Latest / Onapsis Podcast / The Unprecedented Rise in SAP Attacks: Lessons from Mandiant & Onapsis

Transcript

The Unprecedented Rise in SAP Attacks: Lessons from Mandiant & Onapsis · Onapsis Podcast

• 0:00
  Speaker 2: Good afternoon and welcome to today's fireside chat.
• 0:02
  Speaker 2: The unprecedented rise in SAP attacks lessons from Mandiant and Onapsis.
• 0:08
  Speaker 2: My name is Leah, And with us today we talked about the newly released mandient twenty-twenty six M trends report.
• 0:15
  Speaker 2: are Juergen Klitzer Klitzer VP for Mandiant Consulting Google Cloud and Anapsis CEO.
• 0:23
  Speaker 2: I said All right, sorry.
• 0:30
  Speaker 2: Let me do it again.
• 0:31
  Speaker 2: Okay five four three two one.
• 0:33
  Speaker 2: good afternoon and welcome to today's fireside chat.
• 0:36
  Speaker 2: the unprecedented rise in SAP attacks lessons from Mandiant and Onapsis.
• 0:41
  Speaker 2: My name is Leah And with us today could talk about the newly released mandiant twenty-twenty six mTrans report.
• 0:48
  Speaker 2: our Jurgen Kutcher BP VP for Mandiant consulting Google Cloud and onapsis CEO.
• 0:54
  Speaker 2: Mariano Nunez With that mariannel can you start itself?
• 0:59
  Speaker 0: Yeah, thank you very much.
• 1:01
  Speaker 0: Jürgen!
• 1:02
  Speaker 0: Very good to see you happy to have here for this discussion.
• 1:05
  Speaker 0: I know we've got some really exciting and important topics to discuss today.
• 1:10
  Speaker 1: so yeah Thank You Mariano.
• 1:11
  Speaker 1: great to be here
• 1:13
  Speaker 0: of course.
• 1:14
  Speaker 0: So look everyone knows in industry right like Mandi and kind a part of Google Cloud?
• 1:20
  Speaker 0: You guys are at the front end of the trenches.
• 1:24
  Speaker 0: three intelligences who really are tracking what threat actors and adversaries or doing And you really capture a lot of these intelligence and learnings in the M-trend report.
• 1:35
  Speaker 0: I'd love for you to talk more about what we've found over the last kind of twelve months, What were key findings on this year's M-Trend Report?
• 1:44
  Speaker 1: Yeah, so we've been publishing M-trends for about fifteen years or so now and it always summarizes our key observations from the front lines as you correctly said Mariano of the past twelve months.
• 1:54
  Speaker 1: And this year's report.
• 1:56
  Speaker 1: there were really a couple things that immediately jumped out at me.
• 1:59
  Speaker 1: one thing I would like to look at is the dwell time.
• 2:02
  Speaker 1: It was probably one of the most looked up metrics which are defined between initial compromise and detection of a threat actor in an environment.
• 2:12
  Speaker 1: And we've noticed actually for the first time after many, many years of steady decrease return to growth We have gone up to fourteen days from eleven day last year.
• 2:23
  Speaker 1: What's interesting about that?
• 2:24
  Speaker 1: is off course.
• 2:24
  Speaker 1: why behind it?
• 2:25
  Speaker 1: and we see primary reason why this?
• 2:28
  Speaker 1: because again more industrial espionage based attacks also more incidents tied with North Korean IT worker problem And these are two types of incidents where, again, attackers trying to maintain persistence for a long time.
• 2:43
  Speaker 1: I think that explains why we've seen the little bit reversal on this downward trend in the dwell-time over so many years.
• 2:51
  Speaker 1: but overall message remains positive when you look at well because fewer and fewer very long incidence as anything more than six months.
• 3:04
  Speaker 1: We see defenders getting better at detecting and responding to incidents, which is a positive for the industry now.
• 3:12
  Speaker 1: We've also seen an interesting trend around the initial compromise vector.
• 3:16
  Speaker 1: In fact, for this six consecutive year we see that exploits is the most commonly used initial compromised vector at thirty two percent.
• 3:25
  Speaker 1: on The other hand we see email phishing continuously declining.
• 3:29
  Speaker 1: it was down to six percent.
• 3:30
  Speaker 1: now.
• 3:31
  Speaker 1: We think this is primarily due to better technical controls and just simply more fishing emails Also getting blocked.
