Latest / Machine Dreams / AI Is Finding Vulnerabilities Faster Than Humans Can Fix Them
Transcript
- speaker-0: Hi everyone, and welcome again to Machine Dreams. This is the show where we talk to the people who are actually shaping the future of AI and they talk back to us honestly about what's working and what's not working in the space today and what the future might look like. My name is Kalawali Samuel Adibaya. I'm a technology analyst covering AI, cybersecurity, and enterprise technology. And as always, I'm joined by the remarkable. speaker-2: Hi everyone, I'm Leia Stern, a global communications strategist and former war correspondent. Sam, happy birthday to you. speaker-0: You thank you, thank you, thank you. speaker-2: Working and recording on your birthday, I just really admire it. What was last night a big night? Or tonight's the big night? speaker-0: Tonight's the big night. Thank you. speaker-2: That's great. Clear out your morning tomorrow and take it easy. speaker-0: Yeah, yeah, I will. I will try to do that. But thank you so much. ⁓ it's it's very very important. speaker-2: So wishing you only good things, health, happiness, wealth, all of it until a hundred and twenty. speaker-0: Thank you so much. speaker-2: Today we're joined by David Wershowsky, co-founder and CPO of Tonic Security. Tonic has built an end-to-end agentic platform for exposure management. It's designed to help organizations move faster from identifying risk to actually eliminating it. Before co-founding Tonic, David spent more than 20 years in cybersecurity, leading the red team and enterprise security department at Synia, one of the world's top incident response firms where he worked. Closely with Fortune 500 CISOs on building organizational resilience. David, it's really great to have you here on Machine Dream. speaker-1: Thanks, Leah. Thanks, Sam. It's a pleasure to be here. speaker-0: Great, thank you, Davy. Appreciate you joining us today on the show. So let's start ⁓ I guess with Mythos, which is one of the biggest talking points in the agentic cybersecurity world ⁓ today. ⁓ Anthropic announced Mythos preview back in April. And, you know, it said in its own words that the model could identify thousands of zero day vulnerabilities across every major operating system and web browser. And you you know how that went. And There's there's been a lot of debate about the potential ⁓ drawbacks for mythos. But as somebody who has been in the space for ⁓ more than two decades, how did that announcement come across to you? speaker-1: Yeah, well, yeah, Smith's is very much top of mind. And I'd have to say my initial response to this was, wow, kudos to the anthropic marketing team in generating hype around capabilities that to some extent already existed months before. Now, we've already seen in Opus four point six, I believe, la released a few months before, advanced capabilities in identifying bugs. And it has to do with a very simple fact that we can all ⁓ understand and we already know, I guess, to some extent, which is ⁓ the advanced sort of state of the art models are amazing at writing code and reviewing code. And we are seeing step changes. But I would argue that the ⁓ this that the ship has sailed on AI finding complex bugs way before Mythos was released. So there was a so to to on one hand there was a lot of hype and fanferrell on that release. However We need we don't need to look to this as one incident or one event. It's a sequence of events, and I believe it is a wonderful indication of well the world is going. Our assumption, indeed, our working assumption, not our working assumption, it's ours and governments and organizations across the world, is that newer, well, first of all, the current version of Mythos and equivalent models released by OpenAI and others. Will be available to the public either via leak or by the means in the next few months. Like that no one is really doubting that in the next few months we will see this capability publicly available. You just can't contain. Or someone will open source it. However, that's less interesting to me. What's more interesting that if you think about the pace of acceleration and the step changes, if you zoom out. And see the amazing change that we've seen in the past two to three years, there is no doubt in my mind that in a year from now, we will see models that put mythos to shame. Even if this model is overhyped, and I believe to some extent it is, this is still a warning sign, a huge one that should send alarm bells ringing all over the world. speaker-2: That's really interesting and and shines an interesting light on on what we're looking at because, you know, the cybersecurity industry has spent decades getting better at finding vulnerabilities, better scanners, better scoring systems, better detection, and yet breaches continue to happen. What is the industry getting fundamentally wrong at the moment? speaker-1: Yeah, that's a great question. The e one of the main challenges that we've seen, or maybe I should stop when when we started ⁓ dealing with some of the more advanced attacks, and I think the twenty tens were had s we had some pivotal moments. If you think about the golden age of ransomware, Oswanaka and not Petya, what we've seen is that ⁓ if fifteen years ago even organizations were largely not good. At understanding their own attack service. Organizations were not good in understanding that they are they have a battlefield that they need to manage. And it's not just about the technology. We are constantly fighting a battle against adversaries that want to hack our environments for espionage, financial gains, whatever it is, geopolitical reasons, right? ⁓ Intr the industry has matured. In some ways, it has matured too much. Fifteen years ago, it was difficult to understand exactly how the attack surface looks like. Fast forward to today, we have too many tools, too many scanners that are in a shouting competition. ⁓ what we have all these critical alerts, vulnerabilities, findings. And we know my background here in instant response. ⁓ I I've seen this time after time. Most of those critical findings, those critical alerts are just noise. It's simply noise that is distracting the security and IT teams and and senior leadership ⁓ from focusing on what matters most. At the end, and this is something that is almost a cliche by now, but cliches are cliches for a reason. The end goal of cybersecurity is to ensure business continuity. It's not about plugging ⁓ every hole. It's not about fixing every vulnerability. We don't need to. If we try to fix everything, the business will not operate. Because there will always be vulnerabilities. Now rel correlating this or connecting this with mythos, ⁓ my argument or our argument, way before mythos, security teams were drowning in vulnerabilities, in findings, too many. They don't need all those ⁓ to deal with all those stuff. So Mythos is gonna exacerbate the issue tenfold. There are gonna be tsunamis of vulnerabilities and findings. Now the real bottleneck becomes how do I fix all of these? And here is where I see a silver lining. The wonderful thing that Mythos will do for the industry, ⁓ for cyber, but outside of that for IT and indeed for many other ⁓ domains or other industries, it's Mythos will be a catalyst. That will force enterprises to adopt technologies at a much, much, much, much faster pace. And we've seen this, there are it testaments to this across ⁓ the history for the past 20, 30 years, where huge technological advancements created a sense of urgency for organizations to adopt new technologies fast, either because they need to be competitive or because they need to survive. In this case, it's both. speaker-0: David, let me take you back a bit ⁓ about what you said regarding Mythos. ⁓ of course, we both know that there's a lot of potential, ⁓ a lot of great stuff about mythos. And you've talked about some of this ⁓ this capability is to really find vulnerabilities at scale. But of course, people are also talking about the dangers of of mythos. And you said the the other time that it perhaps is overhyped i i in some regard. And so I'm curious to know in what ways exactly would you say that Mythos is is overhyped right now? speaker-1: Several ways. One, I I had the privilege of working with some of the brightest minds in the world. These are cold breakers, vulnerability researchers, hackers, if you will, that did some pretty awesome things and even changed history to some extent. They an extraordinary amount of talent exists today that mythos, and we have access to some of that, that mythos is still not on par with. I would argue that the NSA and equivalent ⁓ organizations around the world still have more talented individuals and teams in cybersecurity and beyond that can beat Mythus on a daily basis. Now ⁓ and maybe one sort of ⁓ a way to think about this, we all remember ⁓ AlphaGo. AlphaGo, that's the Google model that beat the world Go champion. Go is a very intricate, complex game. One way to think of to conceptualize this is this is not the Alpha Gov cybersecurity. Not yet. This is not yet the Alpha Golf cybersecurity. It still does not equate to the best hackers in the world. That's one. Second, think about what is currently happening, Mythos, Project Glasswing, that consortium of organizations that have private access, and there are other organizations working with OpenAI and other companies on equivalent technology. What's currently happening is that they get access to leverage these advanced models and they give them access to source code. It's not exactly cheating, but if you think about the way a real world adversary would approach this, it's sort of it's like a white box versus black box. In many cases, or many of the breaches or attacks, these are adversaries that do not have access to source code. There are other stuff that they can do, and AI is also helping them in that front as well. And so we'll it doesn't it doesn't negate the fact that we need ⁓ to protect or to prevent those adversaries from having access to these models, even if they don't have access to the source code of ⁓ the Microsoft OS or the Macroco OS, whatever. But ⁓ it's still it's not ⁓ your your everyday scenario, your one-of-the-mill scenarios where threat actors breach environments, ⁓ usually they don't have access to the source code when that happens. speaker-2: Well, let's talk about what tonic security actually does. So it describes itself as an agentic decision and execution platform for exposure management. But let's make that concrete. What does it actually do inside an organization? What does the experience look like on the ground? I'm curious how you came up with the name. speaker-1: So ⁓ I would maybe sort of ⁓ to put it very succinctly, security teams have three main tasks on their hand. Discover what they have in the organization, prioritize what needs to be fixed, what needs to be remediated, and then get the job done. Remediate what has been prioritized. Discovery by and large is a solved problem. There's no shortage of tools that tell us what we have. Prioritization is a big challenge. How do we prioritize the vulnerabilities, the findings based on business context, what's critical to the organization? And once we do know, once we do have an answer, how do we then remediate it as fast as not as fast as humanly possible? I should say now, at as at machine speed. Let's talk about the business context element for a second, because this is key. We cannot protect everything. We know this. It's true ⁓ way beyond cyber, also in the physical world. We want to protect these crown jewels that power the business, that keep the lights on. It's very difficult for teams today to understand what these are. And we help them by tapping into the tribal knowledge, the institutional knowledge, the collaboration tools that these organizations leverage, and we leverage this is one positive way. That's how defenders can leverage AI is we leverage AI, visual models and textual models, to understand what matters to the organization. The information is there, but it is ⁓ very challenging for humans to collect and make sense of it at scale. That helps us solve politization. As far as remediation is concerned, it ⁓ remediation is very much a team effort. In large organizations, medium to large organizations, you would have teams for all over the world fighting to get the The the issues fixed. It takes time, it takes coordination, orchestration, and it takes expertise to understand