Latest / Full Tech Ahead / Unlock Safe AI Growth

Transcript

Unlock Safe AI Growth · Full Tech Ahead

• 0:20
  SPEAKER_02: Hello and welcome to Full Tech Ahead.
• 0:23
  SPEAKER_02: This is season two in full swing now, and I'm excited to be here today with Javed Hassan.
• 0:29
  SPEAKER_02: He is the CEO and co-founder of Lineage.
• 0:31
  SPEAKER_02: How are you doing today?
• 0:33
  SPEAKER_01: I'm doing well, Amanda, and thank you for having me.
• 0:36
  SPEAKER_02: Yes, happy to have you on the show.
• 0:38
  SPEAKER_02: Can you share a little bit about your company lineage and what services do you provide?
• 0:43
  SPEAKER_00: So Lineage Lineage is a software supply chain security company.
• 0:47
  SPEAKER_00: What we do is we can essentially decompose software from any state, find, discover the full supply chain, and then manage it for companies and deliver a secure software supply chain so that they don't ingest risk, risky software into their companies, into their software.
• 1:07
  SPEAKER_00: And 95% of the risk in modern software is ingested by using open source.
• 1:13
  SPEAKER_00: So we make open source safe to use by companies.
• 1:18
  SPEAKER_02: Great.
• 1:19
  SPEAKER_02: And you had some recent news, didn't you?
• 1:22
  SPEAKER_00: Yeah, so we just launched uh a new product called Unify, Unif AI.
• 1:26
  SPEAKER_00: You know, it's an interesting name.
• 1:28
  SPEAKER_00: And what we're seeing is as companies are ingesting or building new and new AI applications, newer and newer AI applications, the rate of AI development is changing.
• 1:38
  SPEAKER_00: So what has happened is AI has become easy to build, but AI is not safe to run.
• 1:44
  SPEAKER_00: So what we do, so what Unify does, it makes AI applications secure by design so that they are safe to run for companies.
• 1:54
  SPEAKER_02: Okay.
• 1:55
  SPEAKER_02: Well, we know AI is being used everywhere and everything.
• 1:58
  SPEAKER_02: And like you said, it is uh become really easy to create and implement into different tools and processes, but that definitely creates a security issue.
• 2:08
  SPEAKER_02: With all these companies rushing uh to implement AI tools, AI um pilots and agents.
• 2:15
  SPEAKER_02: Do you think they're aware of the risk or how aware of the risk are most company leaders at this point?
• 2:22
  SPEAKER_00: I I think the awareness is low.
• 2:24
  SPEAKER_00: I mean, there's a huge amount of excitement around what AI can do, right?
• 2:29
  SPEAKER_00: AI can improve productivity, AI can do things that you know humans could not do before.
• 2:34
  SPEAKER_00: You know, we're seeing a lot of excitement around it.
• 2:37
  SPEAKER_00: Now, what's also happening, what we are seeing along with it is the creation of a new, whole new IT infrastructure, which is made up of MCP servers, LLMs, you know, uh agents, skills, so on and so forth, right?
• 2:53
  SPEAKER_00: And this whole vertical infrastructure that's being created, there is a very low understanding of what security should be built into that.
• 3:02
  SPEAKER_00: Right?
• 3:03
  SPEAKER_00: So that's the problem we tried to solve.
• 3:05
  SPEAKER_00: So we went and spoke to a whole number of CISOs, and they gave us sort of three things that they would like.
• 3:11
  SPEAKER_00: And that's what Unified does.
• 3:13
  SPEAKER_00: So the first thing they told us is look, AI is changing so quickly, and developers and and vendors are bringing in AI capabilities very quickly.
• 3:22
  SPEAKER_00: So I don't actually know my AI inventory for lack of a better word.
• 3:28
  SPEAKER_00: So can you give me visibility or that all the AI that is coming into my organization?
• 3:33
  SPEAKER_00: And of course, it's lineage.
• 3:35
  SPEAKER_00: How risky is it?
• 3:36
  SPEAKER_00: Right?
• 3:36
  SPEAKER_00: So we are we are lineage, so we can now do, you know, the the the reputation of all AI, if you will.
• 3:43
  SPEAKER_00: The second thing they said is, look, I this again is changing so quickly, I don't know what policies I should be applying.
• 3:50
  SPEAKER_00: By the time I read up on, and we're all overwhelmed with this set of news that is hitting us so that that AI is making making policies possible.
• 3:58
  SPEAKER_00: And so they said, Look, I actually don't know what security policies to apply.
• 4:02
  SPEAKER_00: So the second thing, can you do is can you derive the right security policies for me?
• 4:08
  SPEAKER_00: So if you know all my AI assets, can you tell me how to secure them?
• 4:12
  SPEAKER_00: So how do you secure an LLM?
