Latest / TeqTalk with Jas / The Visibility Gap That's Costing Enterprises Billions in Ransomware AI

Transcript

The Visibility Gap That's Costing Enterprises Billions in Ransomware AI · TeqTalk with Jas

• speaker-0: Before we actually ask that can AI really defend us faster? Don't you think we should be asking can AI even see what it is supposed to defend? speaker-2: Everyone says, ⁓ it's like a tooling problem, like it's not a tooling problem, it's actually a human problem. We lack integrations of our platforms. speaker-1: not gonna sugarcoat it. Yes, attackers can actually operate at machine speed, whereas enterprises have a lot of compliance and governance needs, they are not, so to speak, able to act as a at a startup pace, whereas attackers can speaker-0: Thank you so much Eric and Aisha for joining me today in the panel discussion. I'm pretty sure it's gonna be very interesting. The topic is interesting and your backgrounds are really, really interesting, suiting the topic. Before we actually go ahead and start having a discussion, why don't you introduce yourself? speaker-1: Thank you just for having me. yeah, I'm Aisha and I I have a software engineering background. I've been in this industry for a number of years. You'll find my verbiage cryptic because I don't want to give or date myself or so it's been a long time. And currently I'm in cybersecurity domain. I have worked for companies like Apple, have worked for Apalo Alto Networks, and ⁓ the cybersecurity domain is interesting. It's very fast and always something exciting to to work on. and these days it's all about how to secure against AI. So I'm loving it. ⁓ I lead an engineering team at Zscaler. Today and this team builds the experience platform, which is basically ⁓ a way for our customers to go and set up policies, do administrative tasks and look into observability or visibility ⁓ or insights on what's happening ⁓ on their enterprise and secure themselves. The most important part of my my life, which is my family, I have to mention them, otherwise they will be upset. ⁓ So yeah, I I have three kids. I have a ⁓ fourteen going on fifteen, ⁓ getting into high school, and eleven years old going into twelve, ⁓ becoming a middle schooler. So big, big milestones. And then I have a seven years old daughter going into eight, ⁓ into third grade. ⁓ so I live in the Bay Area with my lovely family and I love hanging out with my kids, my husband, and we love traveling together. All right. speaker-0: I'm pretty sure you're enjoying enjoying the preteen and teen stage of your kids. A wonderful time. Thank you. Thanks, Aisha. Eric. speaker-2: Okay. So ⁓ Eric Gaston, thanks for having me. ⁓ Jazz. Nice to meet you as well, Aisha. ⁓ so I live in New Jersey. I'm outside of New York City. I was born here. Actually I ended up all over the world. I lived in Germany, I've lived in New Zealand and Australia and all over, and then I still came back to New Jersey. somehow somehow that happens. ⁓ have two children. So I'll start with a family. So I have two children. My ⁓ my son, as I said, they're they're both adults now, so I have a son who's ⁓ graduated from Boston College last year. He's working in New York. And my daughter is currently a women married. She's gonna be a rising junior. so ⁓ been proud proud of my kids, love my kids. We actually have a really, really close family. ⁓ my wife and I, ⁓ yeah, we we are ⁓ Empty nesters and we we enjoy a lot of ⁓ again traveling and ⁓ especially with work. I traveled a lot last year. So I did a f over a few over two hundred thousand miles around the globe last year and we were fortunate enough that she was able to come with me on a lot of trips, so that was really good. Career wise, I've been doing this I I'll I guess I'll just date myself. I've been ⁓ doing technology for a while. ⁓ so I started my first ⁓ big role, I guess, running anything was probably About 2005, 2004. ⁓ So I've started in banking primarily. Ran platform data services at Deutsche Bank. I've ran Target State Architecture as a CTO at Morgan Stanley. And then I've done and product management. And then I've also been a CTO of a software company. So a large global trade platform called Intra. And ⁓ that was kind of my time as a practitioner. All my work as a practitioner is around transformation. Thank you for having me, John. speaker-0: Let's begin. Let's deep dive. But before we actually start having a discussion on AI part, I would like to start with the foundation's visibility, right? So I I would like to read a statement from Microsoft, which was a report named as Digital Defense Report. And that report found that in ransomware, cases that reached the ransom stage, over 90% used unmanaged devices. Either for the initial access or remote encryption. This statement and this ⁓ report has really ⁓ stayed with me because it means that breach often starts where enterprise visibility is zero. So and my reaction is before we actually ask that can AI really defend us faster? Don't you think we