Kentaro Kawamori: ‘It takes AI to understand AI’

Kentaro Kawamori didn’t originally set out to build a security company; he set out to stop his own company’s sensitive data from leaking.

At Persefoni, a sustainability compliance software company he cofounded in 2020, the team wanted to put LLMs to work on data belonging to large, regulated customers — without handing data to the model providers. Kawamori’s thesis was that a prompt could be inspected on the device, before it ever reached the internet, and judged on what it was trying to do.

It worked, and more than a year later, their experiment has become First Recon AI, which he cofounded and runs as CEO. The company launched publicly in July.

Kawamori was a cloud strategy consultant at Accenture, then chief digital officer at Chesapeake Energy, a Fortune 500 energy company. He then turned to cofounding companies: the digital product studio Umbrage in 2019 (Bain & Company acquired it in 2023) and Persefoni the following year.

Kawamori’s latest venture, First Recon, offers a product the company calls an AI Security Runtime: software that reads the intent and context of an AI interaction, enforces security policies in real time and tracks what the business spends on AI. First Recon says it’s already working with Conscia Group, a European cybersecurity and managed IT services provider, along with financial services and other enterprise customers across four continents.

Over coffee with TechInformed, Kawamori – who now runs both First Recon and Persefoni – makes the case that security teams can’t govern what they can’t read, and that the window to fix that is closing as attacks get cheap.

Why did a carbon accounting company end up building a security product?

We started solving it for ourselves. We were trying to figure out how to stop sensitive data from getting to the AI lab in the first place.

I had this thesis: could we inspect prompts right on the device before they ever go to the internet and make that API call? And it worked. We could read the prompts on the device and understand what each one is intended to do.

Is it intended to update a record in Salesforce? Or is it intended to exfiltrate data nefariously? Once you have that sort of inline intelligence, you can start making security decisions. If something isn’t okay, it should be blocked.

That was over a year ago, and it became the nucleus of what’s turned into a much broader, all-in-one secure workspace. We give companies the combined tools their employees are used to, with a complete security and governance layer in between.

Walk me through that. What does it mean to “read” a prompt’s intent?

The easiest way to explain it is that it takes AI to understand AI. It’s happening at machine speed. If you’re using something like [Claude] Cowork or an agent tool, what you’re seeing is the reasoning trail happening in real time, and that really tells you intent.

You put in a prompt and instruct it to do something. LLMs are very goal-seeking, so the way a model interprets what you put in may not be what you get out, as I’m sure you’ve seen many times. That’s because in its reasoning, it’s justifying different behaviors, actions and tool uses as it tries to figure out what its goal is with you. So really the only way to secure AI is to watch its reasoning in real time.

It’s almost like my 7-year-old daughter. When you’re a little kid, you’re doing something and you kind of know it’s the wrong thing to do, but you haven’t learned that lesson yet. You need an adult to come in, supervise you and get you back on the straight and narrow. It’s the same thing. We want to catch those things as they’re happening, so we can steer those prompts, or make sure that something that wasn’t supposed to happen wasn’t happening.

What challenges are organizations dealing with when it comes to securing AI?

Remarkably, the same ones around the world. Just yesterday we were talking to a potential customer with 40,000 seats they’re looking to deploy, and I just got back from Denmark, where companies in various industries might deploy 150 seats. It’s always, “We don’t know what’s going on in the company.” Everybody’s using different tools, and sometimes, even ourselves, we use personal accounts because we have a preference for, say, Claude versus ChatGPT.

So you have the craziest period of shadow AI, or shadow technology use, that’s ever happened, and people are wantonly putting data in.

There are the security basics: how do I see what’s going in and out, and how do I control it? Observe, detect, enforce. Almost nobody has those capabilities.

[Beyond that, the two things I hear most] are, first, compliance. There’s more and more talk about whether we’re actually protecting data, and whether we’re tripping up existing agreements where we’re supposed to be protecting it. The EU is putting out the EU AI Act, and in the US people are talking about regulation, so we hear that more often.

The [other] is really governance, and it’s about cost. Everybody’s AI spend is careening out of control. I think everybody also recognizes that the era of subsidized AI is coming to an end, so costs are only going to continue to go one way, and people just don’t have the tooling today to manage that.

Where do you see this evolving?

On the attacker side, if you take out all the capabilities and what they can and can’t do, the biggest story to me is that the cost of an attack is getting to basically zero.

Nation-state actors — China, North Korea, Iran and Russia — have always been very limited in who and what they attack because of cost. It was simply too costly to attack everyone. But if you want to get to critical infrastructure, for example, there are thousands and thousands of companies, plus thousands more connected to them, servicing that infrastructure. Who gets targeted is just going to explode, simply because it’s cheaper. Now you’re going to have machines doing it at machine speed, 24/7, parallelized and cheaper than ever.

How do you have your caffeine?

I’m half Japanese. I’ve drunk matcha like it’s water since I was a kid.

This interview has been edited for length and clarity.