Latest / The In-Between Tech and Trust Podcast / Why Security Intelligence Fails Before the Attack - Assaf Kipnis (EP 23)

Transcript

Why Security Intelligence Fails Before the Attack - Assaf Kipnis (EP 23) · The In-Between Tech and Trust Podcast

• 0:14
  Hello, this is Eva, and you're listening to the In Between Tech
• 0:18
  and Trust podcast. In this week's episode, we dive
• 0:21
  deep into all aspects around threat intelligence.
• 0:25
  And for that important topic, I have Asaf kidneys with me in
• 0:29
  conversation. And Asaf comes with over 10
• 0:33
  years of experience in that industry.
• 0:35
  He has worked for some of the major tech companies, for
• 0:39
  example, Meta or LinkedIn. And currently he's building his
• 0:43
  own platform because he's convinced that data provenance
• 0:47
  is one of the most important aspects to provide and help us
• 0:52
  engaging with the future. And so together we look at the
• 0:55
  intersection of technology and trust from a threat Intel
• 1:00
  perspective and also from a defense perspective.
• 1:03
  We talk a lot about what it actually means to avoid threats
• 1:08
  and also counter them, of how the operations behind it really
• 1:12
  work and what in times of becomes most important To then
• 1:16
  also dive deep into the actual happenings of attacks and what
• 1:21
  happens behind the scenes. And also how to, you know,
• 1:24
  leverage the knowledge behind it.
• 1:26
  And we do discuss of why understanding your product and
• 1:32
  your platform is the most important aspect for you to
• 1:37
  enable security and also to avoid threats going forward.
• 1:44
  Welcome Asaf and happy to have you on the In Between Tech and
• 1:48
  Trust podcast all. Right.
• 1:49
  Thank you so much for having me. I really appreciate it.
• 1:52
  For the listeners that don't know you, do you briefly just
• 1:55
  want to say a bit about your background and also with what
• 1:58
  perspective on tech and trust you come into the conversation?
• 2:01
  Sure. So my name is Asaf Kipnis.
• 2:03
  I've been in, let's call it the tech space for over 12 years
• 2:10
  now. I've been in information
• 2:12
  security and threat intelligence integrity spanning LinkedIn,
• 2:17
  Google, Meta 11 Labs for a little while and I've been
• 2:20
  mostly working on the investigation space and the
• 2:24
  threat intelligence space within Infosec and Integrity, trust and
• 2:29
  safety. What were underlying challenges
• 2:32
  that you keep identifying over and over again?
• 2:35
  And it doesn't need to be dependent on the tech company.
• 2:38
  On the contrary, is there anything that was particularly
• 2:41
  visible for you in the tech space and also in the background
• 2:44
  that you worked out? I think the main thing that I've
• 2:46
  noticed throughout my career, and This is why I decided to go
• 2:51
  build something on my own, is there's a big focus in, and this
• 2:55
  is more in this security and safety and threat Intel space.
• 2:59
  There's a big focus on dealing with the problem that's right in
• 3:03
  front of our faces and dealing with the manifestation of that
• 3:06
  problem. And what that causes is that we
• 3:10
  end up dealing with the same problems over and over and over
• 3:13
  again. And you can see that the
• 3:15
  industry is very much on a reactive kind of work.
• 3:20
  And a lot of the work that it's done is, is not learning from
• 3:24
  what we what we identified. There's a big lack of kind of
• 3:28
  gap and learning as we continuously fight fires to find
• 3:31
  the next shiny thing that is in front of us.
• 3:35
  And why do you think is that so? I think there's multiple reasons
• 3:38
  for that. I think the most kind of like
• 3:41
  structural reason is that it's very hard to measure what you
• 3:46
  didn't, what didn't happen. Riding in on a White Horse and
• 3:49
  saving everybody from a fire that looks really good, that
• 3:52
  measures really well. You can say we took down X
• 3:55
  amount of actors or we stopped an attack.
• 3:59
  And so if you want to keep your team working and viable in the
• 4:02
  company, you need to show something.
