Latest / Revisionist History / The $5 Billion Effort to help Secure the World’s Shared Software | Smart Talks with IBM

Transcript

The $5 Billion Effort to help Secure the World’s Shared Software | Smart Talks with IBM · Revisionist History

• 0:02
  Speaker 1: Big companies inform insiders and investors of their comings and
• 0:06
  Speaker 1: goings through a steady stream of press releases. Written in
• 0:09
  Speaker 1: plain language, press releases typically serve as a chronicle of
• 0:12
  Speaker 1: the prosaic details of corporate life. If you were to
• 0:16
  Speaker 1: scroll through the news releases from IBM from last May,
• 0:19
  Speaker 1: you would see news of an AI collaboration, updates to
• 0:22
  Speaker 1: the IBM consulting service, a sports tech startup challenge, a
• 0:26
  Speaker 1: new quantum chip manufacturing facility.
• 0:29
  Speaker 2: You get the picture.
• 0:30
  Speaker 1: But keep scrolling. until you reach May 28th, a press
• 0:34
  Speaker 1: release that dwarfs nearly everything else. IBM and Red Hat
• 0:38
  Speaker 1: today announced Project Lightwell, a $ 5 billion commitment backed by
• 0:43
  Speaker 1: new frontier AI capabilities and a global force of more
• 0:47
  Speaker 1: than 20,000 engineers to help enterprises secure open source software.
• 0:53
  Speaker 1: IBM and Red Hat, the open source software leader that
• 0:56
  Speaker 1: IBM acquired in 2019, are committing $ 5 billion and 20,000
• 1:03
  Speaker 1: engineers to a cybersecurity project. Even in an age when
• 1:07
  Speaker 1: we have become inured to very large numbers, these are
• 1:11
  Speaker 1: very large numbers.
• 1:13
  Speaker 2: Keep reading.
• 1:14
  Speaker 1: Paragraph 4. The press release then lists just some of
• 1:17
  Speaker 1: the companies that have already agreed to collaborate as early adopters.
• 1:21
  Speaker 1: Bank of America, Bank of New York, Citicorp, Goldman Sachs,
• 1:25
  Speaker 1: JPMorgan Chase, MasterCard, Morgan Stanley, Royal Bank of Canada, State Street, Visa,
• 1:30
  Speaker 1: and Wells Fargo. Four of the biggest banks in the US,
• 1:34
  Speaker 1: the biggest bank in Canada, two of the biggest investment
• 1:37
  Speaker 1: banks on Wall Street, two of the world's biggest credit
• 1:40
  Speaker 1: card networks, the firm that probably holds your 401k, just
• 1:44
  Speaker 1: for starters. Press releases do not normally require explanations. This
• 1:49
  Speaker 1: one does.
• 1:53
  Speaker 2: I'm Malcolm Gladwell.
• 1:54
  Speaker 1: You're listening to Smart Talks with IBM, a podcast where
• 1:57
  Speaker 1: we explore how AI and emerging technologies are reshaping the
• 2:01
  Speaker 1: way businesses and industries operate. In this episode, I want
• 2:07
  Speaker 1: to explain why one of the world's largest technology companies
• 2:11
  Speaker 1: felt compelled this past spring to launch one of the
• 2:14
  Speaker 1: largest dedicated commitments to open source security to date, and
• 2:19
  Speaker 1: why the minute they did, much of the financial services
• 2:23
  Speaker 1: industry raised their hand and said, count me in. You
• 2:29
  Speaker 1: are the head of information security for a large, very
• 2:34
  Speaker 1: large multinational bank. I put the question to Manish Sharma,
• 2:38
  Speaker 1: the chief information security officer for Wells Fargo, one of
• 2:42
  Speaker 1: the early adopters on Lightwell. Why did Wells Fargo participate?
• 2:47
  Speaker 3: You know, what we've seen with the progress in AI
• 2:51
  Speaker 3: is has created an element of urgency about everything from
• 2:56
  Speaker 3: maintenance to lifecycle management to operational stability, every aspect of it.
• 3:01
  Speaker 3: So it's really in the past few quarters that we've
• 3:06
  Speaker 3: started to look at things differently.
• 3:09
  Speaker 1: Anthropic released Mythos in preview mode just six weeks before
• 3:14
  Speaker 1: the launch of Lightwell. A frontier AI model so powerful...
• 3:18
  Speaker 1: that Anthropic, its developer, said that it would, quote, surpass
• 3:22
  Speaker 1: all but the most skilled humans at finding and exploiting
• 3:26
  Speaker 1: software vulnerabilities. It's right there in the press release. Paragraph three.
• 3:32
  Speaker 1: Anthropic recently reported that its mythos preview model identified nearly
• 3:36
  Speaker 1: 3,900 high or critical severity vulnerabilities in open source software alone.
• 3:44
  Speaker 1: Thousands and thousands, of critical vulnerabilities. But there was a
• 3:50
  Speaker 1: moment where you're like, oh. Yeah. Give me a kind
• 3:53
  Speaker 1: of more specific understanding of that. So when you say
• 3:56
  Speaker 1: the pace has changed, it's gone from what to what?
• 4:00
  Speaker 3: Potentially from days and weeks to minutes.
