Chainguard Assemble 2025 | Kit Merker, Plainsight

Clips
More from Chainguard Assemble 2025

Kit Merker

CEO

Plainsight

play_circle_outline Introduction to Chainguard Assemble conference in San Francisco with Plainsight Technologies CEO Kit Merker

play_circle_outline Challenges and importance of managing data quality and security in computer vision

play_circle_outline Controlling costs and infrastructure in enterprise computer vision adoption

play_circle_outline Overcoming Challenges in AI Production, Optimizing Costs with Software, and Designing Vision Infrastructure for Robotics

play_circle_outline Understanding what robots need for decision-making

Info
Transcript

Kit Merker, Plainsight

Kit Merker

CEO Plainsight

Exploring the Role of Computer Vision and AI in Emerging Data Supply Chains

Kit Merker, Chief Executive Officer of Plainsight Technologies, appears as a guest on theCUBE live from Chainguard Assemble 2025 in San Francisco. Joining host Jackie McGuire, Practice Lead and Principal Analyst for Security, they explore the evolving landscape of computer vision, AI, and the intricacies of data supply chains.

In this engaging discussion, Merker outlines their journey to becoming CEO of Plainsight Technologies, emphasizing the company's focus on enha... Read more

explore Keep Exploring

What are your thoughts on the Chainguard conference so far? add

What are the challenges of manually curating a dataset for machine learning models and how can the principles of the software supply chain be applied to improve data traceability and accuracy? add

What are some ideas for controlling costs in computer vision and AI projects, especially in terms of infrastructure and composable workloads? add

What are the cost inputs to an AI solution? add

What was discussed during the conversation with Kit and Jackie McGuire? add

bolt Powered by CUBE AI

Kit Merker, Plainsight

search

Jackie McGuire

>> Hello, world. I'm Jackie McGuire, Practice Lead and Principal Analyst for Security at theCUBE. We are coming to you live in beautiful, sunny San Francisco, California. I'm here for Chainguard Assemble and I am here with my wonderful guest, CEO of Plainsight Technologies, Kit Merker. Thank you for joining us. It is an unseasonably warm day in San Francisco.

Kit Merker

>> It's very nice, yes.

Jackie McGuire

>> We have windows in front of us who are all absorbing some Vitamin D. How have you found the conference so far? How's your experience been?

Kit Merker

>> I'm having a blast. I mean, first of all, this venue I've never been to before and I think it's really nice. But the Chainguard team has really focused, I think, on building a space for practitioners and customers and people who are really trying to learn. And they're not shy about how proud they are of what they've built as we know. But at the same time, I think they really are humble about what it is and why it's so important and I think very educational. So I appreciate that style of conference, that's much more about understanding and sharing and really explaining what's going on and why you should care. Not just, "Hey, look at this cool thing-"

Jackie McGuire

>> Here's my new feature and product?

Kit Merker

>> Yeah. Exactly. Yeah.

Jackie McGuire

>> Yeah. Agreed. And I think that we were just talking with some of their executives, the focus on their customers and on outcomes is really evident. I have seen, they built in a bunch of time for people to connect. I also want to give a shout-out for the food. Conference food is not always the most palatable food and this food has been fantastic. So Plainsight Technologies is a computer vision company. So why don't you tell us a little bit about what the company does and how you became CEO and what you're interested in and why you're at Chainguard?

Kit Merker

>> Yeah. So Plainsight is focused on computer vision as you mentioned. We think of ourselves as really vision infrastructure. So if you think about all the different ways that AI is changing how we process video and images, we help people turn cameras into spreadsheets. So you think about all these businesses that are counting people and equipment and inventory and cattle and all these things. They have all this data coming in from their cameras. We help them build applications for understanding that and turning it into simple structured data and doing that at scale. That's really what we're all about. I joined the company about 18 months ago and we rebooted it. It had traditionally been... It was a professional services company, had made some really great technology investments. Now, with this new direction, we're focused on productizing that into scalable software infrastructure for running very large vision workloads for big enterprise types of solutions.

