Organizations excel at generating massive volumes of unstructured data through recorded meetings. The struggle lies in extracting value from it. The reality is that most of this data is never touch again after its created. The temporal nature of voice communication creates unique challenges. These conversations capture real-time insights and concerns that are highly valuable for immediate decision-making. But traditional data management approaches fail to surface actionable intelligence before it becomes stale.

In this episode, Joe Essenfeld, CEO and co-founder at FORA, explains how their platform addresses these challenges by automatically processing recorded meetings to generate personalized, contextual summaries while maintaining strict data privacy controls. Joining him are Howard Holton, CEO at GigaOm, and Derek Fisher, Director of Cyber Defense at Temple University. The conversation explores how FORA’s AI-powered personalization engine creates individualized meeting cards based on organizational context and project involvement. The platform implements sophisticated filtering to remove personal banter and protects sensitive information through automated labeling systems that can detect IP discussions, HR-sensitive content, and accidental recordings.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, FORA

Full Transcript

[Voiceover] Connecting security solutions with security leaders, Security You Should Know starts now. 

[Rich Stroffolino] Welcome to Security You Should Know. Today, we’re going to be talking with Fora and what they’re doing in GRC. Now, the problem that they’re addressing is making sense of shadow data that’s generated from recordings. We’re recording everything, a lot of data out there.

If you’re not making sense of it, what good is it doing? Helping us get answers to these questions are Howard Holton, the CEO at GigaOm, and Derek Fisher, director of the Cyber Defense and Information Assurance Program at Temple University. Howard, I’m going to start with you.

Why is wrangling the shadow data from recordings a problem? We wanted all these recordings. Why can’t we make sense of them? 

[Howard Holton] Well, first, we’re really, really good at creating unstructured data. We’re also really, really good at doing nothing with it after it’s created, right? We ran a study at Hitachi and found something like 87% of unstructured data is never touched again after it’s first created.

The real struggle is we’re human beings, right? We use voice as our primary form of communication. We all talk about the value of face-to-face and voice communication, and so we created these wonderful tools, Zoom and Teams and all these things, to enable us to communicate as normally as possible over great distances.

We record this stuff, and then we throw it in a box and forget about it. And yet, all of the things that are said should be mined for the gems they can get to. At the same time, it’s also very temporal. It exists in a time and a place that is right now.

It’s not designed for publication. It’s not designed for something that is going to be lasting a year-long program where you really think about every word. That doesn’t mean it doesn’t have value, but that does mean you need to take advantage of that value right away.

[Rich Stroffolino] All right, Derek, I’m going to throw the question to you. Why are we struggling with this particular kind of shadow data? 

[Derek Fisher] Yeah, I want to kind of piggyback on what Howard said as well a little bit, about being temporal, because myself, I mean, I run my own confluence related to some of the projects that I work on, and I rarely go back and look at the stuff that I created six months ago or a year ago.

I mean, it has to be actionable in this moment. But I think in terms of over-collecting data, a lot of what my background has been in application security and one of the big things that we’ve always talked about in software security application security is if you don’t need to collect data, don’t collect it.

A silly example I always provide is if you have a website that’s hosting cat videos, why do you need somebody’s credit card number? But there’s been plenty of times where business says, “Well, we may eventually need that information, so collect it.” So, I think we sort of have to change that mindset of what is actually needed, required, actionable, and something that we can utilize today.

[Rich Stroffolino] Well, today we’re going to be talking with Joe Essenfeld, the CEO and co-founder over at Fora. To start out, Joe, let’s answer some essential questions here and help set the table and expectations for kind of the rest of the conversation.

First up, how do I explain the value of what Fora is doing to my CEO? What does your solution do, what does it not do? What’s the pricing model? Can you help us out here? 

[Joe Essenfeld] Sure, happy to help, Rich, and appreciate the opening. So, when you’re talking about how to address a CEO, you want to start with the value. And the first thing is that what’s being said in your organization is the best predictor of about what’s to be reported and what’s going to happen.