• 4:04
  The other issue there is that I think the learning piece falls
• 4:10
  between teams. Usually you'll have the team
• 4:13
  that's actually doing the prevention or the detection.
• 4:16
  You'll have the teams that are doing the analysis and the
• 4:18
  finding and it's, it's very hard to connect between those two
• 4:24
  teams. So a thing I've been thinking
• 4:25
  about is how threat intelligence and Intel in general is not
• 4:30
  incorporated into those spaces into safety and, and, and
• 4:33
  security. It's more kind of like adjacent
• 4:36
  and feeds the information when needed.
• 4:39
  But there isn't a clear structure that controls the kind
• 4:43
  of inflow or the influx of information from threat
• 4:47
  intelligence into actual detection.
• 4:49
  Over the years, can you to describe a bit of how threat
• 4:52
  intelligence has potentially also changed and how systems
• 4:57
  have also evolved over time to acknowledge potential blind
• 5:02
  spots that they have or might not have?
• 5:04
  So I think the way threat intelligence has changed is in a
• 5:09
  good way and a bad way. So in a good way, I think threat
• 5:12
  intelligence have become more front and center when when we're
• 5:17
  working on complex actors and we want to try to understand how
• 5:21
  actors are operating. So threat intelligence is taking
• 5:24
  more of a kind of front of the house area.
• 5:27
  On the flip side of of that, some companies have are using
• 5:31
  threat intelligence just to identify new upcoming fires and
• 5:35
  kind of and threat intelligence just stays in the point where
• 5:38
  they're not telling you how to prevent.
• 5:42
  They are, they're, they're focused on telling you, hey,
• 5:45
  what's coming up right now that you need to block right now.
• 5:49
  And they're not very well empowered to actually prevent
• 5:54
  attacks or prevent abuse. And, and we're seeing that is in
• 5:58
  the scam space that it's just become completely rampant and
• 6:02
  super complex. And there is no, I haven't seen
• 6:06
  any, any good structured way of dealing with it at scale.
• 6:10
  Your second question was how did teams evolve?
• 6:13
  So some teams have evolved into connecting threat intelligence
• 6:17
  with detection and really doing their best to take all findings
• 6:22
  and tell, take new things that are found and putting them into
• 6:25
  into detection, putting them into the understanding of the
• 6:27
  attackers. On the other hand, a lot of
• 6:30
  teams have evolved into kind of working with how do we make the
• 6:36
  metrics look really good. So and it's kind of like two
• 6:39
  sides of the spectrum. There's a how do we work this?
• 6:42
  And those are those are the more complex teams of how do we
• 6:44
  actually identify what is, what is actually going on.
• 6:47
  And on the other side, you have the teams that evolved into,
• 6:50
  well, what can I measure? Let's just do that.
• 6:52
  And that's because that's going to give us more funding or make
• 6:56
  us look better. So imagine you would be head of
• 6:59
  the threat intelligence again at one of the companies that you
• 7:01
  work for and you have you've identified either an upcoming
• 7:07
  someone or one that might be on the horizon.
• 7:10
  How? What happens?
• 7:12
  What do you do? So from a threatened
• 7:13
  intelligence perspective, we want to understand what the
• 7:16
  attackers are doing. They have been doing other
• 7:18
  places. So for example, you take
• 7:21
  investigations that were done in other companies that are
• 7:24
  similar. You take reports from the FBI,
• 7:26
  reports from CISA, report from anything out there that can give
• 7:29
  you information which threat intelligence do that,
• 7:31
  Intelligence teams do that. And then you start also you want
• 7:35
  to understand what you are vulnerable to what, what attacks
• 7:40
  have happened on your platform in the recent past, in the
• 7:44
  further past that you did not identify.
• 7:47
  You can identify now hopefully, but what did you not identify in
• 7:50
  the past? And you synthesize this
• 7:53
  information to basically create a threat after journey.