Jackie McGuire

>> It's easy to tip the scale from not enough data to too much data if you can't process it effectively. So we were having a really interesting conversation before we started about two different kinds of supply chain. So I think coming to Chainguard Assemble, I was thinking about the software supply chain. We used to have you would use an application and it was an application. And now, we have all these cloud-based applications and even some of the local applications you run are actually a stack of like a hundred different applications, some open source, some proprietary. And so, we all understand that kind of software supply chain and that you need to have your SBOM and things like that. You were also talking about the data supply chain. So I wanted to see if you could tell us a little bit about what that is and how you think about the data supply chain and what you do at Plainsight.

Kit Merker

>> Yeah. For sure. Well, first of all, I'll say not everybody recognizes the value of the software supply chain so we still have to get there-

Jackie McGuire

>> I guess I shouldn't take that for granted.

Kit Merker

>> But I agree with you, that software supply chain idea of how the dirty software from the world flows in. Well, as applications are becoming more and more AI-driven and I think we've all... It's like it should be no surprise to anyone that people are now embedding AI to varying degrees of success, shall we say. There's a big question mark about where that data came from. Now, there's one side of the equation which is privacy and ethics and that. But there's another side of it which is about attackers and could even be related to the quality in terms of accuracy and efficiency of the models that you're building. And in fact, know there is even scenarios, there was an outage that was reported or a CDE that was reported where YOLO which is a... You Only Look Once, it's a vision framework, had opened up GPU attacks where you could... There was crypto mining happening essentially inside of a computer vision application. So there's a lot of different vectors. The data supply chain, the way I think about this, is that an enterprise who's trying to build applications that are AI-powered, they have all these visual data that they are ingesting from cameras or still images or other batch sources. They have to monitor that process from ingestion through curation, through annotation and training and inference, all those different steps which we think of as vision workloads. One of the things that I think with Plainsight, you imagine a vision workload. You have to both look at the software and the AI part as a single unit, right? It's not just about the inference step of saying, "Okay. Is that a shape? Is that..." We have a lot of livestock that we do for customers, but, "Is that a pallet of whatever? Is that a license plate?" It's easy to imagine that inference step. But leading up to the step where you actually have the AI tell you what it's seeing, there's actually a series of data management steps. Now, historically, or the way I think status quo, I'll put it that way, if you don't think about the supply chain, very similar to the software supply chain, that's done by hand, right? There's a data scientist who's responsible for curating a dataset. They are actually looking at images and deciding what's in or out of various training programs, et cetera. That's not very scalable and it's also not very traceable and it's not easy to correct. And if there's an issue, you have this very difficult problem of, "Okay. How did this data get there? Where did it come from? What are we going to do about it?" So if you now take the same principles of the software supply chain and you say, "Okay. Now, as we're thinking about all the sources of our data for the purposes of models and inference, let's build that traceability, the controls, the automation. So that you can now run this much more accurate system." That's really kind of, I think, what I'm hoping we're able to accomplish.

Jackie McGuire

>> Yeah. It sounds very similar to something that when I moved over to the vendor side of security, I started talking about your data audit trail. And this sounds very similar in that as we add machine learning and AI to the enterprise, we're adding layer upon layer upon layer of abstraction between you and the source data. And so, I was talking about know if your little enterprise chatbot happens to spit out an unhashed session token, how do you figure out where that came from? I love calling it a data supply chain because I think that will make more sense to people than my data audit trail. I come from finance originally, so that's my background.

Kit Merker

>> Audit just sounds so painful, doesn't it?

Jackie McGuire

>> I know. Yeah, yeah. They think regulators. But it is this really important thing in that, if you can't identify the source of bad data, you can't remove it and I think people also forget that you can't remove data from a fully trained model. So that also requires re-training your model. So if you aren't really careful about keeping your data clean, that can cost tens, hundreds of thousands, millions of dollars. And I imagine in computer vision, because we're talking about GPU, that goes up by magnitudes.

Kit Merker

>> It's exactly right. There's a number of issues there. I think the simplest way to think about this is that re-training costs, right? It's not an instantaneous thing. And if you don't know what data was fed in, you don't have good data management around the images or the video snippets, the annotations, the truth data, going back and recreating it, making it reproducible, or even being able to say, "This version of this model..." I mean, frankly, models that we see don't even really have strong semantic versioning or content addressable hashes or things that now... We just know that git commits have hashes, right?