• 4:05
  Speaker 1: To understand the urgency behind Lightwell, you have to understand
• 4:09
  Speaker 1: something about software that most people never think about. Open source.
• 4:15
  Speaker 1: Unlike proprietary code, open source software isn't controlled exclusively by
• 4:20
  Speaker 1: one company or person. In a hypothetical universe where there
• 4:24
  Speaker 1: is no open source, where code is written the way
• 4:30
  Speaker 1: music lyrics are written or books are written, where they're
• 4:33
  Speaker 1: owned exclusively by the person, by the creator, how does
• 4:36
  Speaker 1: that affect the shape of the digital revolution?
• 4:40
  Speaker 2: Well, so actually I'm going to correct you.
• 4:42
  Speaker 1: I'm talking to Gunnar Hellickson. who runs the Lightwell Initiative
• 4:45
  Speaker 1: for IBM and Red Hat.
• 4:47
  Speaker 4: In fact, open source only works because of copyright. So
• 4:51
  Speaker 4: what happens is I write a piece of software, I
• 4:53
  Speaker 4: have a copyright to it, and I use that copyright
• 4:57
  Speaker 4: not to say all rights reserved and restrict access to it.
• 5:00
  Speaker 4: I use those same rights to then, I can now
• 5:02
  Speaker 4: ascribe those rights to other people. So it's actually what
• 5:06
  Speaker 4: was most clever about open source is it kind of
• 5:08
  Speaker 4: inverts the intent of the copyright law and makes it
• 5:12
  Speaker 4: it turns it into a tool for sharing as opposed
• 5:13
  Speaker 4: to a tool for restriction.
• 5:14
  Speaker 1: Yeah. But books and music are not written as tools
• 5:16
  Speaker 1: for sharing.
• 5:17
  Speaker 2: No, that's true.
• 5:17
  Speaker 1: There's a million books I've read where I've said I
• 5:19
  Speaker 1: could make this better and I'm not allowed to.
• 5:22
  Speaker 2: Yeah, that's right. That's right.
• 5:23
  Speaker 4: And so the mechanics of sharing become important because using
• 5:28
  Speaker 4: the copyright law, you can actually ensure that things are
• 5:30
  Speaker 4: shared over time and consistently. So if I write a
• 5:33
  Speaker 4: piece of software and I give it to you, you
• 5:35
  Speaker 4: can improve it, but the license stipulates that you then
• 5:39
  Speaker 4: also have to share any improvements that you made, right?
• 5:41
  Speaker 4: And so in this way, it kind of folds in
• 5:43
  Speaker 4: on itself, right?
• 5:44
  Speaker 2: Yeah.
• 5:44
  Speaker 1: Open source software often works in tandem with proprietary code.
• 5:48
  Speaker 1: Imagine a pyramid. At the top of the pyramid is
• 5:52
  Speaker 1: the specific, carefully tailored code that an individual company might
• 5:56
  Speaker 1: use to solve a specific problem. That code is typically
• 6:00
  Speaker 1: written in-house or purchased from a software company. It's curated.
• 6:05
  Speaker 1: It's controlled. systematically. Someone's in charge of it. But beneath
• 6:11
  Speaker 1: that sits something much larger. Billions of lines of open
• 6:15
  Speaker 1: source code. Shared software components or packages built collectively by
• 6:20
  Speaker 1: developers all over the world over decades. Anyone can use them.
• 6:25
  Speaker 1: Anyone can improve them. Someone fixes a bug, submits the
• 6:29
  Speaker 1: update to the volunteer running that particular package, and the
• 6:32
  Speaker 1: project evolves. A famous essay in the technology world refers
• 6:42
  Speaker 1: to these two models of software production as the cathedral
• 6:46
  Speaker 1: and the bazaar. The cathedral is quiet and composed and hierarchical.
• 6:52
  Speaker 1: The bazaar is sprawling and noisy and chaotic. And the
• 6:56
  Speaker 1: argument in the essay was that the bazaar, against all expectations,
• 7:00
  Speaker 1: was far better suited for the kind of creative work
• 7:03
  Speaker 1: that produces innovative software. Here's an excerpt from the essay.
• 7:07
  Speaker 1: describing the emergence of the most famous of all open-source projects, Linux,
• 7:12
  Speaker 1: started by Linus Torvald in the early 1990s, the operating
• 7:17
  Speaker 1: system that would become the backbone of modern computing. I
• 7:22
  Speaker 1: believed that the most important software needed to be built
• 7:26
  Speaker 1: like cathedrals, carefully crafted by individual wizards or small bands
• 7:31
  Speaker 1: of mages working in splendid isolation with no beta to
• 7:34
  Speaker 1: be released before its time. Linus Torvald's style of development,
• 7:39
  Speaker 1: release early and often, delegate everything you can, be open
• 7:43
  Speaker 1: to the point of promiscuity, came as a surprise. No quiet,
• 7:48
  Speaker 1: reverent cathedral building here. Rather, the Linux community seemed to
• 7:52
  Speaker 1: resemble a giant babbling bazaar of differing agendas and approaches,
• 7:57
  Speaker 1: aptly symbolized by the Linux archive sites who take submissions
• 8:01
  Speaker 1: from anyone, out of which a coherent and stable system
• 8:05
  Speaker 1: could seemingly emerge only by a succession of miracles. The
• 8:10
  Speaker 1: fact that this bizarre style seemed to work, and work well,
• 8:14
  Speaker 1: came as a distinct shock. Could we have gotten to
• 8:23
  Speaker 1: the level of technological sophistication that we have today without
• 8:29
  Speaker 1: open source?
