Latest / Cyber Security America / Predicting Cyberattacks Before They Happen | The Future of Risk Intelligence with Alex Berry
Transcript
- 0:02So many supply chain disruptions seem to come out of nowhere, but
- 0:06often say that the signals appear much
- 0:08earlier.
- 0:08What geopolitical indicators should organizations be paying attention to that most are currently missing?
- 0:14Alex is the CEO of SeeRist.
- 0:17He specializes in identifying risks before they become major incidents.
- 0:21How early can threat intelligence and sentiment analysis help organizations recognize warning signs and take actions before disruptions happen?
- 0:29Alex has been in the industry for a while and is in a cutting-edge field right now I thought he would be best to address this risk of supply chain supply compromises.
- 0:38So welcome to the show Alex.
- 0:40It's great to have you
- 0:41Thanks for having me.
- 0:42I'm excited to be here and always fun to talk about some of the challenges that that we have in in the world and very serious topic.
- 0:49So appreciate ~
- 0:50you having me on.
- 0:51Well, thank you.
- 0:51And you have such an interesting company and what y'all do.
- 0:54When I was talking, I was just fascinated.
- 0:56And you seem like a company I definitely want to know more about.
- 0:59how are government agencies and commercial enterprises applying predictive risk intelligence differently?
- 1:05And what best practice could each of them learn from this just to understand how the world has changed?
- 1:11Yeah, ~ there's that's a complicated question, and it starts with, ~ I'll start with this kind of tagline.
- 1:18~ if you look at the predictive analysis and if you look at history as a guide, and if you look at Threat Intel in general, you know, every major campaign has a geo re geopolitical
- 1:29return address.
- 1:30And what I mean by that is if you watch geopolitics, if you look at cyber activity, if you look at state actors, hactivists, if you look at
- 1:38political triggers, if you're looking at sanctions or tariffs or military moves, I could go on and on.
- 1:46~ you know, things like gatherings, ~ industry events, these are all leading indicators potentially of of hacktivism or or threat intel or other things.
- 1:58And so we c we tend to look at that as ~ looking back to look forward.
- 2:04So ~ no one
- 2:06with any credibility would tell you that we can predict the future or any company can predict the future.
- 2:13But we can use our historical baseline and to give you ~ a leading indicator of what what might happen.
- 2:21And so if you look at all the available information that's out there through open source intelligence, if you look at what we do from a human
- 2:29verification, verified data, and you look at kind of the history and you pull that together, you can start getting a pretty good understanding of where some of the choke
- 2:39points or threats would be.
- 2:41And you can look at sentiment analysis.
- 2:43And so I'll give you a couple of examples that ~ are were in the news.
- 2:47So when before the Ukraine war in 2022, ~ there was a Whispergate ~ attack six weeks before the tanks rolled in from Russia.
- 2:57And so you could look at sentiment analysis and looking at the case.
- 2:59That was a leading indicator.
- 3:01So that was something that you wanted to look at.
- 3:04If you look at October 7th and what happened in the Middle East, you if you looked at the the landscape of Threat Intel and all the different capabilities that are out there, ~ you
- 3:14could see that something was was bubbling up.
- 3:16~ you can also look at things like where diplomats are going to a country.
- 3:21So if you look at Taiwan and when Nancy Pelosi went there and there was that ~
- 3:26cyber attack there, you could start piecing things together.
- 3:29And so I think that the tip of the spear really in in our world is in the threat intel space, which then can guide you when you look at ~ what actually does transpire.
- 3:40And you and I were talking about a situation that that you were in ~ the last couple days.
- 3:45~ I bet there was some triggers, some things that you could look back on that would be a leading indicator.
- 3:52And the more you can understand that, the more you can look at having that that ~ that foresight, which gives you then insight, then you can take action, ~ the better that you
- 4:02will be.
- 4:03So, you know, the bottom line, I look at kind of watch the calendar, watch the anniversary dates, watch ~ sanctions, watch the news and and see what's what's happening.
- 4:13That should give you a good indication of some of the areas that might be ~ at risk to your supply chain, et cetera.
- 4:21And
- 4:21Yeah, I also think that it's important for companies to, ~ especially when you're looking at executive protection or travel security, to have something that they're looking at to
- 4:31make sure that they have an idea, whether it's looking at a specific ring fangs area of where they might be going into into Mexico.
- 4:40Obviously the cartels own a lot of the the ~ the land and and control a lot of the area there.
- 4:46So understanding what those triggers are, what those actions are, where the risks are.
- 4:51in advance can keep you out of trouble.
- 4:53And that's hopefully what ~ this emerging business, which you know a lot of people spend a lot of time on on cyber after the fact ~ or 72 hours.