Jackie McGuire

>> Yeah.

Kit Merker

>> What's the equivalent of that kind of idea in the context of model training? I think this is going become important. And to your point about regulators, I won't be surprised if you know this time is different. One of the big drivers, I believe, in Chainguard's meteoric rise over the last few years has been because of the awareness from regulation. Now, not too big of a stretch to say, "Okay. Well, with all the AI-driven applications, machine learning models, and data collection happening in the world and the implications on privacy and bias and all these other concerns that governments want to be involved in, that the regulations probably will be more aggressive, I would expect. And to take a page out of the supply chain book from software and apply that to data and this world." So I think we should be trying to be ready for that, I guess, is how I'd put it. Yeah.

Jackie McGuire

>> Yeah. I think there is... Given what's going on geopolitically, there's a lot of thought that regulations will decrease over the next several years. And I've been drawing a parallel to the Reagan administration. They kind of undid seatbelt laws and the people that actually came in and got them passed were the insurance companies. Because at the end of the day, if you're having cybersecurity issues, your cyber risk insurance companies are the people who are eating those losses. And there's only a handful of insurance companies that kind of all insurance rolls up to at the top. So I tend to agree with you that even if we're not seeing regulation necessarily from the administration or from Congress, we still will likely see it because the private sector will step up and say, "Hey, we have to balance the losses with the risk." And so, I think that's a truly interesting way to frame regulations happen from one of two directions. And so, while we may have solved one part of it, I don't think people are just going to eat all those losses and not try to do something about it.

Kit Merker

>> You're right. Yeah.

Jackie McGuire

>> So one of the other themes that we've kind of been talking about with everybody today is the fact that occasionally, there is an adversarial relationship between the teams tasked with building, maintaining, controlling the cloud environments. And then, the teams tasked with building and maintaining and controlling the things that happen in the cloud environment. So in your case it would be teams working with machine vision and AI. Then, I think you have some thoughts on building those bridges between the teams and how that can be done effectively. So when you leverage technology, so I guess when we're... Is there a specific way you feel like teams need to be talking about the data supply chain and software supply chain to build those bridges to their cloud engineering teams or what do you think the best way is to start to fix what can sometimes be an adversarial relationship?

Kit Merker

>> Yeah. It's a great question-

Jackie McGuire

>> Solve everything for us right now.

Kit Merker

>> Yeah, yeah, yeah. It made me think about... I was an early product manager at Google on Kubernetes. And the way I would explain Kubernetes was exactly what you just described was this idea that there's really two sides. And Kubernetes came from Borg, that was Google's internal product. So you go all the way back to the beginning, what was the driving force behind that? And I think it's instructive for today. You had people who are responsible for building the data centers, what you now would call the cloud, but the people who are really standing up infrastructure. And then, had the developers that were responsible for quickly iterating on applications. Well, historically, those people actually did have to talk to each other, right? They would plan capacity and they would talk about how much data is going to go into the database and where are we going put the data. Well, what Borg did, and I think it's a lot easier to see in retrospect, what it did is create an API layer between the infrastructure and the application, so those people didn't have to talk anymore actually. And so, the resolution to this sort of Gordian knot of, "How do we get along?", is like maybe we just make it so people don't have to speak and move. I like to say like, "Meetings into APIs," right? And so, I think that in a lot of ways the adversarial discussions are partially because it is discussion. So we don't have the right primitives and abstractions and frameworks to be able to express a design point for how these systems should work, because that's really what we're trying to get to. And so, when you have a data scientist who their world is all about statistics and samples and experiments and their workflow. And you have developers who are all about pull requests and code reviews and compilers, they are really talking about different primitives in the expression of their work. In the new world, that has to come together. And so, the way that we've approached this problem is we've created this application framework, we call them filters. It's inspired by Instagram, by the way-

Jackie McGuire

>> Love.

