Latest / a16z AI Policy Brief / Cyber Resilience in an AI World

Transcript

Cyber Resilience in an AI World · a16z AI Policy Brief

0:00
AI fundamentally gives attackers the ability to jiggle every
0:04
virtual doorknob continuously.
0:06
The institutions and networks and enterprises that underpin our
0:09
way of life need to
0:10
SPEAKER_01: be tested continuously and not just in some lightweight scan,
0:14
like seriously act as an aggressor and see if there are holes
0:19
throughout the
0:20
SPEAKER_01: enterprise.
0:20
Why the threat landscape is fundamentally changed is also why
0:24
the cyber defense
0:26
SPEAKER_03: landscape will potentially fundamentally change for the better too.
0:30
SPEAKER_00: In this episode of the A16Z AI Policy Brief,
0:33
Jairo Maswani sits down with Ann Neuberger and Sam Jones to
0:37
explore one of the
0:38
SPEAKER_00: fastest moving front lines in AI,
0:40
SPEAKER_00: cybersecurity.
0:41
SPEAKER_00: Recorded live at A16Z's American Dynamism Summit in Washington,
0:45
SPEAKER_00: DC,
0:46
the conversation makes clear why adopting AI and cyber defense
0:49
is a national
0:50
SPEAKER_00: security imperative.
0:51
SPEAKER_00: Anne draws on nearly two decades in government,
0:54
including serving as Deputy National Security Advisor for Cyber
0:57
and Emerging
0:57
Technology to explain how AI is changing the threat landscape
1:01
with attackers moving
1:02
SPEAKER_00: faster and at machine scale.
1:04
SPEAKER_00: As the CEO and co-founder of Method Security,
1:07
Sam shares firsthand experience building autonomous cyber
1:10
systems for both offense
1:11
SPEAKER_00: and defense.
1:12
SPEAKER_00: Together,
1:12
SPEAKER_00: they argue that if defenders don't move with speed and seriousness,
1:16
SPEAKER_00: they're left to fight a machine with manual tools.
1:18
SPEAKER_00: They highlight what AI makes newly possible to boost defenses,
1:22
SPEAKER_00: such as continuous testing,
1:23
SPEAKER_00: measurable resilience benchmarks for critical infrastructure,
1:26
SPEAKER_00: and faster recovery when disruptions happen.
1:28
SPEAKER_00: They close on the role of public policy to remove friction for defenders,
1:32
SPEAKER_00: enable high-fidelity information sharing,
1:34
SPEAKER_00: and modernize procurement so the U.S.
1:36
can deploy the defensive capabilities needed to keep pace with
1:39
our adversaries.
1:40
This is an important and urgent conversation about protecting
1:43
our critical
1:43
SPEAKER_00: infrastructure,
1:44
SPEAKER_00: strengthening cyber resilience,
1:46
SPEAKER_00: and keeping Americans safe.
1:48
SPEAKER_02: Welcome to the A16Z Policy Brief.
1:51
SPEAKER_02: Today we have Anne Neuberger and Sam Jones.
1:55
SPEAKER_02: Anne and Sam, would you mind just introducing yourself to the audience?
1:58
SPEAKER_03: Absolutely.
1:59
SPEAKER_03: Sounds like a first grade literature book, Anne and Sam.
2:03
SPEAKER_03: I'm Anne Neuberger.
2:04
SPEAKER_03: I'm a senior advisor at Andreessen Horowitz,
2:05
SPEAKER_03: but previously,
2:07
SPEAKER_03: I'm a distinguished fellow at Stanford.
2:08
I was previously deputy national security advisor for cyber and
2:11
emerging technology
2:12
SPEAKER_03: in the last administration.
2:13
SPEAKER_03: It's great to be here, Jay.
2:15
SPEAKER_01: Welcome.
2:15
SPEAKER_01: Sam Jones.
2:16
SPEAKER_01: I'm the CEO and co-founder of Method Security,
2:19
SPEAKER_01: and I've been working in defense tech my entire career,
2:22
SPEAKER_01: to include cybersecurity,
2:23
SPEAKER_01: and been doing AI since it's become a meme and such a hot topic,
2:27
SPEAKER_01: and excited to get into it today.
2:29
Well,
2:29
that's great,
2:29
and really appreciate both of you having both of you on the
2:32
podcast today.
2:35
SPEAKER_02: Now,
2:35
SPEAKER_02: Anne,
2:36
SPEAKER_02: Sam,
2:36
SPEAKER_02: both of you have written,
2:37
SPEAKER_02: I think,
2:37
SPEAKER_02: extensively on the issues surrounding AI and cybersecurity.
2:42
SPEAKER_02: Very hot topic.
2:43
SPEAKER_02: Clearly one of the risks that I think people are most scared about.
2:49
SPEAKER_02: And I think the real question is...
2:53
SPEAKER_02: whether this technology really changes the threat landscape,
2:59
SPEAKER_02: and if so,
3:00
SPEAKER_02: how,
3:01
SPEAKER_02: and if not,
3:01
SPEAKER_02: why not?
3:02
SPEAKER_02: But Anne,
3:02
SPEAKER_02: given your extensive experience,
3:05
SPEAKER_02: I'd love to hear kind of your thoughts on that kind of a landscape.
3:10
SPEAKER_03: Absolutely.
3:11
AI fundamentally transforms the threat landscape because
3:15
typically an attacker to
3:16
SPEAKER_03: achieve their objective,
3:17
SPEAKER_03: whether it's stealing information or whether it's disrupting a system,
3:21
SPEAKER_03: needs to do some degree of study of the network,
3:25
SPEAKER_03: of the administrator,
3:26
SPEAKER_03: who has rights on the network,
3:27
SPEAKER_03: where are their vulnerabilities on the network,
3:29
and then what's the right way once you get a foothold to
3:32
navigate through and
3:33
SPEAKER_03: achieve the attacker's objectives.
3:36
AI fundamentally gives attackers the ability to jiggle every
3:40
virtual doorknob continuously.
3:42
So even if a new patch comes out and the company is a bit late
3:46
or they deploy code
3:47
SPEAKER_03: that has new vulnerabilities in it,
3:49
it can be found so much quicker by an attacker who can just
3:52
continuously be looking
3:53
SPEAKER_03: for either misconfigurations in the network,
3:56
SPEAKER_03: coding errors that can be exploited.
4:00
SPEAKER_03: and to do so continuously at scale across a target set.
4:04
SPEAKER_03: So it fundamentally transforms that.
4:06
I will say that what's so interesting about cyber is that the
4:10
first steps of either
4:11
SPEAKER_03: exploiting or defending a network look exactly the same.
4:14
SPEAKER_03: It's finding the mistakes, the misconfigurations and vulnerabilities,
4:18
SPEAKER_03: What you then do with it is the key.
4:21
SPEAKER_03: So I think that what I just talked about,
4:23
SPEAKER_03: why the threat landscape is fundamentally changed,
4:25
SPEAKER_03: is also why the cyber defense landscape will potentially,
4:30
SPEAKER_03: if we can get our act together quickly,
4:31
SPEAKER_03: fundamentally change for the better too.
4:34
SPEAKER_02: Sam, your thoughts?
4:35
SPEAKER_01: So just on my perspective,
4:37
just because I'm constantly building with this stuff and aptly
4:42
pointed out
4:43
Regardless if your objective is to attack or to defend,
4:46
those first steps are the same.
4:47
And that's what we build systems to do,
4:49
whether it is to defend or to attack.
4:51
SPEAKER_01: So my team and I are building with this stuff constantly.
4:54
SPEAKER_01: And we've seen a huge evolution over the last two and a half years,
4:57
SPEAKER_01: which is the lifespan of method security.
5:00
Where last year I would characterize how the threat landscape
5:03
was changing as that
5:04
SPEAKER_01: purely everything.
5:05
SPEAKER_01: all known tactics, techniques, and procedures were accelerating.
5:08
Everything was just getting faster,
5:09
but it was all known things that were happening.
5:12
That still poses great threat to old defensive systems that can
5:16
hardly prevent
5:19
SPEAKER_01: basic attacks and basic threats.
5:21
We were seeing a lot of criminal groups that maybe were novice
5:25
in their skill level
5:26
SPEAKER_01: just be upgraded.
5:28
And that poses significant challenges for enterprises that have
5:31
bureaucracy in
5:32
place to adopt and deploy defensive techniques because they're
5:35
just purely
5:36
SPEAKER_01: outmatched at that point.
5:38
SPEAKER_01: But this year,
5:39
what we're seeing is pretty different is AI is now being quite
5:43
effective at exploit
5:44
SPEAKER_01: development.
5:44
SPEAKER_01: And so it's actually helping generate new tactics,
5:47
SPEAKER_01: techniques,
5:47
SPEAKER_01: and procedures to complement that existing acceleration.
5:51
So it's getting doubly bad in the threat landscape,
5:54
all the more reason that
5:56
SPEAKER_01: achieving resilience and defensive posture is like an urgent problem.
6:01
So I think what I'm hearing from both of you is that the way AI
6:06
changes the threat
6:06
SPEAKER_02: landscape is,
6:09
SPEAKER_02: you know,
6:09
SPEAKER_02: I was an old cybercrime prosecutor.
6:12
SPEAKER_02: And the days of kind of the Matthew Broderick load hackers are long gone.
6:17
SPEAKER_02: These are organized transnational criminal organizations,
6:22
SPEAKER_02: nation state actors,
6:23
SPEAKER_02: and sort of a combination of the two.
6:27
But what I'm hearing is that one of the differences is this now
6:30
allows a less
6:31
sophisticated class of actors to get involved because the level
6:35
of sophistication
6:35
you need comes down because AI is commoditized intelligence and
6:40
therefore a lot
6:41
SPEAKER_02: more people can do it.