• 8:29
  Speaker 2: No, no, no.
• 8:31
  Speaker 1: Here's Gunner again.
• 8:32
  Speaker 4: Open source is so widespread right now. Aircraft in the sky, waterworks, electricity, roads, governments,
• 8:39
  Speaker 4: they all rely on software that was largely developed by
• 8:43
  Speaker 4: volunteers who were just scratching their own itch. And no
• 8:50
  Speaker 4: single firm could capture all of that work, couldn't afford to.
• 8:53
  Speaker 2: Pay them, right?
• 8:55
  Speaker 4: And even if it could, the innovation loops that happen
• 8:59
  Speaker 4: in all of the sharing would be confined to that
• 9:01
  Speaker 4: one firm it would be very, very difficult for three
• 9:05
  Speaker 4: or four of these firms to share the information as
• 9:07
  Speaker 4: easily as they can with open source.
• 9:09
  Speaker 1: To give you a sense of the scale of open source, GitHub,
• 9:13
  Speaker 1: the largest archive of open source code, has over 420
• 9:17
  Speaker 1: million software packages in its library. 230 new repositories were
• 9:23
  Speaker 1: created every minute in 2025. That year, software developers around
• 9:28
  Speaker 1: the world made just under a billion commits to that archive.
• 9:32
  Speaker 1: This year, in 2026, GitHub is seeing over 2 billion
• 9:36
  Speaker 1: commits a month due to an explosion in AI-assisted coding.
• 9:41
  Speaker 1: Open source is massive. But the very thing that makes
• 9:45
  Speaker 1: open source so dynamic, the fact that there is no
• 9:49
  Speaker 1: central controlling authority, is also what makes it so fragile.
• 9:54
  Speaker 1: So who actually worries about the security of open source code?
• 9:58
  Speaker 4: So as the software graduates and moves into commercialization, it's
• 10:04
  Speaker 4: real clear, right? There's not just one, but probably several
• 10:06
  Speaker 4: companies who are interested in making sure that that software
• 10:08
  Speaker 4: is secure, right? So things work really well at that point.
• 10:11
  Speaker 4: So really what we're talking about is the software that
• 10:13
  Speaker 4: doesn't quite get swept up in the commercialization process, but
• 10:16
  Speaker 4: it's still essential. And the way I just described it
• 10:19
  Speaker 4: makes it sound like that's like 5% of the problem,
• 10:22
  Speaker 4: but across the, all of it, it's about 60 to 70%
• 10:26
  Speaker 4: of the software that we're running falls in that chasm, uh,
• 10:29
  Speaker 4: between it's not actually commercially supported and it's not software
• 10:33
  Speaker 4: that the, uh, company has written itself. It's a, these are,
• 10:37
  Speaker 4: we call them dependencies, right? Um, so these are software
• 10:40
  Speaker 4: that we need to go write other software, right? Um,
• 10:43
  Speaker 4: and that's, uh, to date, uh, We have not tended
• 10:49
  Speaker 4: not to think very hard about the security of those dependencies.
• 10:53
  Speaker 1: Much of the software underneath modern life doesn't belong to
• 10:56
  Speaker 1: anyone in particular, which raises an obvious question. If everyone
• 11:01
  Speaker 1: depends on it, who's responsible for maintaining it?
• 11:05
  Speaker 5: Well, this is the whole thing about open source software
• 11:09
  Speaker 5: is it's incredibly important and it is maintained by a
• 11:16
  Speaker 5: relatively small number of people. And so you can think
• 11:21
  Speaker 5: about these enormously consequential projects that we all rely upon,
• 11:26
  Speaker 5: basically maintained by a handful of people. And that's been
• 11:29
  Speaker 5: the biggest issue of it, sort of industrial use and
• 11:32
  Speaker 5: then artisanal scale maintenance. And because of where we're at
• 11:38
  Speaker 5: right now with respect to infrastructure and software being under
• 11:43
  Speaker 5: increasing threat, given these very powerful AI capabilities, there's now
• 11:49
  Speaker 5: been a big flashlight on, wow, we depend on this
• 11:52
  Speaker 5: open source software, but it is maintained by, in a
• 11:56
  Speaker 5: lot of cases, volunteers.
• 11:57
  Speaker 1: That's Jen Easterly. She has spent her career thinking about risk. First,
• 12:02
  Speaker 1: as a soldier and intelligence officer, later inside the cybersecurity establishment,
• 12:07
  Speaker 1: and now as the head of RSAC, one of the
• 12:10
  Speaker 1: world's leading cybersecurity conferences and communities. Talk a little bit
• 12:14
  Speaker 1: about your own path to worrying about this problem. How
• 12:18
  Speaker 1: did you get into this?
• 12:20
  Speaker 5: Yeah, I mean, a pretty circuitous path, to be honest.
