders is, I think, immensely important moving forward. And I think what's wonderful with Gen AI now is we're all learning at the pace that we haven't been learning before, and then we have to, right? So, so, yeah, so just being, you know, really understanding what's going is immense. We can't just let the teams work and check in or wait for a circle. It's, it's really important for us to understand what's what's going on, so that when the decision point comes along that we will probably manage risk in the best way that we can for us to make a decision.

YY - AIBP: 11:26

Is that one word that you would use to really look into your current mindset when it comes to doing this balance between innovation and Cyber Security?

Jojo - Kayana: 11:36

Faith. No just kidding. Just just bravery, I think, right, just, you know, like, I think a lot of us are uncomfortable in this world, and I think being uncomfortable is good because we learn, we evolve right.

YY - AIBP: 11:51

Better to be uncomfortable yourself than to allow the market to throw that discomfort to you.

Jojo - Kayana: 11:56

Exactly.

YY - AIBP: 11:57

Understand. Well, Sid, in your role, how are you really looking at trust as maybe a top line growth enabler, rather than really just a box that say CISOs take in order to mitigate risk? How do you really look at that conversation?

Sid - Palo Alto: 12:13

You know, this discussion has been around in our industry for the better part of the last decade or two, right? How do you is there a quantifiable value to the cyber security program and the trust that we are generating from our customers. And I think today, the trust equations are changing little bit. In the sense that because everything is a lot more digital, and the ways that brands are interacting with their customers is very much more dynamic. In the sense, if you have an AI, for example, AI enabled platform to reach your customers, and you have various different mechanisms of engaging them, which might not be necessarily all human driven, right? So the because the customer touch points with your brand is so so many and so diverse, the trust equation also changes. So trust from being a static, more predictable element to say, Oh, this is a trusted brand. You know, trust could go up and down depending on how organizations digital footprint is actually laid out, and how customers feel about the trustworthiness and the security of it. So, you know, in the past, you would have trust metrics like reliability, safety, consistency, those are still important. But now, with AI coming in, you have newer principles like fairness, ethics, you know, transparency, lack of bias. So these new things are getting enveloped into the trust equations which organizations have to deal with. And I think it's a massive opportunity for boards to recognize that by innovating, they can actually improve the trust equation, and have an opportunity to shorten the time window it takes to establish trust with their customers than in the past, where it took a much longer time to do so. So I think, I think there is a lot of focus from boards on on how digital innovation and associated trust that they generate based on that is going to have a positive impact on their brand. Again, a lot of interest from boards around agentic AI and and agents, and what that means for the business model, and if the cyber security program is able to help flip the switch from being from the business being in evaluation mode for innovation to go into production, like that's the big thing, right? Everybody's experimenting with it, but how many people are able to flip the switch and innovate and put it in production? And having a robust cyber security strategy around that and governance strategy can help that switch to happen much faster. Therefore, innovate outperform your competition, establish trust and therefore generate business value as a result.

YY - AIBP: 15:04

Sir Jojo, we talked a little bit about Open Claw. We talked a little bit about how you know, in your role, sometimes, for AI, you just have to be "brave". The word that you use, right? So how do you do it within an organization? Any examples that you could share with the audience?