6:43
SPEAKER_02: And then speed, scale, all those other things really are different.
6:57
SPEAKER_02: the capability aspect of AI is not asymmetric.
7:01
There are some technologies that will benefit attackers more
7:04
than defenders,
7:07
SPEAKER_02: but with this technology,
7:08
SPEAKER_02: I think what I'm hearing is that there's a sort of symmetry,
7:11
SPEAKER_02: that both attackers and defenders can use this.
7:15
SPEAKER_02: Talk to me a little bit about that.
7:18
SPEAKER_02: Based on that, what are the real net new risks?
7:22
SPEAKER_02: I think it's always helped to think not just
7:24
SPEAKER_02: What are the risks?
7:25
SPEAKER_02: What's new about this technology?
7:26
What do we need to worry about and then deal with from a policy
7:29
perspective?
7:32
So I want to answer actually the two really good points and the
7:36
two questions are
7:37
SPEAKER_03: fundamentally linked because AI does make attack far easier,
7:43
much more continuous and much and also continuous in the types
7:48
of attacks that are
7:49
SPEAKER_03: possible and evolving them.
7:51
SPEAKER_03: And as such,
7:52
defenders who aren't using AI in defense are in a much worse
7:56
position because a
7:58
SPEAKER_03: human against a machine in this game just
8:01
SPEAKER_03: just doesn't win.
8:02
SPEAKER_03: Humans and machines fundamentally can.
8:05
But there are certain parts of cybersecurity that speed now
8:09
matters much more and
8:10
SPEAKER_03: they have to be automated.
8:12
SPEAKER_03: Think about this.
8:13
SPEAKER_03: You know,
8:13
SPEAKER_03: we've long put in place,
8:15
SPEAKER_03: particularly post the rise of insider threats,
8:18
SPEAKER_03: monitoring to say what's a pattern of behavior,
8:21
SPEAKER_03: particularly for a particular role,
8:23
SPEAKER_03: where a person works,
8:24
SPEAKER_03: what their typical work pattern is,
8:26
SPEAKER_03: when they come to work,
8:26
SPEAKER_03: what are the kinds of data they are
8:29
SPEAKER_03: Authorized to look at if you're working on Asia bond markets.
8:34
It's something odd if you're looking at South American equities
8:39
or whatever it is.
8:41
SPEAKER_03: And as such,
8:43
but in the past what we would do is to avoid false positives
8:47
and potentially
8:47
SPEAKER_03: disrupting somebody's work,
8:49
that would alert and send it to a network administrator who
8:51
would investigate and
8:52
SPEAKER_03: say,
8:52
SPEAKER_03: was this legitimate?
8:53
Somebody's just working on something,
8:54
a new project,
8:55
or was it something malicious?
8:57
SPEAKER_03: Now there's a need to automatically turn off the account and investigate
9:02
SPEAKER_03: afterwards,
9:02
SPEAKER_03: because you can't risk that speed of what's possible in attack.
9:06
SPEAKER_03: So that is the net risk,
9:08
SPEAKER_03: very new kinds of adaptable attacks,
9:11
and that if defenders don't deploy AI-based defense with speed
9:16
and determine,
9:17
SPEAKER_03: frankly,
9:18
SPEAKER_03: the risk equation differently,
9:19
SPEAKER_03: we've often been worried about legitimately false positives.
9:23
SPEAKER_03: I think now because of the speed issue,
9:26
We've got to really turn the dial on automating as much a
9:29
defense as possible and
9:31
then ensuring that we can do investigations rapidly quickly to
9:35
turn things back on
9:36
SPEAKER_03: if needed.
9:37
I mean,
9:37
that puts a premium on the types of solutions that are out
9:41
there,
9:41
it seems to me.
9:42
And Sam,
9:42
you're building some of these solutions,
9:44
but that can be really disruptive.
9:46
SPEAKER_02: I mean,
9:46
SPEAKER_02: if I'm somebody who needs this information,
9:49
particularly in the financial markets or something where
9:51
actually it's not just for
9:52
SPEAKER_02: the attackers,
9:53
SPEAKER_02: but for the business,
9:54
SPEAKER_02: real time is real cost.
9:58
SPEAKER_02: How do you think about developing solutions in that kind of environment?
10:02
SPEAKER_01: I kind of almost work back from the buyer psychology,
10:06
SPEAKER_01: if you will,
10:07
whether that's a Fortune 500 enterprise CISO or a military DCO
10:12
or OCO commander.
10:15
All those groups have to accept serious risk when employing new
10:18
technologies
10:19
SPEAKER_01: because their domain is no fail.
10:21
SPEAKER_01: They're not making...
10:23
SPEAKER_01: sloppy internal development apps that could be fun.
10:26
SPEAKER_01: They're not making images or art.
10:29
SPEAKER_01: If their work goes down, they get fired for a specific reason.
10:34
Or there's an actual threat to the infrastructure or to safety
10:38
that's affected.
10:38
SPEAKER_01: Which then they get fired anyway.
10:41
So they rightfully are skeptical of employing too much new
10:47
technology too quickly.
10:48
SPEAKER_01: But at the same time, they also know they need to adapt to win.
10:51
And so what we have been trying to do is come from the stance
10:54
of AI is almost like
10:56
SPEAKER_01: a raw intelligence material is inherently not trustworthy.
11:00
And so how do you build systems around that raw ingredient that
11:04
no one should off
11:05
SPEAKER_01: the shelf trust such that it can be employed in production?
11:09
Can you dig a little bit more deeply into what it means to be
11:11
not trustworthy?
11:12
SPEAKER_02: What do you mean by that in this realm?
11:15
SPEAKER_01: For a no-fail security system,
11:17
whether that's an inline security control that's going to make
11:20
a decision of
11:22
classifying this as good or bad behavior and shutting down an
11:25
account or something
11:26
SPEAKER_01: like that,
11:26
SPEAKER_01: or deciding to delete data,
11:28
SPEAKER_01: whatever it might be,
11:30
leaving things up to too much non-determinism is like really
11:33
scary for folks that
11:35
SPEAKER_01: this is their job and it's like there's no tolerance for failure.
11:39
SPEAKER_01: So just the AI is especially this class of large language models is so
11:45
SPEAKER_01: non-deterministic and it's evolving so quickly that
11:50
you're not going to take chat GPT off the shelf and decide to
11:53
put it into a
11:54
SPEAKER_01: critical security control.
11:55
SPEAKER_01: There's just no way.
11:56
And so there has to be guardrails before and after and all
12:00
around anything at the
12:02
SPEAKER_01: AI core of some kind of security product.
12:04
SPEAKER_01: That's what we've tried to do very thoughtfully,
12:07
SPEAKER_01: both for defense and offense,
12:08
SPEAKER_01: and it's going over well.
12:10
It's a lot more to build than just making a really cool
12:12
prototype that is on the
12:13
SPEAKER_01: Internet that looks really cool.
12:15
We've been trying to architect for what is actually viable from
12:19
someone who will
12:20
SPEAKER_01: get fired if this doesn't work.
12:23
It's interesting you raise that point because oftentimes when
12:28
we're talking about
12:29
SPEAKER_02: AI,
12:29
SPEAKER_02: the benchmark seems to be perfection.
12:32
I want to push you on that a little bit because human beings
12:35
make mistakes all the time.
12:37
Are you saying that psychology of organizations is such that
12:40
when the human being
12:40
SPEAKER_02: makes the mistake,
12:42
SPEAKER_02: you're going to be forgiven for it because they see,
12:44
SPEAKER_02: oh,
12:45
we're giving you a certain amount of tolerance because you're a
12:47
human being.
12:48
SPEAKER_02: But if you put money on the line or you start relying on a technology,
12:53
SPEAKER_02: then my standard is different than it is when judging a human being.
12:56
SPEAKER_01: A little bit.
12:57
And we're probably going to see some similar psychology with
12:59
Waymos and Teslas,
13:00
SPEAKER_01: like going out to the road,
13:02
SPEAKER_01: which are definitively safer,
13:03
SPEAKER_01: but we're accepting a different type of robot risk.
13:06
I think what's different in cyber is that these technologies
13:10
can be deployed so
13:11
prolifically across the enterprise that they can make so many
13:14
decisions that
13:15
compound even lower error rates to a higher degree that it's
13:19
almost like you're not
13:19
SPEAKER_01: in control.
13:21
SPEAKER_02: So there is a new risk in that.
13:23
SPEAKER_02: The compounding effect is a net new risk given the speed.
13:26
SPEAKER_02: Exactly.
13:27
SPEAKER_01: Ultimately, what security teams, they want to be in control.
13:30
SPEAKER_01: Yeah.
13:30
SPEAKER_01: And AI off the shelf does not allow them to do that.
13:33
And so there's a lot of systemry around it,
13:35
and that's kind of what we focus on.
13:38
SPEAKER_02: And you've both talked about speed.
13:41
SPEAKER_02: What other things,
13:42
SPEAKER_02: and now we have this sort of compounding risk,
13:44
any other net new risks that you can think of that this
13:47
technology introduces?
13:49
You know,
13:49
I'm struck by your comment of being a former cybercrime
13:52
prosecutor.
13:54
SPEAKER_03: And,
13:55
SPEAKER_03: you know,
13:55
SPEAKER_03: I'd love to ask you back that question,
13:56
SPEAKER_03: but first reflecting on it,
13:58
SPEAKER_03: when we think about cyberspace,
13:59
SPEAKER_03: there's really three sets of actors.
14:02
SPEAKER_03: You mentioned it at the beginning.