• 12:25
  Speaker 5: It sort of started out right after my 18th birthday,
• 12:29
  Speaker 5: where I entered the gates of the United States Military
• 12:31
  Speaker 5: Academy at West Point.
• 12:33
  Speaker 1: Easterly was in the military for the fall of the
• 12:35
  Speaker 1: Berlin Wall. She served on the ground in Haiti, Bosnia, Kosovo, Somalia.
• 12:41
  Speaker 1: She returned to West Point to teach economics.
• 12:43
  Speaker 5: And I was there during 9-11, where the world changed again.
• 12:47
  Speaker 5: And the next decade became all about terrorism. I was
• 12:50
  Speaker 5: at the White House working for Condi Rice as her
• 12:52
  Speaker 5: executive assistant, and then went off to the National Security Agency,
• 12:56
  Speaker 5: of course, the world's largest and most powerful intelligence agency.
• 13:00
  Speaker 5: And I was there for over a decade in Iraq.
• 13:02
  Speaker 5: in Afghanistan, and that's where I got into cyber. Stood
• 13:06
  Speaker 5: up the Army's first cyber operations battalion, went to stand
• 13:09
  Speaker 5: up U.S. Cyber Command, and then ended up in the
• 13:12
  Speaker 5: private sector at Morgan Stanley, and then at CISA, which
• 13:16
  Speaker 5: is America's Cyber Defense Agency, and now I run the
• 13:19
  Speaker 5: largest platform for cybersecurity. And so a very circuitous path,
• 13:24
  Speaker 5: which all kinds of different threats, but right now a
• 13:27
  Speaker 5: huge focus on cyber.
• 13:29
  Speaker 2: Craziest career path I've ever heard.
• 13:31
  Speaker 5: It is a little crazy.
• 13:32
  Speaker 1: Easterly is, in the world of cybersecurity, a unique figure.
• 13:37
  Speaker 1: She's a soldier and a strategist, not a coder. She
• 13:41
  Speaker 1: spent her career moving between the military government and the
• 13:44
  Speaker 1: private sector, not growing up in Silicon Valley. And most
• 13:47
  Speaker 1: of all, she's someone who has spent her career looking
• 13:50
  Speaker 1: at problems through the lens of national security and resilience.
• 13:53
  Speaker 1: Who threatens us? Where are we vulnerable? How do we
• 13:57
  Speaker 1: reduce risk? And how do we make the systems we
• 14:00
  Speaker 1: depend on harder to break and and faster to recover
• 14:03
  Speaker 1: when they do. That combination has given her an unusual
• 14:07
  Speaker 1: and influential voice on cybersecurity. And one of Easterly's mantras is,
• 14:12
  Speaker 1: the world does not have a cybersecurity problem. It has,
• 14:16
  Speaker 1: and to her mind, this distinction is crucial, a software
• 14:19
  Speaker 1: quality problem.
• 14:21
  Speaker 5: So security has always been a bolt-on, right? That's arguably
• 14:25
  Speaker 5: what created the multi-billion dollar cybersecurity aftermarket.
• 14:29
  Speaker 1: What she means is that cybersecurity is is thought of
• 14:31
  Speaker 1: as a layer added to software after the fact, often
• 14:36
  Speaker 1: by someone other than the original software developer to keep
• 14:39
  Speaker 1: the software secure. Her question is, why isn't the security
• 14:44
  Speaker 1: baked into the software itself? Answer, because the incentive structure
• 14:50
  Speaker 1: around writing software is all wrong.
• 14:53
  Speaker 5: I mean, it comes down to without getting too geeky or,
• 14:57
  Speaker 5: you know.
• 14:57
  Speaker 2: No, you can get geeky.
• 14:58
  Speaker 1: This is IBM smart talks. You can be geeky as
• 15:02
  Speaker 1: you want.
• 15:03
  Speaker 5: All right. We're going to do a quick econ 101.
• 15:09
  Speaker 5: So it all comes down to like basic economics, right? Goods, right? So,
• 15:12
  Speaker 5: you know, you have search goods where you can tell
• 15:16
  Speaker 5: the quality of a good before you buy it. Pair
• 15:18
  Speaker 5: of shoes, nice shirt. And then you have experienced goods.
• 15:21
  Speaker 5: You tell the quality after you buy it, like a
• 15:23
  Speaker 5: meal in a restaurant or a nice, you know, trip, right?
• 15:27
  Speaker 5: But software security is a quintessential credence good. What does
• 15:31
  Speaker 5: that mean? It means that a person can't actually tell
• 15:35
  Speaker 5: the quality of a good before you purchase it or
• 15:37
  Speaker 5: even after you purchase it. So the average human is
• 15:40
  Speaker 5: not going to look at a piece of software and say,
• 15:42
  Speaker 5: that is the most secure software. That is the best,
• 15:46
  Speaker 5: most resilient code ever. Or I am definitely going to
• 15:50
  Speaker 5: get hacked and all my money is going to get stolen.
• 15:53
  Speaker 5: You can't look at that, right? And so because of that,
• 15:57
  Speaker 5: consumers don't really know what to ask for. And so
• 16:01
  Speaker 5: the makers of the software were never incentivized to prioritize it.