- 5:03But if we can get to the point where we're getting better at predicting what might happen, I think that just makes the entire universe safer.
- 5:12That's a really good point.
- 5:13mean, I've seen threat Intel is always after the fact like this.
- 5:16That is incident.
- 5:17I was in with a customer and they had a number of Linux servers that were hit some backup software that was zero day when we started doing an Intel assessment of it within the IR.
- 5:27We can see going back that attackers were publishing some of the toolkit to exploit this several weeks back, but nobody was tuned into it.
- 5:35It wasn't so after the fact when we're trying to figure out what was going on that it became relevant.
- 5:39I think this other one supply chain
- 5:41You heard about the refrigeration units in France that got hit and lost all ~ perishable items.
- 5:48Now that's scary.
- 5:49Yeah.
- 5:49I've been in cyber and and ~ technology for the the bulk of my career.
- 5:56And I remember ten years ago when I was at a company called New Star.
- 6:00~ we were we had a lot of exhaust and data that we would help, to the federal government.
- 6:04to help make decisions about where DDoS attacks were happened or where some of the bad actors were.
- 6:09But back then it was really concentrated, from my perspective, within the federal government.
- 6:14The commercial side had not really woken up to it.
- 6:17And what happened obviously, unfortunately, of the assassination of the United Healthcare CEO, companies started waking up.
- 6:25And there were leading indicators ~ with United Healthcare from that individual.
- 6:30That if they had put two and two together, they probably would have had a better security detail.
- 6:34They would have probably not had that person walking alone in the streets of Manhattan, in the in the morning.
- 6:40So that there are signs and triggers out there, and the key is to make sure that you can get with a a company that helps you kind of source through that and gives the executives
- 6:51and the CSOs and the sh chief security officers the opportunity to then
- 6:56provide insight and intel so the executives can make decisions based on data and fact.
- 7:02But you're absolutely right.
- 7:03There was I'm sure chat groups, ~ Reddit comments, what have you that were talking about, you know, maybe doing something to the company that you and I were talking about before.
- 7:13And you know what's interesting, and you know, I talk to companies a lot about this as well, and you'll probably maybe you witnessed this in in your situation yesterday.
- 7:23But attackers don't respect your org chart, right?
- 7:27So one of the challenges that companies have is that they move freely across the internet.
- 7:34~ they're obviously using AI.
- 7:36~ there's both physical and ~ and and digital channels that they go through.
- 7:43But if companies are not coordinated, so if the CSO is not talking to the, you know, the the physical security, the the cyber security, ~
- 7:53the the threat intel piece, if there are three silos not communicating, ~ then attackers will take advantage of that.
- 8:00So I think organizing so that there's that coordination and collaboration when an attack happens.
- 8:05And you you might have seen that firsthand in in your situation, but ~ that's really important and I think something that companies are starting to wake up to, to have that,
- 8:15you know, centralized group that can handles all of those different ~ variances so that they can react accordingly.
- 8:21Yeah, I think intelligence and sentiment analysis.
- 8:24~ I was in the banking industry with E&Y and Wells Fargo.
- 8:27And so we did a lot of work.
- 8:28And whenever a merger acquisition was announced, the next day they were doing phishing emails towards that.
- 8:34They were saying, don't lose access to your bank account here.
- 8:37Click on this, install this new
- 8:38digital certificate.
- 8:39Well, that could have been anticipated.
- 8:41We knew that was happening based on experience, but you could see where that kind of stuff would bubble up.
- 8:47And how do you handle that?
- 8:48How do you respond to that?
- 8:49And the threat Intel world for the longest has has been just IOCs.
- 8:53Here's IP addresses of bad guys and funnel them into your tools.
- 8:57And then half the time the IOCs change.
- 8:59And so they're not even ~ worth it.
- 9:01Like the incident I just had, were AI enabled by, it was definitely guaranteed that it was AI enabled.
- 9:08moved IPs, they moved systems so fast that the IOCs were stale just in a few minutes.
- 9:14Yeah, and I I I think it's a good point.
- 9:16the other thing is, ~ you know, it's activist activity, you can see days, weeks, as you were talking about, and months ahead.
- 9:25But that's a a singular, you know, ~ piece of data.
- 9:29And really what's important is that you y leverage all of the different factors.
- 9:33But what's critically important is the problem with the world now, especially in the threat intel space, isn't that ~
- 9:42there's a lack of of there's too little data, right?
- 9:45It's that there's too much and it's it's noise.
- 9:48And so when you have a a GSOC and you're getting all these alerts, how do you siphon through, you know, the one alert or the thousands thousands alert in a timely manner to
- 10:00make sure that you're capturing the one that's really critical.