14:04
There are pure criminals out for financial gain,
14:08
the rise of ransomware,
14:09
and an entire
14:10
SPEAKER_03: pretty sophisticated ransomware ecosystem in the last few years.
14:14
SPEAKER_03: The first set of groups who gets access and sells that access,
14:17
SPEAKER_03: the second who builds exploits,
14:18
SPEAKER_03: the third that does negotiations,
14:20
SPEAKER_03: the fourth that does the process of the payments and the decryption.
14:24
SPEAKER_03: It really rose and funded.
14:26
We're talking billions of dollars in ransom revenue that really
14:29
drove this ecosystem.
14:31
SPEAKER_03: And the challenges of pursuing them was,
14:34
SPEAKER_03: first,
14:34
SPEAKER_03: you have some countries that offer safe haven to the actors themselves,
14:38
other countries that offer safe haven to the virtual asset
14:41
service providers who
14:42
SPEAKER_03: don't follow anti-money laundering rules.
14:44
SPEAKER_03: So actually, the prosecution of the much more complex...
14:49
SPEAKER_03: cybercrime ecosystem became far harder.
14:52
SPEAKER_03: The reason you saw kind of groups of countries working across,
14:56
SPEAKER_03: you know,
14:57
SPEAKER_03: and transnational rules don't really exist.
14:58
So they'd essentially be cobbling together an international
15:01
system to deal with a
15:02
SPEAKER_03: criminal problem that crosses borders.
15:04
SPEAKER_03: Obviously,
15:04
SPEAKER_03: there's also the set of threats,
15:06
which are more countries seeking to disrupt at a convenient
15:09
period of time.
15:10
And then there's the loose gray space of countries who usefully
15:13
use hacktivists or
15:14
SPEAKER_03: actors to achieve their goals.
15:16
SPEAKER_03: And I think the speed on the action also,
15:21
SPEAKER_03: while it can help in using AI to draw across,
15:24
SPEAKER_03: let's say,
15:25
SPEAKER_03: here's the malicious infrastructure that was used for an attack,
15:28
it has become far harder to find the evidence because attackers
15:33
can also clean up
15:34
SPEAKER_03: that infrastructure far more quickly as well.
15:37
SPEAKER_03: So I think the attack infrastructure has become easier to set up,
15:40
SPEAKER_03: tear down,
15:41
SPEAKER_03: and our laws and policies in actually
15:43
pulling the thread to investigate it and bring folks to justice
15:46
and begin to deter
15:47
SPEAKER_03: it,
15:49
SPEAKER_03: remain pretty much the same.
15:51
So that speed is now playing against the ability to deter and
15:55
counter these actors.
15:57
SPEAKER_02: Yeah, I think that's right.
15:58
SPEAKER_02: I think in the cybercrime space,
16:00
SPEAKER_02: one thing that really changed the game was the Budapest Convention.
16:04
SPEAKER_02: Yeah.
16:05
SPEAKER_02: because sharing of information is hard in a prosecution.
16:10
SPEAKER_02: Cybercrime happens in real time.
16:13
Legal processes take months,
16:14
sometimes years,
16:16
to put in a mutual legal assistance request.
16:21
SPEAKER_02: And so I think there probably does need to be some additional kind of
16:25
SPEAKER_02: infrastructure built to deal with the even now increasing speed.
16:31
SPEAKER_02: But in some senses,
16:34
SPEAKER_02: My thought is that,
16:36
SPEAKER_02: and I'd love you to validate this or not,
16:39
SPEAKER_02: as we move to what you described,
16:41
SPEAKER_02: Anne,
16:41
SPEAKER_02: as an AI versus AI world,
16:43
I'm going to date myself when I think of Mad Magazine spy
16:45
versus spy when I think
16:47
SPEAKER_02: of AI versus AI,
16:48
SPEAKER_02: but where AIs are essentially fighting against each other for measure,
16:53
SPEAKER_02: countermeasure,
16:54
SPEAKER_02: offense,
16:54
SPEAKER_02: defense.
16:57
SPEAKER_02: How does AI tilt the playing field one way or another?
17:02
SPEAKER_02: Does offense have an advantage?
17:05
SPEAKER_02: Does defense have an advantage?
17:07
We'd love to have your thoughts on who benefits more from this
17:11
since both will benefit.
17:12
SPEAKER_03: Yeah.
17:13
SPEAKER_03: And I'm looking forward to hearing Sam's thoughts too.
17:15
SPEAKER_03: Defense is fundamentally harder.
17:17
SPEAKER_03: And that's why I think defense benefits more.
17:19
SPEAKER_03: In short,
17:20
SPEAKER_03: you know,
17:20
SPEAKER_03: an attacker has to find one way in and there's,
17:23
SPEAKER_03: especially on a large network,
17:24
SPEAKER_03: especially on a hybrid network,
17:26
SPEAKER_03: some of it on premise,
17:27
SPEAKER_03: some of it in the cloud,
17:28
SPEAKER_03: there's likely to be a misconfiguration,
17:31
SPEAKER_03: a system that just,
17:32
SPEAKER_03: you know,
17:32
was down when the patch went out or code that got pushed and
17:37
somehow there was
17:39
SPEAKER_03: vulnerable code there.
17:40
So it's far harder for defense to always ensure that that
17:44
entire space is safe.
17:46
SPEAKER_03: On the other hand,
17:47
SPEAKER_03: so much of cyber defense today is still manual,
17:50
is still bringing together lots of different data to find
17:54
what's anomalous.
17:55
SPEAKER_03: And once you figure out what's anomalous,
17:56
you can figure out what's malicious and then put in place the
17:59
actual algorithms to
18:00
SPEAKER_03: then address that in the future.
18:02
So I actually think given defense is harder and given defense
18:06
today is still far more manual,
18:08
AI will make a bigger difference in leveling up the two as both
18:12
become far more
18:14
SPEAKER_03: capable in each space via AI.
18:17
And so I think what I'm hearing from you is that there's more
18:19
low-hanging fruit in
18:21
SPEAKER_02: the defensive sector.
18:21
SPEAKER_02: That's a good way to put it.
18:22
SPEAKER_02: We haven't,
18:23
SPEAKER_02: in a sense,
18:24
maximized our efficiency on the defense side because it's so
18:27
human-intensive,
18:28
SPEAKER_02: maybe for organizational institutional reasons,
18:31
maybe just because it's harder from a policy perspective to
18:35
adopt defensive
18:36
SPEAKER_02: measures.
18:37
SPEAKER_02: And I think I'd love to sort of think through that a little bit more.
18:41
Do either of you have thoughts on how we get policy out of the
18:47
way so that it
18:47
SPEAKER_02: doesn't become an impediment for companies,
18:51
SPEAKER_02: for the defenders to adopt these technologies?
18:54
Because we know that the criminals and the nation states have
18:59
no restrictions in
19:01
SPEAKER_02: whether they can adopt this stuff.
19:02
SPEAKER_02: And so they're adopting it in real time, whereas there are sometimes...
19:06
SPEAKER_02: legal policy,
19:08
SPEAKER_02: other reasons,
19:09
SPEAKER_02: maybe reputational reasons,
19:11
SPEAKER_02: why the defenders don't want to adopt this policy.
19:14
SPEAKER_02: What are the kind of policy levers we have to encourage,
19:18
just to get them out of the way so that defenders can also
19:21
adopt these things in
19:22
SPEAKER_02: real time?
19:23
You know,
19:23
I'll start with a quick thought that actually builds on
19:25
something Sam said earlier.
19:28
This conversation,
19:29
which is to say,
19:30
AI is going to make attacking and attacks
19:34
SPEAKER_03: far more capable.
19:35
SPEAKER_03: So defenders have got to move out with AI.
19:38
SPEAKER_03: If CEOs say that to their security teams,
19:42
SPEAKER_03: to Sam's earlier point,
19:44
SPEAKER_03: that enables them to say,
19:46
SPEAKER_03: the key is you've got to move out fast.
19:48
SPEAKER_03: There's risk of doing, there's risk of not doing.
19:50
SPEAKER_03: The risk of not doing exceeds the risk of doing here.
19:52
SPEAKER_03: So move out and I'll have your back is some of the early rollouts.
19:56
SPEAKER_03: We run into issues because any new technology, as you're deploying it,
20:00
SPEAKER_03: The tech is immature.
20:01
SPEAKER_03: Something can go wrong.
20:03
And I think that what I'm struck by is sometimes defenders
20:07
rightfully are worried
20:08
SPEAKER_03: that early adoption,
20:10
SPEAKER_03: there'll be issues and they'll be caught up with that.
20:14
SPEAKER_03: So I think that push to say, we have no choice.
20:16
SPEAKER_03: We have to deploy.
20:18
SPEAKER_03: ways for companies doing those early deployments to compare notes.
20:22
SPEAKER_03: What have we learned about TTPs?
20:24
SPEAKER_03: What have we learned about bringing together different kinds of data?
20:27
Which products are exposing the data needed so that you can
20:30
actually use AI to
20:32
SPEAKER_03: bring that data together and run a next level of
20:35
SPEAKER_03: defense on that?
20:36
What are the most effective code vulnerability scanners that
20:40
actually generate
20:41
patches that you can trust and deploy those quickly too so you
20:43
can close that
20:45
SPEAKER_03: cycle?
20:45
So I think a big part of it first is the executive leadership
20:49
recognizing the
20:50
SPEAKER_03: dynamic we're talking about and giving top cover for rapid deployment.
20:54
SPEAKER_03: And then second,
20:56
the ability for companies to come together and actually share
21:00
what they're learning
21:00
SPEAKER_03: with a level of fidelity.
