I was ready for bed at 10 p.m. in Koh Samui until Ken Herfurth started talking about codifying 150 years of human knowledge work.
10 p.m., Koh Samui time. I was sitting in my Strategy Room, fresh off two back to back Convergence pre-interview calls, and I was cooked. My brain wanted a blanket and Netflix, not one more Zoom.
Then Ken Herfurth started talking about codifying 150 years of human knowledge work into what he calls enterprise AI governance, and what that actually means for my kids and grandkids one day. I got real goosebumps. The part of me that wanted to sleep just shut down.
Here’s what woke me up.
The Moat Everyone Built On Just Moved
This shift represents the “Agentic Pivot”, a fundamental transition from AI systems that require constant human interaction to autonomous agents capable of planning, executing, and interacting independently.
As these systems gain the authority to take actions that are difficult to reverse, the requirement for robust governance has skyrocketed beyond traditional software oversight.
Ken spent 20 plus years running M&A deals before he founded Ander, and before that he was an engineer on the Space Shuttle program, then spent years in senior leadership at a top five U.S. bank, then founded a private equity firm that IBM eventually acquired. In other words, Ken’s career is a career that’s been spent figuring out what actually makes a business worth something.
That’s why his acquisition test stuck with me…
One of the most proactive moats an enterprise can build today is “Continuous Cyber Defense”. By deploying agents to patrol network infrastructure and identify vulnerabilities at a scale and speed that surpasses human teams, companies can move from reactive security to a state of autonomous, around-the-clock protection.
Ken’s test before any acquisition:
- Find at least three specific, identifiable things the deal does for you (market share, revenue, technology, people, or patents). One reason is never enough.
- Define the strategy and the integration plan before you close, while you still have room to shape it. Finance-led deals that skip this step are the ones where the operational team shows up post-close and asks what happens now.
- Judge the deal on whether you can actually integrate it. The close itself is always the easy part.
For the past two decades, SaaS companies got acquired because of their tech and their data. That was the moat.
But, AI has dissolved that moat.
“AI is only as good as what you feed it,” Ken told me. “If you feed it crap, you get crappy AI.” The real moat today is your corpus: your branding guide, your product specs, your legal docs, your actual accumulated intellectual property, the stuff that’s been hiding dormant in your Google Drive for years. The whole thesis behind enterprise AI governance is this: govern the corpus and the output both.
According to Ocean Tomo (intellectual property valuation research), intellectual property made up 10 to 15% of S&P 500 company value back in the 1970s. Today it’s around 90%.
It couldn’t be more clear that your IP is now the primary asset, and most of what your company is worth.
Why Waiting on Enterprise AI Governance Is Too Expensive
I asked Ken why so many enterprises are still dragging their feet on AI adoption. His answer is the reason I wanted to write this piece.
Courts have already repeatedly ruled that the company deploying an AI system is the one that’s legally responsible for what it does.
The Air Canada chatbot liability case is the clearest example… Their chatbot quoted a bereavement fare that didn’t exist, a customer sued, and the court held the airline itself responsible for the chatbot’s mistake.
“Naivete is not an option” – Ken Herfurth
“Naivete is not an option,” as Ken put it.
The risk math that enterprises are ignoring:
- Around 95% of insurance carriers pulled AI coverage from general liability and cyber policies as of January this year.
- Gartner (AI-related lawsuit projections) expects roughly 2,000 AI-related lawsuits between 2026 and 2027 to be severe enough to end the company that’s involved.
- Large regulated industries like automotive already take 18 months to clear a single AI use case through legal, which tells you how seriously the exposure is being taken internally.
That’s what enterprises get wrong when they decide to wait.
The sidelines only feel safe from a distance.
Every quarter you delay is a quarter you’re still paying the old, more expensive way of doing things, while your competitors who figured out how to adopt AI safely pull ahead.
The real risk is that you’re already losing to the version of this company that moved faster.
