Latest / Machine Dreams / AI Agents Are Coming For The Security Operations Center
Transcript
- speaker-0: Hi everyone and welcome again to Machine Dreams. This is where you get the very best insights from some of the most forward thinking leaders, experts and stakeholders in the wild AI industry who get us behind the scenes to show what's exactly working and what's not working in the space today and what the future could look like for all of us. My name is Kolauli Samuel Adebayo. I'm a technology analyst covering AI cybersecurity. and enterprise technology, and is always enjoined by the one and only delectable, remarkable. speaker-1: Wow, the adjectives keep getting better. Hi, everyone. I'm Leah Stern, communication strategist and venture capitalist. Happy to be here. Sam, where do we find you today in the world? speaker-0: Today I am in San Jose, California. I came here for some business conference and I'm hanging out for a bit. So I'm shooting out of a makeshift studio, which goes to show just how much thoughts and efforts we put into making this work. So yeah, that's where I am. speaker-1: I admire the dedication and enjoy the mothership of tech where you are at the moment. Let me know what you get up to there. speaker-0: Okay. speaker-1: Today we're diving into something that I think is going to genuinely unsettle a lot of people in the security world. And you know what? That's a good thing. Our guest is Tom Fidling, CEO and co-founder of Conifers. It's a company enabling security teams to build AI socks. Not AI sucks, AI socks. They don't just assist human defenders, but can take ownership of security investigations in real time. Tom comes from deep roots in cybersecurity and the Israeli startup ecosystem, a world where operating under constraint and constant threat isn't hypothetical. It's just an ordinary Tuesday. Conifers is his latest bet on what the future of defense actually looks like when AI stops being a co-pilot and starts being the investigator. Tom, welcome to Machine Dreams. speaker-2: Thank you guys for having me. speaker-0: Great, Tom. Thank you once again for joining us. So let's just dive right into it. ⁓ When you talk about the concept of shifting away from human led socks into always on AI operators or systems that can catch a lot really fast, what does that mean in practice? And what really is driving that shift from human led socks to this always on AI systems? speaker-2: That's a great question. And I think there are multiple parts to it. I think the first one we see that today we don't have enough talents and we don't have enough people to deal with today's load. So socks today, stay behind, takes them a lot of time to remediate threats and risks. And the byproduct of that is that a lot of organizations are getting breached. So being able to get ahead of it and investigate more incidents much earlier in the kill chain. find the real threats, escalate them and contain them much, you know, much faster than what we have today if we can. Obviously can, you know, help us to prevent a lot of the incidents and the breaches that we see today. That's number one. I think the future, it's a little bit more concerning. And I think we've all heard about CodeMetos and the 5.4 cyber that BopenEye put out there. And the future is going to look very different than what we have today. In the future, you will have adversaries using agents and very powerful models to find zero-day vulnerabilities, find holes in your attack surface. ⁓ And they will do it in machine speed and they will do it in scale that you have never seen before. So if the adversaries have superpowers and the defenders don't, that will be a very sad situation for all of us. And then the last thing. is the maturity of the models and the agents. We looked at 24, it was the introduction to LLMs that were a great tool. In 25, we started to see agents. It was infancy at this point. ⁓ Now at 26, agents matured, they can scale, they can communicate with each other, there you can monitor them. And also the models, as we can see with GPT-54 and Mitos and others, become so powerful. So, you can start utilizing them to do those tasks. And in certain cases, and we see that a lot, sometimes also do better jobs than humans on certain aspects of the business. speaker-1: And Tom, apparently you coined your own term, which we're hoping will go mainstream. It's called the agentic blue team. Can you tell me what that means? speaker-2: So the agent-in-chief team is an interesting concept. So as I said before, us looking forward to what the future of cybersecurity looks like, it looks very different than what we see today. Our core business when we started was just looking at investigations and investigation time and streamlined that process. And this is definitely something that helps today a lot of enterprise organizations and service providers. But when we look forward, our adversaries are going to use the agentic capabilities. We see that they're going to find a lot more vulnerabilities. They're going to find a lot of more holes in your attack surface. And then just, if we look at the stock as a whole, just looking at the investigations, which has been the biggest bottleneck for many, many organizations today, it's not enough. You need to be able to provide agentic threat intelligence capabilities. things that are coming in in large masses, being able to triage them, understand which part of threat intelligence is relevant for you as an organization, and then being able to launch an automatic threat hunt and figure out, I ⁓ vulnerable for these things? Do I have an incident for those pieces of threat intel that are relevant? And also just learn the environment into continuous threat hunting. And then moving those threat hunting into detections, meaning things that are on a scheduled basis to catch. the bad guys, not as freestyle