21:02
SPEAKER_03: Finally,
21:02
SPEAKER_03: on a policy side,
21:03
SPEAKER_03: there are some areas where regulatory barriers exist,
21:07
SPEAKER_03: enabling that kind of data sharing.
21:09
SPEAKER_03: HIPAA is a good example,
21:10
SPEAKER_03: the rules around health information sharing,
21:12
SPEAKER_03: GDPR,
21:13
SPEAKER_03: EU rules around data sharing that prevent that,
21:16
SPEAKER_03: particularly cross-border.
21:18
And that's going to be key to getting the tech to work in the
21:21
way that defenders need.
21:22
SPEAKER_02: On that regulatory issue,
21:24
SPEAKER_02: one of the things that I think has been kind of disappointing to see is,
21:30
SPEAKER_02: in the financial space specifically,
21:32
you see that fraud detection way outstrips and the use of AI in
21:39
that world way
21:40
SPEAKER_02: outstrips anti-money laundering.
21:43
SPEAKER_02: A large part of it is the regulatory barriers.
21:47
SPEAKER_02: There are a lot fewer regulatory barriers to adopting AI in fraud,
21:52
SPEAKER_02: whereas in AML,
21:54
SPEAKER_02: there's model validation and other concerns that arise,
21:57
SPEAKER_02: and it can take months to deploy new AI.
22:01
SPEAKER_02: Those are the kinds of barriers I think about.
22:05
SPEAKER_02: Can you think of,
22:06
SPEAKER_02: in the incidents that you were exposed to,
22:09
SPEAKER_02: given your senior government experience,
22:12
Are there any that you can talk about where AI and the
22:15
technologies you're seeing
22:16
SPEAKER_02: would have made a meaningful difference in the defensive side?
22:20
SPEAKER_03: Yes, very much so.
22:21
SPEAKER_03: I'll give two examples.
22:22
SPEAKER_03: One that responsive, by the way, to your AML point.
22:25
SPEAKER_03: You know,
22:25
SPEAKER_03: I recall after the Colonial Pipeline attack of May of 2021,
22:29
that really opened a lot of people's eyes to the fact that
22:32
cyber attacks could be
22:34
SPEAKER_03: not just stealing data,
22:35
SPEAKER_03: but also fundamentally disrupting everyday lives,
22:37
SPEAKER_03: right?
22:38
SPEAKER_03: Cars queued up at the gas station.
22:40
SPEAKER_03: People couldn't get gas.
22:41
And frankly,
22:42
our one pipeline that runs down the eastern seaboard shut down
22:46
for almost a week.
22:46
SPEAKER_03: That's a major impact.
22:48
And at the time we were trying to figure out what was the scale
22:52
of the issue
22:52
SPEAKER_03: because many companies that were affected,
22:55
SPEAKER_03: you know,
22:55
SPEAKER_03: would pay a ransom quietly and we didn't have visibility.
22:58
SPEAKER_03: Things changed after that.
22:59
But I recall a conversation with the CEO of a large bank and he
23:02
said to me,
23:03
SPEAKER_03: Anne,
23:03
SPEAKER_03: we know the ransom payments.
23:05
SPEAKER_03: And I said, really?
23:06
SPEAKER_03: How do you know it?
23:07
He said,
23:07
well,
23:08
suddenly you have a company that never touched the crypto
23:10
market before.
23:11
SPEAKER_03: There's a cyber attack that's public,
23:14
SPEAKER_03: and they come in and they're buying crypto and like,
23:16
SPEAKER_03: you know,
23:16
SPEAKER_03: immediately moving it to that point,
23:18
SPEAKER_03: right?
23:18
SPEAKER_03: It was just an interesting.
23:20
SPEAKER_03: But similarly,
23:22
SPEAKER_03: you know,
23:22
SPEAKER_03: when I think about,
23:23
SPEAKER_03: to your question,
23:24
SPEAKER_03: the most disruptive cyber attacks that occurred in the last few years,
23:28
SPEAKER_03: you know,
23:29
SPEAKER_03: one of them was a company called Change Healthcare,
23:31
SPEAKER_03: major division of United Healthcare.
23:33
SPEAKER_03: A third of all medical transactions in the United States go through them.
23:37
SPEAKER_03: A hospital billing, a pharmacy dispensing a prescription.
23:40
SPEAKER_03: And essentially, they were hit by a cyber attack, the clearinghouse.
23:45
SPEAKER_03: So all these transactions were not happening.
23:48
SPEAKER_03: At the time,
23:48
SPEAKER_03: and the CEO said this publicly,
23:50
SPEAKER_03: it was caused by they did not deploy multi-factor authentication.
23:56
an authentication for a user other than a password and we know
23:58
passwords have been
23:59
compromised so many times that enabled the attackers to get on
24:02
and then the network
24:03
was also not properly segmented and configured so the attacker
24:06
was able to move
24:07
along that is the kind of thing where from an AI perspective
24:13
firstly you know an AI
24:14
SPEAKER_03: monitor that's looking to see you know an account
24:18
that has just passwords,
24:20
find them,
24:21
because today you shouldn't have accounts.
24:23
SPEAKER_03: Certainly you shouldn't have admin accounts with just passwords.
24:25
SPEAKER_03: Find those, lock them, which will get them to be changed.
24:28
SPEAKER_03: Similarly,
24:28
in actually identifying a network and figuring out where it can
24:32
be segmented,
24:32
how to optimize it so that an attacker that gets a foothold
24:35
can't move along,
24:36
SPEAKER_03: finding vulnerabilities at scale,
24:38
all of that is achievable from an AI perspective today in a way
24:42
that previously for
24:43
SPEAKER_03: a complex network was a lot of manual work.
24:47
SPEAKER_02: Again, the automation versus manual dichotomy.
24:52
Sam,
24:53
from your perspective,
24:55
where does AI help the most in a real incident?
24:59
SPEAKER_02: Is it time to detection, understanding?
25:02
SPEAKER_02: Is it automation of processes?
25:04
SPEAKER_02: How do you think about where AI becomes most effective?
25:08
most effective right now in processing huge amounts of
25:12
disparate data sets and kind
25:13
SPEAKER_01: of the like higher tier of the investigation.
25:16
SPEAKER_01: It's certainly useful in the like time to detect in some sense,
25:21
but a lot of times that time to detect you have a lot of weak
25:24
signals that you're
25:24
SPEAKER_01: trying to aggregate together to find a stronger set of signals.
25:29
And there's still a lot of data plumbing to like actually make
25:32
that possible.
25:33
SPEAKER_01: It's not like you can just shove all of your like endpoint logs into
25:38
SPEAKER_01: cloud code and say, is it good or bad?
25:40
There's still a lot of non-AI data engineering work to even
25:43
make that possible.
25:45
SPEAKER_01: In reality, a lot of the real-time stuff is pretty hard, but fusing
25:50
SPEAKER_01: contextual data sets like Intel,
25:53
SPEAKER_01: data that's been shared with you,
25:54
SPEAKER_01: past incidents and what you've done across your,
25:57
SPEAKER_01: whether it's like Jira or some other ticketing system,
25:59
SPEAKER_01: like what did we do in this case?
26:00
SPEAKER_01: Is this normal?
26:01
That's pretty powerful and basically like a unlock for free
26:04
that most teams have.
26:05
But a lot of times these AI systems need complementing other
26:10
software systems that
26:11
SPEAKER_01: are just hard and messy to build,
26:14
SPEAKER_01: which prevent the full unlock of AI,
26:17
SPEAKER_01: if that makes sense.
26:19
SPEAKER_01: When you have someone that's researching adversaries,
26:23
SPEAKER_01: researching what they've done in the past,
26:24
researching a really clean set of data that they've combed
26:29
through on the incident,
26:29
SPEAKER_01: that's basically free.
26:32
SPEAKER_01: But stuff that's larger scale is actually quite difficult still.
26:36
SPEAKER_02: From a technical perspective.
26:37
SPEAKER_02: And on that,
26:37
I want to double click on that a little bit because I'd love to
26:40
get your view on
26:41
what does cyber resilience look like 10 years down the road
26:45
when some of this stuff
26:48
SPEAKER_02: is actually out there and being used?
26:50
SPEAKER_02: And then a compound question,
26:52
SPEAKER_02: which I've always been taught we shouldn't ask,
26:53
SPEAKER_02: but I'll ask it anyways,
26:55
SPEAKER_02: is this just a question of deployment or is there,
26:59
SPEAKER_02: and you sort of mentioned this,
27:00
SPEAKER_02: but is there actual innovation that
27:02
SPEAKER_02: and building that needs to take place.
27:05
SPEAKER_02: Talk about that.
27:07
If it's not just deployment,
27:08
what are the things we still need to invent to be able to do
27:11
this?
27:11
I'll answer your first question first with maybe some policy
27:15
twists on where I
27:16
SPEAKER_01: think it's most important to achieve resilience,
27:18
SPEAKER_01: where it also happens to be the most difficult.
27:22
I mean,
27:22
10 years from,
27:23
I don't even know what's going to happen in 10 years.
27:24
SPEAKER_01: I kind of look at, like, a year or two ahead.
27:26
SPEAKER_01: But we need to be tested.
27:29
The institutions and networks and enterprises that underpin our
27:32
way of life need to
27:32
SPEAKER_01: be tested continuously.
27:34
And not just in some lightweight scan,
27:37
like,
27:38
hey,
27:38
you don't have any internet exposure.
27:40
SPEAKER_01: Like, you're good.
27:41
SPEAKER_01: Like,
27:41
SPEAKER_01: There's no way that is actually helpful at all.