should be asking, can AI even see what it is supposed to defend? Coming to you, Eric, first from a CIO lens. What's your opinion? I I I want to understand that how enterprises really operate when they have this level of invisibility. speaker-2: I mean, yeah, so that's that is a good question, right? ⁓ you know, the the the bottom line is really that, you know, anything to prov either perform well or to be effective, you have to have the the observability or the visibility. If you can't touch it, you can't secure it, you can't manage it. And I think we've been struggling with that for years. And if you look at different industries, ⁓ advancements make it even harder. So if I take healthcare, medical devices, things that don't have chips, stuff that sits at the edge. ⁓ the the big problem with observability is is that most companies were designed sort of from an inside out approach. And if you look at how technology's evolved, you know, technology's sort of started in the middle. The problem we're running into now and the reason why that visibility is becoming more and more difficult to manage is that our businesses no longer grow at the core. They grow at the edge. And we keep adding devices and adding sorts bring your own device. And then if you look at, you know, the pandemic, we We immediately had to make this pivot and add more to you know, so we added so much weight at the edge. And I think the the big problem you have with it is when I talk to CISOs and CIOs, they just go like, look, like the table has no edges anymore. And then we started using third party software. We expanded the number of APIs. We like you start thinking about this, it just keeps like snowballing. ⁓ so yeah, so that that seventy percent. ⁓ It's not so much the what's in the seventy, it's what's it's what's in the thirty or even you know, and even places where they say, ⁓ we're ninety five percent. It's like the five percent is the tough part because you can't, you know, you can't look at this and say, observability, visibility, it's the core for everything. It is the foundation for every single security program. Step one is always get visibility. So I'll stop there. I know that's a lot, but ⁓ I'll have to pass. speaker-0: I'll I'll come back to you ⁓ to know some of the scenarios, but then let me ⁓ go to Aisha and check. ⁓ Aisha, do you think from the engineering perspective, right, when AI is getting trained on this incomplete telemetry data, ⁓ what do you think it fails loudly or quietly and what matters more to you as an engineering leader? speaker-1: Thank you just for that ⁓ question. I think we all have heard lines like AI is as good as the data and we all kind of know that when data is incomplete, and then the SLIs or the metrics that we have defined are not good enough. They don't take into account that completeness, then we have ⁓ assumptions that are that are not you know, validated or not trustworthy. You can fully trust those assumptions. So these problems then get exposed more because you have incomplete data, you're telling half the story, and then those assumptions that tell that half the story are incorrect. That's like the accelerator, but let's look at what we are already doing wrong. Or what are the what are the challenges, which is observability, having completeness of that data. And you are very right, Eric. Sometimes ⁓ and most enterprises didn't focus on that completeness because either they they that was their blind spot, they they were v busy like either shipping features, and then I have seen it from the side where the enter the enterprise or cybersecurity company that's focusing on like securing that. So what I would say is AI Security is n it's not failing because models are weak or, you know, the tech is not there. It's mainly because of that quality of the data. And when I say quality of the data is how complete is it? Are you capturing all the signals? are your dashboards only showing you the stuff that you put there with assumptions or are you looking at signals that ⁓ you didn't consider or are you challenging all the assumptions? So success is when we start challenging the assumptions. We look at this ⁓ and then we also look at the trustworthiness of the data. Like can we trust it? AI is security is failing silently because it's failing on the things where we didn't we weren't paying attention to unmanaged devices, for example, or like unauthenticated traffic. speaker-0: Yeah, I shall completely agree to it. And Eric, from your lens, I would like to know that what are some of the steps ⁓ senior leader, CIOs can take to have more visibility in their organization, right? speaker-2: So there's a there's a couple things. And I think part of it actually has to do a lot with what what what you were talking about, Aisha. The first problem you run into is that ch it's change management. And and you know, when I look at engineering, so I you know, I run product development and when you start to do it, that you get in this pattern, right, where ⁓ instrumentation, for example, all the sort of non-functional requirements start going into your your product ⁓ or not. And then it seems like every time you make a release. ⁓ you kind of contribute to the problems you already have. So you spend the whole month kind of unwinding things and fixing them. And then you get to the end of the month and then they put a you know you put something into production. And so I'd say first thing is, you know, make sure that through your SDLC and and your process and your release, like there has to be good governance. You can't squeeze the balloon and and develop for, you know, have a huge development cycle and no testing. Like testing is very important. And if you start to think about the ability of AI to generate unit testing and things like that and and regression. It's an incredible advancement. So the first thing I think is is that is really get focused on that pre production kind of like the the the process through SDLC. The other thing is you have to partner with the business. If you're a leader, ⁓ shadow AI or shadow IT it's been a problem for years. The big problem you start to run into is, you know, the business has money. They go out and they s they start to to build things sort of behind your back or when you don't know them, they put them in production and then you're there with assets. That's where a lot of it comes from. The IT department, we're gonna set the guidelines, we're gonna provide, you know, governance and we're gonna have buy-in from you, but I need business stewardship. The business actually has to understand that they own the data. They own the outcomes. We're here to help deliver that for you. If you don't have that relationship tied together, you're gonna end up with a bunch of assets and a bunch of data that has no ownership. And you don't really even know what the business outcome of them are. And that's where you put your your the most risk, I think, on an organization from visibility. speaker-0: So ⁓ I think with what you have said, ⁓ like inventory management, endpoint management, asset management, and all of these area we should have tight kind of scrutiny and ⁓ whoever is coming in, coming out should be tracked properly to have the hundred percent visibility. Absolutely. Right. And is there any framework or something we can we can talk about ⁓ to maintain this? I know this is a very, very broad topic, but on high level if you think of any ⁓ framework. Open question to both of you. speaker-2: I mean I I just have zero trust that I would hope. ⁓ speaker-1: Yeah. ⁓ I think I wanna add one thing to what Eric was saying. Like, you know, what he's saying is along the lines of making security as first principle when you're building. So from an engineering point of view, from the time that you make a code change and you commit this, there should be, you know, ⁓ security scans running. So your Black Duck, your check marks, your SAS scans and y Like all those scans should be running. And now I think people in engineering domain or leaders should be thinking about how to run AI you know scans in in like, for example, we've been hearing about, you know, Anthropic and OpenAI launching these new models that are focused on ⁓ the the sp security domain. so I think those things should be big as first step, right? Not not later on when it's in production. So that's one thing. And then I think generally from a fra framework point of view, it's zero trust. And now zero trust with AI, of course. and and and it's not just now, whatever we were doing with AI scans before, it just needs to become part of the CI it ⁓ the continuous integration process when you're you're building things. So I think One thing ⁓ with zero trust that I I wanna say is like, you know, that's the whole point that you are looking at all the unmanaged endpoints, you're looking at all sorts of traffic, you know, agents, ⁓ unauthenticated traffic, you're looking at shadow SAS, you're looking at, you know, east west blind spots, you're looking you're paying attention to signals that you might have missed otherwise. And why is that important? Because See, in cybersecurity, you know, you have to have confidence in your approach. And it's expensive if you misplace that by having assumptions about some signals that that you ignored them. So yeah, that's that's kind of you know, my add on to what what Eric is ⁓ Eric was saying and what you're asking in terms of framework. So security as a principle and zero trust with AI. So speaker-0: We have talked about visibility. We have talked about ⁓ the best practices one can take to make sure that you know things are visible before actually implementing AI so that they just do not enhance that blind spot and they work on the realistic data. So moving on to another pillar, which is the speed gap. So we have seen the rate, the pace with which AI has been accelerated from the last couple of years now. And similarly, the attackers, the Crime rate has also been increased on the same way, or maybe