• 7:57
  So we want to understand whether it's on our platform or not on
• 8:01
  our platform. So there's the end of the chain,
• 8:04
  which is what actually we saw and what happened.
• 8:07
  Where's the harm? But a good threat intelligence
• 8:10
  team or a good team will go and pick up all the pieces of how
• 8:15
  this happened along along the way.
• 8:18
  And the Holy Grail there is not how do we stop the attack is how
• 8:23
  do we make this exhausting and expensive for the attacker to
• 8:27
  get to the point of their attacking.
• 8:29
  At Facebook, one of the teams, they had this saying it was
• 8:32
  like, get off my platform and get off my platform says exactly
• 8:35
  that. I just want to make it so you
• 8:38
  just think that MAG platform is the worst place for you to be
• 8:42
  and you'll go somewhere else. And breaking down your path
• 8:45
  towards the attack is where that becomes more difficult because,
• 8:49
  and the really, really good teams that do that, they focus
• 8:52
  on the threat actor journeys and how to circumvent them along the
• 8:55
  way. Was there an incident or a
• 8:58
  threat in your career that was quite memorable that you have or
• 9:02
  have either lived through or prevented, that you could say of
• 9:07
  why it was so memorable? Yeah.
• 9:09
  So right before the 2020 elections, we were looking into
• 9:13
  specific actor group or a set of actor groups that in the past
• 9:18
  were taken down by the company was was very clear that this is
• 9:22
  we, we need this not to happen again.
• 9:24
  This happened in 2016. We need this not to happen again
• 9:27
  in 2020. So I received the the structure
• 9:30
  and the resources to actually deal with that at scale, meaning
• 9:34
  I could investigate it with the team that I had, but we also had
• 9:37
  a direct connection to the team that was deploying detection and
• 9:41
  operations and policy and then kind of put it all together.
• 9:45
  That was very successful because the the intelligence part of the
• 9:48
  team was able to identify what they're doing, identify how
• 9:51
  they're doing it, and then immediately put that into
• 9:54
  policy, into operational flows, into prevention and detection.
• 9:58
  And the great thing about it is that we literally saw them
• 10:02
  leaving the platform. They were talking to each other
• 10:05
  and saying we don't, this doesn't work for us anymore.
• 10:07
  We're now in 2026. Threat landscape moves faster
• 10:11
  than ever. Where do you see the biggest
• 10:13
  cracks in Be it detection, attribution, context,
• 10:17
  provenance? Choose the field that you want
• 10:19
  to explore with us. So the generic answer is AIAI
• 10:24
  makes everything bad and scary. It's true that with the advent
• 10:28
  of AI and we're God in the last three years, attackers are armed
• 10:33
  with more tools that can just make them faster and more agile.
• 10:37
  But the way I look at it is, while yes, this is a kind of
• 10:42
  somewhat of a pivot point that attackers are getting faster,
• 10:45
  but I feel attackers have been getting ahead of us for the at
• 10:49
  least the last six years, if not more.
• 10:52
  So they are already far ahead because of the way we were.
• 10:57
  Even as defenders, we don't know our product as well as as
• 11:01
  attackers know our product and our landscape.
• 11:03
  And I think kind of the thing I've always said is as an
• 11:06
  attacker, I can focus on on a target and then learn everything
• 11:11
  about that target and just keep going.
• 11:13
  As a defender, I need to defend everything that's coming across.
• 11:17
  So we're already hamstrung. So I think we've always been
• 11:21
  like that in trust and safety and in security that we're kind
• 11:24
  of like plugging holes and trying to get ahead of attacks
• 11:29
  now. So the attackers with AII able
• 11:31
  to do 2 things. One, they're able to be a lot
• 11:33
  faster. And two, they are able to
• 11:37
  enhance their knowledge and enhance their tactics by
• 11:40
  learning faster. It's not just automating, it's
• 11:42
  just they can automate and then they can learn from it really
• 11:45
  quickly and then they can iterate.