• 3:37
  Speaker 1: but we created a new category voice phishing A category that has grown to eleven percent, which Thread Actor started to use very heavily now because it bypasses the technical controls.
• 3:49
  Speaker 1: One example is Thread Actors targeting help desks and they're managing to social engineer their help desk employees too for example register attacker control mobile devices for NFA.
• 4:01
  Speaker 1: And another interesting trend is the handoff time between initial access and a full-blown ransomware attack that's gone down over the past few years from days to hours, now just twenty two seconds.
• 4:13
  Speaker 1: It is showing the challenge that defenders are facing dealing with attacks at go from like low impact intrusion to a super high-impact ransomware incident in just seconds.
• 4:25
  Speaker 1: Machine speed is critical for the SOC as we go forward, and on the topic of ransomware... The last trend I want to talk about here is threat.
• 4:34
  Speaker 1: actors are not only focusing on causing operational pain by encrypting critical systems but they've moved into actually preventing recovery.
• 4:42
  Speaker 1: They're actively targeting recovery system such as backup infrastructure or virtualization platform and other systems needed to restore an environment with a goal of course, of inflicting the maximum amount of pain.
• 4:54
  Speaker 1: To increase the odds of achieving their ransom payments.
• 4:58
  Speaker 1: those are some of the most interesting trends that we've seen in this year's entrance.
• 5:03
  Speaker 0: now That's great context you're gonna And I think it so important right for kind of The audience.
• 5:07
  Speaker 0: context like This is not a theoretical observation or prediction Like this Is actually from the front lines as You do easy response As your doing forensics.
• 5:15
  Speaker 0: So It's really high quality data and signal right across.
• 5:20
  Speaker 0: We're all kind of inundated with noise, things that come out.
• 5:22
  Speaker 0: but I think everyone looks forward to getting this telemetry and insights from you on your team because it's high quality And i think its interesting.
• 5:30
  Speaker 0: we've both been inside for more time than what we want to meet This evolution of fishing being less relevant and going towards exploitation of vulnerabilities which over the last decade were seeing a different trend.
• 5:47
  Speaker 0: That's definitely interesting to me as well.
• 5:50
  Speaker 0: I think that part of it, one of the things i noticed in this report is there a significant emphasis or relevance now on enterprise applications right?
• 5:59
  Speaker 0: In the Mannion report which we haven't seen before so maybe its connected with exploitation aspect but what happened you see and whats changed at enterprise application are really coming into the forefront.
• 6:14
  Speaker 1: Yeah, it's been an interesting evolution indeed.
• 6:17
  Speaker 1: I mean again as i said exploitation of vulnerabilities first place most commonly used attack vector and within that we do see a heavy focus on enterprise applications.
• 6:29
  Speaker 1: top three most frequently used CVEs were all tied to enterprise applications with SAP NetWeaver, taking the first place actually followed by Oracle e-Business Suite and finally Microsoft SharePoint.
• 6:43
  Speaker 1: Obviously, all three major players in the enterprise application space impact huge client footprint.
• 6:50
  Speaker 1: interesting the SAP Netweaver vulnerability specifically.
• 6:54
  Speaker 1: it related an unauthenticated remote arbitrary code upload vulnerability which when you combined it with another CVE also could result in code execution, making this indeed a very severe and very impactful vulnerability.
• 7:09
  Speaker 1: Now we track this as a campaign at Mandion When We See Recurring
• 7:14
  Speaker 0: Attacks
• 7:14
  Speaker 1: With attackers exploiting for example recurring vulnerabilities or using consistent methodologies that create campaigns around them and we saw this campaign last for the large majority of twenty-twenty five, with multiple investigations relating to these specific vulnerabilities.
• 7:31
  Speaker 1: In fact when we first started tracking it as a zero day in the early part of Twenty-Twenty Five We observed four distinct threat clusters that were exploiting this as a Zero Day And then after SAP released a patch we saw another six threat actor clusters starting to exploit this vulnerability.
• 7:51
  Speaker 1: It is clearly something that a lot of threat actors actively started to exploit.
• 7:57
  Speaker 1: One thing we've also seen, the post-compromise, we saw a lot attackers leveraging it for initial access but also then leveraging as starting point further conduct internal reconnaissance within those environments.
• 8:11
  Speaker 1: Obviously these enterprise applications are very critical assets too most organizations extremely high valuable, and I think attackers have just really taken advantage of that when those vulnerabilities were identified to immediately get sort the most critical components within an enterprise with some other most valuable data assets.