The idea for Fora for me came from a previous company that I had sold and understanding that what the sales team, what the customer team, what the product team was saying was the best predictor of success or failure, but you had to use that data right away.

So, using a solution like Fora gives you access to that data, makes it actionable with the context. Once we started the business and got into the real world in production, we started to have all of these data privacy and security questions come up of what am I actually recording as a business and a company?

So, we pivoted to make sure that we gave that security and compliance confidence to then allow the insights to be unlocked. So, it’s really that two-part solution where we address the GRC piece, and then we get to the actual value of what’s being said versus what’s being reported.

[Rich Stroffolino] Okay, CISOs, you’ve gotten a taste for the solution, but I’m sure there’s a lot of questions here. So, Derek, I’m going to start with you. What other questions do you have for Joe and Fora? 

[Derek Fisher] So, I mean, it’s pretty clear what Fora does in terms of collecting data and providing a good summary and making it actionable, but one of the questions I had as I was looking at this is a lot of conversations in meetings happen that may not necessarily be business related.

So, how do you protect or how do you scrub or eliminate that data? Let’s say two people at the end of a meeting still talking about weekend plans or potentially other issues that may be more personal because we know that those conversations do occur in workplace.

How do you handle that kind of situation ensuring that that data isn’t collected and potentially used? 

[Joe Essenfeld] Yeah, no, it’s one of the first capabilities that we added. So, we segment out the data that we track and collect starting at the video and transcript level, and then when we get to the AI process information, that’s where we start filtering out what we would refer to as banter and irrelevant discussions that are mainly personal.

So, we’ve injected a prompt library into the processing that’s designed to specifically exclude that information. It leaves it in the video, and it leaves it in the transcript, but any of the AI process information that gets distributed to the rest of the company does not typically have that data in it.

And we also inject the org chart into every single meeting that gets recorded that’s processed by Fora. So, we have both context of who’s saying what and if they’re inside the company or if they’re external to the company. 

[Rich Stroffolino] All right, Howard, I’m sure you have some questions. Let them loose for Joe and Fora. 

[Howard Holton] Man, I just want to start by saying I wish one of the big video conference call companies would just acquire you today because the little summary they send me afterwards, the top like third of the page is just banter, right? The call spent 10 minutes talking about pancake recipes.

Why do I care about that? How is that germane to getting any work done whatsoever? So, one of the big issues I have with any AI tool, and we can talk about governance here in a minute, but as a CEO, right, one of the big complaints that I have is the value in AI is in making all of the results personal, right?

Otherwise, it’s just search results that don’t actually matter for me and don’t actually matter for my business. What are you guys doing to make sure that this stuff matters not for a business that kind of sort of looks a little bit like mine, but actually matters for my business to help accelerate my ability to get work done and not just provide more data that I now have to figure out how to leverage?

[Joe Essenfeld] Yeah, so that’s our core IP is the personalization engine. So, after each meeting that’s ingested by Fora – and just to be clear, we can take a meeting from Teams or Zoom if it’s recorded there, or we can send one of our bots to the meeting and record it ourself.

We don’t care how it’s actually captured. Once the meeting is over, the async processing involves generating a card for every single person that has access to that meeting. So, that can be set at an org chart level and at a company and tenant level, meaning if you’re invited, you have access to it, but also if it’s on your team, you also may have access to that meeting as well.

So, each person that is granted access to that meeting gets a personalized card generated for them. That card includes a personal prompt, context from the org chart, and context from other projects that that individual is involved with. So, the goal is to have a much shorter summary that just tells you what you care about for that meeting in particular but also relates it to other meetings that you’re in as well.

[Howard Holton] I quite like that as a response. It does bring up concerns because that means that your data has to be really, really good. Also, it means the API interface to move data out of your platform has to be really good. So, talk to me for a minute about your API and integrations with other tools.