- 10:03And I think that's something that the industry in general is starting to ~ you know ~ adh adhere to and looking at
- 10:11They want to make sure that they're funneling that.
- 10:13So great organizations that use capabilities and tools to funnel that, to give the analyst the opportunity to really sort through the noise and provide that data, gives you then
- 10:23that foresight, that insight, and then you can take action on it.
- 10:27But ~ there's a lot of data out there, and that's I think one of the challenges that the industry faces.
- 10:33How do you sort through that and ~ not just get lost in in in the noise?
- 10:38And and we see that.
- 10:40know, often with with our customers as well, where they're really trying to make sure that they're giving themselves the opportunity to make sound decisions and not getting, you
- 10:49know, ~ caught up in the in the in the mire of the of the noise.
- 10:54Yeah, and you also see stuff like 9-11, October 7th in Israel, blindsiding events, all this intelligence services that we have, all this stuff that's out there, they still
- 11:04didn't see that.
- 11:05Stuff like...
- 11:06~
- 11:07President Trump's assassination attempt in Butler.
- 11:09It was his mother that called in the tip towards it.
- 11:12It is always seems to be the lower end.
- 11:15It's not some technology, some chatter from some group.
- 11:18It just seems to be people on the ground that notice, hey, this person is a threat.
- 11:22I need to call it in.
- 11:24That seems to be like a great source that you'd have to be able to pull into any kind of threat intel feed,
- 11:29Yeah, and you got
- 11:30you you gotta correlate that.
- 11:32So ~ and this isn't a a ~ a discussion about SeeRist or the company that I'm I'm I'm CEO of now, but I think the how we approach it is there's the open source intelligence that
- 11:45you can get.
- 11:46So we use X feeds, we use all kinds of different data feeds, we use the Uzbekistan news to kind of correlate this information, then we use open source intel.
- 11:56But to your point
- 11:57The other piece that we have, which is a unique differentiator, is the human analytics and human verified information.
- 12:03So we have 200 analysts that are all across the globe.
- 12:07They're gathering that real-time information that you can't get anywhere else.
- 12:11You correlate that with the open source Intel, and that's how you start to paint the picture of something that's really actionable and that you can you can you can validate
- 12:20and feel comfortable with.
- 12:21having that go up go up the the chain so to speak.
- 12:24So I think you're absolutely right.
- 12:26It's a combination and ~ it's also making sure that ~ you have both things handled from my perspective.
- 12:34And so what does your company exactly do?
- 12:36Does it say, I'm going to take an Intel profile of you, but I'm also going to understand your operational risks within your supply chain and then start to pull out, maybe you've
- 12:45got five, six core companies that are part of your supply chain.
- 12:48That if they went down, you've lost a 30 year revenue for that time period.
- 12:52So is it a combination of Intel gathering once you've done a risk assessment on them or how does that work?
- 12:58Yeah, well, it's a platform.
- 12:59And so what we've done is we've built a large language model that ingests all the open source intelligence.
- 13:04Then we have human verified intelligence that is garnered over 15 plus years.
- 13:10And so we correlate that information into a platform.
- 13:13And so we have risk ratings.
- 13:15And so risk rating would show by country, kind of the simple if you go to our website, you can see it.
- 13:21~ and
- 13:23It will show red, yellow, green.
- 13:25It's a a one to a hundred as far as the risk rating.
- 13:28So the lower number, the more risk.
- 13:30And then you can click into that and get into granular detail of what's the situation.
- 13:35So what's the breaking events, what's happening there right now, historically, what's what's been going on.
- 13:41You can look at their sentiment analysis.
- 13:44So we then correlate all this information.
- 13:46We start doing a graph of things like in Venezuela.
- 13:51I knew two or three days before just by looking at our platform that something was going on down there.
- 13:55I didn't have, you know, obviously ~ the the ac actual insight, but by correlating all this information and looking at it, we were able to, you know, get that sentiment
- 14:06analysis.
- 14:07we're launching this called ~ any place on earth, which you can go down to the granular of a street level of what's happening on that street.
- 14:14And so
- 14:15GSOC operators, global security operations, they use our platform to kind of look at those things to then make decisions.
- 14:24So if you're a ~ oil and gas company and you're looking at building out ~ a refinery in some new area, ~ you use that information, that platform to make informed decisions about
- 14:36are you going invest a billion dollars ~ in an area that is maybe sketchy.
- 14:42That's how people use the the platform.
- 14:44That's how we correlate it.
- 14:46But ~ yeah, we're we're using all the information that you talked about, and then we're trying to provide that solution so that people can take action.
- 14:54I'll give you a a case in point.
