Latest / Full Tech Ahead / Stop Patching Everything!

Transcript

Stop Patching Everything! · Full Tech Ahead

• 0:29
  SPEAKER_00: Hello and welcome to Full Tech Ahead.
• 0:32
  SPEAKER_00: I'm your host, Amanda Razzani, and I'm doing something new today.
• 0:35
  SPEAKER_00: I'm here at the Tech Conference.
• 0:38
  SPEAKER_00: I'm at Qualis Rock on 2026 Americas.
• 0:41
  SPEAKER_00: And I'm here with Sumed Takar.
• 0:43
  SPEAKER_00: And I am so excited to have him with me here today.
• 0:47
  SPEAKER_00: He was our keynote speaker.
• 0:49
  SPEAKER_00: And with that, I'm going to let you introduce yourself and your background and a little bit about Qualas.
• 0:53
  SPEAKER_01: Okay.
• 0:54
  SPEAKER_01: Well, thank you very much for having me.
• 0:55
  SPEAKER_01: And uh I'm Sumed Takar.
• 0:57
  SPEAKER_01: I'm the CEO of Qualest.
• 0:58
  SPEAKER_01: I've been at Qualas for 23 years, started as an engineer back in the day and had the privilege of leading the company as CEO the last six years.
• 1:06
  SPEAKER_01: And Qualis is a company we are very well known in the field of cybersecurity, primarily around managing proactive risk from coming from cyber and helping organizations essentially think of risk management in the way that they look at losses to businesses.
• 1:24
  SPEAKER_01: And that's really our focus.
• 1:26
  SPEAKER_00: Wonderful.
• 1:27
  SPEAKER_00: Well, there were some big announcements, but let's start.
• 1:30
  SPEAKER_00: What was the overarching message at this conference that you wanted to really drive home?
• 1:35
  SPEAKER_01: Look, I think the big message for the conference has been that AI is something that is prevalent now everywhere.
• 1:42
  SPEAKER_01: And as your businesses are looking to leverage AI, attackers are also leveraging AI for their business, which is to get into your business.
• 1:50
  SPEAKER_01: And so I think what we're seeing is a sort of a new acceleration in the way that attackers are creating attacks by leveraging AI to get into your organization and a high explosion in the number of vulnerabilities being detected in the software that we are using on a daily basis.
• 2:05
  SPEAKER_01: And you know, just uh yesterday, the Pack Tuesday from Microsoft had uh almost 1400 CVE findings, which is quite different from what it used to be in the past.
• 2:15
  SPEAKER_01: And so, as business leaders, teams are looking to figure out how do we deal with this big number of findings that are coming out.
• 2:23
  SPEAKER_01: And really the big message from the conference has been that you just cannot fix everything, and you need to be able to figure out what actually causes risk to your organization and then focus on fixing that risk.
• 2:34
  SPEAKER_01: But that then that risk needs to be fixed pretty quickly.
• 2:38
  SPEAKER_01: And so the only way you could do that to fight the AI exploitation is with some form of AI-based uh remediation to fight back, and that's pretty much everything we're talking at the conference, is really about how do we get to the point where we are successfully and confidently able to leverage AI to do autonomous remediation at the speed at which AI attackers are coming at us.
• 2:59
  SPEAKER_00: Yes, absolutely.
• 3:01
  SPEAKER_00: And you spoke a lot about so many companies are in reactive fight or flight mode and wanting to be proactive.
• 3:10
  SPEAKER_00: Can you share a little bit more about your advice to business leaders when it comes to being proactive, especially in this age of AI with the increased, large amount increased vulnerabilities?
• 3:21
  SPEAKER_01: Yeah, see, the at the end of the day, why should you fix a vulnerability?
• 3:26
  SPEAKER_01: That's because it could potentially cause a business loss.
• 3:29
  SPEAKER_01: And so, where the focus for everybody needs to be not about the volume and the counts, is about how do we get to the point where we can quickly identify, and and we talked about this at the conference that typically less than 1% of the vulnerability findings actually create risk to the organization.
• 3:43
  SPEAKER_01: So, how do we get to that risk quicker, faster?
• 3:47
  SPEAKER_01: And then how do we leverage AI to uh be able to uh affect that remediation at the speed at which attackers are coming at us?