it has doubled. So I have ⁓ again very interesting report, and it says that average e-crime breakout time has dropped to 29 minutes now, which was something like 48 minutes, and before that, it was some 60-62 minutes. Just imagine within half an hour, any crime can happen. ⁓ let's start talking about it that how How we can really, you know, compete with the cybersecurity crimes and it's not only one industry which is impacted. Eric, Aisha, open ⁓ for both of you. If attackers are moving as twice as fast as five years ago, what do you think we should take actions from our side to make sure that our systems are, you know, stable, concrete? speaker-2: Yeah, I mean the the the whole point we're you know running into right now is that you know i it's almost like great is the enemy of good. And I think what we start to see is, you know, the the the way our systems are arranged, you you really have to think about re-architecting and looking at how you're built. ⁓ so for example, most most security teams were built around tools and teams. So We bought tool, we have a team, and we have a tool and a team. And the it's you know, and everyone says, ⁓ it's like a tooling problem. Like it's not a tooling problem, it's actually a human problem. It's ⁓ we we lack we lack integrations of our platforms per se. We we fight like latency and error rates and response times and things like that. Like these are, you know, there's performance metrics baked in, but a lot of those are indicative of of being attacked. Now, obviously, you know the the if you think about how the gangs and how the how the attackers have changed as well. ⁓ you talk a lot about ransomware. Ransomware now has moved to cyber extortion. They don't want you know, w you've you've moved from these sort of government problem we're running into now and and I see this a lot is like you can't think of your security posture the way you used to look at it. We used to look at it and ask the questions like are we protected? Are we doing enough? And then they would throw a tool and a team at that. Now, the question you really need to ask is, you know, what do I look like to an attacker? And what do I look like right now? And that's a very different question. And that requires things like you cannot protect your systems without real-time data. You cannot protect your systems if you don't know if your security controls are present and effective where they need to be. on that edge. That's all that we talked about, right? Where your business is happening, where your third parties are coming in. So that's where the risk lies. ⁓ the reason why I think it's getting so fast is because business is all happening out at that edge. There's just a lot more places and little spots that people can kind of dig in and and grab grab hold and then, you know, start to move laterally through your business. So I think, you know, to me it's it has a lot to do with with that. speaker-0: Actually you want to add on top of what Eric mentioned. speaker-1: Finding your attack surface is even more important today than like, you know, before. And that's what Eric was talking about, right? You you need to know what is exposed and w where you stand today with the all this AI accelerated attacks. And I'm not gonna sugarcoat it. Yes, attackers can actually operate at machine speed, whereas enterprises have a lot of compliance and governance needs and they they are not, so to speak, able to act at a startup pace, ⁓ whereas attackers can. And ⁓ earlier maybe, you know, we they had the luxury, the enterprises, to to just be that way, but now not anymore. We are realizing that ⁓ but attackers are fast. It's not it's not a hype. It's not like, you know, it is happening in real time and we're seeing it. Especially you saw the recent NPM supply ⁓ chain attacks and You know, so this is happening and ⁓ we cannot be reactive and by that I mean like understand your attack surface and put programs into place that that can address those gaps. speaker-2: You know, single pane of glass isn't isn't realistic, but you need to have like one control plane for every type of say domain level problem that you're trying to solve. You can't have multiple sources of the truth. So, you know, getting your your data and bringing that together and saying like, okay, I have this is my control plane for dealing with, you know, like specific just across your domains. You can just look at the different whether it's identified identity management. This is my identity management, you know, dashboard and and place where we go for the for those answers. You know, we start looking at like the different spaces. So I think that's extremely important as part of your strategy if you're gonna succeed in this one. speaker-1: I'm just smiling because Eric said single pane of glass is not possible and that's the very project that I'm ⁓ I've been working on for two and a half years. It's possible, it's real, and I will show you. speaker-2: At least consolidate their that's a speaker-0: Yeah. So Eric you mentioned about the strategy. So in your ⁓ whole career of decades, have you ever seen the common leadership decision failure which is causing such kind of, you know, breaches? I do not want you to name the organization or anything, but if a small scenario which comes to your mind and you can talk about it. speaker-2: It's not so much the impact, right? That initial impact happens, you look at the blast radius, you start to think about okay, how big is it? What what they have a hard time controlling is really the dwell time on it. And that creates this tail on the monster. Now, in certain industries, it becomes a an issue. So, like if you're in financial services, you always have, you know, you got 24 hours in a day, and then the next day you gotta start trading again. So if you can't fix it, and as that dwell time expands out and you're trying to you know, pull in and then reprocess. As you're fixing, it it starts to, you know, you it you're you're up against time. I think the biggest problem in terms of leadership and and common decision is that it has a lot to do with communication. Delaying communication is always a problem, you know. And I think that everyone's trying to be, you know, again, great is the enemy of good. This you cannot go for perfection in this one. Like said, to be honest, if you're if you're ninety percent there, you're you might as well be a hundred because that last five to ten percent, ⁓ from an instrumentation perspective's gonna cost you a fortune. You're gonna spend so much time on it that you're gonna, you know, you're gonna ignore the body while you're there worrying about the the thumb and the pinky finger. speaker-0: Great. And Aisha, I would like to know from you, do you feel there is a gap in what has been committed in ⁓ to deliver in production? But when actually the product comes out, sometimes do you feel frustrated that okay, no, this I do not want to know exactly in your situation, but have you seen in your organization want to put you in trouble? Or or or someone working in this phase, that engineering team. They're working hard, but then ⁓ There is totally a gap between what has to be produced and what actually is being produced as an outcome. speaker-1: that don't lose sense of the first principle or why we went out to do something in the first place. I see that happening less. And if that's that's kind of part of the process. That at every level of review, you are saying, did we meet our definition of done that we set out or set in the beginning of when we try to roll out this feature. So I would say yeah, it it it happens, but with good kind of ⁓ SDLC where you have that those success metrics definition of done with each engineering outcome that you've defined early on. ⁓ and then you validate that at each ⁓ you know review step before you ⁓ push things to production, then it happens less. ⁓ I think in those cases where it happens less and that you know maybe five percent of the times that you didn't do well is if you made assumptions in the beginning of what your customers would need to secure your enterprise, then then that would happen. ⁓ but then I I think ⁓ great companies have a lot of user research and they're like right there hand in hand with their customers, ⁓ figuring out whether each step of the way, whether we're building the right thing for them. Yeah. So I think that helps a lot a long way to be more systematic about it. speaker-0: Yeah. And when we talk about cybersecurity, it's such important portion and heart of any enterprise. And when we use technical points like endpoints, telemetry, identity, ⁓ detection, response, it is easy to say in technical words than to actually adapt and implement in the organization. So ⁓ I was also reading about one of the biggest scams happened ever in the US healthcare system. It was in twenty twenty-four. It was the massive breach and Approximately one ninety two point seven million individuals were impacted by that. And it happened in the healthcare system. So before going to Eric Aisha, ⁓ from the engineering side, if you can tell me, when when a breach like this happens, right, does that land really differently for someone who has put a lot of efforts in building the platform protecting those systems? speaker-1: Yeah, of course, because you made some assumptions and now, you know, you didn't achieve the results, right? So I I would say that a good engineering team would learn from that and then they'll look relook at their process and say, Okay, what can we change? What assumptions need to go out the door and we need to change our process to that and I I think that's where, you know, but today I'm learning is that we have to look at end to end. For example, you were Talking about identity. You can't have a single pane of glass for identity if you have fourteen different products that have different ways of authenticating and authorizing your your customers. ⁓ so you need a platform approach there. and so I think everything now