- 14:56Last week I was in Los Angeles, we do customer roundtables and with a number of media companies, number of technology companies, and it's actually before the Houthis bombed the
- 15:07airport in Riyadh.
- 15:08React.
- 15:09we were talking about this two days before.
- 15:11And there was a woman who was trying to get her executive team not to travel to Riyadh.
- 15:17And this is before anything happened.
- 15:19And she used SeeRist to provide them with a sit rep report, with the analysis, with the data to show them here's the risk, and they ended up not traveling.
- 15:29And the thing that was, I think, most important is her kind of final punchline to get them is she said, look, you
- 15:35can probably get in there, you'll probably be okay, here's all the risk.
- 15:39But if something happens, you won't be getting home for your daughter's birthday.
- 15:43You'll be stuck there because there's no easy way out when the airports are shut down.
- 15:47There's no, if you look at Saudi Arabia, which s which country do you want to try to evacuate from?
- 15:53And so it's using that information in in real life situations to make sure people don't get in harm's way.
- 16:01And you know the the challenge is ~ is,
- 16:05yourself, myself, ~ we have to listen to that information and we have to not be bullheaded, stubborn to think that it's not gonna happen, because ~ a lot of times
- 16:15executives will take that information and they'll act in a different way.
- 16:19And I thankfully I think ~ the world that we're in right now, they're they're much more willing to listen to data and facts, and that's that's how we provide that information to
- 16:30Yeah, and I would see in these situations.
- 16:32had a friend of mine that was in Mexico and he was driving one of those jet skis, got into a big accident, messed him up, ~ wanted to fly him back to the United States, but it's too
- 16:42bad of shape to actually go commercial.
- 16:45You have to have one of those private jets come in with a medical team and transport you.
- 16:49And that's $25,000.
- 16:51So the whole church and friends had to get money.
- 16:54So you could see we're in a situation where you're going to send an executive to a hostile area like that.
- 16:59Should you have the medical
- 17:00medical flight coverage.
- 17:01So when that does occur, you can get a team on the ground hostage rescue if it may be.
- 17:06What's the procedures in the event there is a ~ hostage situation or just medical and you need to get them out?
- 17:13A lot of people don't think that they're sitting in line with everyone else trying to get out of some country and they're refugee now.
- 17:18So that would
- 17:19be an example of knowing ahead of time.
- 17:21Maybe you have some mitigating control or some factor to mitigate the risk of some executive going to that area.
- 17:26Yeah, and I think you bring up a good point.
- 17:28The other thing that's important, and probably should have mentioned this before, but you really can't spot a deviation without a baseline.
- 17:36And what I mean by that is that using history, right, ~ looking at what's happened up until that point, ~ having humans in the loop, we talked about the analysts, and so you
- 17:46establish that baseline, because without a baseline, everything will look like ~ a crisis potentially.
- 17:51So as and we do that, you establish that baseline, that's that risk rating report.
- 17:56And then you start seeing things tick up, or you see issues, or you see ~ you know, ~ activism or or what have you.
- 18:05And really establishing that baseline gives you also that ability to kind of see through the noise.
- 18:10And I think that's really important is for companies to really spend that time doing that, because without that, everything seems like a crisis, and that that serves nobody.
- 18:20Yeah.
- 18:20Yeah, absolutely.
- 18:21I think I told you that story of we had ~ some reporters that were going through Ukraine and I was at Booz Allen at the time and they created a Intel map of which streets were
- 18:30safe, which way to go, what kind of patches do you look for?
- 18:33Is that a national police uniform?
- 18:35Is that something else?
- 18:36And I just think it's ~ very invaluable now moving forward.
- 18:40And are you seeing where there's more risk towards executives now ~ after the United Health?
- 18:45But is it really more of a risk to them or is it more of a cyber risk?
- 18:49more than physical.
- 18:50I think it's it's both.
- 18:52~ I think both are getting amped up.
- 18:55we see awareness much more now from executives in the c in the commercials, so your Fortune two thousands.
- 19:03~ the government's always been a little leading ahead of this.
- 19:06They've they've been thinking about this ~ because of, you know, the troops on the ground and what have you.
- 19:13But
- 19:13~ I I I see it
- 19:15amping up and I I think that it's becoming more and more a topic of conversation that we have.
- 19:21You know, four years ago, ~ there the the threat intel was part of the cybersecurity group.
- 19:27This goes back to what I was talking about before is that ~ you know hacktivists, ~ folks, the bad actors don't care about your org chart.
- 19:36They were actually exploiting your org chart before because some of the threat intel was just buried.
- 19:40Now that's come out
- 19:42in in front and center and there's teams that are now dedicated to that.