• 3:55
  SPEAKER_01: And so I think the focus for enterprises really need to be how can they create a framework that allows them to very quickly and continuously look at these new threats that are continuously coming or the new risks that are coming and then figure out that 1% quickly and then fix that fast.
• 4:12
  SPEAKER_01: And typically, this process of reactive risk management has been people build different dashboards and they send that those dashboards and tickets to people and that take time to fix, and there's a committee and approval.
• 4:24
  SPEAKER_01: When we are talking about fixing the vulnerability in 24 hours, you don't have time for something like that.
• 4:30
  SPEAKER_01: And so that's where the risk operations center that we talked about, which is the idea of creating a framework that allows you to repeatly and confidently figure out what matters to your business and then actually make sure that it gets fixed, is the focus that most business leaders need to have.
• 4:47
  SPEAKER_01: Less about trying to figure out the counts and stuff, more about how can I operationalize my risk uh operations process in a proactive way instead of just waiting and reacting uh after the fact when something has has come out and has become a challenge for you?
• 5:01
  SPEAKER_00: Yes, absolutely.
• 5:02
  SPEAKER_00: And you mentioned, you know, focusing in on those 20 or 30 big ones and how there's just a never-ending, it seems a never-ending chain of attacks now with AI.
• 5:12
  SPEAKER_00: Yeah.
• 5:13
  SPEAKER_00: So how can people get in front of that and break that chain?
• 5:17
  SPEAKER_00: Um, you know, sometimes the minor stuff gets overlooked, but how do they just break that chain?
• 5:22
  SPEAKER_01: That's a great question.
• 5:23
  SPEAKER_01: And I think that uh a breach is always a series of steps that the attacker has to take to have a breach, right?
• 5:31
  SPEAKER_01: Just be an exploitation may not necessarily become a breach.
• 5:33
  SPEAKER_01: And so what has changed really with AI is the volume of findings, but I'm not as concerned about that relative to the speed at which uh attackers are able to change these things.
• 5:44
  SPEAKER_01: And so as an organization, if you want to be able to keep pace, we have to be able to do the similar strategies that attackers are doing, but do those safely in our own environment.
• 5:54
  SPEAKER_01: So part of that really is uh setting up proactive processes that allow you to figure out which of your assets are important, which of them lead to business losses, which types of software is very important to you, and set up those rules.
• 6:09
  SPEAKER_01: But then ultimately, after that, being able to kind of normalize all of your findings and then be able to get to the point where you kind of get them remediated and build the confidence in that remediation is kind of the focus that everybody needs to have.
• 6:22
  SPEAKER_01: Again, doing that in the context of the business, I think that's that's really where I think that people need to focus on right now.
• 6:29
  SPEAKER_00: And then you mentioned savings factor.
• 6:31
  SPEAKER_00: How much will a business save if they do this with that new strategy, approach it from that new strategy?
• 6:39
  SPEAKER_01: Look, I think uh automation always helps uh bring costs down, typically, right?
• 6:44
  SPEAKER_01: And so building the confidence in the automation is gonna help you achieve broader scale at a lower cost, right?
• 6:50
  SPEAKER_01: And I think that's where organizations uh, if you know, cybersecurity, especially in the vulnerability management side, you could fix 10,000 findings and make no impact to your risk of a breach, or you could fix like 30 and that could actually be a major uh impact.
• 7:07
  SPEAKER_01: And so you can see the cost difference trying to fix 10,000 as an emergency patches versus 30 is a big difference, and the outcome is very different.
• 7:15
  SPEAKER_01: So I think overall I believe that organizations can really tighten their spend into more measurable outcomes if they approach take the approach of the risk operation center versus you know it's it's a it's very disruptive for dev teams and IT teams when they have to keep dropping what they're doing and keep applying security patches.
• 7:33
  SPEAKER_01: So I think an approach that says, look, the less than 1% vulnerabilities high risk if we can get those fixed in a bit of an emergency, which is a much smaller number, but then the rest of the issues can be upgraded software or updated software in the next update cycle that IT or dev has already planned is a big saving.
• 7:53
  SPEAKER_01: So now you're not having to go out of your way and disrupt a bunch of people.
• 7:57
  SPEAKER_01: And the less vulnerabilities that you have to fix, that's a big saving for the organization.
• 8:01
  SPEAKER_01: So I think taking a proactive risk operations approach is going to help you overall manage uh your spend.