• 16:05
  Speaker 5: They were incentivized to prioritize getting that product to market
• 16:08
  Speaker 5: first or driving down the cost. And so you have
• 16:12
  Speaker 5: basically a classic market failure. where the market is not
• 16:16
  Speaker 5: going to reward something that consumers don't actually care about.
• 16:19
  Speaker 5: And then the further problem is, what happens, you know,
• 16:22
  Speaker 5: how do you fix a market failure? Well, the government
• 16:24
  Speaker 5: steps in with regulation to protect consumers. But in this case,
• 16:29
  Speaker 5: the technology vendors who make this stuff have said, you know,
• 16:32
  Speaker 5: at the end of the day, these flaws, these defects,
• 16:36
  Speaker 5: these vulnerabilities, they're just the cost of doing business. We'll
• 16:40
  Speaker 5: tell customers that there's a flaw and you need to
• 16:43
  Speaker 5: patch it and just take care of it after the fact.
• 16:46
  Speaker 5: And so there's never been any sort of technology regulation.
• 16:49
  Speaker 5: There's never been any sort of a software liability. So
• 16:52
  Speaker 5: anybody who buys software, I challenge you, whether you're a
• 16:55
  Speaker 5: corporation or an individual, look at that contract that you sign.
• 17:00
  Speaker 5: And somewhere on that contract, it will say, you buy
• 17:04
  Speaker 5: this product entirely at your own I guarantee you it
• 17:09
  Speaker 5: will say that. And of course, we all check that box.
• 17:12
  Speaker 5: But essentially, we've set up a world where software quality
• 17:16
  Speaker 5: is not prized. And so that's where developers have never been,
• 17:21
  Speaker 5: you know, security has never been the number one thing
• 17:24
  Speaker 5: that developers have focused on. It's certainly not a malicious thing.
• 17:28
  Speaker 5: It's just they're writing code and they are moving out
• 17:31
  Speaker 5: products and there's not been this incentive to write secure code.
• 17:36
  Speaker 1: With open source software, This misalignment of incentives is in
• 17:39
  Speaker 1: some ways even more pronounced because you have this far-flung
• 17:43
  Speaker 1: group of developers working independently on a single project, improving,
• 17:48
  Speaker 1: evolving in fits and starts. Some things just fall through
• 17:52
  Speaker 1: the cracks. Here's Gunnar again. Why isn't the open source
• 17:56
  Speaker 1: innovator in the beginning motivated to make the code as
• 18:01
  Speaker 1: secure as possible? are they indifferent to it or do
• 18:05
  Speaker 1: other things take priority or what's the kind of.
• 18:08
  Speaker 2: Yeah, well, it's a, it's a combination of things. It's, uh, uh, well,
• 18:12
  Speaker 2: do you brush your teeth every day? I do. Oh, okay.
• 18:15
  Speaker 2: That's a bad example then. My children, maybe you could
• 18:19
  Speaker 2: use my kids.
• 18:20
  Speaker 4: So do they know that they need to brush their
• 18:22
  Speaker 4: teeth every day?
• 18:22
  Speaker 2: Yes.
• 18:23
  Speaker 4: Will they actually brush their teeth every day?
• 18:24
  Speaker 2: No, we're all human. We all have reasons.
• 18:26
  Speaker 4: And an open source project maintainer may, uh, They may
• 18:31
  Speaker 4: not have the skills or the wherewithal to actually make
• 18:34
  Speaker 4: the software secure. That's very common because making software secure
• 18:37
  Speaker 4: is a dark art, right? It's very complicated. And it
• 18:41
  Speaker 4: could be also that they were distracted, right? They could
• 18:43
  Speaker 4: be that they started a project that was very, very promising,
• 18:47
  Speaker 4: but then they got married, they got a dog, and
• 18:49
  Speaker 4: they got distracted, they got a new job, and now
• 18:52
  Speaker 4: that software got picked up by somebody else who didn't
• 18:54
  Speaker 4: go back and check the code.
• 18:56
  Speaker 2: You know, there's lots of reasons why.
• 18:57
  Speaker 1: Historically, that kind of messiness was manageable. The bizarre would
• 19:01
  Speaker 1: inevitably get around to identifying and fixing the most serious
• 19:05
  Speaker 1: of vulnerabilities. Before AI comes along, developers have an intuition
• 19:10
  Speaker 1: about how safe a piece of software is. And what
• 19:13
  Speaker 1: AI does is it says those intuitions tended to radically
• 19:16
  Speaker 1: underestimate the number of vulnerabilities.
• 19:19
  Speaker 5: Yeah.
• 19:20
  Speaker 1: How radically?
• 19:22
  Speaker 2: Quite radically.
• 19:22
  Speaker 4: The number of vulnerabilities that we joke internally that a
• 19:26
  Speaker 4: lot of the vulnerabilities that we've discovered are old enough
• 19:29
  Speaker 4: to vote. They have been in software for 18, 20 years.
• 19:33
  Speaker 1: These people just never.
• 19:34
  Speaker 2: Yeah. Just never looked. Or never had an AI that
• 19:37
  Speaker 2: had the patience to look, right?