- 19:46~ United Healthcare was was a a turning point and we've seen that.
- 19:51You know, if look at ~ Silicon Valley and and some of the the monumental wealth that is happening there with you know the anthropics and open AIs and Metas, you know, that
- 20:02heightens risk.
- 20:03When have you know a number of multimillionaires or billionaires, they're at at risk.
- 20:09So I s I think that's starting to
- 20:11take hold as well and where these people ~ need to be protected.
- 20:16They need to understand what the risks are.
- 20:18And it's not ~ unfortunately it's ~ the geopolitics and and the the challenges that we face globally ~ don't seem to be tempered down.
- 20:29I don't see them being tempered down anytime soon.
- 20:31I think it's just getting you know more radicalized and and more intense
- 20:37certainly even since the year I've been here at SeeRist.
- 20:40I I see that there's much more focus on executive protection, travel security, supply chain risk through the threat intel piece.
- 20:50People take it seriously now because they know if you can get ahead of it, you can prevent some of the more meaningful attacks in the cyber world or ~ you know within a facility
- 21:00that ~ houses
- 21:02Yeah, thousands of people.
- 21:03Yeah, one question I had, I was always curious with the volume of information available today, how does SeeRist distinguish real threats from noise and misinformation, especially
- 21:12with everything that's just AI-ified today?
- 21:14So how do you filter out that disinformation?
- 21:17the first thing that we've done is we've created our our large language model and ~ we're we're constantly learning.
- 21:24So we have you know 15 plus years of curated verified data that comes from our partner control risk.
- 21:31And then we've also had four plus years as a company that that SeeRist has been around that has built out
- 21:38these large language models, we ingest that information.
- 21:40We're constantly learning and and sifting through that threats.
- 21:44So ~ that's the way that that that we do it.
- 21:48And then we provide that in a in a platform that you can go see and take action on it.
- 21:53as I talked about, the the noise aspect of it.
- 21:56There's a lot of data out there, but it's how do you sift through and get to that kernel that's really important.
- 22:01And that's what our platform does.
- 22:02Yeah.
- 22:03And how do you interact with it?
- 22:04It's like a browser or would your AI platform talk to my AI platform, for instance, and ask questions back and forth?
- 22:11you know, it's a s a standalone platform you buy.
- 22:14~ if you look at some of the ~ organizations that do kind of alerting, so look at like an Everbridge or ~ an OnTIC, we we in work with them and so we share our information.
- 22:27So you get a holistic view of the the Threat Intel landscape.
- 22:31So
- 22:31we're an open system.
- 22:33~ we want to make sure that we integrate with different folks.
- 22:36We've created a a great API that we're very API friendly and we have an MCP server that also ~ helps companies ~ sift through the the noise.
- 22:45So now I need to understand how to integrate it.
- 22:47What is that online predicting clist or one of those where I can bet on what's going to happen here in the future and I can use your platform to do it.
- 22:55what what's
- 22:56interesting, I was at a a trade show and I had a private equity guy come up to me and and said, you know, Calci is I think what you're talking about.
- 23:04And ~
- 23:05he said this could be really interesting for, you know, predictive analytics.
- 23:11And I had never really thought about it before, but ~ you know what we're doing is ~ helping companies make that, you know, foresight and and understand and then ~ give them
- 23:21the ability to then make decisions.
- 23:23~
- 23:24I would love to be able to predict the future with Threat Intel.
- 23:28~ if I said that then I'd lose all credibility 'cause that's not going to happen.
- 23:32But we want to get as close to that as possible to give our customers and and the industry the opportunity to make decisions before something bad happens.
- 23:42It makes sense.
- 23:42~ it seems to be the way of the world now, all the information that's online, all the risks that are happening to these companies.
- 23:50It just seems like there's just an area you just can't ignore.
- 23:52But for the longest time, I think Intel was in the back corner because it was report driven.
- 23:58It was like IOCs for different things.
- 24:00It didn't really help anyone make true decisions.
- 24:03And it seems like that's making a turn here.
- 24:06We are starting to do that.
- 24:07Yeah, no, absolutely.
- 24:08And I think ~ the industry is really, ~ it's still nascent in in in my perspective.
- 24:14And you know, going back to when I was at ~ New Star, ~ it was the beginning of that kind of threat intel world, but it was it was something that was kind of an afterthought or not
- 24:27I I never had really conversations, this goes back probably ten years ago, with any commercial clients about Threat Intel.
- 24:34I did with the the federal government and international governments.
- 24:38That's changed.
- 24:39our ideal customer profile is Global 2000 plus federal and international governments.
- 24:45And ~ the the commercial side as we refer to it is is really taking off.