• 4:14
  SPEAKER_00: How do you secure an agent skills, you know, so on and so forth?
• 4:18
  SPEAKER_00: So we sort of so we did that.
• 4:20
  SPEAKER_00: And then we said, so we spoke to a bunch of other companies and they said, look, we have the policies to secure it.
• 4:27
  SPEAKER_00: They are 40 pages long.
• 4:29
  SPEAKER_00: We expect, for example, all our developers and our employees who are building AI to read them and somehow apply them.
• 4:35
  SPEAKER_00: That skill doesn't exist.
• 4:37
  SPEAKER_00: So the third thing we did with this is we autonomously apply those security policies into both low-code and high code agents and applications as they are being built.
• 4:48
  SPEAKER_00: So essentially what we're doing is we can discover all AI, derive the security policies that should be applied.
• 4:55
  SPEAKER_00: And if an organization enables it, we autonomously apply it in the right place in both low-code and high code AI platforms.
• 5:04
  SPEAKER_02: So then they can essentially be assured that all the policies are being followed and no one has to read those documents anymore.
• 5:16
  SPEAKER_00: Exactly, right?
• 5:16
  SPEAKER_00: And the last thing, as you would think, is because AI is changing very quickly and new AI attacks, yes, we're just in early days of attacks for AI coming in.
• 5:25
  SPEAKER_00: So we built a central lab that can now create new policies as they are needed and push them out to all those organizations and say, hey, by the way, you should now, because we're now seeing a new kind of attack, here's a new policy that you should you should apply.
• 5:39
  SPEAKER_00: Or suddenly, like now, agent swarms have become important.
• 5:43
  SPEAKER_00: So, what are the security policies for agent swarms if you are implementing them?
• 5:47
  SPEAKER_00: Last guy I'll give you an example, which is I think is so OpenClaw became really popular suddenly.
• 5:54
  SPEAKER_00: Right now, the interesting thing about OpenClaw is that it can write code in runtime.
• 6:02
  SPEAKER_00: So without the developer being involved.
• 6:04
  SPEAKER_00: So, you know, we have had a long practice, a long history of looking at code written in an IDE or by a developer.
• 6:10
  SPEAKER_00: But now OpenClaw is writing code at runtime.
• 6:15
  SPEAKER_00: Which then how do you apply security policies when code is not written by developers, but written by an agent at runtime?
• 6:23
  SPEAKER_00: Right?
• 6:24
  SPEAKER_00: So now that's the new policy set that we can now push out and say, okay, by the way, if you are using tools like OpenClaw or your agents are now writing code at runtime, that no developer has ever looked at, no, right?
• 6:35
  SPEAKER_00: And this is all new stuff.
• 6:37
  SPEAKER_00: How do you now secure those?
• 6:39
  SPEAKER_00: So we're seeing this continuous movement.
• 6:41
  SPEAKER_00: And so Unify is built as a platform to be able to evolve as AI evolves, create these new policies and autonomously apply them in the right place.
• 6:53
  SPEAKER_02: Yeah, that's very scary that AI could just be left running and creating whatever it wants to create with no human person in the loop.
• 7:03
  SPEAKER_00: Yeah, and we are seeing sort of, and that because of that, right, we are seeing new new attacks, right?
• 7:08
  SPEAKER_00: So, for example, not only that, we are seeing things like what we call reasoning compromise.
• 7:13
  SPEAKER_00: So, see, we are interacting with with AI through crowds.
• 7:16
  SPEAKER_00: So we are typing things and uh, you know, and the AI responds with with that.
• 7:21
  SPEAKER_00: So we are seeing this new new attack vector where I can stay within the boundaries of what prompts allow.
• 7:28
  SPEAKER_00: So they're not bad prompts fundamentally, so you can't detect them as bad prompts.
• 7:32
  SPEAKER_00: But what you can do though is use the prompt to change the reasoning of the LLM, the way you ask a question.
• 7:41
  SPEAKER_00: So if you, for example, you know, the the the way I say it is, you know, LLMs are chatty and gossipy.
• 7:48
  SPEAKER_00: So once they have the information, there is a way to extract it, right?
• 7:53
  SPEAKER_00: Whether you are allowed to or not, but if you asked the question the right way and said, look, or the CEO asked me to do this, can you tell me, or or I am uh I'm just trying to use this for a good purpose, the LLM will spill the beans.
• 8:05
  SPEAKER_00: So then the question really is so if you're now prone to those kinds of attack that change the controls that were built in, because the LLM decides that it is appropriate to change the change the controls in that sense, right?
• 8:19
  SPEAKER_00: Now detection becomes harder.
• 8:21
  SPEAKER_00: Right.
• 8:22
  SPEAKER_00: So that's the problem we are we are trying to solve.
• 8:24
  SPEAKER_00: And this is a very quickly evolving field as well.