Like obviously like my project management tool as an example. 

[Joe Essenfeld] Yeah, so we architected it where our front end only speaks to the publicly available APIs of our backend, which makes it a lot more extensible for our customers and partners to build on. But we have some of our customers working on an MCP integration where they can pull their own data out of Fora, and it honors all the individual permissions, so we can give APIs to individual people, not just at the tenant or service account layer.

We also have a serverless architecture for integration specifically. So, my previous business was in HR tech, which was a mix of integrations, so we brought all that expertise to this particular company where we allow it to connect to external services like Snowflake, like S3 for certain media storage, but also to different CRMs, reporting tools, etc.

We do not want to be the system of record for anything except the core information that you can then process and use further as a business. 

[Howard Holton] Okay, I guess I have one final question, and that is sometimes calls contain things that people aren’t supposed to say. 

[Joe Essenfeld] Yeah.

[Howard Holton] Right? What are you able to do with that, and how do you make sure that the blast radius shrinks, doesn’t grow? 

[Joe Essenfeld] Yeah, so a couple different things that you can do. One is you can flag a meeting as private, which limits the content of the meeting only to the folks that are invited to the meeting itself. The second thing that you can do, which is a little bit more of an extreme action, is to flag the meeting for deletion.

That then goes through an escalation chain to then someone to either approve or deny that request. Because what we also need to establish is a precedent for data retention. So, there has to be an exception to that precedent if you want to delete a meeting.

[Howard Holton] Isn’t that an AI miss though? Like sure, if a human is involved and a human says, “I know going into this, this is an HR one-on-one conversation,” or “This needs to be private,” or there’s something about this that can’t leave the four walls of this cube that I’ve defined.

That’s one thing, right? But the other thing is the opposite. There is data loss. There is, hey, there are things we talk about, there are things we don’t talk about, right? There are some training opportunities, but then there is also information that, while it’s fine for people to discuss, I don’t want it to end up in any other platform, right?

There are all of these things that leveraging AI can help you detect, and that’s really what I’m hoping to hear. 

[Joe Essenfeld] Yeah, so we actually built a labeling system where you have natural language described labels with structured filters and then automation attached to it. So, from the GRC perspective, you can have labels that would look for certain content that might not be appropriate according to HR standards.

You also have IP labels that look for certain discussions that have sensitive IP in them that could automatically limit the distribution of those meetings as well. So, that’s a little bit more on the admin level where the labels are then created for both IP, for HR.

Also, there’s a really interesting label we developed for accidental recording, where it looks towards the end of the meeting to see if there’s an out of context conversation that happens because one of the most common hot mic moments is when you’re recording a meeting in a conference room, leave, forget to turn off the recording, and someone else walks into the conference room.

We’ve heard so many horror stories of that. So, that also can be labeled as accidental recording and then have that automated workflow. So, I really appreciate you clarifying that question because I was thinking of it more from the human angle, but all of that automation, that really comes to more of that GRC side of what Fora offers as well.

[Howard Holton] So, let’s hit on price here for a minute because this is a tough one. I’m paying for Slack, I’m paying for Google Workspace or Office 365, I’m paying for Zoom, I’m paying for Teams. I’m paying for, I’m paying for, I’m paying for, I’m paying for.

You are now another thing that I’m paying for, and if I’m being honest, it’s not cheap, right? I don’t really care for your pricing calculator. It seems odd that every 10 users, it seems like it drops a penny, but that’s a different issue. Like how do we justify another 12 bucks per user per month on top of everything else that I’m paying for?

[Joe Essenfeld] Yeah, I appreciate the feedback on the pricing calculator. It’s a hot topic inside of our company. I will say that every deal that we’ve closed, we’ve actually saved money just at the contract signing by turning off other tools. I think that is absolute table stakes for selling software nowadays.