Kit Merker

>> Because if you have a filter in Instagram, right? You can make your hair on fire or a dog face or other applications of filtering. But the idea is that you have a camera with a feed that's getting one app that's being run at a time. Now, if you imagine that application framework, it has both... We'll call it business logic, right? There's some code and there's some AI that are working together in a consolidated form. And guess what? If you stick that into a Docker container and you make it so you can deploy it into Kubernetes cluster or run it in an Edge device, now we have a way of taking computer vision applications and expressing both sides of the coin. The data side of it and the ML and the code side of the application and put it into a single package. And so, that's been the inspiration for how I think we can solve this issue of getting these different concerns talking together, is to have better abstractions and primitives and methodologies. And as that becomes more and more mainstream, I think it will become easier for these things to happen. But I think one of the fundamentals, and this is expressed from a Chainguard perspective, security and innovation are at odds, generally speaking. And when you want to have a more convenient experience, you're almost necessarily going to have to reduce the security and vice versa. And so, getting this idea of security by default and having it built in and making it the natural way, again, another analogy I think of is they used to sell antivirus separately from email. You used to have to buy email and then you would buy a separate virus solution. And then, at some point, people just thought, "Well, why would you ever want to not have antivirus in your email? You always want to scan your emails." I think the same thing is happening in the software supply chain. And hopefully, it will happen again in the data supply chain, is that it's no longer seen as, "Well, there's the tools we use for productivity and then the tools you use for security." It's now, "We have these tools that together provide both productivity and security." And that, to me, is really the breakthrough, right? It's like if we can get both and actually make the team more productive, part of that could be by reducing the audit trails, right? Less auditing, less meetings, more coding, more productivity, more vacations. If we can get that to work, then I think we're on to something, but that... The fundamental trade-offs don't go away, they have to be managed. I think that's the key.

Jackie McGuire

>> Yeah. So and I love how Chainguard's approach to continually updating things. I think exactly what you're saying, it makes security part of the process. It's not the thing that's the checkbox standing between you and a finished project, it's the continual process of hardening. And this is the, I feel like from a culture and policy standpoint in the enterprise, we have not caught up to the fact that everything is an attack surface now.

Kit Merker

>> Everything.

Jackie McGuire

>> And so, it used to be that security was just for email and like things you download and file scans and that was it. And now, everything is an attack surface. Your air conditioning is an attack surface, right? Look at Target.

Kit Merker

>> Yes, yes.

Jackie McGuire

>> So I love that the kind of thinking about, "How do we just make security part of a developer's everyday job?" That they don't even think about it as security. It's just like, "Oh, there's an update today." Just like on your phone. Like your phone updates itself, you never even think about it, right?

Kit Merker

>> Right.

Jackie McGuire

>> I'm going to switch gears a little bit with the time that we have left, because one of the things that we were talking about earlier today with some of the execs from Chainguard was cost. And so, in computer vision and AI in general, there is a lot of cost, right? So being a data scientist who accidentally went to lunch and didn't limit the number of Kibana queries I was pulling and ran up a over $50,000 AWS bill in two hours, I am acutely aware of how costs can skyrocket with data science and AI. And I think one of the... You had some ideas about how the infrastructure you use and the way Chainguard helps with your infrastructure controls cost in these kind of composable workloads. And I wanted to dig into that a little bit, because I think it's something that's on top of mind for most enterprises as they're looking to develop AI in the enterprise is there's... Whether there's ROI or not, I think is TBD. But, you know, how they think about cost and controlling costs and as a data scientist, I was like, "Oh, minimal images that don't just have all this crap that I don't know how to secure and don't need?" So how do you think about that, about composable images and controlling cost in computer vision?