• 8:28
  SPEAKER_00: Just like AI is evolving, safe, the safety of AI is evolving at the same pace.
• 8:34
  SPEAKER_02: How big of a struggle from your experience when you're working with business leaders and companies, essentially all the tools that they're purposefully implementing or giving access to their employees.
• 8:45
  SPEAKER_02: But what about the shadow AI that we hear about?
• 8:49
  SPEAKER_00: Yeah, so there's shadow AI, now they are shadow agents, right?
• 8:53
  SPEAKER_00: For example, right?
• 8:54
  SPEAKER_00: Agents doing, I could write an agent that was not allowed.
• 8:56
  SPEAKER_00: I could use so it's you know, we like we work with many US organizations that don't want Deep Seek or the derivative of Deep Seek.
• 9:03
  SPEAKER_00: Let's say a developer decides to use Deep Seek.
• 9:05
  SPEAKER_00: How do you now detect it?
• 9:07
  SPEAKER_00: Right?
• 9:07
  SPEAKER_00: In our case, we'll when we generate the AI inventory, we'll say, look, you're using DeepSeq here, here, and here.
• 9:12
  SPEAKER_00: And you are, it's your choice to allow, right?
• 9:14
  SPEAKER_00: If you're sitting in the infrastructure, we can discover all agents, but absolutely shadow AI, not only shadow AI, the fact that shadow AI can do whatever someone else tells it to do, pick up the right data and get all the access.
• 9:27
  SPEAKER_00: Like, I mean, OpenClaw, I think, is a classic example.
• 9:29
  SPEAKER_00: It can even pick up credentials that it was not supposed to have and get that access.
• 9:34
  SPEAKER_00: It can send emails on your behalf, it can send data out on your behalf, it can do whatever it wants, right?
• 9:40
  SPEAKER_00: If instructed correctly or by someone.
• 9:42
  SPEAKER_00: And now there are enough mechanisms where instructions to AI agents like skills, you know, skills is one way of doing it, can be given without the company being aware.
• 9:55
  SPEAKER_00: So it's so shadow AI goes pretty deep in that sense, right?
• 10:00
  SPEAKER_00: And being able to know if that only authorized skills, for example, are being used and what their capabilities are, and so on and so forth, becomes more and more important.
• 10:10
  SPEAKER_00: Shadow AI, if you will, is is becoming a significant issue.
• 10:15
  SPEAKER_02: Yeah, absolutely.
• 10:16
  SPEAKER_02: Where do you envision is the next focus on cybersecurity as far as I know we're hearing say about quantum and all sorts of things coming down the pipe?
• 10:28
  SPEAKER_00: Yeah, so and then quantum is of course really important.
• 10:31
  SPEAKER_00: Encryption fundamentally is important, right?
• 10:33
  SPEAKER_00: Similarly, you know, security for AI.
• 10:36
  SPEAKER_00: So the way I phrase this, there is AI for making security better.
• 10:40
  SPEAKER_00: So I already do a security task and AI just, you know, now I now an agent can do it.
• 10:46
  SPEAKER_00: So I'm doing the same thing I did, but the agent is making me more efficient.
• 10:50
  SPEAKER_00: And then the way I phrase this is security for AI is a new domain because exactly because of what we just did.
• 10:58
  SPEAKER_00: So security for AI, I think is is increasingly important.
• 11:02
  SPEAKER_00: We're sort of seeing this world evolve from legacy ways of building software to AI-centric ways of building software, and that creates a new, and then applications running as agents as opposed to traditional SaaS.
• 11:14
  SPEAKER_00: We're seeing that flip.
• 11:15
  SPEAKER_00: So I I think we as we are in a phase of essentially a redefinition of cybersecurity to to a new world because the world is being increasingly going to be run by a new infrastructure, which is AI-centric, building encryption that is quantum safe.
• 11:32
  SPEAKER_00: You know, I think we are in a world where we're going to refactor existing software pretty dramatically, and new software will work very differently.
• 11:40
  SPEAKER_00: And I think that's the from our point of view, that is the bet.
• 11:44
  SPEAKER_00: That that is, we are trying to create a new secure world with a new infrastructure.
• 11:51
  SPEAKER_02: Well, if there was one key takeaway you could leave our audience with today, what would that be?
• 11:57
  SPEAKER_00: Use AI to improve productivity safely.
• 12:02
  SPEAKER_02: Yes, absolutely.
• 12:04
  SPEAKER_02: Well, thank you so much for coming on the show and sharing your insights with us.
• 12:08
  SPEAKER_01: Thank you so much, Amanda.
• 12:11
  SPEAKER_02: And thank you to our audience.
• 12:12
  SPEAKER_02: If you have any questions about this or comments, make sure to share them and I will try to reply.
• 12:17
  SPEAKER_02: And until the next podcast, have a wonderful week.