Jojo - Kayana: 15:19

To be frank, we're still early on in the journey that while I would like something to be more natural for the teams to be able to execute like you know, but what we've learned is beyond just giving people tools and training programs, it's really building a culture, giving the you know, ensuring that that bravery, that bravery and accountability, understanding of the business translates as deep into the organization as possible, gives the organization confidence to be able to to execute, and also communicating that, you know, it's okay to fail, right? You know, we are testing, we are iterating, but we also be, we should be able to measure, you know, what is the impact of a failure? How to mitigate so it's, it's essentially a lot of these foundations need to be set. And I think culture is, is a big part of it. And frankly, I think it's something that we have to take very seriously. Because we're talking about this morning, that one word that seems to come up in the large corporate or the tech circles the last three years is this word called unhinged, right? How do you unhinge? How do you just totally go against the flow in areas I think we've seen so many examples over the last few years, starting with, you know, open AI being brave to release something that Google never wanted or did not want to release at that point, you know, exposed the industry to ridicule the amount of hallucinations. But look at, you know, how the industry has evolved and where it's gotten us now, I think the latest iteration is this thing, this movement on, on OpenClaw, right? While it would give a CISO nightmares and trying to to secure. And, you know, because if, if zero trust is like OpenClaw, like, you know, trust all right, right? And, you know, you know, at the end of the day, for those that have embraced that revolution, they are, they are really sharing, you know, the value that it's been creating for them, but in but it's exposing the you know, it may expose, it will expose, because so it's being able to empower the cyber organizations to really ensure that the innovation happens while because, yeah, it's, you know, it's, it's, you know, I think the next industrial revolution really is here, and it happens. And, you know, the OpenClaw founder saying that he joined open AI so that he can build something that will enable his grandma to build agents by herself. I think it's, it's a it's a fairly good, it's a fairly good aspiration that can really impact, you know, impact a lot of lives.

Sid - Palo Alto: 18:16

That's a very, very fascinating dimension that's opened up in the last two, three weeks. But if I may just add, if you don't ask me the question, but I'll say it anyway, one word if I were to pick would be visibility. Because how can you be brave? You can be brave if you know what's going on, right? So like, if I were to ask you, YY, to walk from here to this door with your eyes open, we'll do it easily, right? But if I put a blindfold over your eyes, you'll be feeling for the tables, chairs, so that you don't bump into stuff. The same way for security and governance functions, if they have a mechanism of understanding agents, what what agents are running in my organization, what are people actually doing, what apps are they using, and what data is going to those applications, then they're in a position to have a concerted effort to say, Okay, this is good, this is not acceptable, or perhaps this is a good workflow for us, but let's put some guardrails around it. But if you don't have the visibility, it becomes hard. So that's been a big focus for us at Palo Alto Networks is, whether it is employees that are using commercial AI applications for their regular work, as assists or whatever, or it is developers or slightly more technical people using agents to automate workflows or other things. The first step is getting visibility, yeah, and then after that comes governance and then runtime protection, but visibility enables you to be brave, is my contention.

YY - AIBP: 19:43

So brave, unhinge, visibility. I think what we are trying to do is also to really make sure that AI is not a hype word and it can be sustainable and be really organization changing, like what you've mentioned. The OpenClaw founder trying to build it to make sure that his grandma is able to build her own agents. But I think in this day and age, there's so many changes that are coming in at breakneck pace, right? Sometimes it's about, how do I architect my enterprise in a way that it can always be resilient and be able to benefit from AI no matter what happens, any advice on that, Sid?

Sid - Palo Alto: 20:30

So we've been talking about this with our customers in the Philippines and broader region as well. We have this framework called "Secure AI by design". So the idea is we have to build the foundations with first principles to make sure that organizations have the ability to prepare for future advancements in the field. Would be able to put that framework in place. So essentially, it's about like I was saying, visibility, governance, and the last one is protection. So once you once you can see what's going on, you have the confidence and bravery, then you can have a concerted business decision around what to govern, what to allow, and what to not. And then once the system, whatever system it is, is in production, you need to be able to make sure that it's being used in the intended way. Now, if you look at a lot of these frameworks, like ISO 42,001, NIST, RMF and AI RMF and whole bunch of industry standards, one of the big things is organizations are on the hook for ensuring that their AI systems are being used in the intended way. What does that mean? That means that the model should, the models or the agents should not give out harmful information. They should not have bias in their output. They should not they should not be poisoned in a way that they're spitting out malicious links or what have your leaking sensitive data. So that runtime protection is super important so this secure AI by design forms, we are going to first principles, right? We are not talking about products. Because tomorrow, you never know what new manifestation might come about of this agentic trend, but these principles will still remain. So that's the foundation at which we are designing our cyber security platforms, and all the new acquisitions or innovations we make are underpinned on that. And the other element is we don't want to create complex point solutions to solve the AI problem. As much as possible, we would like to be able to integrate the AI protections, agentic protections, into what enterprise security teams are doing already, so that it becomes an extension of what they do. And we're calling this platformization, right and that's that's really going to be a sustainable way for organizations to build and scale and be resilient moving forward.