how to get things right. What we did at Tonic is to, based on the context and tribal knowledge that we can collect, is we've built the agentic workflows that automate much of that heavy lifting that goes into orchestration and remediation ⁓ of those vulnerabilities. So we can really accelerate those teams and there so they'll be able to say, okay, I understand myths is coming. I will be forced to deal with threat actors that are moving at machine speed. We need to sort of level the playing field. And we enable deploy our own agent workflows to combat the the threat actors' agents or AI capabilities. And to that extent, this is why I believe Mythos is a wonderful catalyst. It will allow organizations to say, okay, I need this technology now, not in 12 months. And you ask about and you ask about Tonic. Still an answer for that. So the Again, two or two answers here. One is it's refreshing. It used to be a medicine. We believe that cybersecurity, despite a very inherent adversarial nature, in some cases it is needlessly painful and we can help provide a fresh ⁓ perspective to it. And also, I think it's ⁓ it's a nice common denominator when you ask around, hey, what's your favorite drink? People will usually say gin tonic. ⁓ And that's also yeah, it's gin and tonic. speaker-2: Quite your favorite drink? speaker-1: Yes, indeed. speaker-0: Okay. That's interesting. You know, David, y Tonic's position, it appears to me, is that agentic AI will not just improve vulnerability management, but that it will replace the legacy version of it entirely. I think that's quite a strong claim. Can you make the case for that claim? speaker-1: Sure. There are and there are several incentives into into into what and several factors that c that come into what you just ⁓ described. It has to do with the way organizations are built. Think about a company that was built, founded, set up, deployed, distributed in the twenty tens versus an organization or a company that for all intents or purposes we can call them AI native. That was built in 2022, threefold hasten years. Since we've seen this wonderful advancement in technology, the way that organizations are built has a lot to do, has affect has a major effect on how these companies can innovate. And innovation is key. We are living in a defining moment where technology is it's it sounds like a ⁓ a cliche, but again, a cliche is a cliche for reason. Wh where technology is changing dramatically on a ⁓ weekly, monthly basis. And the companies that are able to innovate and keep pace are those that will win. Many of these legacy companies do not have the ability to innovate on that basis. speaker-2: And you've landed customers like the United States, Senate, Federal Credit Union. They obviously operate in environments where security failures carry serious consequences. When a customer is highly regulated, high stakes environments trust you with their security posture. So what is that ⁓ what are you actually asking to solve ⁓ with their existing tools and curious also ⁓ what other companies might be on the horizon ⁓ that you're going after to use your services? speaker-1: ⁓ so ⁓ the United States Sutherland Federal Credit Union is a beautiful c use case of an organization that is heavily regulated. Trust is important to them for obvious reasons, and they are adopters of of of early technologies. And they I think they have amazing foresight, and we are fortunate to be working with them. They have amazing foresight into many of the threats that we'll see emerging or they are seeing emerging ⁓ in ⁓ right now in the next few months. And they realize that the The old ways of doing things are no longer real. And we're helping them accelerate and signi dramatically reduce the time it takes them to identify and then remediate some of these issues that we've discussed. Now, it's not only limited to financial organizations. Any organization that is working in a complex operational environment requires the ability to move very fast and discover, prioritize, and ultimately remediate those. Issues that are critical to them. And we've been working with organizations across oil and gas, media and entertainment, gaming, ⁓ logistics, transportation, semiconductor. Organizations of all shapes and sizes are highly susceptible to these types of attacks, and many of them are already crumbling under the huge ⁓ weight of dealing with all these tsunami vulnerabilities that are coming our way. speaker-0: Last question. Every now and then I'm hearing people talk about AI agents, agenc security. It's be becoming more of a buzzword. ⁓ it so much that if I got a dollar for every time I I heard AI agent ⁓ or agentic security, I would probably be a billionaire right now. And you know, the cybersecurity industry sometimes ⁓ raises alarms or jumps on trends without giving people a clear sense of what to do next. So I'm curious, ⁓ for a business leader who is not a security professional, say maybe a CEO or a CFO or a board member, what is the one thing that you want them to walk away with from this conversation? speaker-1: Agents can be a wonderful tool in your toolbox to both accelerate your business and also protect it. Agents are not a replacement for people, at least in most domains. We still need people, expert workers, expert knowledge that working hand in hand with agents will help organizations to accelerate at a faster pace than ever before. Humans, agents, like humans, need high quality data. They need context. Without all context, they fail. Much of what we do as TANIC is to provide with humans and agents the ability to work together based on the context that we curate. That is key. Without that, agents and humans will fail. speaker-0: Great. Thank you so much, David, for joining us on Machine Dreams today. I think you've made really resonant points that many of our viewers and listeners will take away as insights for their businesses and and their everyday endeavour. So we appreciate you. This is exactly what this show is for. speaker-1: Thanks Stan, thank Lea. Pleasure to be here. Thank you for having me. speaker-2: Thanks, David, and thank you to everyone listening. This is Machine Dreams. We have more conversations coming with the people shaping the future of AI. See ya next.