- 24:50And we're seeing that ~ more and more.
- 24:53So it's not behind the scenes, it's not embedded into the
- 24:57CSO's organization or the CISO's organization.
- 25:00It's actually it has its in many cases has its own, ~ leadership and it reports into the the chief security officer or the CISO and or or in many cases it it has time at every
- 25:12board meeting to talk about what's happening.
- 25:14Yeah.
- 25:14And do you see most of your, output of your product used for strategic decisions or a lot of tactical as well?
- 25:21~ I was doing a project now for Trinidad and Toboggan and I was considering whether I should go to that Caribbean nation or not.
- 25:28But I go and look up the travel warnings from the state department and it says that tourists shouldn't go there.
- 25:34They have robbery and murder and it's not safe there.
- 25:37And it almost seems like, ~ from a strategic, where are you going?
- 25:42~ perspective, where's the company going?
- 25:44versus just tactical.
- 25:45All I'm going to this city.
- 25:46What do I need to know about it?
- 25:48So is it both of them together?
- 25:51Yeah, I I I absolutely and I think so rather than going to the State Department, we need to get you hooked up with SeeRist because ~ the information we have is is much better and
- 26:00and we'll give you the historical context.
- 26:02And so ~ all kidding aside, I think that people are using it as I mentioned with the Riyadh example of the executives that didn't travel there.
- 26:11There was a conference, they looked at the information, they looked back, they used our our platform to to make that decision to not go.
- 26:18~ it's also made for
- 26:20investment decisions as I talked about.
- 26:22So Bloomberg's a a customer of ours and they use it to you know make bets on what they might invest in, right?
- 26:29So that's a another use case that that we use in all the information.
- 26:33If you look at some of our oil and gas customers or regulate regulated industries, a lot of times, especially if you're a miner or or if you're an oil and gas, a lot of the
- 26:44exploration that has happened is, you know, all the safe places
- 26:49Those have already been, ~ mined or so now you're looking at going to places like potentially Ghana or other areas.
- 26:56And these are billion dollar decisions.
- 26:58And so leveraging a platform like SeeRist to go in and disc you know and look at the threat vector, those are the decisions that when they go to the investment committee to
- 27:07make that potential billion dollar decision, they're leveraging not only our data but others to make that informed decision and a go or no go.
- 27:15So it's much more strategic, it's much more
- 27:18~ advanced team, if you will, that is that is how people are using it.
- 27:22And that's evolved kind of to your point.
- 27:24It was almost an afterthought.
- 27:26And you would do a threat assessment ~ after the event.
- 27:30Well those days are are over.
- 27:32You want to do that threat assessment before there's an event so that you can prepare, make make changes and plans, move move employees, ~ do what have what what have you.
- 27:44And that also
- 27:45comes when you look at natural disasters and wildfires and everything else, those are all part of it.
- 27:50If we as much forewarning as you can give the the better.
- 27:54And one I think great example, and just tied to your point from a strategic perspective is we had a client who was looking to invest in in Bolivia and they were looking to do a site
- 28:07visit.
- 28:08And they came to us and said, look, can you look back at the last 10 years of the Bolivian elections?
- 28:14And then use your ~ the information you have right now to tell us, A, is it safe to go?
- 28:20Or what happens five days before the election and what happens five days after.
- 28:25So we were able to give them an analysis that showed, you know, historically if you go back the last four elections, and it was pretty s pretty similar, right?
- 28:34There'd be protests, there'd be disruption, and then after a couple of weeks things would kind of die down and get back to some sort of normal.
- 28:42But ~
- 28:43That's more of a strategic view of how you're going to leverage the the Threat Intel landscape to make informed decisions about where you travel, what you're doing, where your
- 28:53supply chain is, how safe for your employees, et cetera.
- 28:57That's a point.
- 28:58So Alex, I'm going to ask you to pull out your crystal ball here.
- 29:02But what is a black swan event you're most worried about that hasn't happened yet?
- 29:06Huh, that's a good question.
- 29:08~
- 29:08I would say ~ I'll give you mine real quick while are you thinking about that.
- 29:11But for instance, the pilot taking the safety axe and trying to stab the captain of the plane, the fly Dubai plane there was not anticipated.
- 29:20They always thought that the risk was coming from the passengers trying to break in through the door, not that the pilot would attack the captain with one of the hatchet sets
- 29:29there.
- 29:29Even though there was some ~ predictive analysis, it should have been because the, the co-pilot there had, was, was let go from Oman.
- 29:37air, I think it was, because of extreme abuse.
- 29:40So there did seem to be some risk there that should have been caught, like he was fired from one place, put into another company because of this extremist behavior.