YY - AIBP: 22:48

Does that seem to help? Because I know that CISOs now, they always say that there's so many new compliance and then with AI coming in, there's more regulations that come in, which makes their job a lot more complex, make their sleep a lot more interrupted. So for you, how does innovations like that help?

Jojo - Kayana: 23:06

Well, I look at it with more, you know, I look at it on the bright side of things. I'm very excited as the potential. We're in this new world where people are suddenly more well, not suddenly, where people can be more productive. That this the ability to embrace, to grasp, to let go of old, you know, to let go of old habits and embrace new ones really has to follow, if not be, be ahead while you know the attack vectors are scary, and you know, definitely scary and more and more complex. But you know, our people are also more empowered. There's more tools out there. So really, you know, I like the term secure AI by design. So while it's something that has to be deliberate and thought about, we need necessary measures to ensure that the foundations are set right. So I really look at it as with the excitement. You know, we just have to accept this challenge. It is the it is the part of doing business, and it's our responsibility to our stakeholders, our customers, to be able to really govern and secure and maintain their trust.

YY - AIBP: 24:12

If I could double click a little bit on that, right? So if you're very positive about the future, do you potentially also see some challenges or bottlenecks that you have to face in order to get to utopia. What are some of the challenges that you think could potentially derail and how, what are you doing to maybe guard against that?

Jojo - Kayana: 24:32

So the my top of mind, you know, to that question, YY, is really, you know, this all this is not free, right? We have to be able to communicate to our boards that this is the vision. This is what it takes to achieve that vision. These are theirs. We have to invest in. These are theirs, where we have to take risks. And I think it's important to be able to to effectively tell these stories to our boards, to our stakeholders, to get their support. So, you know, sponsorship is important. Sponsorship is important to be able to, you know, get the fire going. You know, get the engine running. And really our ability to maintain that support, to invest in the people, the platforms have enough to or to have the confidence to to always experiment. I think it's immensely important, immensely important moving forward.

YY - AIBP: 25:31

A very, very apt point, because this is some of the challenges that what we see enterprise leaders across Southeast Asia are facing. Any tips that you'd like to share on how to gain executive support?

Jojo - Kayana: 25:43

I've been I'm not good at it yet, but I'm trying to sum out some ultimate formula that you should be able to communicate your strategy in 25 words or less. So the more succinctly you're able to distill your motions, the better sponsorship you'll get across multiple stakeholders. If they remember those 15 or so words, right? If you just build on it, I think you know it's it can make things a lot easier.

YY - AIBP: 26:13

Sid, on your end, any advice for enterprise leaders gaining support for their vision?

Sid - Palo Alto: 26:20

I think it's really about ensuring it aligns with what the overall business is going for. I mean, in the security space, we are all, to some small or large extent, guilty of being very zoned into fighting threats. But ultimately, we need to tie it back to the core brand values like trust, reliability and business growth and things like that, and that cannot that's that's not easy, right? That's why being a CISO is a hard job. Being a leader of risk function is a hard job. It's really about ensuring you're able to somehow enable what the organization is doing or trying to do through the security and risk function. I think that becomes super important. And, you know, enabling that is it takes some forward thinking and planning, like, for example, if, if you know that the business is about to go into acquisition mode and they're planning to expand into new markets or merge with another company, that means there's a lot of new identities, new employees, new workflows needs to be integrated, potentially expanding into new markets. So there's going to be disparate systems that have to be integrated, you know, different locations that need to be onboarded, different application stacks. So looking forward and saying, look, here's what we're doing in the security program, to platformize, to embed secure AI by design. So these new business initiatives or business strategies we are adopting, we can enable that. So I think that's what I found in my conversations to work.

YY - AIBP: 27:50

To enable the sighte in foresight, so they get the visibility in order to plan further for their business.

Sid - Palo Alto: 27:57

Think about, think about like, outcome driven, outcome driven cyber security. What is the outcome we are trying to go for? I mean, we tend to put numbers on the slide. I'm guilty of that too, right? This much percentage of threats blocked. But that doesn't really mean as much to somebody sitting on the board as much as if we start talking about business objectives and outcomes. And it's different for every organization.