• 8:08
  SPEAKER_01: And uh, more than the spend, I think if you can give you know four hours back to your dev teams uh every week or four hours back to your IT teams, they can actually spend that and doing things that will actually help your organization get ahead in in a competing world rather than having to sit down and fix all these findings, which ultimately may or may not even have an impact for you from a security perspective.
• 8:29
  SPEAKER_00: Absolutely.
• 8:30
  SPEAKER_00: Well, as we can see, AI is advancing so rapidly.
• 8:33
  SPEAKER_00: Now you have quantum looming.
• 8:35
  SPEAKER_00: What is your advice to business leaders to be prepared for the future?
• 8:40
  SPEAKER_01: Look, I think technology has been there and technology will come and technology will go.
• 8:45
  SPEAKER_01: I don't think it really ever goes because we can we're still 70% of our airline reservation systems are still running mainframes.
• 8:52
  SPEAKER_01: But I do think that the no matter what technology comes, that technology is used to advance the business in a competitive environment ultimately, right?
• 9:00
  SPEAKER_01: Whether moving to the cloud or AI, uh when AI came.
• 9:04
  SPEAKER_01: And I think quantum is gonna be another risk that is going to come because encryption is super important.
• 9:09
  SPEAKER_01: The questions are always the same though, right?
• 9:11
  SPEAKER_01: When you have a new risk come up, first question is well, how what does that mean to my business?
• 9:16
  SPEAKER_01: How much loss could I have if this happens?
• 9:18
  SPEAKER_01: And then the follow-up questions are always the same, whether it's AI, whether it's cloud, whether it's uh quantum, where do I have it?
• 9:25
  SPEAKER_01: How do I assess that it's uh correctly implemented or not?
• 9:29
  SPEAKER_01: How do I prioritize the ones that actually matter to me?
• 9:31
  SPEAKER_01: And then how do I get it remained to it?
• 9:33
  SPEAKER_01: And that framework doesn't change no matter what new technology comes in.
• 9:37
  SPEAKER_01: So I think in my mind, creating that risk operations framework allows you to ingest any new risk in the same overall formula that you have and be able to make those decisions quicker and faster because also it's also about shifting the budget accordingly, right?
• 9:53
  SPEAKER_01: So if the quantum risk is significantly more than the risk of something else, you know, you as a leader might want to look at how do you how do you move some of that budget to the right area where the risk is higher.
• 10:04
  SPEAKER_01: However, on the other hand, you know, as amazing and as uh cool the new technology might be, if it doesn't bring the kind of risk to your business, well, you don't need to really be spending.
• 10:13
  SPEAKER_01: I mean, you know, we've seen some of these technologies like bring your own device, etc., come become like a big thing, people are worried.
• 10:19
  SPEAKER_01: And then now, how many people actually really focus on that security as much as it used to?
• 10:24
  SPEAKER_01: So I think that as the threat vector changes, you you are gonna keep moving your risk, and and the risk is moved, you're gonna move your spend as well accordingly.
• 10:32
  SPEAKER_01: So I think uh building a risk operation center really helps you make sure that you're future-proof your overall security program.
• 10:39
  SPEAKER_00: All right.
• 10:40
  SPEAKER_00: Well, if there was one key takeaway you could leave our audience with today, what would that be?
• 10:44
  SPEAKER_01: You cannot fight AI without using AI.
• 10:47
  SPEAKER_01: I know it feels like you know, something we could do.
• 10:50
  SPEAKER_01: So, you know, the key takeaway is really gonna be now that you know you have to do it, the question is what's the economic equation in which you're gonna use AI to fight AI?
• 10:58
  SPEAKER_01: Is it something you're gonna build yourself or is it something you're gonna trust your partners and your vendors who have uh capabilities built around that to help you achieve the outcomes that you need to use AI to be able to fight back the attackers?
• 11:10
  SPEAKER_01: So that's something that I would ask people to think about from more of a business perspective.
• 11:14
  SPEAKER_00: Wonderful.
• 11:15
  SPEAKER_00: Well, thank you so much for sitting down with me and doing my first live podcast show, Qualis.
• 11:22
  SPEAKER_01: Thank you very much.
• 11:22
  SPEAKER_01: It was a pleasure talking to you.
• 11:23
  SPEAKER_00: Yes.
• 11:24
  SPEAKER_00: And to our audience, if you have any questions or comments, please leave them in the comments below, and I'll get back as soon as possible.
• 11:30
  SPEAKER_00: Have a great day.