- 29:51But now everybody's got to look at pilots and what to do in case one goes rogue, which wasn't really anticipated before.
- 29:56was always what happens when a passenger tries to break into the door.
- 30:00~ So anything like that you think that we ought to worry about?
- 30:04I don't mean to get ~ you know draconian or or fearmongering, but the thing I worry most about is ~ a rogue nation ~ getting a nuclear weapon.
- 30:14And that that's the thing that scares me the most.
- 30:19I think that's that's my black swan ~ thing I I worry most about.
- 30:26~ if I had to
- 30:28put it down.
- 30:28And there's there's other things as well, as you mentioned.
- 30:31but another terrorist attack and not being prepared and not looking at the warning signs and not taking action before ~ someone ~ does something terrible.
- 30:41Yeah, think mine would be the supply chain compromise from an electronics perspective.
- 30:46Let's say China put bugs into everything that they own from every VCR to every TV.
- 30:51We already know that they're in the water supply now.
- 30:54So what happens when those water processing plants go down and the parts you can't replace because the parts are compromised, the replacement compromise themselves or EMP
- 31:04type event in which the ~ electrical grid cannot be replaced because those parts are blown out or we have a supply
- 31:11chain risk of getting them as well.
- 31:13some of these things, ~ I never thought someone would try to hack the refrigeration units in France like that and perishable food for millions of people gets destroyed ~ overnight.
- 31:24Imagine something like had happened in our food chain collapse because of that.
- 31:29And why do you really need
- 31:30the freezers on the internet anyway?
- 31:32That don't make sense completely anyway.
- 31:34Yeah, no, and I I think the other thing, and we're we're living this, all of us right now is, you know, I think there's so much positive ~ in AI, ~ but there are risks and those
- 31:45those have been well publicized.
- 31:47And, you know, the the thing that I hope is that ~ you know, is as a leader of a business, I think it is your responsibility to, if you're developing a product, to make sure it's
- 31:57safe.
- 31:58~ it's your responsibility that it does no harm and that it it serves a a a greater good.
- 32:04And ~ I just hope that's how we continue to see that.
- 32:07people talk about ~ AI and and and the threat, and you know, there's certainly threats, but you know, this isn't anything new.
- 32:13I mean, back in the fifties there was the Cold War, right?
- 32:17We we've we've had issues ~ we had the Cuban Missile Crisis, that was ~ a concern.
- 32:22We had ~ you know the the financial crisis.
- 32:26I I'm old enough to have lived through a lot of these things, and so
- 32:30We've come out of it.
- 32:30And I think AI is an accelerant to all of these things.
- 32:33I think in in your particular world for certainly from a cyber perspective.
- 32:37You know, back when I was running a a cyber business and we had a DDoS mitigation ~ scrubbing center and business, you know, you could see ~ the activity that was really
- 32:50driving that.
- 32:51That's just been amplified now with with ~ with AI.
- 32:54And ~ so I worry about that as well.
- 32:57And I think that hopefully the
- 32:59leaders of these businesses ~ take take heed that you know if there's something that is not good for all of us that you you clamp it down and you'd be responsible because there's
- 33:11so much good within ~ ai whether it's healthcare, whether it's in productivity, whether it's in the you know the daily operational review, but we don't want to get ahead of
- 33:21ourselves.
- 33:22And you know that's that's another thing that ~ I work
- 33:26I worry about the supply chain risks of putting these AI systems in to make these decisions.
- 33:32And years from now, there is no backup if that goes down.
- 33:35Like how do we process that work now that the AI is not properly working, the LLM is corrupted or whatever it may be, there is no human knows how to do that anymore.
- 33:45yeah
- 33:45And so we get to a point where that we're critically down or just an accreditation.
- 33:50want to be able to have an accreditation of this platform and say that it
- 33:55adheres to the standards, it's got morals, it has this.
- 33:58I don't know of any certification like that that says, our model equivalent to having like secret or top secret clearance in the military.
- 34:06When I had clearance in the military, was, you know, you could be trusted with this information to do this and ~ this type of sensitive work.
- 34:14Where is that real accreditation for the AI that's happening now in these different levels?
- 34:18~ I love the productivity gains that I get from it, ~ but I am really nervous
- 34:24about how it takes actions on its behalf to do things that it shouldn't.
- 34:28we're seeing OpenAI attacking other companies and you're seeing Claude breaking out of sandboxes and you're seeing all this stuff but there's a bit of capability and that's a
- 34:38bit scary.
- 34:39At the same time, I'm so glad that I can now write reports better.
- 34:43can QA it.
- 34:44I could have it checked to see if I had a not just a grammatical error, but a reference issue.