• 19:39
  Speaker 1: Yeah. In the world of cybersecurity, vulnerabilities are given a
• 19:42
  Speaker 1: grade on the Common Vulnerability Scoring System, more commonly referred
• 19:46
  Speaker 1: to as a CVSS score.
• 19:49
  Speaker 2: The CVSS.
• 19:50
  Speaker 1: scale measures how serious a vulnerability is.
• 19:53
  Speaker 4: So if you say that my piece of software has
• 19:56
  Speaker 4: a critical vulnerability, cool, I'll go fix the critical vulnerability
• 19:58
  Speaker 4: and then work it. But to date, we've said, well,
• 20:02
  Speaker 4: if you've got 10 low vulnerabilities, it's kind of like, well,
• 20:05
  Speaker 4: I could go fix it, but it's actually probably even
• 20:07
  Speaker 4: more disruptive and risky to fix it than it is
• 20:09
  Speaker 4: to just leave it alone, so we're just going to
• 20:10
  Speaker 4: let it be. And we kind of, as an industry,
• 20:12
  Speaker 4: we kind of collectively decided over the last 25 years, like,
• 20:15
  Speaker 4: when we get these low-impact vulnerabilities, let's just leave them be.
• 20:19
  Speaker 2: It's too risky to fix them.
• 20:22
  Speaker 4: So any one of these things is not very important,
• 20:24
  Speaker 4: but when you chain five or six of them together
• 20:27
  Speaker 4: in a very specific way, now suddenly they become critical.
• 20:30
  Speaker 4: That is one of the consequences of, now that we've
• 20:32
  Speaker 4: pointed AI at this problem, that's one of the things
• 20:35
  Speaker 4: that we've collectively come to this realization.
• 20:37
  Speaker 1: We're talking about not just second-order effects, but third, fourth,
• 20:41
  Speaker 1: fifth order. It's like chess. This one move doesn't appear
• 20:45
  Speaker 1: to put me in any peril, but what I've done
• 20:47
  Speaker 1: in the first round will come back to haunt me
• 20:49
  Speaker 1: five rounds in, and by then, I've lost. There's a
• 20:52
  Speaker 1: flip side to this, though, and that's where the story
• 20:55
  Speaker 1: turns optimistic. If AI has made it much easier for
• 20:59
  Speaker 1: bad actors to find vulnerabilities, it has also made it
• 21:03
  Speaker 1: easier for the good guys to fix them. Here's Manish
• 21:06
  Speaker 1: Sharma again, who has the massive responsibility of ensuring digital
• 21:10
  Speaker 1: security for a major institution, Wells Fargo.
• 21:14
  Speaker 3: We've quite literally used AI to sort of combat the
• 21:17
  Speaker 3: risk of AI. And what I mean by that is
• 21:19
  Speaker 3: we've developed automated capabilities using AI to be able to fix,
• 21:24
  Speaker 3: you know, what we detect in our software.
• 21:26
  Speaker 1: Like any competitive struggle, from a sporting match to human warfare,
• 21:30
  Speaker 1: competition involves a constant back and forth between defense and offense,
• 21:35
  Speaker 1: with each side having a momentary advantage. And while the
• 21:38
  Speaker 1: advantage in software is to the attacker right now, that
• 21:42
  Speaker 1: shouldn't always be the case. Manish says he's also seeing
• 21:46
  Speaker 1: the balance shift with some of the new AI tools.
• 21:50
  Speaker 3: Done the right way, architected the right way, I don't
• 21:55
  Speaker 3: think it's easier or faster for AI to identify than
• 22:01
  Speaker 3: to mitigate. Obviously, there is going to be a little
• 22:04
  Speaker 3: bit of a lag between those two, but it's not
• 22:07
  Speaker 3: orders of magnitude, meaning it's not as if you can
• 22:09
  Speaker 3: find things in a day and it takes you months
• 22:15
  Speaker 3: to patch them or to mitigate them. If that's where
• 22:19
  Speaker 3: an institution is, I'd be a little concerned. So your
• 22:22
  Speaker 3: ability to respond to things has gotten a lot faster
• 22:27
  Speaker 3: as well. It's not one-to-one mapping between finding and resolving.
• 22:32
  Speaker 3: Usually it's one-to-many. But using AI, you can very efficiently
• 22:39
  Speaker 3: create an architecture where you're able to respond to those
• 22:42
  Speaker 3: threats way, way faster.
• 22:43
  Speaker 2: That's our area of focus.
• 22:45
  Speaker 1: Can you give me a rough sense of how much
• 22:47
  Speaker 1: that gap has closed in recent months?
• 22:51
  Speaker 3: It's closing pretty fast. And it's closing pretty fast at
• 22:55
  Speaker 3: at most institutions that I talk to. And let me
• 22:58
  Speaker 3: give you an example. In terms of scale, you are
• 23:01
  Speaker 3: now seeing not a factor of two times or three
• 23:05
  Speaker 3: times the number of fixes to critical and high vulnerabilities.
• 23:09
  Speaker 3: You're seeing a magnitude of 10x, 20x within the same
• 23:16
  Speaker 3: window of time. So if an organization was mitigating, let's say,
• 23:22
  Speaker 3: 100 vulnerabilities, critical or high in a month, Our ability
• 23:26
  Speaker 3: to patch that is order of magnitude faster now than
• 23:30
  Speaker 3: it was in the past.