• 8:36
  Speaker 1: want to ask you some questions Mariano and obviously, You've seen the same thing that we have seen.
• 8:42
  Speaker 1: We've worked very closely together here And obviously on Upses is the expert in enterprise application security and protecting organizations against these types of attacks.
• 8:53
  Speaker 1: I know your team was at the center Of this global response as well.
• 8:57
  Speaker 1: i'd love To hear a little bit more from Your perspective what did u see specifically In twenty-twenty five when it came vulnerabilities.
• 9:07
  Speaker 0: Yeah, no absolutely you're gonna.
• 9:10
  Speaker 0: it's been a pleasure working with your team and many who work along with SAP.
• 9:15
  Speaker 0: we'd see some European certs as you described at the epicenter of that response.
• 9:22
  Speaker 0: but maybe taking this step back I think for us if you think about we've been working on the enterprise application space over the last sixteen years And we've been seeing this steady increase of, especially SAP threat activity.
• 9:36
  Speaker 0: But really what happened with the zero-day and DCB was really before an after, right?
• 9:40
  Speaker 0: It's kind of that.
• 9:41
  Speaker 0: it really became their first mass exploited SAP Zero Day vulnerability history which we hadn't seen... We'd seem very targeted attacks or some campaigns against known SAP vulnerabilities but we have never seen this scale and also used in a zero day and to your point with like now threat, different thread clusters that were kind of interacting or leveraging this.
• 10:03
  Speaker 0: So at a very high level just give you sense of the time.
• 10:06
  Speaker 0: when I get the audience's sense of their timeline Like they started really in April publicly starting in April end of April When I rely on Quest puts out a blog saying That they identified few customers who have Their SAP systems potentially compromised But it was not clear.
• 10:21
  Speaker 0: It wasn't zero day Was an over ability that has been exploited.
• 10:25
  Speaker 0: So, two days later after that blog SAP actually releases an emergency patch.
• 10:29
  Speaker 0: Right?
• 10:29
  Speaker 0: That makes it clear to everyone.
• 10:31
  Speaker 0: we're dealing with a CODA so as well started working closely with SAP and Mandian and government agencies across the world really help raise awareness on protect customers.
• 10:43
  Speaker 0: We are part of the work with SAP based.
• 10:46
  Speaker 0: some unique capabilities which have been discovered at that time was more complex than initially thought.
• 10:50
  Speaker 0: So SAP release another patch about fifteen days later, so then there's an other patch that has to be applied now.
• 10:57
  Speaker 0: But basically we have a time frame of at least since the block post two point end-of-the year off several waves of attacks.
• 11:05
  Speaker 0: right and one of reasons is that mid August this group Shiny Hunters goes out on publishes releases their public exploit so that it's another wave of attacks after that.
• 11:16
  Speaker 0: I think what interesting for us was big learning would realize happening way before kind of that April time for it, right?
• 11:23
  Speaker 0: And
• 11:23
  Speaker 1: as
• 11:24
  Speaker 0: part of an app system we have a capability.
• 11:25
  Speaker 0: We call SAP Thread Intelligence Network where we can actually see real-world attackers exploit in SAP systems and will use our intelligence to really improve our products and protect our customers but through them we found evidence like very very targeted exploits and probes happen all the way back from January.
• 11:44
  Speaker 0: So actually the threat actors were exploiting this probability.
• 11:47
  Speaker 0: In January, really we see a spike in February and March And then continuing again through different waves afterwards.
• 11:54
  Speaker 0: But if you think about the aftermath right?
• 11:55
  Speaker 0: This led to over five hundred companies being compromised Through their SAP systems.
• 12:01
  Speaker 0: I think We're fortunate that The actual component being targeted wasn't really old.
• 12:06
  Speaker 0: i'm not enabled many places so I think That actually reduced the attack surface.
• 12:11
  Speaker 0: otherwise numbers who have been ten X of
• 12:13
  Speaker 1: that?
• 12:14
  Speaker 0: I think one of the key cases that ended up becoming public later on was this very famous large UK manufacturer.
• 12:23
  Speaker 0: Unfortunately, through these attacks there were down production for six weeks.
• 12:28
  Speaker 0: they had to follow thirty thousand people and we're talking about a company has a really sophisticated SAP operation with a sophisticated security program.
• 12:36
  Speaker 0: but unfortunately this attack led two point four billion dollars in profit lost today
• 12:40
  Speaker 1: right?