• 11:47
  And we get to a point that where we used to worry about the
• 11:51
  complex actors and the much less complex actors, but not and then
• 11:55
  we would say, OK, we would just make it very difficult for the
• 11:58
  non complex actors and then we'll deal with the more complex
• 12:00
  actors. But now a lot of the less
• 12:03
  complex actors have the ability to become a lot more agile, a
• 12:07
  lot more complex and challenge us a lot more, while we are kind
• 12:12
  of in the same space of we need to defend against everything.
• 12:16
  And now you're part of a podcast that looks at the intersection
• 12:20
  of tech and trust. But if I listen to you, I might
• 12:22
  assume that trust in tech is something that doesn't come
• 12:26
  naturally in the sense that you necessarily need to 1st think
• 12:31
  about everything that could happen before you start trusting
• 12:35
  into the ways that things don't happen or how is it for you.
• 12:39
  So I think the way I see trust, I see it from a practitioner
• 12:43
  perspective, trust is really important to me from first of
• 12:47
  like how do the customers trust you?
• 12:50
  And then how can I trust the data I'm looking at?
• 12:52
  And that the, if we go into the trusting the data I'm working
• 12:57
  with, that's really complex because as you grow in scale,
• 13:00
  it's much harder to validate what you're looking at and say,
• 13:04
  yeah, and this is 100% what's happening.
• 13:07
  And then I can, I can make assumptions from there.
• 13:10
  The problems that I've seen in the industry or in my specific
• 13:14
  work is if I can't trust my findings, then it's very hard
• 13:19
  for me to deploy them into something that's scaled because
• 13:24
  you can make a small mistake. And in a small company it might
• 13:27
  be a small issue. But as you scale, you're going
• 13:30
  to have, you're going to come across across growth, you're
• 13:33
  going to come across false positives, you're going to come
• 13:35
  across, you're going to break your network.
• 13:37
  So trusting in what you're doing, or at least the data
• 13:42
  you're dealing with, is very, very important.
• 13:44
  And you've now said that you're working on a business idea
• 13:47
  yourself and that you also look into the way of how data
• 13:51
  provenance can be deployed. Can you explain to me or also
• 13:56
  the listeners of what data provenance like really is and if
• 14:00
  it's connected to the way that you can trust data?
• 14:03
  So my friend and I now came up with an idea we called the our
• 14:07
  company Catalyst Labs. The idea behind it is how do we
• 14:13
  help companies not fight the same fires over and over and
• 14:16
  over again? How do we actually leverage the
• 14:19
  intelligence so it doesn't sit on a shelf somewhere?
• 14:22
  Because what I found and what I throughout the years, this is a
• 14:25
  systems engineering problem. Like I said, you have
• 14:28
  information security on one is like a system.
• 14:30
  You have threat intelligence that's tangential, but threat
• 14:34
  intelligence is only pulled in when it's necessary.
• 14:37
  And even then it's very difficult to take tactic
• 14:41
  techniques, procedures and actually narrative or prose and
• 14:45
  turn that into something you can you can deploy.
• 14:48
  So what I created and I'll explain the Providence thing is
• 14:52
  a way to take let's say an analyst or FBI said threat actor
• 14:57
  X does this and then this and then that and then and then does
• 15:00
  all these actions and this is how they X filled it, their
• 15:03
  information. How do we turn that into code?
• 15:06
  So my system, instead of producing it to a detection
• 15:09
  engineer, that will take hours or days or weeks to turn that
• 15:12
  into actual detection. We can do that within two
• 15:15
  minutes. But the first question that I
• 15:17
  had when I thought about it is if I do this with an LLM, if I
• 15:21
  do this with an AI, I don't trust it, especially at scale,
• 15:25
  because it can read whatever information is on the on the
• 15:29
  document and then it can infer something that's not true or it
• 15:33
  can get bias from the document. And that's where I came up with
• 15:37
  how do I have data provenance that I can actually go to to a
• 15:42
  team like the team I worked at at Facebook and say here is
• 15:45
  detection logic. But I know 100% that this came
• 15:50
  exactly from the document that you provided at the very core of
• 15:54
  the product, the extraction doesn't happen with the LLM.