• 23:31
  Speaker 1: If you are someone sitting on a mountain of open
• 23:33
  Speaker 1: source code, of uncertain integrity, all is not lost. The
• 23:40
  Speaker 1: same technology that threatens you can also help save you.
• 23:44
  Speaker 1: But you have to be organized. You need a strategy.
• 23:47
  Speaker 1: And you need a partner. The AI company Anthropic released
• 23:52
  Speaker 1: a preview of Mythos on April 7th of this year.
• 23:56
  Speaker 1: The model was so good at finding vulnerabilities in software,
• 23:59
  Speaker 1: Anthropic said, that it would give a select group of partners,
• 24:03
  Speaker 1: mostly tech, cybersecurity, and critical infrastructure organizations, two months of
• 24:09
  Speaker 1: early access, so they could prepare themselves for Mythos' extraordinary abilities.
• 24:15
  Speaker 1: The same day, Treasury Secretary Scott Besant announced and the
• 24:18
  Speaker 1: chair of the Federal Reserve, Jerome Powell, summoned the CEOs
• 24:22
  Speaker 1: of the country's top banks to a closed-door meeting in
• 24:25
  Speaker 1: Washington to warn them that AI was posing an unprecedented
• 24:30
  Speaker 1: threat to the banking community. Financial firms have always been
• 24:34
  Speaker 1: high on the hackers' list of preferred targets. As the
• 24:37
  Speaker 1: notorious bank robber Willie Sutton famously said in response to
• 24:41
  Speaker 1: a question about why he robbed banks, that's where the
• 24:44
  Speaker 1: money is. The digital world isn't any different. Lightwell was
• 24:49
  Speaker 1: the logical next step. IBM's Red Hat was already in
• 24:52
  Speaker 1: this game. Their flagship business is aimed at bridging the
• 24:56
  Speaker 1: gap between the open-source software systems and corporate users. Gunnar
• 25:01
  Speaker 1: Halikson said they had talked about doing a wider effort,
• 25:04
  Speaker 1: but had always dismissed the idea because it seemed too ambitious.
• 25:08
  Speaker 1: Too much code to manage. Too many people to hire. But,
• 25:11
  Speaker 1: he says, once Mythos was announced, we realized the urgency
• 25:15
  Speaker 1: of the problem. and that we finally had the tools
• 25:18
  Speaker 1: we needed to solve it. By the end of May,
• 25:21
  Speaker 1: Lightwell was up and running. And one by one, the banks,
• 25:25
  Speaker 1: many of whom had been at that April meeting at
• 25:27
  Speaker 1: the Treasury Department, signed up. The problem was so large,
• 25:31
  Speaker 1: they realized, they couldn't tackle it on their own. This
• 25:34
  Speaker 1: is Munish Sharma again, on the scale of the task
• 25:37
  Speaker 1: of securing open source code.
• 25:41
  Speaker 3: So it is large. It is humongous in terms of how...
• 25:46
  Speaker 3: integrated it is in the overall software stack. In our
• 25:50
  Speaker 3: ability to manage it, that's where the various institutions are
• 25:53
  Speaker 3: coming together. And we are taking a systematic stance on
• 25:58
  Speaker 3: it instead of trying to fork off and starting to
• 26:01
  Speaker 3: manage the packages ourselves, which is one way of doing things.
• 26:04
  Speaker 3: Another is to partner with industry and really come at
• 26:08
  Speaker 3: it together. So I think there has been a lot
• 26:10
  Speaker 3: of focus on this in the past few months and
• 26:13
  Speaker 3: through various institutions. including Lightwell, where we are focused on
• 26:18
  Speaker 3: making sure that we extensively scan and understand the security
• 26:24
  Speaker 3: risks within the open source packages that have been consumed.
• 26:27
  Speaker 1: You talked about partnerships. What are you looking for in
• 26:31
  Speaker 1: a partner? What is it you need when you look
• 26:33
  Speaker 1: outside your own organization?
• 26:35
  Speaker 3: So first and foremost, it's the first thing I'd look
• 26:40
  Speaker 3: at is their ability to scale. And followed by... a
• 26:46
  Speaker 3: mindset that is security first. This has to be a sustainable,
• 26:50
  Speaker 3: at-scale solution. We're not talking dozens of packages. We're not
• 26:55
  Speaker 3: talking hundreds of packages. We're talking tens of thousands of packages.
• 27:00
  Speaker 1: So, Lightwell. 20,000 people and $ 5 billion. Big because it
• 27:07
  Speaker 1: has to be big. It offers a repository or network
• 27:12
  Speaker 1: of fixes and components.
• 27:14
  Speaker 4: Lightwell is a clearinghouse for open source vulnerabilities. Companies join
• 27:22
  Speaker 4: the clearinghouse. They submit their vulnerabilities to Lightwell. Lightwell fixes
• 27:27
  Speaker 4: those vulnerabilities and then delivers them back to the customers
• 27:31
  Speaker 4: and to the open source communities they came from.
• 27:35
  Speaker 1: And you said, do you have 20,000 people or do
• 27:37
  Speaker 1: you want to have 20,000 people?