• 12:41
  Speaker 0: And what a lot.
• 12:43
  Speaker 0: This was the result of shiny hunters.
• 12:44
  Speaker 0: They claim responsibility for this attack, and they say that it didn't use this SAP CRD.
• 12:50
  Speaker 0: It's a significant moment in the enterprise application security space.
• 12:55
  Speaker 0: Something I do want to highlight is we work together with you Jurgen and Charles Carmichael on the team at Mandia where not only protecting our customers but also securing all SAP customers and security community.
• 13:08
  Speaker 0: So we did work really closely to release an open source scanner, so IOC in the care of compromise scanning tool... We published it on GitHub.
• 13:20
  Speaker 0: that also helped the community and defenders worldwide get ahead of this right?
• 13:27
  Speaker 0: It was impressive to see scale at a level of sophistication and knowledge that bad guys have about these enterprise applications.
• 13:36
  Speaker 0: Now, to your point going directly after the crown jewels that are kind of in the cloud and more internet-facing than they used to be before.
• 13:43
  Speaker 0: And when I think about this right now it's like all these was pre AI Right?
• 13:48
  Speaker 0: It feels like the world changed last six months More than ever on All these attacks.
• 13:52
  Speaker 0: so this campaign we're talking about were basically mostly kind of pre AI campaigns and operations.
• 13:58
  Speaker 0: No AIs change everything.
• 14:00
  Speaker 0: So i'm very curious what Mandian sees kind of coming here in this regard, what you predict will happen now with things.
• 14:06
  Speaker 0: So as you mentioned the findings they were not good before right and there was a lot of challenges for defenders.
• 14:12
  Speaker 0: What do you see happening from threat perspective?
• 14:16
  Speaker 1: Yeah it's been really interesting couple months or maybe year where we've seen an incredible evolution with AI.
• 14:26
  Speaker 1: I remember Thread Actors first starting to use AI for social engineering, creating better emails, creating them in local language and then maybe moving into audio-video based content to ultimately be more convincing on the social engineering side.
• 14:42
  Speaker 1: that was where things started but it's not where thing stayed.
• 14:45
  Speaker 1: obviously very quickly Thread actors realized a power of egos well beyond.
• 14:51
  Speaker 1: Obviously, we'll talk more about how power AI can be in discovering vulnerabilities and exploits.
• 14:57
  Speaker 1: But even before I get to that attackers are using AI at many different capabilities.
• 15:03
  Speaker 1: At the highest level it helps them for speed scale and sophistication those other three main drivers and values that attackers getting out of AI.
• 15:15
  Speaker 1: They're, for example capable of building better attacker tools with higher speed and less knowledge that they require.
• 15:22
  Speaker 1: We've seen them build polymorphic malware meaning malware that can dynamically change its capabilities.
• 15:29
  Speaker 1: now think about what that does to anything signature based in terms of detection.
• 15:33
  Speaker 1: it just completely renders any signature-based detection completely obsolete.
• 15:38
  Speaker 1: This is malware without any human intervention can add and remove functionality through the use of AI, extremely impressive.
• 15:46
  Speaker 1: we saw that for the first time with our threat intelligence team GTIC found out in The Underground And now We've also seen it actually already being used by Threat Actors In live attacks right?
• 15:57
  Speaker 1: Extremely difficult
• 15:59
  Speaker 0: to
• 15:59
  Speaker 1: identify That.
• 16:01
  Speaker 1: and then Of course Thread actors are also automating different phases of the attack lifecycle.
• 16:07
  Speaker 1: One phase that, for example oftentimes gave the defenders an advantage was the time it took thread actors to identify crown jewels they were looking.
• 16:17
  Speaker 1: In the case of industrial espionage, finding whatever information that you're supposed to find is not a trivial task for threat actors.
• 16:25
  Speaker 1: They are usually not subject matter experts in their specific field.
• 16:28
  Speaker 1: they land somewhere in an enterprise and don't know where it's at or if there needs to be a crown jewel.
• 16:34
  Speaker 1: They need to move laterally so they can take documents out from the environment sometimes its right but also wrong information.
• 16:43
  Speaker 1: It takes time and creates noise.
• 16:45
  Speaker 1: AI can do all that for them.
• 16:47
  Speaker 1: AI can run a perfect discovery across a very large environment, look at thousands and thousands of documents to identify the right ones with much higher sophistication and much higher accuracy than a human without any special training could do.