Ultimately, effective governance must be embedded, not bolted on. The organizations that are best positioned to thrive are those that are building their governance infrastructure alongside their deployment programs.
The stark fact is that treating oversight as an afterthought rather than an architectural requirement is a recipe for the kind of catastrophic failure that can end a company entirely.
Is Your Startup Falling Behind Its AI-Native Competitors?
The Three Ways AI Drifts From Your Source of Truth
I asked Ken how Ander actually catches an AI system that’s going off the rails, since “trust the settings page” isn’t a strategy. He broke it down into three specific failure modes his platform watches for.
Those three ways are:
- Semantic drift. The AI’s answer stops matching the meaning of your approved source of truth. When it crosses a set threshold, the answer gets pulled offline and routed to a human instead of guessing.
- Sufficiency drift. The AI answers a question even when it lacks enough information to answer correctly. Ken’s example: an AI that’s trained on basic algebra will still attempt a calculus question, with undue confidence, simply because giving an answer is what it does by default.
- Constitutional drift. The AI needs explicit moral and brand guardrails… in other words, a constitution, beyond simple bylaws. Skip that step and it will answer questions it should have refused, which is exactly how a “just curious” prompt can trick a chatbot into leaking information.
Plus, there is a bonus way: The “pleaser” problem. Current agents are often coded to satisfy user intent at any cost. This design tendency can lead them to prioritize user satisfaction over accuracy, causing them to fabricate answers or bypass essential guardrails simply to avoid the friction of acknowledging their own limitations or saying “I don”t know”.
Unfortunately these are not even edge cases! They’re the default behavior of any AI system if no one has stepped in to codify constraints.
Reproduce This Win
If you’re building something that’s ahead of what the market realizes it needs, you’re in the good company of almost every deep tech AI founder I’m talking to right now.
You may find it useful to see how Ander is sequencing its own go-to-market.
Many of the founders I speak to on a regular basis are building LLMs and governance layers (instead of just wrapping them – no fault with that though!). They almost all hit the same wall where they’re ahead of their buyer. The market hasn’t yet felt the pain or even named the problem. As a result, the startup’s messaging gets nebulous fast, especially when a product could technically help ten different types of people solve five different problems.
Ander is in a similar position with its flagship product, Ander IPX, the enterprise AI governance infrastructure that manages the relationship between a company’s AI and its intellectual property.
Instead of trying to sell the ambitious, category-defining bet cold, Ken is working to prove the underlying discipline somewhere safer first.
That’s Ander Learning, the company’s existing revenue engine. It uses the same source of truth and enterprise AI governance approach as IPX, but applies it to employee training instead of live customer-facing systems.
Basically he is validating and pre-selling with existing customers. A not-uncommon move to be honest.
I mean, why not… lower stakes, provable ROI, and real revenue today.
In fact, one automotive client ran the numbers: The 3,500 employees who engaged with Ander’s learning system sold 1 additional car per month than the employees who didn’t.
That’s pretty incredible for a product that hasn’t even launched publicly yet.
If you’re building the thing the market can’t feel the need for yet, find the safe, provable version of your idea first. Let that fund and validate the bigger bet.
Behind the Feature
I’ll be honest, some of this conversation was beyond my subject matter expertise, but in fun and exciting ways. I mean, quantum cryptography and constitutional drift aren’t exactly my home turf.
But Ken’s bigger point – about AI exposing every company’s weaknesses right now – it really hit home. If your intellectual property was never organized, AI is about to make that obvious to everyone, including your customers and your regulators.
Treat enterprise AI governance as infrastructure, and get your source of truth in order before something forces the issue.
P.S. Ken’s building Ander IPX in the open right now and looking for three kinds of people: founders who want to pilot enterprise AI governance somewhere safe (like learning and development), partners who want to help build out the process side of it, and investors who want in on the infrastructure play before the category has a name. If any of those are you, reach out to Ken directly on LinkedIn.