• 15:57
  It's a lot more programmatic that that provides you the here
• 16:01
  is the rule and and then you have full provenance of it came
• 16:04
  from this page of the document that you provided me from this
• 16:07
  line. It is exactly what it says.
• 16:09
  This is why we turned it into this detection logic.
• 16:12
  And that's really critical because as I've been looking at
• 16:15
  other companies doing it, there's this sense in the
• 16:18
  industry that AI is this like magic tool that can do these
• 16:22
  things, can do AI can do a lot, but what it can't do because
• 16:26
  it's not built to do that is be deterministic.
• 16:30
  So while you can trust it for doing one report, maybe 2
• 16:33
  reports, as you start scaling you're going to start getting
• 16:37
  very weird information flowing your way that will look like
• 16:41
  it's real detection, but it's actually going to cause a lot
• 16:44
  more work than anything. Why do you think what you what
• 16:47
  you are building is so foundational?
• 16:51
  Also, how does it work? How can I?
• 16:53
  Yeah, if I use it, what would happen?
• 16:55
  OK, So the reason it's foundational in my eyes is that
• 16:59
  we've tried to do this forever. We've always tried to say how do
• 17:04
  we take our intelligence and make it so it's not shelf wear.
• 17:07
  So the intelligence is not just sitting there or, or for
• 17:10
  example, I would see an attack and then I would say, I worked
• 17:13
  on this exact thing three years ago.
• 17:16
  I remember this. It's the same issue.
• 17:18
  It's just a completely different actor.
• 17:19
  So this has always been a problem.
• 17:22
  And I think the one of the things that have changed is
• 17:26
  that, yes, you can start doing that more with the help of LLMS
• 17:29
  of turning intelligence into actual detection.
• 17:31
  But I think the deeper problem is different.
• 17:34
  The deeper problem is that this issue falls between teams.
• 17:39
  So that's the big foundational problem here.
• 17:41
  That's it's very, very difficult to have this even at smaller
• 17:47
  scale deployed across teams and have it.
• 17:50
  Work. And during your design process
• 17:52
  for the platform, what trade-offs do you face when you
• 17:55
  need to choose between speed or trust, openness and security,
• 18:00
  and usability versus verification?
• 18:02
  So right now my biggest trade off is speed and currently I'm
• 18:06
  OK with it. The speed is not that major,
• 18:09
  major of a difference. I would like it to be under a
• 18:12
  minute, but now it's 2 to 6 minutes depends on the size of
• 18:15
  the document. You cannot let go of the
• 18:17
  Providence. It must be there.
• 18:19
  So you can always the, the let's say that the secure engine
• 18:24
  engineer can always say I know exactly where this rule came
• 18:27
  from. And then it actually provides
• 18:29
  you with an audit trail that you can say that rule that that did
• 18:33
  XYZ, maybe that rule failed, maybe that rule's really
• 18:36
  effective. We can actually say that rule
• 18:39
  was created at this point by breaking down this type of
• 18:43
  report at that time. So the provenance and the trust
• 18:47
  are critical here. Much, much more than speed.
• 18:51
  And if we now do you see any issue with the new like AI tool
• 18:56
  providers that could potentially influence the user trust and
• 19:02
  that also you would advise them to change?
• 19:05
  Yes. So LLMS are non deterministic by
• 19:09
  design. If you tell it never do a thing,
• 19:12
  you are telling it be deterministic, always find this
• 19:15
  thing and never do it, and that's you're going against the
• 19:18
  design of the actual idea or the actual system.
• 19:21
  What I have been seeing with AI is a couple of things.
• 19:24
  There's a mad dash to implement AI into absolutely everything,
• 19:29
  and some places that's great. Some places don't really need
• 19:32
  it, but that's not the issue. The issue is that there is, I'm
• 19:37
  noticing this around leadership mostly of AI can just do
• 19:40
  everything. We'll just need to implement it
• 19:42
  and it will solve everything and it will automate.