• 17:01
  Speaker 1: That is, for example, critical phase.
• 17:03
  Speaker 1: threat actors are automating in-the attack lifecycle meaning again they're gaining speed or scale because fewer people are required to launch an attack And so this usage of the sophistication is increasing and evolving really, really rapidly here.
• 17:25
  Speaker 1: the capabilities of AI more and more as this ultimately allows them to reduce their barrier for entry.
• 17:33
  Speaker 1: It allows him to scale their attacks far faster, it allows them run more attacks in parallel And Of course As I was saying ,it allows us identify also vulnerabilities new entry points.
• 17:46
  Speaker 1: We already see.
• 17:47
  Speaker 1: exploitation of vulnerabilities like enterprise application vulnerabilities we were talking about is a number one threat vector.
• 17:55
  Speaker 1: Now, when you see how powerful AI is at discovering vulnerabilities in systems and applications but also now it's building exploits this going to be another force multiplier for the threat actors.
• 18:17
  Speaker 1: it really reduces the barrier of entry for threat actors.
• 18:22
  Speaker 1: And I think that is something we as defenders need to realize, We NEED TO USE AI FOR THE EXACT SAME REASONS, SPEED, SCALE AND SOFISTICATION!
• 18:34
  Speaker 1: The POSITIVE IS WE'RE SEEING ENTERPRISES ADOPTING AI EXACTLY FOR THAT!
• 18:40
  Speaker 1: Since we're on the topic of AI, Marianne I also wanted to ask you.
• 18:44
  Speaker 1: Of course i know SAP is obviously really focused on AI and what are the specific cyber risks to SAP applications that have now changed with AI?
• 18:57
  Speaker 1: What is your view on this?
• 18:59
  Speaker 0: It's a great question exactly.
• 19:01
  Speaker 0: SAP is doing massive transformation as a business to focus on AI.
• 19:06
  Speaker 0: they launch their autonomous enterprise vision and really strategy, which I think it's really impactful.
• 19:13
  Speaker 0: But the challenges they see is starting with what you just mentioned right?
• 19:17
  Speaker 0: We're-I was actually talking to CISO a couple of weeks ago now And he was very concerned about this.
• 19:23
  Speaker 0: new models meant exactly because one other point that you mention.
• 19:25
  Speaker 0: He said Hey!
• 19:27
  Speaker 0: I used to have advantage against... I know advanced attackers already knows how hack SAP systems.
• 19:33
  Speaker 0: we saw in these twenty five campaigns but at least I knew that most of the war from a Threlaska perspective, they don't really understand SAP.
• 19:42
  Speaker 0: They didn't know how to attack SAP systems.
• 19:43
  Speaker 0: They don't know their proprietary protocols or how to navigate SAP T-codes.
• 19:48
  Speaker 0: and now when you think about it all those like AI completely democratizes that access right?
• 19:54
  Speaker 0: Now they can just do a lot of that through the LLMs And they don' t need be an expert on the target applications.
• 20:01
  Speaker 0: That maybe kind of they did have knowledge before.
• 20:04
  Speaker 0: um i think in SAP also particular What happens is we're talking about mission critical systems, right?
• 20:10
  Speaker 0: So you gonna have now significant more volume as to describe off kind of more patches.
• 20:14
  Speaker 0: More things to patch or zero days that you've been attacked on.
• 20:18
  Speaker 0: but even for no vulnerabilities You cannot apply the patch Even if you haven't because it may not be able to get a downtime.
• 20:25
  Speaker 0: so your operating with assistance will long exposure to non vulnerabilities and I think in that point kind of the three intelligence, that context for triage and remediation is key.
• 20:36
  Speaker 0: You're not going to be able to fix everything.
• 20:38
  Speaker 0: so knowing through three intelligence kind of purpose built for this which are the ten things you're exposed too?
• 20:44
  Speaker 0: Which other two have actually been exploited by the three actors today right now most likely gonna be compromised kinda supersized with AI.
• 20:52
  Speaker 0: That's definitely I think an area off opportunity.
• 20:54
  Speaker 0: on balance The other one has a lot around zero-day detection, right?
• 20:59
  Speaker 0: It's like we're going to see as you describe more zero day vulnerabilities being discovered by LLMs.
• 21:04
  Speaker 0: So having the ability to detect zero data attacks against SAP is kind of critical and then something will hear a lot about this.