as threat hunting, but things that you would like to run continuously, then do the investigation and then the response. And basically today, this whole process takes weeks to month. And because adversaries are slow, it's kind of, there is a balance between defenders and adversaries. If adversaries are going to start using agents, defenders will have to streamline that whole process and make it fully agentic beginning to an end. Obviously in some places I'm human in the loop, but what used to take us as a blue team weeks, potentially months to operationalize, we will have to start operationalizing in minutes and we will have to start running in machine speed as opposed to human speed. And not because we want to, because we have to, because the adversaries will get those superpowers that I was talking about earlier. speaker-0: Tom, I understand what you're doing and obviously the challenge with human led ⁓ SOC. But as you can imagine, and I'm sure that you probably have also had this conversation ⁓ in some capacity before, that opens up a conversation about AI replacing people versus AI helping people work faster. ⁓ so what do you say to that conversation, especially for people in cybersecurity or in stocks around the world who are anxious or fearful about their place in the world in the AI era? speaker-2: It's again, very interesting topic and I've been asked a lot about it. It's in cybersecurity and as a software company, see it in software in-house. Like, well, are we going to have coders in one or two years from now? Probably not. But I think what we will see, and especially in cybersecurity, is the human role within stock or other places in cybersecurity is going to evolve quite a bit. for learning and understanding how to write queries, how to interact with APIs or doing basic triaging, you will be able to start operating in a much higher level. When you're overseeing the AI, you provide guidance, you provide some sort of verification layer and start guiding it towards what ecosystem you would like to build that works for you as a company, rather than doing all the nitty-gritty stuff on a daily basis. which takes a lot of time and we just simply don't have enough people to do that. So it will elevate the role of humans. And if you are currently working for a cybersecurity organization or a software company, I highly recommend just to dive into this whole AI world and literally understand to the deepest level what AI can do and where humans needs to direct and orchestrate and help. And try to fit yourself into those roles because those roles are going to become super relevant in the future. Because AI needs guidance. AI needs verification. But if you are just kind of do what I do to like kind of keep doing what you're doing today and hope for the best in five years you will have a job, that's probably going to flip on you, unfortunately. speaker-1: Building on that, Tom, I'm curious your thoughts on the news on Mythos last week. It was the clearest articulation yet of something the market is only starting to process. AI isn't just a better security tool, it's a structural threat to the existing security business model. And they're saying that where the opportunity lies, firms that pivot from human error prevention to agent behavior monitoring will define the next era. What are your thoughts on that and do you agree? speaker-2: First, I think it's a brilliant marketing move by Entropic. They did, you know, something that it's remarkable. First, they came up with Mitos. And when you think of Mitos, it is not a cybersecurity related model. It's just really good at coding. And when you were so good at coding, you can find all of those uncovered vulnerabilities that have been living for the last 26 years in... you know, Linux or all the other platforms. Like nobody put so much effort finding those vulnerabilities before. And it's never been as easy as it is right now that every 12 years old with a thousand dollars worth of tokens with Antropic can have the capabilities that a nation state has today. So things will have to change. So I think we've proved on one end that the models are that powerful, that they can uncover all those, you know, But where we're going into, I think, we will have to create it again as a software company too, we'll have to create that layer that is part of everybody's software development life cycle that goes and find those vulnerabilities and remediate them as part of every software process that exists out there. So if I'm looking at, you know, previous capabilities, brute force phishing, all those things probably is going to stay. actually very interesting to see how they will adapt into the agent world. Would you try to fish an agent? Like obviously people today try to do social engineering on agents and this is why they're all security for AI, such a big industry today. So that's going to involve for sure. But I think, Anthropic uncovered the problem and potentially the solution ⁓ that it's going to be introduced into the future life cycle of developing software. And if you dive even deeper into it, like cloud basically The biggest revenue income for Antropic is tokens that are coming from people who writing code. So Antropic today and Cloud generates insane amount of code. If this code is not secure and has vulnerabilities, and we also talking today, all of us talk about, hey, know, vibe coding, is that something that we can integrate into production? Do you have to look at every piece of code that gets in? And now what it's so easy to create code is humans becoming bottleneck reviewing everything. So if AI is going to review that, we just need to make sure that we're not creating like the new marketplace for vulnerabilities for adversaries. And that's why the security and finding vulnerabilities in such, not just the static level, but also much higher