27:44
SPEAKER_01: Seriously,
27:46
act as an aggressor and see if there are holes throughout the
27:49
enterprise and use AI
27:51
SPEAKER_01: to do that to make sure that you're okay.
27:55
SPEAKER_01: Enterprises and organizations that are playing in critical industries,
27:58
SPEAKER_01: this is where policy comes into play,
27:59
SPEAKER_01: probably need to have some continuous testing.
28:04
SPEAKER_01: or red teaming,
28:06
SPEAKER_01: because otherwise,
28:07
SPEAKER_01: I just don't think you can play in some of these critical spaces,
28:11
whether it be energy or another recent incident that I think
28:13
was pretty noticeable
28:15
SPEAKER_01: to most when a bunch of airlines were targeted about a year ago or so,
28:20
and they used a third party contractor to infiltrate to get
28:24
access to systems and
28:25
basically shut everything down and nobody could travel in the
28:27
US for a while and in
28:28
SPEAKER_01: Europe.
28:31
SPEAKER_01: And when it was like a hacking 101,
28:33
SPEAKER_01: like it wasn't even hard,
28:34
SPEAKER_01: but there was just,
28:35
there were so many doors open now that you need to basically
28:38
test those things.
28:39
SPEAKER_01: And yes,
28:41
SPEAKER_01: a fortune 500 airline should have the budget to be able to do that,
28:44
but they need to be like held accountable if they're going to
28:47
be playing in these
28:48
SPEAKER_01: different sectors to actually go enforce that.
28:51
SPEAKER_01: And then I think it all on the commercial side,
28:53
SPEAKER_01: all comes back to the board of directors and,
28:55
SPEAKER_01: and the management team,
28:56
SPEAKER_01: which is,
28:57
SPEAKER_01: this is no longer optional.
28:59
SPEAKER_01: We have to do this.
29:01
SPEAKER_01: And yes,
29:01
there are some policy things like reporting breaches to SEC is
29:06
useful actually as a
29:07
SPEAKER_01: forcing function.
29:07
But I think you also need to know we're going to get hit hard
29:11
every single quarter
29:12
if we're going to be playing in this market and we're going to
29:15
be up to par here.
29:16
SPEAKER_01: I think that is something that we should actually be looking at doing.
29:19
SPEAKER_03: I just want to add because I love Sam's point so much,
29:21
which is today the hardest problem I used to think we had in
29:24
cybersecurity was
29:27
SPEAKER_03: What is measurable resilience, right?
29:30
I recall,
29:30
you know,
29:31
before Russia's invasion of Ukraine,
29:33
we knew an invasion was likely.
29:35
SPEAKER_03: And at the time,
29:36
SPEAKER_03: working in the prime administration,
29:37
SPEAKER_03: the president turned to me and said,
29:38
and how likely is it that Russia will conduct offensive cyber
29:41
attacks against the
29:42
SPEAKER_03: U.S.?
29:42
SPEAKER_03: ?
29:43
SPEAKER_03: And at that point,
29:44
we had mandated the first ever minimum cybersecurity
29:49
requirements for pipelines
29:50
SPEAKER_03: after Colonial Pipeline.
29:52
SPEAKER_03: But for every other sector,
29:53
the US government had zero visibility on their required minimum
29:57
cybersecurity
29:58
SPEAKER_03: baseline.
29:59
SPEAKER_03: So we actually didn't have an answer to that.
30:02
SPEAKER_03: What I loved about Sam's point is today,
30:04
SPEAKER_03: we know attackers can be continuously jiggling digital doorknobs.
30:09
We want the key critical infrastructure companies to do that
30:12
first and then to tell
30:14
us what is the likelihood that we believe that our network
30:18
could be disrupted and
30:20
SPEAKER_03: not recoverable for a period of time.
30:22
Because I think we want to have the resilience benchmark that a
30:25
critical power
30:26
SPEAKER_03: water pipeline company
30:29
SPEAKER_03: if they are disrupted, can be recovered in four to six hours.
30:32
And I think if you're continuously red teaming by AI agents
30:36
externally and
30:37
SPEAKER_03: internally,
30:38
you're far more likely to know what are the paths in and how
30:41
many of those have you
30:42
SPEAKER_03: been able to close or address.
30:44
SPEAKER_03: And before that,
30:45
SPEAKER_03: to be frank,
30:46
it wasn't an answerable question at a cost ratio that was
30:49
reasonable for companies
30:51
SPEAKER_03: to do.
30:52
SPEAKER_02: I actually want to drill down on something both of you have mentioned,
30:56
SPEAKER_02: which is metrics,
30:58
SPEAKER_02: measurability,
30:58
SPEAKER_02: evidence.
30:59
SPEAKER_02: Because it seems to me that for systems to be resilient,
31:03
SPEAKER_02: It can't just be anecdotally based.
31:05
SPEAKER_02: It's got to be evidence-based, measurement-based in some sense.
31:08
We also know just general management theory,
31:11
what you manage to what you measure.
31:14
As we think about evidence-based cybersecurity and the types of
31:21
metrics we need,
31:23
SPEAKER_02: and you mentioned a couple
31:26
Sam,
31:26
I'd love to hear your thoughts on what are the metrics that are
31:30
useful?
31:30
SPEAKER_02: What are the benchmarks that are useful in developing a system?
31:34
SPEAKER_01: I think you just need to look at the enterprise as a whole and test,
31:40
SPEAKER_01: especially if we're talking from a policy perspective.
31:42
Internal security teams will have much more fine-grained things
31:45
that they're
31:46
SPEAKER_01: working on to realize their security program,
31:48
SPEAKER_01: but at a higher level,
31:51
the efficacy to respond to a legitimate threat actor is the
31:55
ultimate measure.
31:56
SPEAKER_01: I think everything works back from that.
31:58
SPEAKER_01: Of course,
31:58
SPEAKER_01: historically,
31:59
SPEAKER_01: as Ann pointed out,
32:00
the cost of actually emulating those threat actors as a red
32:03
team has just been too
32:04
SPEAKER_01: cost prohibitive.
32:06
SPEAKER_01: Thus, it has never really happened at scale.
32:08
That is all changing now and it can actually be employed
32:11
nationally at scale.
32:13
SPEAKER_01: I would say even today, that's the work that we do.
32:17
And so I think something about can these organizations defend
32:23
and recover from like
32:24
legitimately looking threat actors at some kind of continuous
32:27
cadence along certain
32:29
SPEAKER_01: metrics,
32:29
SPEAKER_01: whether that's,
32:30
SPEAKER_01: you know,
32:30
you have to be able to prevent and block like this lower class
32:34
of adversarial
32:35
SPEAKER_01: behavior.
32:36
SPEAKER_01: And then for everything above that,
32:37
SPEAKER_01: you need to be able to recover within like some few hour period,
32:41
SPEAKER_01: depending on your industry and depending on the criticality.
32:43
SPEAKER_01: I think that's like the ultimate measure.
32:47
SPEAKER_01: unpack that to make it a little bit more continuously enforceable,
32:51
but we should be deploying probably nationally certified teams
32:56
that are doing this
32:56
SPEAKER_01: for every publicly traded company or critical infrastructure at scale.
33:00
SPEAKER_01: I think that's obviously a huge workforce opportunity for us,
33:05
but also maybe one of the coolest ways to employ AI to really
33:08
work on national
33:09
SPEAKER_02: resilience.
33:11
SPEAKER_02: Any other benchmarks you can think of that are important?
33:14
SPEAKER_03: I think the key one is,
33:17
SPEAKER_03: as I think about the different kinds of threats,
33:20
SPEAKER_03: criminals in countries,
33:22
SPEAKER_03: is can we feel confident?
33:26
SPEAKER_03: The average American deserves to know that when they turn on their water,
33:29
SPEAKER_03: that the water filtration system is working.
33:31
SPEAKER_03: When they go to the gas station, they get gas.
33:34
SPEAKER_03: And I think as we look at countries like
33:37
China and North Korea China in that case that we know is
33:39
prepositioned in critical
33:41
infrastructure in the US and in our allies around the world
33:44
With the goal of
33:45
disrupting it either for military military objectives if you
33:48
disrupt and airports
33:50
operations American service members deploy through our regular
33:53
commercial airports
33:55
one could they can buy time in just delaying a military
33:58
deployment all the way
33:59
through to concerns that a Chinese focus disruption would be to
34:04
foment panic or
34:05
SPEAKER_03: or frankly,
34:06
SPEAKER_03: to put political pressure on the domestic population of Americans saying,
34:10
SPEAKER_03: why are we getting involved in a crisis around the world?
34:12
SPEAKER_03: That typically is, Americans question that.
34:15
SPEAKER_03: How does this fit American interests?
34:17
So from a national security objective as a country,
34:21
we really do want to know
34:23
that the country's core infrastructure and military bases are
34:27
secure enough from a
34:28
SPEAKER_03: digital perspective.
34:29
So I think we mentioned that before,
34:31
but I really want to put a metric on that.
34:33
SPEAKER_03: I think AI makes that achievable if we create a digital twin,
34:37
SPEAKER_03: for example,
34:37
of parts of the power grid and test different kinds of attacks
34:40
against it in order
34:42
SPEAKER_03: to identify the most effective and highest ROI cybersecurity.
34:48
SPEAKER_03: There's a cost in cybersecurity that's been at the root of the policy
34:52
SPEAKER_03: failures and challenges we've had.
34:54
SPEAKER_03: The last time the Hill tried to pass a cybersecurity bill was in 2015,
34:59
SPEAKER_03: the Lieberman Collins bill that failed.
35:03
SPEAKER_03: And it failed because in that case,
35:04
SPEAKER_03: there were difference of opinion on a number of areas,
35:07
SPEAKER_03: but also the issue was who bears the cost.