• 21:12
  Speaker 0: everyone is coding with AI.
• 21:14
  Speaker 0: now I'm creating code way faster with more volume of code.
• 21:21
  Speaker 0: there are a lot concerns whether that code is actually secure or not.
• 21:24
  Speaker 0: SAP has total capabilities like dual base assistance where you can actually generate code.
• 21:30
  Speaker 0: based on our analysis, it's very important that organizations run those new AI generated code capabilities through security controls.
• 21:39
  Speaker 0: Otherwise your pushing insecure or potential malicious code into production which could be
• 21:45
  Speaker 2: dangerous.
• 21:47
  Speaker 0: but I think again for this a lot of threats and pessimism.
• 21:53
  Speaker 0: in one perspective As we know, there's also a recognition I think from us practitioners that AI can be actually used for good.
• 22:02
  Speaker 0: So i'm curious about Jurgen and you're touching a little bit on it like where do you see that AI could use by defenders to really protect themselves against this new
• 22:10
  Speaker 2: reality?
• 22:12
  Speaker 1: Yeah, before I respond to that.
• 22:13
  Speaker 1: I just wanted to add your previous comment right?
• 22:15
  Speaker 1: That exposure window...I think it's an important topic for enterprises to realize with this new wave of zero days and vulnerabilities being identified by AI.
• 22:26
  Speaker 1: already in the twenty-twenty five mTrends reports we saw that the average exposure window is now negative.
• 22:32
  Speaker 1: seven Attackers are using vulnerabilities before a patch is even realized.
• 22:40
  Speaker 1: That means you as a CISO will have to accept that, You're going to have vulnerabilities and not gonna be able to patch fast enough?
• 22:49
  Speaker 1: The other reason it's just simply.
• 22:51
  Speaker 1: we expect of course A very significant number of vulnerabilities to be identified And As already seen in the past several years We'll also deal with vulnerabilities In systems which can no longer be patched.
• 23:03
  Speaker 1: Maybe the manufacturer no longer exists.
• 23:05
  Speaker 1: The devices are end of support, end-of life.
• 23:08
  Speaker 1: most enterprises deal with challenges like that and I think this is a critical moment for us again as cyber security professionals to realize To go back to a lot of the foundations That we've been talking about For so long.
• 23:22
  Speaker 1: Defense in depth zero trust architectures improving cyber defense capabilities all Of these things are going to be critically important.
• 23:31
  Speaker 1: obviously patching changing and updating your vulnerability management program is absolutely critical.
• 23:37
  Speaker 1: Reducing your attack surface, it's critical.
• 23:40
  Speaker 1: but also all of the additional security controls that we've been talking about for these years are going to be critical because you have to assume breach.
• 23:48
  Speaker 1: You're gonna have issues where not being able to fix fast enough before a threat actor potentially identifies.
• 23:56
  Speaker 1: But I agree with you.
• 23:58
  Speaker 1: Let's let's leave the doom and gloom a little bit behind us And let's also talk about how AI helps to defenders, and by the way?
• 24:05
  Speaker 1: I do believe that AI will give a greater Advantage to the defenders than to the threat actors.
• 24:11
  Speaker 1: right it may seem at times like things are not in perfect balance but i think over time Ai is A huge advantage for Us as defenders.
• 24:19
  Speaker 1: The first thing That I Think About Is when I talked To sysos is You need to use ai For the same three drivers that the threat actors are using, its speed scale sophistication.
• 24:30
  Speaker 1: There's many different ways that defenders can do it.
• 24:33
  Speaker 1: I'm just going to give a couple of examples.
• 24:37
  Speaker 1: i was talking earlier about how attack life cycles have gotten shorter through the use of AI .I gave that example of the twenty-two seconds in handoff time between two different threat actors going from initial foothold.
• 24:53
  Speaker 1: Now we as humans don't deal well with twenty two seconds in terms of response time, right?
• 24:58
  Speaker 1: If you're a sock analyst the light turns red.
• 25:01
  Speaker 1: Twenty-two seconds later You've got to complete ransomware incident In your hand.
• 25:05
  Speaker 1: chances are not going to react fast enough.
• 25:08
  Speaker 1: that alert will sit in the queue by The time it gets picked up.
• 25:11
  Speaker 1: It's evolved significantly.
• 25:13
  Speaker 1: AI can give us as cyber defenders such a powerful tool, building agentic songs that can operate at machine speed and make decisions for us is so critical.