needs to be looked at from a platform lens and end to end coverage. And when I say end to end, before you even write a piece of code, you have to think How will you monitor it in production? How will we you ⁓ ingest those signals? Because now actually AI is writing your code. So once you push it to prod, you need to be observing it. There has to be some sort of trust scoring. How much can you trust the the there has to be s ⁓ you know some and and y I'm not saying observability that you have thousand alerts coming? Every day and then now you have tr alert fatigue and you can't cut the noise. So I think these are the things that we put for the very end traditionally in the past. But after 2020 we realized that we can't, as engineering team, we need to put these like up front. So yeah, I I would say that those are the learnings that we should now incorporate into our process and we have to do it fast. And it's ⁓ we all know that it's really hard. to change a process a at scale at a big enterprise. So enterprise needs to start working as small startups within ⁓ and and the ones that are already doing it have leverage, I guess. speaker-0: Yeah, I think it's rightly said, and that's a reason even this the attacks these are happening. They are also smart. They are seeing where the enterprises that are having legacy systems, those who are having dis a lot of disconnects, they are, you know, ⁓ attacking those systems. So it's very well said that it has to be accelerated fast in terms of, you know, connecting the systems and adopting all of ⁓ the best practices from the security point of view. As soon as possible. Going back to my previous question, Eric, I would like to know more from you. What was your reaction when this attack happened? Change healthcare? Who what was the frustration inside you and what were you thinking that it could have been stopped if we had done, you know, all the organizations have done these things? speaker-2: Yeah, you know, the the the biggest problem you run into is that you know everything becomes a bolt-on as part part of your strategy. And I think that's where you see the issue. Security was always the fifth bullet or the fourth bullet. You know, was like, ⁓ we're gonna go do this, this, and then ⁓ wait, security, let's put some security. It's like and I think what we're starting to see in this process, and and you touched upon it, right? So we think about your CI C D pipeline. We think like if you start to look at how AI is changing the face if we, you know, talk about engineering, it's changing the face of engineering because What it's doing is it's it instead of going through this full SDLC where there's like handoff, like, ⁓ let's all sit in a room and do our go go decision now and like that's over. So let's talk about, you know, change healthcare. What you know, why is it so difficult to kind of unwind and look at that? Because a lot of healthcare companies, the way they're built, they were built on like huge server farms. They buy a bunch of COTS applications, they bring them in together, and then they start to like do these integrations in the background. Like, okay. So you it it's like i it it it feels like a black box. It's kinda not, but you can't follow all the different decisions that were made throughout it. So that when a breach happens, like that thing's being held together literally by like you know, it's pretty pretty brittle. And when it breaks, you see it break like that. You know, right through to execution. It all has to be working together. I think that's to me like the big lesson learned from things like this change healthcare. It's like you start looking at this like Wow, we have to really think more, you know, end to end. And we have to incorporate you know, the the security strategy has to be part of this. Now AI is going to be a part of this. So we're we're we're starting to like see these things like there's no more bolting on things. You have to actually bake them in. speaker-0: Yeah, and according to the ⁓ public reporting or for change healthcare, attackers entered into the remote access p portal that did not have ⁓ a multifactor authentication. Nowadays it is so common to have it, right? speaker-2: Yeah, you think about that, right, Jazz? It's like how do attackers get in? It's the same way. Passwords, lack of authentication, passwords. It goes back to the you know, we talk about ⁓ you know, zero trust is a strategy, so trust but verify or don't trust any you know, don't trust anything, verify everything that's coming through. ⁓ I think in that case, when you start looking at it, it's like this is this is what you're seeing right now. It's like E even the attackers having new modern capabilities come in, they still come in the same way. They just do it faster and at higher scale, but they're still doing the same things. We can just do the same things but just a lot more and a lot faster. speaker-1: Yeah, I th I I think you just hit you know, hit it on point. ⁓ I will just add this again in