• 27:40
  Speaker 4: The aspiration is 20,000 people dedicated to the effort of
• 27:44
  Speaker 4: securing open source software.
• 27:46
  Speaker 2: It's an astonishing number. It's an astonishing number. Yeah.
• 27:50
  Speaker 1: And are all these people going to be in one
• 27:51
  Speaker 1: place or scattered throughout the world?
• 27:53
  Speaker 2: No, necessarily they have to be scattered.
• 27:54
  Speaker 1: How busy have you been?
• 27:56
  Speaker 2: Extraordinarily. I've been at Red Hat for 20 years.
• 28:01
  Speaker 4: And I was talking to another old head at Red Hat.
• 28:05
  Speaker 4: And he and I had the same impression. It's like,
• 28:07
  Speaker 4: this is what Linux felt like. When we first caught
• 28:12
  Speaker 4: the wave of Linux adoption 20, 25 years ago, this
• 28:16
  Speaker 4: is what it felt like. Everyone understood what needed to happen.
• 28:20
  Speaker 4: Nobody really knew how it was supposed to work in
• 28:23
  Speaker 4: its entirety, but everyone was kind of rushing in to
• 28:26
  Speaker 4: figure it out.
• 28:27
  Speaker 2: And it feels very much the same.
• 28:30
  Speaker 1: For Easterly, the moment we're in reminds her of the
• 28:33
  Speaker 1: early days of the Cold War. A superweapon arrived, posing
• 28:37
  Speaker 1: an existential threat. But what happened? The world responded, built institutions,
• 28:43
  Speaker 1: learned how to protect itself. She's an optimist by nature.
• 28:47
  Speaker 5: And so we've actually created an environment where defenders are
• 28:52
  Speaker 5: at a massive disadvantage because of the way that technology
• 28:57
  Speaker 5: was created with these flaws and defects. Now, the great
• 29:01
  Speaker 5: news is what we can see with these AI tools
• 29:05
  Speaker 5: as they become increasingly powerful is they can actually shift
• 29:09
  Speaker 5: the advantage to defenders by creating much more secure and
• 29:14
  Speaker 5: much more resilient code than we've ever had before. And importantly,
• 29:19
  Speaker 5: helping us to transform and refactor a lot of the
• 29:23
  Speaker 5: insecure legacy code that we've been dealing with for decades
• 29:27
  Speaker 5: and decades. And so I wrote a piece last year
• 29:30
  Speaker 5: that was called The End of Cybersecurity, an optimist's guide
• 29:33
  Speaker 5: to improving software quality. And it was all about how
• 29:38
  Speaker 5: we can look at AI as a cure for insecure code.
• 29:41
  Speaker 5: So I do believe in the next couple years, we
• 29:44
  Speaker 5: can actually see a significant reduction in cyber risk, a
• 29:48
  Speaker 5: significant improvement in software quality. But the path to get
• 29:53
  Speaker 5: from here to there, I think is going to be
• 29:55
  Speaker 5: pretty rocky. Because in the short term, attackers will have
• 29:59
  Speaker 5: an advantage by using these AI tools to more rapidly
• 30:03
  Speaker 5: find those flaws, those defects, those vulnerabilities, and potentially weaponize them.
• 30:09
  Speaker 5: So in the short term, the advantage goes to attackers.
• 30:12
  Speaker 5: In the long term, it goes to the defenders.
• 30:15
  Speaker 1: And in the end, maybe that's why this press release
• 30:18
  Speaker 1: felt so different. It wasn't a company announcing a new product.
• 30:22
  Speaker 1: It signaled the arrival of a new era. The recognition
• 30:26
  Speaker 1: that some of the most important infrastructure in the modern
• 30:29
  Speaker 1: world is shared infrastructure. And shared infrastructure requires shared defense.
• 30:38
  Speaker 1: Before you go, we're trying something new. If you have
• 30:41
  Speaker 1: a question you'd like to ask an IBM technical expert,
• 30:44
  Speaker 1: submit it at ibm.com slash smart talks. We're exploring ways
• 30:49
  Speaker 1: to bring your questions directly to the experts, and we'd
• 30:52
  Speaker 1: love to hear what's on your mind. Smart Talks with
• 30:56
  Speaker 1: IBM is produced by Matt Romano, Amy Gaines-McQuaid, Trina Menino,
• 31:01
  Speaker 1: and Jake Harper. Engineering by Nina Bird Lawrence. Mastering by
• 31:05
  Speaker 1: Sarah Bruguier. Music by Gramascope. Strategy by Cassidy Meyer and
• 31:10
  Speaker 1: Alina Choi. Smart Talks with IBM is a production of
• 31:14
  Speaker 1: Pushkin Industries and Ruby Studio at iHeartMedia. To find more
• 31:18
  Speaker 1: Pushkin podcasts, listen on the iHeartRadio app, Apple Podcasts, or
• 31:23
  Speaker 1: wherever you listen to podcasts. I'm Malcolm Gladwell. This is
• 31:27
  Speaker 1: a paid advertisement from IBM. The conversations on this podcast
• 31:31
  Speaker 1: don't necessarily represent IBM's positions, strategies, or opinions.