level. It's so important for Anthropic to make sure that people can take CloudCode and let Cloud start or Codex or anything, any other model out there with coding agent go into production. So you want to uncover them, you want to fix them, and part of it is making sure that you're opting to the cybersecurity standards out there. So I think it's a bigger strategy of us maturing into how AI is going to incorporate in the whole development life cycle. And it's a huge threat for a lot of the software that has been around for a while, especially open source one, that hasn't gone through that. process yet. So what do you do with all of this tech debt? And that's a very interesting conversation to have for sure. speaker-0: Great. You know, on the back of that, I know that one of the biggest challenges with AI socks is the issue of false alerts where, you know, the systems at the back end could like pick up wrong signals or maybe even an AI agent who's probably a primary investigator could make a wrong call. Right. And so that's a big issue that I've seen people talk about in the industry. ⁓ How are you getting around this problem with false alerts. And I guess the more important question is, if an AI agent makes a wrong call or a bad decision, who bears the liability for that decision? speaker-2: That's a very, very interesting conversation. And I will split it down to, I think the liability issue, something which is very, very interesting. I'm like, we started to benchmark the results of our agents to human analysts. And we did find that agents today with the capabilities today in certain organizations that we assessed is doing less, like it has less mistakes than humans. The biggest thing is that humans have a lot less tolerance for agents mistakes versus human mistakes. We're like, oh, all humans do mistake. It's fine that, you know, five, six, seven percent of human judgment is a mistake. But when agent has one mistake, we're like, oh my God, that's, you know, completely wrong. And there is a clear double standard. It's like with the driving group stars. I'm like, you know, humans crash into so many and into each other, into trees, into whatever thing every day. But when a driving less car crash into whatever a telephone pole in San Francisco, it's on the front page of every newspaper in the city. So, I think we will have to understand, is it better than what we're experiencing today? Yes or no? I think we're starting to see, especially with the major leaps that happened in the fall of 25 and the beginning of 26, we're definitely getting there. That some tasks are being handled better by AI than humans, and we will have to start accepting it. There is an error rate that you will have to accept, especially compared to human and understand if you're like, like realistically getting better or worse. ⁓ and for the second, for the first part of your question about the false positive, this is a classic use of AI. So if for human, it's so hard to go, let's go analyze the last hundred alerts from a certain detections and figure out what went wrong and why, you know, 95 % of the incidents that are popping up are false positives. For AI, this is like a three minutes job. So this feedback loop and reinforcement and continuous improvement, this is part of the agentic team. Like, you know, you have a noisy detection, you look at it, you improve it, you roll it out, like you, you know, you kind of run it on try run, you roll it into production, you improve it. And you're a consistent path for improving yourself, which again, something that most organizations don't have the time today, don't have the expertise. And for humans, it's just never ending. amount of time that we're not allocating. And this is like the perfect, perfect solutions for AI to step in and help us to analyze these mountains of data and help us to rationalize that to something that humans can look at and say, ⁓ those are the top five issues that I have. ⁓ I want to fix number one, number three, and number five, the other two I don't care about, ⁓ roll it into production and keep improving. So this self-improving systems with human in the loop. By the way, you asked about where humans will find themselves in the future. Great example of AI is doing the analysis, the human review, it decides what he wants to implement, and then AI goes and implement that and then keep improving itself. ⁓ also with software, like it's never done. It's not like you ship the code and it's static code, it runs. Even our product today learns from customer environment, self-improving it, self-improving itself on the customer side. And this is, you know, if you would have asked me two years ago where we're going to be, know, 24 months later, I could have never imagined that we will be in a position that we have software that runs on customer-like environment and improve itself based on the customer's environment-like behaviors without even letting us know. It's like kind of doing it and sometimes doing it with the customer, but we're not even involved with the process. This is just fascinating to see and watch and to be part of. speaker-1: And you've been on this journey coming from cybersecurity. I imagine perhaps you were in a cyber unit back in your early days of military service, maybe 8,200, maybe 8,100, if I could take a guess. And you've seen the evolution of the cyber industry and Israeli cybersecurity is still the hottest, the most coveted 50 cents of every dollar globally spent on cyber comes out of Israel and you've shifted to the U.S. So I wonder how you compare the cybersecurity startup scene in Israel versus in the US and Silicon Valley and elsewhere, and how you see it evolving and moving because it seems to be now changing at an accelerated pace. you said, previous startups in cybersecurity will no longer be relevant with the technology changing so