• 19:44
  And then this, there's this push of you either implement AI or
• 19:48
  we're not going to talk to you. And then I am seeing new
• 19:51
  companies that are acting in kind of the same way machine
• 19:56
  learning works is this is a black box.
• 19:58
  You put your information, this spits out the right things and
• 20:01
  trust it. And we are putting a lot of
• 20:04
  trust into prompt engineering into.
• 20:09
  Specific models and saying, yeah, we'll put this here and it
• 20:13
  will just magically create what I wanted to create.
• 20:15
  And I think there's a big chasm opening between providers of AI
• 20:20
  solutions and actual practitioners.
• 20:22
  Have you ever worked in defense in some sort of defense tech and
• 20:27
  threat intelligence on a defense and regional kind of context?
• 20:31
  I have but not in tech. So I was in the military and I
• 20:35
  was doing defense, border defense, and interestingly
• 20:39
  enough, it is exactly the same concepts.
• 20:41
  That's what I wanted to get at because there's so much strategy
• 20:45
  in the way that threat intelligence needs to be
• 20:48
  designed and that could be translated either from a defence
• 20:52
  tech. And I do want to ask that
• 20:53
  because we're currently in quite tense times.
• 20:56
  Also from a regional perspective, I'm not getting
• 20:59
  into US, whatever Europe kind of discussion.
• 21:02
  I'd rather want to abstract, like have an abstract view on
• 21:06
  the way that this is approached. Do you have insights on that, on
• 21:10
  how this is moving forward according to your views?
• 21:14
  This is something I've said for for years in tech that we would
• 21:17
  see. So in kinetic defense, like
• 21:21
  order defense, we would see actors behave in a in a specific
• 21:25
  way. We would see actors pretending
• 21:27
  to be just benign activity. And that's really you can really
• 21:31
  correlate it to, for example, network defense of you're saying
• 21:34
  are you see actor go low and slow and or actor not automating
• 21:39
  but or making different automation that doesn't look
• 21:42
  like it's repetitive activity. What I have seen is that actors,
• 21:47
  bad actors, no matter what they are, their main job is to learn
• 21:51
  your defenses. And once they figure out your
• 21:54
  defenses, they will start chaining A vulnerability and
• 21:57
  another vulnerability and another vulnerability.
• 22:00
  So an example would be you have a fence with the border, you
• 22:04
  have cameras on the fence. You will it will it will take
• 22:07
  them, could take them a year. They will find the place where
• 22:10
  they get to the fence and you're not seeing them with the
• 22:12
  cameras. And then they will see how long
• 22:15
  it takes you to actually show up when they touch the fence.
• 22:18
  And what do they need to do if they need to not touch the
• 22:20
  fence. And then a lot of times we see
• 22:24
  those as specific atomic instances and we'll say, oh, so
• 22:29
  we need to add a camera here. Oh, we need a response time to
• 22:32
  be faster. But what they're doing is
• 22:34
  they're testing, continuously testing until they can say I
• 22:38
  know instead of a zero day, I can now say that I know exactly
• 22:44
  where you can't see me, how long it is until you see me.
• 22:48
  If I, if I do something, how long it will take you to get
• 22:51
  here. And then I can figure out my
• 22:53
  tactic around that. Where do I strike?
• 22:56
  How long will it take? What exactly what are the tools
• 22:59
  that I need to use in order for you to not see me?
• 23:02
  I think that the military is a lot better at that because their
• 23:04
  lifes are at stake. There aren't metrics that you
• 23:06
  need to measure. You measure and how many people
• 23:08
  died. You don't even measure that.
• 23:10
  But there's a lot of in the, in the military that there was
• 23:13
  constant learning. And I, I think this is a part of
• 23:17
  kind of space that I'm seeing that there is time to learn.
• 23:21
  We are constantly chasing the new thing that's happening.