Kit Merker

>> This is the number one issue for enterprise computer vision adoption. And I think as a industry there is a treasure trove of data, of video data, vision data, that these enterprises have across many different industries and they've all invested to a one. They've all invested in some sort of prototype and thought, "Oh, this is really cool. I got something working." And then, the next step was, "Okay. Now, how are we going to roll this to production?" All of a sudden we've got to make it work with 1000x more data, more cameras. And if you just do the simple back of the envelope and say, "Okay. Well, I take number of cameras, times number of models, times number of GPUs equals an astronomical amount of money." And then, the project dies there and nobody knows what to do. That is the business situation we find ourselves in. So what we did is we took a step back and we thought, "Well, what are all these sort of kind of a first principles approach? What are the cost inputs to an AI solution?" And one is that data acquisition... The reality is that video and image data is very heavy and video is designed... Video infrastructure... Think about delivering video, it's designed for human consumption. And so, therefore, what do we want when we look at video? Well, we want it to be smooth and high resolution and all this. It's incredibly redundant data. So we think about Netflix for robots, right? How do you design a vision infrastructure that's designed for consumption by robotics as opposed to humans? That's the first thing. It's just thinking about this simple problem of, "I have all this large data, how do I actually just compress it down?" And then, the second thing is the training, the training costs, the actual annotation training costs. So that's where we can use software and automation to build active learning and continuous improvement and reduce amount of data. Another driver is literally the algorithmic complexity. And so, if you think about the idea that you're going to take all the cameras in the world and just shove it into all the GPUs in the world, there's a more elegant way to think about it. So for example, if you say, "All right. I want to build a vision solution..." We had a super contrived example, which was a vision solution... Halloween, we did this thing where we had like a detect if there was a Halloween pumpkin in the frame, like a jack-o'-lantern. We actually set that into an LLM. Well, LLM is expensive for vision. But what we could do is have a rule ahead of that, which was, "If you don't see orange, don't bother sending it," right? Again, it's a very simple thing. You can detect the orange with very low complexity. But if you don't have the orange, there's definitely no jack-o'-lantern. So think about how you could generate computer vision rules on the fly that could run upstream and prevent the data from coming in or deduplicating frames, et cetera. So there's a variety of techniques with this composable approach where you can start to... It takes more design. You can orchestrate that design, but it allows you to leverage these different costs drivers. So we basically looked at the cost drivers. We thought, "How can we use software to optimize this and use traditional approaches for workload management and prioritization and orchestration to drive down that cost and use different tools and techniques to get there kind of broadly?" But this is the blocker. And you go to companies that have an idea for a computer vision problem and I've... There's no shortage of use cases. Everyone has an idea. Your point is correct, the ROI of the use case, it really comes down to a very simple question, "Will I be able to replace a human worker or not?" I hate to say it, but it really is that simple. And if you can't replace a human worker, then the project's probably not worth pursuing. And that litmus test, when you actually talk to people about that, then you start to think, "Okay. Instead of having... I make some food on a kitchen and then I put it under a thing and it gives me a red light or a green light, that's not useful." Well, because now, you're putting all of that intelligence of the labor of the person into this overly simplistic system. On the other hand, what if you could build a Copilot that says, "I don't see... There was an ingredient on the order and I don't see it." It doesn't mean it has to be 100% accurate and it's now augmenting the person. We can get away with a much cheaper solution, lower accuracy, et cetera, lower data requirements. And it's not replacing the human, but it's okay. It's making the person better and that requires a certain level of design and sophistication on part of the customer. But when you get it right, it's kind of a magical thing because all the stars align. So I think that is one of the keys to this change is having those really smart solutions. And that's where, for us, it's all about our ecosystem of people who are building solutions. We're really an infrastructure company and we work with Chainguard to help us with that, make it secure. But then, we deliver our technology infrastructure to application builders who are now going into these different verticals and building these end-customer things. We have to help them know how to evaluate these end-customer requests. Yeah.

Jackie McGuire

>> So understanding what robots need to make decisions, not what humans need is the key takeaway from that-

Kit Merker

>> That's a great takeaway. There you go.

Jackie McGuire

>> Yeah. I mean, because I-

Kit Merker

>> summarize it all.

Jackie McGuire

>> I think, to your point, we try to anthropomorphize AI and that's not always necessarily what we need to do.

Kit Merker

>> I agree.

Jackie McGuire

>> Well, Kit, thank you so much for joining me today. It was really, really awesome to have this conversation. Thank you for adding data supply chain to my lexicon, so I can quit scaring people with the audit trail. Thank you, world, for tuning in. This is Jackie McGuire, live from San Francisco with theCUBE. We will be back with more coverage of Chainguard Assemble. Yeah.

>> First solo interview-

Jackie McGuire

>> First solo interview. They've finally-