YY - AIBP: 28:21

Last question for the both of you. At MVP group, you hold many different entities which are crucial to Philippines growth. And the Philippines have always looked to the region as becoming a leader in terms of AI development and really driving the digital economy. What are some of the opportunities that you see that you that can contribute to Philippines vision of AI sovereignty?

Jojo - Kayana: 28:50

I'll let Sid answer that first.

YY - AIBP: 28:54

How do you look at, say, supporting Philippines vision when it comes to becoming a nation that can really capitalize on its digital growth.

Sid - Palo Alto: 29:05

Look, I think the AI ecosystem is very interconnected, right? And I mean, innovation is happening in different pockets of the world, and if you look at the AI stack, there's the models, there's the infrastructure, there's the data. So there's a need for for organizations to have a perspective on what that governance of all of that looks like. And it's also perhaps room for some national or individual industry sector guidelines to help provide some some directionality on that. But you know, essentially, the principles remain the same, right? You need to have make sure that it is fair, it's ethical, it is transparent, it has lack of bias, it's inclusive, it's providing benefits to society. So all of these principles are actually commonly understood. Organizations tend to use frameworks like ISO 42,001 as a as a way to design a industry standard AI management system. There's the NIST risk management framework that's also used at an industry level. But then in our region, we're also seeing some governments like, for example, Singapore has the AI verify foundation that provides a common kind of a governance structure that takes some of the best practices from all these frameworks and puts a Singapore lens on it. So I think potentially there is, there is some work being done, I think obviously in the Philippines as well, no doubt. But eventually I expect that that to also come out and provide some, some more localized versions of the AI sovereignty. But I think the secret to any country's AI sovereignty strategy is, how can we leverage the global innovation without isolating ourselves, but yet protect the interest of our citizens? And that that to do that, there has to be a combination of the existing laws which already are there, like aI national AI policies, data privacy laws, cyber security laws, and also guidance around AI governance, yeah.

Jojo - Kayana: 31:05

And just, would just like to share that I think the MVP group and a lot of other conglomerates are well positioned in AI and sovereign AI, like, just MVP group of companies. For example, you know, we're the largest data center provider in the Philippines. We're the largest power distributor. Power is a big part of AI. Obviously, we have big plans in energy generation. We are a very big also in, you know, as a utility when it comes to water, with the Manila going public recently, there's, there's. So a lot of the building blocks that empowers AI is is within the group. So I think we have the responsibility to ensure that the country is is ready, and, you know, ensuring that the entities are able to execute and deliver, so that they have the, you know, they have the ability to invest for for AI will be important moving forward. So that's one dynamic. The other dynamic is also realizing that, you know, a lot of the foundational technology for AI really happens in the east and the west, and you know, you can't fight that. You cannot it's, it's, it's understanding, it's, it's, it's accepting, it's building depth in areas of how to apply that responsibly is important. Moving forward, we're inspired by companies like Harvey, for example, right? You know, Harvey's built a, an interesting, you know, play in, a going really deep in, in, in one era, but, and there's a lot of stories that can be built around that, around Philippine organizations and and and enterprises, but at the end of the day, we'll never get there if you don't use it. So, so just again, going back to bravery and visibility, being able to really, you know, jump in, maybe at some point be, be, be unhinged from your usual ways of working. You know, it's probably an important you know, you know, motions we should consider moving forward, right?

YY - AIBP: 33:12

Thank you very much, Sir Jojo, thank you very much, Sid. Well for Kayana, I believe every Philippine consumer will touch some point of a Kayana subsidiaries, under the MVP group of company solution. From the start of life at a hospital all the way to to their everyday living, right? So I'm very, very glad about that, and I think we've talked a lot about trust. How do you enable trust? Trust By Design. And with that, thank you very much for listening in. Appreciate your time and appreciate both of you, being here today. Thank you.

Sid - Palo Alto: 33:44

Thanks for having us.

Jojo - Kayana: 33:45

Thank you. Bye.