• 23:24
  We are unable to, to learn which is, which is, it's a scale
• 23:29
  issue. It's how many attackers are
• 23:31
  attacking you issue, which the military doesn't have in the
• 23:33
  same way. But that's the thing that I've
• 23:35
  been always leaning towards at any company that I've been.
• 23:39
  I said, OK, there was a big attack, something happened.
• 23:42
  Are we doing a postmortem? And you would start doing a
• 23:44
  postmortem and then who has time for that?
• 23:46
  A new, new fire came. Now we need to fix this.
• 23:49
  So that's at least when I look at at issues like that, I look
• 23:53
  at them from that perspective. And for someone who's now
• 23:56
  building up a threat intelligence team, what are the
• 23:59
  top three things that you would advise them to do?
• 24:02
  The top thing to do first is to understand your platform as well
• 24:08
  as you can. It's very, very hard, but you
• 24:10
  really need to understand the platform and appreciate that
• 24:13
  you're not going to understand the platform as well as your
• 24:15
  attackers, but do your very, very best to understand the
• 24:18
  attackers, the platform. Then the second thing is to
• 24:22
  break down your adversaries into adversaries that are are
• 24:27
  opportunistic or like low sophistication.
• 24:30
  And then kind of what's the scale of that versus attackers
• 24:34
  that are going to attack you? They're going to wait and do
• 24:36
  something massive and and work with that the and can really
• 24:40
  understand the threat actor journeys for both.
• 24:43
  The last critical thing is relationships must be on
• 24:48
  understanding your product. You must if you're a threat
• 24:50
  Intel team, you need to understand how the detection
• 24:53
  teams work. What do they need from you?
• 24:57
  What are they gold on and then work with them to empower them
• 25:03
  and the business versus being a team that says no, don't do this
• 25:07
  now do that you want to understand your partners and
• 25:10
  then see how can I empower them to move forward safely and with
• 25:15
  adherence of the law and the word escapes me regulations.
• 25:20
  If we now come back to the lab that you built and the platform
• 25:24
  that you aim to deploy in the future, so how does provenance
• 25:27
  help us rebuild the concept of evidence in that world and also
• 25:31
  for a particular potential users?
• 25:34
  So that's a great question. The, the most critical thing
• 25:37
  that I'm thinking about when I'm building is how do we build a
• 25:42
  knowledge corpus that we know an attack happened or, or we
• 25:46
  learned something. Now we can utilize it to learn
• 25:50
  something else or now we can, when something new comes, we can
• 25:53
  say we actually have this in our, in our, you know, evidence
• 25:57
  storage. And we, we put a new report and
• 26:00
  we say actually that's another attack that happened somewhere
• 26:04
  else or happened with us a month ago, a year ago, or this is
• 26:08
  something that we got from the FBI couple of months ago.
• 26:10
  We should actually incorporate that information into what we're
• 26:13
  doing. The way I was thinking about it
• 26:15
  is one, we create this knowledge corpus of everything that's
• 26:19
  happening and two, we are able to remove the friction between
• 26:24
  teams into something that flows a lot faster.
• 26:27
  Instead of producing something that an detection engineer will
• 26:30
  have to now figure out what to do with, you produce them with
• 26:34
  here's here's actual detection that you just need to review and
• 26:38
  deploy and then you can go do the other things you want to do.
• 26:41
  This actually brings all these teams together into having the
• 26:44
  ability to circumvent the attackers together.
• 26:47
  And if you now look ahead in a near future, what do you see?
• 26:51
  What will be critical to deploy and also to follow through from
• 26:55
  a platform provider and from a user perspective?
• 26:59
  So I think one of the critical things to deploy are well is, is
• 27:05
  a robust understanding. We are currently talking about
• 27:09
  it. I see people frustrated with
• 27:11
  attacks that keep coming back. They that I see it a lot in
• 27:14
  scams of we are expecting other other entities to save us.
• 27:20
  For example, we're expecting the government to create rules to to
• 27:25
  save us, which which is great. The government, the government
• 27:27
  creates rules that makes companies do things.