quickly. So what is your assessment now on where we stand versus where we were? speaker-2: So first, we enjoy the best from both worlds. We're split up between ⁓ Texas and Tel Aviv. So we have a big office here in Texas. We have a big office in Tel Aviv. And we find a way to bring the Israeli startup mentality and the US startup mentality and get the best from both worlds. But Leah, for your question, it literally feels like... Every three months or even less than that, somebody pulls their rug under your feet and you have to fall on your butt and it sometimes hurts. And it started like that a year and a half ago, but you will just have to accept it. I'm like, we changed completely our hiring process, the people that we are looking for. We completely changed our dev process, how we rolling out things into production, how we put things in tech preview, how we collect. It's like how we connect feedback from our customers and how we iterate, iterating much faster. And I keep telling all of my direct reports and all our executives. In the past, like I remember myself when I just got into the product engineering world, they send me into, I was at VMware, they send me into an HL class and said, Hey, that's the future. Go take a class. came back. kind of figured it all out, adopted into what you were doing. There is no class of how you develop software. in the AI world and if it would have been a class, it would have been outdated in like two weeks. like if you, we're looking for people that love change, people that can adopt really, really fast and it could be that 20, 30, 40, 60 % of what you worked on on the last year is going to be tossed away and you will have new things that you have to work on. So, this is like almost against human nature. Like we all hate change and we love stability. But the few people that embrace change and super agile, those are the people that are going to be very successful in this world. And there is no textbook. There is all those podcasts, like what you guys are doing and others. I listen to all of them all the time when people kind of exchange ideas. ⁓ that was not working for me. I tried it, it didn't work. It was a horrible trial, don't even go down that path. And something that we tried three months ago and failed completely, now we're achievable, then we can double down on them. So you have to be so agile and reevaluate yourself and use the community and always communicate about what's working, what's not working. And it's very important to separate like the hype of what people talk about in YouTube and LinkedIn and what actually works for people ⁓ in real life. And this is why we created like a small community of, you know, founders and companies that communicate with each other and really help us. We help ourselves to adapt because we became a little, you know, research software lab teams that kind of always have to keep up with what's going on outside and out there. And if you stay behind for three months and you're not innovating, you can become obsolete. So it used to take months or years to become obsolete. Now it's weeks or months. So, ⁓ my God, it's just crazy in the cyber world, but it's not, it's beyond that. If you start a company, in the past, you had to the right timing, the right talent, the right technology. Now you have to reinvent yourself every two weeks, which is amazing. ⁓ Living through that is a fortune. speaker-0: Tom, my last question. Earlier on, you spoke about the talent shortage in the cybersecurity space, especially in socks around the world. And of course, AI now has entered into the fray to really, really shift the landscape. I'm curious. And I know a lot of people watching and listening would be curious about this. What is the future? What does the future look like for humans? in, you know, socks around the world. speaker-2: That would be a very interesting prediction to make. As I said before, I think it will start being AI fighting AI. know, humans will not be in the front line anymore. And the humans will be able to have the adaptation to work in the agentic ward, in the AI ward, and understand what agents can or cannot do, how to guide agents, ⁓ how to, you know, adjust and communicate well with them. It's so funny, we just added a feature to our product that allows you to speak directly with the agent around the investigation ⁓ of your incident. So now you can literally text with them, like you will text with your email on Teams and you will communicate with them. And we are also going to roll out ability to talk with them, like in voice. So imagine you can talk with somebody like, are talking right now. And he will be able to respond back and you would not know if it's a machine or a real human. being able to understand what are the agent capabilities, apply them in the best way possible in your environment, safeguard, guideline, and communicate with that layer to bring it into the extreme, that will become the core capabilities that will define the best future cyber defenders. It will be very, very different than what we see and know today. And we already ⁓ in a shortage on some of the new skills that in cybersecurity. So yeah, if you're curious, if you're smart, and you can start thinking out of the box and challenge agents and find better how to communicate and work with them, your job is almost guaranteed for the next couple of years. But if you just kind of still doing what you're doing right now. I think that will be a little bit more challenging. speaker-0: Tom Fimlin, CEO and co-founder of Conifers. Thank you for joining us on Machine Dreams. This was an important, insightful conversation. speaker-2: Thank you for having me. speaker-1: Thanks, Tom, and thank you to everyone listening. If this one got you thinking, share it with someone in security who needs to hear it. We'll see you next time on Machine Dreams.