going back to that whole sentiment of you know, we have to redesign the enterprise is actually this same concept. Earlier the the technical team under CTO and you know the IT teams and the business were working toward their own kind of This is our strategy and we're gonna go do it and afterwards we're gonna think about security or or that. So that just has to kind of shift left and become like the first thing ⁓ upfront. ⁓ I'll say another thing from an engineering point of view. ⁓ I'm I can see now like we also have to basically say, no, you know, how you do SDLC, but also your thinking, your mindset. Like what do you pri how do you prioritize? ⁓ security or velocity or you know, so I think security becomes like the next like v velocity, quality, security and and you know how we balance that and and we always keep security at the top because if we don't then the other two things really don't matter. speaker-0: Yeah, but I I think it's it's complicated as well, right? It's not easy because if we see industries like healthcare where there is legacy of data, they do not have a lot of budget to do, you know, implement things quickly. They have a lot of approval processes, a lot of guardrills, lot of compliances. And like how Eric mentioned, so many third parties integrations, they do not even themselves know that okay, th ⁓ we are integrated with this to get the data. So it's definitely hard. speaker-2: You know, if you think about a a healthcare company or any any large enterprise, their spend profile is like eighty percent of their spend is on infrastructure and the heavy and then you can spend maybe twenty percent on security like everything else, right? speaker-0: Exactly. And ⁓ that is what my next section I wanted to talk. We have spoken a lot about the visibility gap and but how AI is really going to, you know, impact and improve the systems. ⁓ would be happy to discuss Aisha from ⁓ would like to know from your viewpoints that what do you think how AI is really impacting what are some of the crazy developments you are doing if you're allowed to speak and how they are really going to, you know, impact the enterprises those who will be using Z scalar. speaker-1: I would say so some of the interesting things that we are doing with AI, of course, is beat AI with AI. So what can we do to you know, protect our customers, ⁓ enterprises ⁓ with agentic AI and you know how fast can we, you know, deliver features to them? How we can incorporate ⁓ AI into S DLC. We are doing things at a record speed now, like things that we did in six months before we can do in a month and a week, ⁓ five weeks or six weeks. ⁓ things that we did in a month or doing in a week. So we are accelerating a lot. ⁓ we're also investing a lot in validating that whatever we are doing using AI, is actually going to be something that we can support with full observability and you know, stay on top of ⁓ helping our customers. So these things are kind of baked as first principles as we ⁓ are adopting AI. I think in a couple of years, you know, landscape's gonna change. ⁓ nature of the job is gonna change. Yeah, I think ⁓ that's that's all speaker-0: All right. ⁓ thank you, Aisha. ⁓ Eric, what are you seeing some of the innovations happening with AI in this cybersecurity side? speaker-2: I on the cybersecurity side right now, I think, you know, you're starting to just see ⁓ you're starting to see a lot of movement if I look at like security, you know, security co-pilot, things like that that are in the market. ⁓ I think the the first thing I'll say, there's a lot of security dashboards kind of being created through AI. So that's the first thing, is the visibility side of this. ⁓ I think the the risk there, ⁓ you know, w we'll we'll table the the single pane of glass thing. whether we we think it's there or not. But the reality of it is, you know, ⁓ a lot of the AI, you know, it's gonna it it's learning as it's going. And I think i it doesn't have the it doesn't have the domain knowledge. It doesn't have a lot of the tribal knowledge that teams have, especially in healthcare and financials and things like that. So when you look at regulated industries, ⁓ I think what you're starting to see is, you know, AI will in these in these mashed up views create ⁓ false sense of security. It'll say, ⁓ everything's good. and and and then the the biggest mistake is that the people with the tribal domain knowledge will say, ⁓ okay, well we have full visibility now from from AI ⁓ across these key systems. And then they look at it and they're like, ⁓ wait a minute, but we're only we only have seventy percent of our our assets instrumented. So now we have a bigger problem. So like like like we've talked about we started right with this whole idea like there's fundamentals. visibility, making sure like, do I have everything? If you think that AI is going to make that situation a lot better, it's it's probably not because you have to feed it information. It's gonna it's gonna learn. So to to train those