• 27:29
  That's great that that usually doesn't happen because what
• 27:34
  happens is that the government creates rules, smart company
• 27:37
  figures out how to do the very bare minimum.
• 27:40
  So I think what we need to move forward is if I think about it
• 27:44
  from the AI perspective, is one of the things that's really
• 27:47
  critical is not to look at AI as how can we use, how can we have
• 27:51
  less people? How can we reduce headcount?
• 27:53
  But instead, how do we give the people that we have superpowers
• 27:58
  so they're faster. They're, they can, they can
• 28:01
  analyze things faster, they can deploy things faster.
• 28:04
  And that's again where the trust comes in and the Providence
• 28:07
  comes in that as we move faster, we also need to move with
• 28:11
  confidence. We need to know that what we're
• 28:13
  doing is the correct issue so we don't fall back into
• 28:17
  firefighting. Most teams are just stuck in
• 28:19
  firefighting mode and it's very, very hard to get out of that.
• 28:23
  But I think if we don't get out of firefighting mode, we're
• 28:26
  going to continue losing. We're now coming to the end of
• 28:29
  our podcast, even though I could talk to you probably for another
• 28:32
  hour. And before we end our
• 28:34
  conversation, I want to get into some in between moments with
• 28:37
  you. At the first moment that I want
• 28:39
  to start with you is what does trust online feels like to you?
• 28:43
  Currently, Trust Online feels like a pipe dream, like fiction.
• 28:46
  And what is the one thing that AI must verify in the future?
• 28:50
  AI needs to verify both the output and the input.
• 28:53
  Have AI verify both the input that is not junk and the output
• 28:58
  that it can actually relates to something that wasn't invented
• 29:02
  by the LLM. What is the biggest blind spot
• 29:05
  in information security? Bias on that, But the biggest
• 29:08
  blind spot is adversarial complexity.
• 29:11
  Everybody likes to talk about adversarial complexity, but then
• 29:14
  it ends up being a discussion about 0 days, which persistent
• 29:18
  actors don't use zero days Willy nilly.
• 29:21
  They consistently get around you daily without 0 days.
• 29:25
  I need a sidestep here. What are 0 days 0?
• 29:28
  Day is an exploit that nobody has heard of before.
• 29:31
  Is this is a new vulnerability that nobody has heard of that
• 29:34
  they can they can now leverage and there are no defenses for it
• 29:38
  because this is the first time it's ever been used.
• 29:40
  All right. Understood.
• 29:42
  What does provenance unlock? Provenance unlocks trust in the
• 29:46
  system, trust in the fact that you can move forward without
• 29:51
  without creating a additional fiction.
• 29:53
  What is the future that we are not preparing for?
• 29:57
  I think we're not preparing. I think we're talking about it a
• 29:59
  lot, but nobody's really preparing for the future where
• 30:03
  threat actors will be using image, voice, video generation
• 30:07
  to completely go around any current static mitigations.
• 30:12
  And what is one word that you're currently in between?
• 30:14
  Currently in between. I'm currently stuck on on
• 30:18
  accuracy and robustness. I think those are the words.
• 30:22
  What do you mean with that? So as I'm building and working
• 30:26
  with partners and people to work with on deploying this product,
• 30:31
  I constantly see opportunities to make the rules more robust,
• 30:34
  to make the rules more accurate. But that's how you get into
• 30:38
  analysis paralysis of like, we are not, we are not there yet.
• 30:42
  We're not there yet where we need to worry about that, that
• 30:44
  much. This needs to work.
• 30:46
  And then we'll see how we make it work better.
• 30:48
  But accuracy is very important to me and also robustness that
• 30:52
  I'm not telling you here's an attack or here's a threat.
• 30:55
  And this is how you can mitigate it.
• 30:57
  And you can say, oh, actually you're missing a bunch of parts.
• 31:00
  That's that's the thing that scares me the most.
• 31:02
  For now, thank you so much for the time, for sharing all your
• 31:06
  insights, and for joining us on the podcast.
• 31:09
  Thank you so much. I appreciate it.