35:10
SPEAKER_03: And there's always this debate.
35:11
SPEAKER_03: I've had CEOs come to me and say, we're up against the government.
35:14
SPEAKER_03: Our government should pay.
35:14
SPEAKER_03: The answer is,
35:16
SPEAKER_03: OK,
35:16
but there's some amount of cybersecurity you're responsible for
35:19
in your network.
35:19
SPEAKER_03: And then agreed, above and beyond that could be the government.
35:22
But the rich work of AI now makes it a tractable problem from a
35:27
cost perspective.
35:29
SPEAKER_03: And as such, a measurable one from a national security perspective.
35:32
I think it opens up a whole new interesting line of policy work
35:35
that we can do
35:35
between government and private sector to fundamentally get at a
35:38
more secure digital
35:39
ecosystem as our economy and our security is now moved to the
35:43
digital ecosystem.
35:44
SPEAKER_02: Yeah.
35:44
SPEAKER_02: I mean, you raise an interesting point, which is that
35:47
SPEAKER_02: The infrastructure,
35:49
SPEAKER_02: for the most part,
35:50
SPEAKER_02: is private sector,
35:51
SPEAKER_02: and that's one of the hardest things about cybersecurity,
35:53
SPEAKER_02: that the government does not control the thing that is vulnerable.
35:58
SPEAKER_02: Anne,
35:59
you also had sort of mentioned something that I think it's
36:02
worth drilling down a
36:03
SPEAKER_02: little bit more,
36:03
SPEAKER_02: which is information sharing within the private sector.
36:09
SPEAKER_02: If you talk to some industry in different industries,
36:12
SPEAKER_02: some industry perspectives or people who have perspectives,
36:17
they will say that they have some fears around information
36:21
sharing from antitrust,
36:23
SPEAKER_02: from privacy,
36:24
SPEAKER_02: from a bunch of other things.
36:25
SPEAKER_02: We talked about policy levers.
36:28
I think that it's fair to say that the government sometimes can
36:32
be skeptical that
36:33
SPEAKER_02: there are real legal barriers.
36:35
SPEAKER_02: But from the private sector perspective, there's uncertainty.
36:38
SPEAKER_02: And we know companies don't like uncertainty,
36:41
and they're not going to take risks where they feel that there
36:43
is that uncertainty.
36:44
But can you talk about the challenges around information
36:47
sharing and whether there
36:49
SPEAKER_02: might be some clarity or policy levers,
36:51
SPEAKER_02: or maybe not,
36:52
SPEAKER_02: that are available?
36:53
SPEAKER_03: I'm very sensitive to those concerns.
36:55
SPEAKER_03: I worked across four administrations.
36:57
SPEAKER_03: I came in to government in 2007, intending for one year.
37:01
SPEAKER_03: And as my husband likes to say, one year became 19 years.
37:05
SPEAKER_03: And I was across Republican and Democratic administrations.
37:08
SPEAKER_03: One thing that's interesting to me is that
37:10
the core cybersecurity,
37:12
how do you protect the nation in cyberspace,
37:14
remains a bipartisan goal.
37:17
SPEAKER_03: To your point,
37:18
SPEAKER_03: what role and responsibility the private sector has,
37:21
SPEAKER_03: what role there is of regulation,
37:23
so government kind of requires the private sector to do the
37:26
things it needs to do,
37:27
SPEAKER_03: because there's a level of assurance that we want to provide citizens,
37:31
SPEAKER_03: has been the crux of the debate.
37:34
And I think to your point,
37:36
after the salt typhoon attacks,
37:37
Chinese attacks against telecoms,
37:39
A number of the telecoms raise the issue you raise,
37:42
which is antitrust concerns.
37:45
I should say that sectors like financial services have long had
37:49
extensive intra-sector sharing.
37:52
SPEAKER_03: It's the most sophisticated sharing.
37:54
I think it builds on some of the existing processes there was
37:57
across banking.
37:58
But extensive sharing happens today across banking and
38:00
financial services.
38:01
SPEAKER_03: And it began 10, 15 years ago.
38:04
And they built it because they managed to first also crack the
38:07
code of concerns
38:10
SPEAKER_03: that competitors would expose each other for brand impact.
38:14
And essentially what they said was,
38:15
if anybody leaks this once,
38:17
you're out.
38:17
SPEAKER_03: And the benefit,
38:18
SPEAKER_03: because attackers use techniques again and again,
38:21
SPEAKER_03: the benefit to a company of being a part of it is significant.
38:23
SPEAKER_03: So they've managed to retain that shared approach.
38:28
SPEAKER_03: But at the time,
38:29
SPEAKER_03: when the telecoms raised it,
38:30
SPEAKER_03: I actually brought together NSC lawyers,
38:33
SPEAKER_03: Department of Justice lawyers,
38:34
SPEAKER_03: and said,
38:34
SPEAKER_03: please dig into this.
38:36
They dug into it and they said there are no antitrust concerns
38:39
because companies
38:40
SPEAKER_03: are not competing on their cybersecurity.
38:43
SPEAKER_03: They're competing on their products.
38:44
SPEAKER_03: Cybersecurity is a shared goal.
38:46
SPEAKER_03: We brought them.
38:47
So we brought in the CEOs of the major telecoms and
38:50
cybersecurity companies in the
38:51
SPEAKER_03: aftermath of the Chinese compromise because it was so significant.
38:55
And we actually brought DOD to the table and said,
38:58
please answer this directly.
39:00
SPEAKER_03: And they did.
39:02
SPEAKER_03: That being said,
39:03
I think that it's fair for companies at the beginning of an
39:06
administration to say,
39:07
we want to hear this said to us again because of a concern that
39:11
sometimes a
39:12
SPEAKER_03: perspective may change.
39:13
SPEAKER_03: But I think as we dig into it,
39:15
SPEAKER_03: one can see the legal perspective of it's not a competitive factor.
39:19
SPEAKER_03: Right.
39:21
SPEAKER_02: Right.
39:22
SPEAKER_02: I think that's fair.
39:23
SPEAKER_02: I think the hardest thing from the company perspective, and now I see it.
39:27
SPEAKER_02: I had your perspective when I was at the DOJ,
39:29
SPEAKER_02: and now as a CLO,
39:32
SPEAKER_02: I'm seeing it from the private sector side.
39:35
The challenge is that so much depends on an administration
39:39
interpretation.
39:40
We know through court cases that guidance is not considered
39:43
regulation,
39:43
is not binding.
39:45
SPEAKER_02: And because increasingly we have a bit of a whipsaw problem,
39:51
companies would like to have more certainty either in some sort
39:54
of notice and
39:54
SPEAKER_02: comment rulemaking,
39:56
SPEAKER_02: legislation,
39:56
SPEAKER_02: something that they can point their boards to and say,
40:00
SPEAKER_02: we're not going to take on liability and here's why to the point of –
40:04
no kind of compliance officer wants to be fired because they
40:08
made the wrong call.
40:09
SPEAKER_02: So I think that that's where the rubber meets the road is,
40:13
SPEAKER_02: I think in good faith,
40:14
SPEAKER_02: the government can say,
40:16
SPEAKER_02: we don't see a problem here.
40:18
SPEAKER_02: And yet the uncertainty can still exist.
40:21
SPEAKER_02: And so some sort of, and I don't know what form that could take.
40:24
SPEAKER_02: And there's an interagency problem.
40:26
SPEAKER_02: There are many agencies involved,
40:28
SPEAKER_02: but that to me seems to be some of the friction that could exist.
40:32
SPEAKER_02: And
40:33
SPEAKER_02: And you're right.
40:33
I think financial services has solved it,
40:36
partially because they're used to information sharing.
40:39
There are all sorts of ways in which they share threat
40:42
information on the cyber
40:43
SPEAKER_02: side,
40:44
SPEAKER_02: on the money laundering side.
40:45
SPEAKER_02: There's FSISACs that allow that.
40:48
SPEAKER_02: So they built that muscle memory and they're now comfortable with it.
40:51
SPEAKER_02: So probably is some of that, is my guess.
40:54
SPEAKER_03: Your comment is also reminding me of another issue we saw.
40:57
SPEAKER_03: And again,
40:57
I look at the salt typhoon or the Chinese compromises of
41:00
telecoms as a good one
41:01
SPEAKER_03: because
41:02
SPEAKER_03: the impact of that compromise was so significant.
41:05
SPEAKER_03: Essentially, the Chinese had compromised
41:09
SPEAKER_03: many large American telecoms, in some cases for a number of years.
41:13
SPEAKER_03: So they were positioned to collect conversations at will.
41:16
SPEAKER_03: They could also geolocate based on the nearest cell tower individual.
41:19
So really broad in terms of potentially the number impact and
41:23
the depth of the impact.
41:25
SPEAKER_03: The other issue I saw in those interagency discussions,
41:28
SPEAKER_03: to your point,
41:29
is we brought together the FCC as the regulator and the
41:33
Department of Justice as
41:34
SPEAKER_03: the FBI.
41:35
And there was a lot of resistance by the law enforcement
41:37
community to being at the same table.
41:40
SPEAKER_03: And I think,
41:41
SPEAKER_03: but the FCC brought a set of tools,
41:43
SPEAKER_03: responsibility,
41:44
SPEAKER_03: and most importantly,
41:45
knowledge of the sector that was very important because our
41:48
core goal was how do we
41:49
SPEAKER_03: prevent this happening again?
41:50
SPEAKER_03: Yeah.
41:51
SPEAKER_03: Yeah.
41:51
SPEAKER_03: And what I saw was at the beginning of those meetings,
41:53
SPEAKER_03: I chaired those meetings,
41:55
SPEAKER_03: I always said,
41:55
SPEAKER_03: we're here for one purpose.