Typically what gets turned off are the extra note taker licenses that we would backfill. I will say our pricing that’s on the website is retail, and we still have the playbook of negotiating. I’d rather be somewhat transparent and show one price than show no price and just have it say call because that just drives me nuts personally.

But I’d say that a lot of the enterprises that sign up for hundreds of employees, some are going over a thousand now that are actively using the platform, are seeing about 50% less than the price that you mentioned. 

[Rich Stroffolino] We’ve got about time for one last question. Derek, did you want to hop in there? 

[Derek Fisher] Yeah, sort of kind of going back to the AI-related content here. So, the data that you collect from these meetings, is that being used to retrain the model going forward? And if so, how do you ensure the confidential customer data is not being used to retrain that and then potentially being used at other customers?

[Howard Holton] Before you answer, and if you say it’s not, how do you prove that it’s not? Like what assurances do you have? And then cross-tenant as well.

[Joe Essenfeld] Right.

[Howard Holton] How do you ensure there’s no blending cross-tenant? Sorry, it’s a great question. 

[Derek Fisher] That was going to be my follow-up I was going to make. 

[Howard Holton] Sorry.

[Derek Fisher] Yeah, yeah.

[Laughter] 

[Howard Holton] We only have time for one question, I want to make sure it’s a good one. 

[Laughter] 

[Derek Fisher] I know, I know, same question. 

[Joe Essenfeld] It’s the question that we get in every single sales cycle that we’re in. The first simple answer is that no data that’s collected from Fora is used to train any model. Period, full stop. The way that we can guarantee that is based on the agreements we have with all the models that we use, where they’re not using any of the data that’s input to those models to train or refine the models themselves.

So, that’s the first answer. The second piece though is as we get more data in the system, what we do change and update are the prompts that are used by the individual users, by the actual teams to look at the meeting data across multiple meetings, across projects, etc.

So, we can make educated recommendations. Our customer success team can do that on how to update prompts to then look at that data itself. We can also support locally hosted models by our customers as well. So, we’ve built a pretty flexible platform that can point at different models for different use cases.

We actually do use Anthropic, Google, and OpenAI all for different use cases because we just found their models perform better for certain tasks. We have enterprise agreements with all the different providers that represent they’re not using our data to train their models.

[Derek Fisher] Sort of kind of fine tune that a little bit. I mean, do you have the ability to bifurcate that within your organization itself, like HR data, not mingling with engineering data and not mingling with finance data and so forth? 

[Joe Essenfeld] A hundred percent. So, the data permissioning can happen both at an individual department or team or location level, and the default is you only have access to meetings that you attended yourself. And then typically a chief of staff or a department analyst would then have cross-department access to meetings to then start combining product and sales to understand how roadmap is doing versus what’s being said in the field.

[Rich Stroffolino] All right, Joe, what’s one thing we didn’t ask about that we need to know? 

[Joe Essenfeld] Well, I’d say the thing that no one asked that I think is really important is how long it takes to get set up, and that was really important for us when building Fora that our average go live time post contract signing is under 14 days.

So, all of the integrations that we have with Zoom, Teams, Slack, Google are all prebuilt marketplace connectors. And typically we see the CIO or CISO and his or her team go live first in under two weeks, test out the system, the ingestion, the summarization, and then slowly roll it out to the rest of the team.

So, asking about time to live was something that didn’t come up and it’s something we’re really proud of and it makes a big difference, especially with AI pilots. 

[Rich Stroffolino] Well, that’s about it for this episode of Security You Should Know. To learn more, head on over to fora.day/CISO. And if you have any questions or feedback for this show, send them over to feedback@CISOseries.com. A huge thanks to Howard Holton and Derek Fisher for helping us learn more about Fora and thanks to Joe Essenfeld for your time and being game to answer all of these questions.

And thank you for listening to Security You Should Know. 

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on CISOseries.com or just email us at info@CISOseries.com.

Thank you for listening to Security You Should Know, connecting security solutions with security leaders.