• 25:25
  Speaker 1: it can triage these huge volumes of alerts at machine speeds So that the sock can then focus on those elements That really matter.
• 25:34
  Speaker 1: where human intervention Is needed.
• 25:36
  Speaker 1: Where complexity still demands Human analysis or human decision ultimately need to be made.
• 25:43
  Speaker 1: But one of the things that is clear for me and something we've also seen threat actors do, For example at a moment they will create a distraction or diversion.
• 25:53
  Speaker 1: They'll make very noisy attacks on each side They're overloading the sock.
• 26:01
  Speaker 1: I mean, this goes back to some of the old movies bank heists etc.
• 26:05
  Speaker 1: where The bad guys generate a lot of distraction for law enforcement in one particular part Of the city when they try to launch an attack In another part of the City and threat actors use the same technique.
• 26:16
  Speaker 1: that means your sock needs to scale And the human component is never gonna scale than their specific scenario especially if we're dealing with more and more zero-days vulnerabilities, more attacks automated fully AI driven attacks.
• 26:30
  Speaker 1: We need to be able to triage and work these alerts at machine
• 26:34
  Speaker 1: speed."
• 26:35
  Speaker 1: And I think there's great agentic solutions out there that Google have built now that can really help deal with the specific... threats that are out there, can build at scale and speed is absolutely necessary.
• 26:51
  Speaker 1: And on top of that with AI so many new things you could also do.
• 26:56
  Speaker 1: for example a look back function looking at closed incidents understanding if anything was missed by looking across multiple tickets or incidents.
• 27:06
  Speaker 1: maybe they were close.
• 27:07
  Speaker 1: it's an additional pattern identified.
• 27:13
  Speaker 1: typically a sock never has the time to go back and look at past events, past alerts.
• 27:20
  Speaker 1: And I think AI also needs to be used again in the identification of vulnerabilities by the defenders.
• 27:28
  Speaker 1: obviously we have a huge role to play there as well.
• 27:32
  Speaker 1: when i look at the vulnerability problem tied to AI always look at it from two perspectives.
• 27:37
  Speaker 1: one is How do we make sure that what we release in the future doesn't have problems of past?
• 27:45
  Speaker 1: AI is a phenomenal tool.
• 27:47
  Speaker 1: We're helping organizations build better, more secure SDLC processes by integrating AI into the SDLC.
• 27:55
  Speaker 1: It's a tool that is available.
• 27:56
  Speaker 1: it's very powerful and capable And can really reduce and improve quality of code being generated.
• 28:04
  Speaker 1: as you were saying Mariano earlier right?
• 28:06
  Speaker 1: A lot of this custom code is where risk sits because again, it's developed very quickly.
• 28:13
  Speaker 1: And that is a huge opportunity that defenders have to proactively scan this code before it goes into production and identify vulnerabilities.
• 28:22
  Speaker 1: The great thing about AI is they can also help with identifying these specific vulnerabilities and actually providing recommendations around them.
• 28:32
  Speaker 1: so not just pointing out the problem but telling you as software engineer what we need to do Right.
• 28:39
  Speaker 1: I mean, we recently launched for example the AI threat defense here at Google Cloud that exactly aims to help with this type of problem.
• 28:47
  Speaker 1: so That way We can deal With a go forward problem.
• 28:49
  Speaker 1: but Of course you still have all The past?
• 28:52
  Speaker 1: You need To review as well But also there again ai Can give you speed and scale when humans review source code.
• 28:59
  Speaker 1: i've done it As A consultant.
• 29:01
  Speaker 1: It's very tedious process slow process for a human to review source code and quite honestly, you will miss all of these.
• 29:10
  Speaker 1: AI is phenomenal at reviewing source code.
• 29:13
  Speaker 1: Enterprises need to use that to review all their applications and systems they have already in production And also, of course thinking about some of the supply chain risks etc.
• 29:23
  Speaker 1: Enterprises that provide software as a service will absolutely need to use AI To help ensure they proactively identify and remediate these critical vulnerabilities.
• 29:36
  Speaker 1: so what they give their clients ultimately has been tested by AI and has been fully remediated.
• 29:44
  Speaker 1: So again, I think there's a huge advantage here to us as the defenders.
• 29:48
  Speaker 1: we're playing a little bit of catch-up right now but i think ultimately We will get there Right?
• 29:55
  Speaker 1: AI will be an advantage for the defenders.
• 29:58
  Speaker 0: Now I fully agree.