41:56
SPEAKER_03: This is the goal.
41:57
SPEAKER_03: We want to prevent this happening again.
41:59
SPEAKER_03: We're one team.
42:00
So no particular agency moves out and does their own thing
42:03
until we have a
42:04
coordinated approach because there are a set of tools and
42:07
instruments of U.S.
42:07
SPEAKER_03: government policy.
42:09
SPEAKER_03: And some are competing, exactly to your point, Jay.
42:12
SPEAKER_03: And to be most effective, we need to work that together.
42:16
SPEAKER_03: I think we,
42:17
SPEAKER_03: perhaps we,
42:18
SPEAKER_03: I'm no longer in government,
42:19
I think government can do a better job sometimes of recognizing
42:22
that there are
42:23
SPEAKER_03: sometimes competing objectives across a regulatory approach,
42:26
SPEAKER_03: a law enforcement approach,
42:28
SPEAKER_03: a partnership approach,
42:30
SPEAKER_03: given the private sector owns and operates this infrastructure,
42:33
SPEAKER_03: and really actually,
42:34
SPEAKER_03: you know,
42:35
SPEAKER_03: documenting in these kinds of incidents,
42:38
here's how we're going to work through these different tools
42:40
most effectively so
42:41
SPEAKER_03: companies know what to expect.
42:43
SPEAKER_03: You're raising a very fair point that it's probably pretty unpredictable.
42:47
The financial sector is definitely the shining beacon of,
42:51
I think,
42:51
this working well.
42:52
But I think that does have a lot to do with their concentration
42:55
of budget and talent.
42:57
And a lot of other industries that we would deem critical
43:00
infrastructure do not
43:01
SPEAKER_01: have that luxury.
43:02
SPEAKER_01: I'm thinking power.
43:03
SPEAKER_01: I'm thinking water.
43:04
SPEAKER_01: I'm thinking grid.
43:05
SPEAKER_01: I'm thinking oil and gas to some extent probably has that.
43:09
That is where we probably need to have different types of
43:13
policies apply to that
43:14
infrastructure because the proactive information sharing that
43:17
relies on pretty
43:18
talented people to implement and run those processes probably
43:21
won't work there
43:22
where they might have a single IT person that's underpinning an
43:25
entire water
43:26
SPEAKER_01: treatment plant.
43:27
SPEAKER_01: And if I were an attacker looking at the homeland, that would be...
43:31
SPEAKER_01: And I just wanted to disrupt and cause chaos.
43:33
SPEAKER_01: That would be one of my target number ones.
43:36
And so we probably need to look at different policy that is
43:39
maybe more like
43:40
SPEAKER_01: enforced deployment of technology that is like government managed,
43:44
SPEAKER_01: which is a little bit similar to
43:46
SPEAKER_01: how the PLA runs some of their nationwide,
43:49
SPEAKER_01: and Anne has pointed this out in her foreign affairs piece last year,
43:52
where they have persistent monitoring across all critical
43:57
infrastructure because
43:58
SPEAKER_01: there is no such worry about data privacy.
44:01
SPEAKER_01: I'm not saying we should relax to that extent, but...
44:05
We can't believe that folks that have no budget and basically
44:10
one IT person are
44:11
SPEAKER_01: going to effectively implement security controls even with AI.
44:15
And so we probably need more enforcement there because that's
44:18
the underbelly that's
44:19
SPEAKER_01: going to get hit the hardest.
44:20
SPEAKER_02: That's a great perspective.
44:23
SPEAKER_02: And I'd like to actually drill down a little bit more on that,
44:26
because one thing we really haven't talked about yet is your
44:29
perspective as a
44:31
SPEAKER_02: builder,
44:32
SPEAKER_02: as a founder,
44:33
SPEAKER_02: a CEO.
44:34
SPEAKER_02: You bring, I think, a unique perspective.
44:38
So would love to hear,
44:39
to the extent that you can share,
44:42
what is your company building?
44:43
SPEAKER_02: What are the things you're most excited about?
44:46
SPEAKER_02: And give us the kind of grounds-eye view of
44:50
SPEAKER_02: the founder?
44:52
SPEAKER_01: I am a defensive optimist like Anne on this,
44:56
SPEAKER_01: but I think it'll be a rocky road to get to that ultimately.
45:00
SPEAKER_01: So that's like maybe a long-term view at least that I have.
45:02
But we build autonomous cyber systems both for offense and
45:06
defense with the mission
45:08
SPEAKER_01: of delivering cyber resilience to the United States.
45:10
SPEAKER_01: And that to us is a very dual-use problem.
45:14
The United States,
45:14
as we've been talking about,
45:15
critical infrastructure is composed of
45:17
SPEAKER_01: public and private.
45:19
SPEAKER_01: And so that's kind of the composition of our customer base.
45:22
But the company in many ways is kind of like a long time in the
45:26
making from myself
45:27
SPEAKER_01: and my founders of our experience.
45:30
My CTO and I both started our career working in government as
45:32
cyber operators.
45:33
SPEAKER_01: I was working at the Air Force,
45:34
SPEAKER_01: he was working at the NSA,
45:37
SPEAKER_01: and we didn't really have the tools we wanted to win,
45:40
SPEAKER_01: and we obviously didn't like the bureaucracy either.
45:44
SPEAKER_01: We wanted to just build, and so we both found our way back to Palantir
45:49
SPEAKER_01: I was there 12 years ago.
45:50
SPEAKER_01: I think he joined like 13 or 14 years ago.
45:52
SPEAKER_01: My third co-founder joined 13 years ago,
45:54
where we built up a lot of data tradecraft and knew how to
45:57
build hardcore software
45:58
SPEAKER_01: systems,
45:59
but then got a clear view into board level priorities as it
46:03
comes to software and
46:04
SPEAKER_01: things like that.
46:06
SPEAKER_01: I joined this company called Shield AI.
46:08
SPEAKER_01: I was their 20th or so employee,
46:10
SPEAKER_01: which I know is another portfolio company,
46:14
figuring out how to put AI onto drones back in 2018 when it
46:17
didn't quite work that
46:19
SPEAKER_01: well.
46:19
SPEAKER_01: But we got it working.
46:21
SPEAKER_01: And now, obviously, they're hugely successful.
46:23
SPEAKER_01: And this company is kind of like we're trying to
46:25
fuse all these different experiences and disciplines into
46:28
building like the
46:29
SPEAKER_01: ultimate company that can actually deliver on this mission.
46:32
SPEAKER_01: And that's why we started the company as we kind of called each other.
46:35
SPEAKER_01: We'd always wanted to start a company.
46:36
SPEAKER_01: And it was like,
46:38
who else is going to do this in a seriously trustworthy way and
46:41
has the engineering
46:42
SPEAKER_01: background to actually pull it off?
46:44
Like,
46:44
I think a lot of folks in the security industry are tired of
46:48
the like,
46:49
security industrial complex if you will which is just these
46:53
like small niche point
46:54
products that are really really cool tools but not built for
46:57
national priorities
47:00
and we kind of asked ourselves who else can do this in this ai
47:02
moment it's going to
47:03
get out of control and so we kind of like felt like we had to
47:06
start this company in
47:06
SPEAKER_01: a way
47:08
And so what we do specifically is we build a lot of the systems
47:11
that Anne alluded
47:13
SPEAKER_01: to on how,
47:14
SPEAKER_01: you know,
47:14
I liked your comment on regardless of whether you're trying to
47:17
defend and close the
47:18
SPEAKER_01: doors and adjust the security controls or attack,
47:20
SPEAKER_01: it's the same actual start to the workflow.
47:23
That's the workflow that we deliver in our product in a kind of
47:27
hyper AI enabled
47:28
SPEAKER_01: way,
47:29
SPEAKER_01: but that doesn't sacrifice on trust and scale.
47:32
SPEAKER_01: And that is a lot of like,
47:34
SPEAKER_01: Palantir software training on,
47:36
SPEAKER_01: you know,
47:37
what was access controls for them or guardrails for security
47:40
agents for us.
47:41
SPEAKER_01: And so when I talk to a Fortune 500 CISO and I say,
47:45
your ultimate measure of resilience is can you emulate a
47:48
realistic and relevant
47:49
SPEAKER_01: adversary and know that you're
47:51
up to par,
47:52
they would say,
47:53
sure,
47:54
but nowhere near in production because I don't trust it.
47:56
And then we go through how we've actually built the system and
47:59
they're like,
47:59
SPEAKER_01: okay,
48:00
SPEAKER_01: I trust it,
48:00
SPEAKER_01: let's do it.
48:01
And that is basically like the technical barrier to get to what
48:04
we're talking about
48:05
SPEAKER_01: in terms of resilience and we build that.
48:06
SPEAKER_01: So it's a lot of defensive work in the Fortune 500 and in the
48:11
SPEAKER_01: Government space,
48:12
SPEAKER_01: as you could imagine,
48:13
SPEAKER_01: is increasingly a lot of offensive work,
48:15
SPEAKER_01: whether that is red teaming,
48:17
SPEAKER_01: which is offense for defense effectively.
48:19
How do you scale those teams that have historically been like
48:23
cost prohibitively
48:24
SPEAKER_01: expensive,
48:25
SPEAKER_01: but now you can unleash them across the Department of War or,
48:28
SPEAKER_01: you know,
48:28
SPEAKER_01: the US government.
48:30
SPEAKER_01: But also offensive cyber operations where,
48:32
SPEAKER_01: you know,
48:33
we want the ability to deter at machine speed for reasons of
48:38
both defense and
48:39
SPEAKER_01: offense.