models, if you're training them with bad data, or you know, to me, that's why I say real-time data, it has to have real-time data. Cause cause what you're doing to it is is you're you're starting to give it the ability to have like adaptive controls within it. So no different than I'm changing lanes in my car and the mirror on my thing is lit up. Like, well I probably don't want to drive now. Now if I give you data from a week ago and you're like I guess maybe there's a car there, maybe not, you know, you you might take the risk. The other thing too, I think we start to use AI to score things, like confidence scoring. ⁓ I think we have to pressure test that a lot. You know, I think about some of these risk scores and risk risk trends, right? Producing confidence. you know, like I'll say, like, so we think about that asset inventory. Not all assets are the same. Some are higher risk than others. So when you start looking at them and saying, like, is everything instrument? Like, you're not gonna instrument them all the same. You're not gonna look at, you know, I'm not gonna view certain things, especially when I think about healthcare, because you're really looking at a business continuity problem, right? So the risk involved with this could lead to certain, you know, business t you know, shutdowns, continuity, ⁓ how you deploy the assets around your patient and patient care. It's it's not about, you know, the the system's shutting off. So I think there's a lot there. speaker-0: Absolutely. So you mentioned data is the core. Without good data, again, whatever you are building, even AI will not solve your problem, which is very valid and it's across all the industry, be it healthcare, finance, high tech, or any other. So ⁓ Eric, if any CIO is listening to this podcast and has one week to take any action, what is the first move that actually reduces risk? What are the recommendations from your side? speaker-2: ⁓ I think there's there's a few things that I would tell them to do, but the first thing is like if you're gonna do one thing, ⁓ so become a red team bigot. Go do your sixty minute breakout readiness. ⁓ Like, do it every week. Get your teams going. Like, are we ready? Don't stop stop looking at this from you know, the the how fast can we react. Start to become proactive. ⁓ yeah. So become a proactive red team bigot would be my first thing. And then the second thing is, and it probably dovetails on that, ⁓ stop asking questions like, are we safe? Like that's a terrible question to ask in this day and age. ⁓ so I say, you know, start asking the outside in questions. You know, see where you stand against that, and then from there take that outside in approach. Get to the point where you go around your walk around the floor. Hey, what do we look like to an attacker right now? speaker-0: ⁓ speaker-2: What is that that's like I'm out on the edge now looking back in, right? And it's like, Wow, this is this is what if you can answer that and you can answer that in real time, you're you're probably c crushing it in your job. So th those would be my two my two pieces. speaker-0: Awesome. Thank you so much, Eric, for the two awesome pieces of advice. ⁓ Aisha coming to you. One thing a security engineer leader should ⁓ do differently starting Monday. Starting this coming Monday. We are recording on Friday. So starting Monday, what do you think a security engineer leader should be making things different? speaker-1: at your SDLC end to end, find the top movers. I I already kind of ⁓ you know so I would say this is kind of looking at your system and identifying the things that will break first and then focus on on those. And you can use AI to actually do that. ⁓ you know identify at least the common scenarios where you will fail and and then you know start focusing on those ⁓ I I I think one of the things I'm realizing is engineering usually takes the brunt of everything and doesn't talk to business or the product partners. But it's that time where you have to evangelize why these things that you focused on, like RAS, tech debt, and and these things are also important for the business. So that partnership needs to happen and and they we all need to kind of work together to prioritize these items that we identify as like key key things that may fail in that scenario. So that's that's my my advice. And then one thing that I I really started to think when ⁓ you were asking me this question. I ha once had an opportunity to do a wheel of misfortune ⁓ with Google. It's I think a concept that they have. So I would say every engineering leader should be running a wheel of misfortune and that's what can go wrong? What are your assumptions? If something bad happened today, an incident happened like that, ⁓ what are the things that that will fail and and then start, you know, getting getting better at ⁓ making those things work? speaker-0: Great, awesome. Thank you for such candid conversation. speaker-2: Pleasure Jess. Thank you so much opportunity to to discuss this and