• 30:00
  Speaker 0: Im an incredible optimistic optimist.
• 30:04
  Speaker 0: so if you think about in my mind I'm actually really optimistic about the long term.
• 30:09
  Speaker 0: I think in probably five over like, five years plus we're going to be probably AI gives us as a defender one of the unique opportunities.
• 30:17
  Speaker 0: We will have to actually change that kind of asymmetry situation between the offensive defense and what we've been always being exposed too.
• 30:26
  Speaker 0: i think The next few years before we get there as defenders are gonna Be pretty tough right now.
• 30:32
  Speaker 0: because exactly What you said?
• 30:34
  Speaker 0: that is going to generate the speed at which attackers are gonna be able use it, how many attackers can leverage this.
• 30:39
  Speaker 0: So I think there's recommendations and best practices.
• 30:42
  Speaker 0: you're saying like sooner organizations can implement those controls using AI through the five AIs.
• 30:48
  Speaker 0: as said i think that will bring a lot of balance that equation as quickly we got right?
• 30:54
  Speaker 0: And innovations like Google AI threat defense solutions where building really helping organisations get their faster.
• 31:02
  Speaker 0: We do same.
• 31:03
  Speaker 0: On our end, we announced a few months ago the on-apps agent gateway to really help organizations bring SAP into their agent security and compliance workflows.
• 31:13
  Speaker 0: Because at DFA it's all about context right?
• 31:15
  Speaker 0: You can like.
• 31:16
  Speaker 0: LLMs are really good at kind of high level understanding different components in domains.
• 31:20
  Speaker 0: but there is certain domains like in our case enterprise applications where you need to have really deep domain contexts that kind and really do impact assessment, actually drive that autonomous defense.
• 31:35
  Speaker 0: So we are continuously innovating to help customers achieve it.
• 31:40
  Speaker 0: I think we're running up against time here but i just want to close.
• 31:44
  Speaker 0: maybe in closing here... It's great to see kind of the power off of mandian kind of part at google cloud And what Anaps has been doing
• 31:53
  Speaker 1: over the last several years
• 31:54
  Speaker 0: right?
• 31:54
  Speaker 0: We bring a really great synergistic value even responding to an incident, right?
• 32:01
  Speaker 0: Something that affects a application like SAP.
• 32:05
  Speaker 0: Mandate is of course kind of leading organization in understanding the network and sending the operating system database really looking at all those assets on how these systems were compromised.
• 32:14
  Speaker 0: or how do we respond?
• 32:15
  Speaker 0: I would cover from there.
• 32:16
  Speaker 0: And we bring it into the application layer.
• 32:19
  Speaker 0: intelligence.
• 32:21
  Speaker 0: What exactly if the attacker went into the SAP application layer Like then this where can provide a lot value helping remove that blind spot so that the full attack chain, the full kind of business impact could be understood and really mitigated.
• 32:35
  Speaker 0: And clean up and mitigate it moving forward.
• 32:36
  Speaker 0: So I'm really pleased with the collaborations we've done also not only in the field but all the three intelligence sharing We're doing between our teams.
• 32:44
  Speaker 0: they open source tools will release to help everyone.
• 32:47
  Speaker 0: The committee on defenders are very excited about other steps Of our partnership as well.
• 32:53
  Speaker 1: Yeah if i can just echo That was recently at a panel where again this topic off we need to collaborate more as security solutions providers, to help enterprises deal with these new threats out there.
• 33:06
  Speaker 1: And I find this partnership between Anapsis and Google Mandiant of course really refreshing that intelligence sharing but then also giving back to the community.
• 33:16
  Speaker 1: Giving tools, giving intelligence to the Community so The Community learns how to protect themselves helps identify what might or may not be going on in their environment.
• 33:27
  Speaker 1: collaboration between Onapsis and Manion, I think it is so critical.
• 33:32
  Speaker 1: And that there's definitely something we as an industry need to continue to promote –to have collaboration–and make this type of a positive impact on the
• 33:40
  Speaker 1: community.".
• 33:42
  Speaker 1: Couldn't agree more with you, Mariano?
• 33:53
  Speaker 0: Thank you very much for your time!
• 33:54
  Speaker 1: Well, thank you
• 33:59
  Speaker 2: both for drilling down into the latest zero-day exploit campaigns.
• 34:04
  Speaker 2: The impact of AI driven threats and for discussing how to develop a defense strategy.