48:39
But that is not something that is like a toy-like product and
48:43
is a very serious
48:43
SPEAKER_01: capability which we build.
48:46
I'd also like you to share with the audience the little tech
48:49
perspective.
48:50
A lot of our policy framework at A16Z is built on
48:54
distinguishing between what
48:56
SPEAKER_02: startups,
48:57
the policy environment that startups face versus what a big
49:00
company faces and can
49:02
SPEAKER_02: deal with.
49:02
SPEAKER_02: But talk to us a little bit about
49:05
SPEAKER_02: about method security and how many people are there?
49:10
SPEAKER_02: What are you like as a startup company?
49:14
SPEAKER_02: Are you the prototypical couple of guys in a garage?
49:18
SPEAKER_02: Just give us some color on the nature of your company.
49:20
SPEAKER_01: We were.
49:20
SPEAKER_01: It was basement versus garage.
49:23
SPEAKER_01: We are 21 people full-time as of yesterday, actually.
49:28
SPEAKER_01: We've been keeping the company lean intentionally.
49:31
SPEAKER_01: Software engineers are so much more
49:34
productive right now when really thinking about what is the
49:36
composition of company.
49:37
SPEAKER_02: Is that because of AI coding agents?
49:40
SPEAKER_01: Yes.
49:41
We've been trying to think through first principles like what
49:43
does the engineering
49:44
SPEAKER_01: team look like?
49:45
We're also forward deploying a lot of our engineers into
49:48
customer situations to
49:49
SPEAKER_01: build better products,
49:50
SPEAKER_01: but also to just stay engineering focused.
49:52
SPEAKER_01: Out of the 21, 18 of us are engineers, so we're very engineer focused.
49:58
SPEAKER_01: I think that's
49:59
SPEAKER_01: Ultimately,
49:59
our strategy around raising the ultimate ceiling of method and
50:03
building tech that
50:06
SPEAKER_01: has compounding returns.
50:07
But we are taking a very small team and trying to sell to
50:12
Fortune 500,
50:13
the US government.
50:15
SPEAKER_01: From a little tech perspective, that is very, very hard.
50:17
SPEAKER_01: It's almost like we're on a suicide mission.
50:21
SPEAKER_02: Explain that.
50:21
SPEAKER_02: Why is that?
50:23
SPEAKER_01: If you have not delivered and sold software to the U.S.
50:28
government before and you go into it reading all this goodness
50:32
on Twitter like it's
50:33
SPEAKER_01: the new thing and that's where you should put your career,
50:34
SPEAKER_01: you are in from a world of hurt.
50:37
And I think unless you have that pain tolerance and deep desire
50:41
to deliver for the
50:42
SPEAKER_01: mission,
50:42
SPEAKER_01: you will...
50:43
SPEAKER_01: work on it for nine months and then start pivoting to something else.
50:47
SPEAKER_01: And so it's a really long-term bet,
50:49
both from the company and how we're building the personality of
50:52
the company.
50:52
SPEAKER_01: And here's a specific little tech thing that we have that touches on AI,
51:00
SPEAKER_01: the government,
51:01
SPEAKER_01: and building a business right now.
51:04
Things in the commercial space,
51:05
especially as it relates to AI technology,
51:08
SPEAKER_01: capabilities are moving so fast,
51:11
the government is increasingly even further behind in their
51:15
understanding of what
51:16
SPEAKER_01: is possible.
51:16
SPEAKER_01: Even with all the work that the administration is doing,
51:19
SPEAKER_01: to their credit,
51:20
it is still like actually the gap is accelerating because the
51:23
innovation is
51:24
SPEAKER_01: accelerating too fast.
51:25
And so we have stuff that is a lot of the things that we're
51:29
talking about here,
51:29
SPEAKER_01: we have deployed with Fortune 500 organizations.
51:32
SPEAKER_01: They can...
51:33
SPEAKER_01: emulate adversaries at scale safely at Fortune 500 level environments,
51:41
SPEAKER_01: the government doesn't understand that that is even possible.
51:44
SPEAKER_01: And so instead of saying,
51:47
let's go out into commercial – and there are some change agents
51:49
that might get
51:50
SPEAKER_01: this,
51:50
SPEAKER_01: but as a whole,
51:51
SPEAKER_01: it's still a lot of inertia.
51:54
SPEAKER_01: So what the government will do in that case is –
51:57
look to do some early R&D experiments on what our capability
52:01
already does in
52:02
SPEAKER_01: production where we're saying it's already delivered.
52:06
SPEAKER_01: You don't need to wait two or three more years to do this.
52:10
SPEAKER_01: It's actually already ready.
52:12
And that is still a huge cultural battle that we have to fight
52:15
all the time.
52:15
So I spend a lot of my time educating senior leaders on this is
52:18
actually possible now.
52:20
SPEAKER_01: You can call up
52:21
SPEAKER_01: my Fortune 500 CISO reference phone book here and ask if you'd like.
52:26
SPEAKER_01: But that has a lot to do with the color of money,
52:32
SPEAKER_01: getting things accredited,
52:33
changing what was supposed to be an early pilot with FY28
52:37
delivery to we can
52:39
SPEAKER_01: actually deliver it next week.
52:40
SPEAKER_01: And there's a huge mentality change that has to happen there.
52:42
SPEAKER_01: And cyber is
52:43
probably one of the top places where things are accelerating
52:46
most quickly.
52:47
It's interesting because there has been some movement in the
52:51
procurement space with
52:52
SPEAKER_02: the recent NDAA.
52:56
SPEAKER_02: One,
52:56
I'd love you to comment on how that may have impacted your
53:02
ability to compete in
53:03
SPEAKER_02: this space.
53:04
SPEAKER_02: Two, there's still some challenges.
53:05
SPEAKER_02: I think what you mentioned is the term of artist, commercial first.
53:09
SPEAKER_02: That's the goal.
53:10
SPEAKER_02: I think
53:12
the world has changed there was a time when for technology the
53:15
government was the
53:16
principal buyer um and now things are progressing much more
53:22
quickly in in the
53:23
private sector for a whole host of reasons but um uh but is
53:27
that kind of what
53:27
you're getting at is a sort of commercial first principle and
53:29
and there's still
53:30
work to be done in the commercial first space that would be
53:32
meaningful for your
53:33
SPEAKER_02: business
53:33
SPEAKER_01: Yeah, I mean, the commercial sector is a bigger market for us, candidly.
53:38
I think there's a unique moment in time where we're trying to
53:40
put an extra emphasis
53:41
in the government space just because we need to figure this out
53:44
and we need to
53:44
SPEAKER_01: figure it out today.
53:47
SPEAKER_01: But the commercial security market is definitely bigger from like a total
53:50
SPEAKER_01: addressable market for us.
53:52
SPEAKER_01: And ultimately, I think...
53:54
SPEAKER_01: Cyber is the ultimate dual-use use case,
53:57
SPEAKER_01: in my opinion,
53:58
SPEAKER_01: and we want to deliver the capabilities that the government deserves,
54:03
SPEAKER_01: and that is only,
54:04
SPEAKER_01: and needs,
54:05
SPEAKER_01: yes.
54:06
SPEAKER_01: I know if you're like, which side of Harvey Dent are we on that one?
54:09
SPEAKER_01: But probably both.
54:12
That is only possible if you're commercially competing your
54:15
technology with serious
54:17
enterprise buyers that have no friction to buying what they
54:19
want every second of
54:20
SPEAKER_01: every day.
54:21
Otherwise,
54:21
it's a GOTS-like thing that'll inevitably be a dead science
54:25
project.
54:26
SPEAKER_02: Does the NDAA have a meaningful impact on your business?
54:32
SPEAKER_02: What challenges remain that you would like to see addressed?
54:35
SPEAKER_01: It does.
54:36
SPEAKER_01: I think the,
54:38
SPEAKER_01: the little tech perspective is like the,
54:40
SPEAKER_01: the top down like authorities and like decisions are very helpful,
54:44
SPEAKER_01: but it,
54:45
it takes years for it to like to trickle down the like defense
54:48
and government
54:48
SPEAKER_01: apparatus to the O six or GS 15s that are actually making the decisions.
54:54
SPEAKER_01: It might take two years for like that cult is culture to get down there.
54:59
SPEAKER_01: Um,
55:00
SPEAKER_01: So it is definitely helping,
55:01
and this administration is doing a very good job of injecting
55:04
people that are
55:05
SPEAKER_01: change agents at multiple levels.
55:07
But I don't want to give people the hope that a top-down
55:11
authority actually has
55:13
SPEAKER_01: direct effects the next day.
55:14
SPEAKER_01: It takes a long time, and it takes a huge battle on the inside.
55:18
Are there any other sort of policy changes that you'd like to
55:22
see in future NDAAs
55:24
SPEAKER_02: that would be meaningful for your business?
55:26
I think increasing flexibility for in-year purchasing decisions
55:32
for organizations
55:33
is probably the most important thing to keep up with how fast
55:37
commercial innovation
55:38
is happening because of the current program budget execution
55:42
cycle is still like a
55:43
SPEAKER_01: three to five-year cycle,
55:44
SPEAKER_01: and that's just de facto three to five years behind.
55:47
And so giving organizations increased R&D and procurement spend
55:53
in year that they
55:54
SPEAKER_01: can use at their discretion is necessary to win.
55:57
SPEAKER_02: Fantastic.
55:58
SPEAKER_02: Well, Sam, thank you, and thank you.
56:00
This has been a wonderful conversation,
56:01
and I appreciate your coming on the podcast.
56:02
SPEAKER_02: Thanks for having us.
56:03
SPEAKER_02: It's great to be here.