- 34:48It's now referencing something ~ that you shouldn't from a legal perspective, or you're missing this element in this deliverable in the SOW and you really should ~ cross
- 34:58reference that.
- 35:00I love it from a contract perspective.
- 35:01I get an SOW from one company
- 35:04and I get another version and I'm like, I'm not reading 50 pages of this and trying to figure out what's
- 35:09difference, nor do I want to spend $300 an hour sending it to an attorney to do a contract read.
- 35:14Can you just do a diff between the two and use some logic, not just wordsmithing, hey, this word is different than this document.
- 35:21That's rudimentary.
- 35:22That's been around for a while.
- 35:23But some kind of critical thinking that says this indemnification clause isn't as solid as the ones I've seen over here or meets this other standard and just reduces our time to
- 35:34help our customers instead of spending five, six days trying to get an S.O.W.
- 35:38approved or get a master service agreement approved.
- 35:41~ Why can't we use those AI models to reduce the risk and move forward with that quickly?
- 35:47So I see those kind of benefits at the same time, this automatic decisions that occur and the outcome of it is just a little bit scary.
- 35:55That doesn't seem to have too many ~ humans in the loop as they should be.
- 35:59I don't know.
- 36:00what are your thoughts?
- 36:01No, I I I agree and I think ~ we're trying to figure it out on the on the fly.
- 36:06And ~ I think the the points you you break you make are ~ are right on.
- 36:12I think we need some kind of guardrails and some kind of control and and ~ but we don't want to stifle innovation.
- 36:17it's a sticky thorn and sticky conversation that ~ I'm sure we'll be talking about for the next ~ year or so.
- 36:25Yeah, and it's not just the AI models, but it's also the robotics and how advanced that's getting where you actually have robots that can walk around and you can see them sorting
- 36:33packages now for Amazon.
- 36:35So you don't have humans that are sorting packages anymore.
- 36:38And just the disruption that's going to have to the economy, to the workforce.
- 36:42~
- 36:43were you telling these junior people that are trying to get out?
- 36:46My daughter, for instance, is a animator, 2D animator.
- 36:49And what she's finding out, it's hard to get intern positions.
- 36:52know, people are using different tool sets.
- 36:54They don't need these young people to do internships the same way with computer science.
- 36:59And it almost seems that ladder that connects the entry-level intern into the middle-level experience, two, three years, is much harder than it ever used to be.
- 37:09Those legs at the end of that ladder are kind of missing now because of
- 37:12Okay.
- 37:14I was I
- 37:14was speaking to a a young woman who just graduated from college and she had a marketing and communications degree, had a number of internships in in ~ her career in in college
- 37:25and was struggling to find ~ a marketing role and a lot of it was you don't have the experience.
- 37:30You know, I I kind of flipped the script sc script a little bit.
- 37:33I I've instructed my team.
- 37:35I I want to have recent college graduates for a number of reasons.
- 37:38One is I think they've come up through
- 37:40A different age than we have and
- 37:43have a great perspective.
- 37:44They're much better in the digital and and ~ digital marketing and and leveraging you know the tools that are that are out there.
- 37:53It's just more prevalent for them.
- 37:56But I worry that who's our next leaders, who's our next generation?
- 38:00the people that are gonna take the roles?
- 38:01Because AI is not gonna replace everything.
- 38:04~ I think sales is a great example.
- 38:06~
- 38:07I I will never buy from a robot.
- 38:09I won't buy from I'll but I'll do a lot of research and leverage AI to get me as much information I can, much of the competitive environment.
- 38:17But I want to talk to a human before I stroke a check.
- 38:20And if you don't have those, you know, SDRs or BDRs or you know marketing analysts or RevOps folks that are coming in, then we're gonna have five years from now a real gap
- 38:35between
- 38:35the senior folks and and ~ the folks that ~ need to take on those new leadership roles.
- 38:41So I I've seen a switch in some of my peers and and folks that I talk to that are in certain roles looking to bring in, you know, more junior folks to build them up.
- 38:55And ~ you know that's something that I think is really important.
- 38:58Yeah, no, absolutely.
- 38:59Especially when we're making decisions that impact a certain customer.
- 39:02they're like, wait a minute, that's one of our largest customers.
- 39:05They had sensitivity because six months ago we did this and that didn't work out.
- 39:08We should take that into consideration.
- 39:11I like the, use AI a lot, especially when doing incident response.
- 39:15And there may be some process or some software on a machine that I don't know what that is.
- 39:19I've never seen that
- 39:20before.
- 39:20And I can spend a lot of time trying to Google it and look up some manuals and try to figure out what that is.
- 39:25Or I could just ask copilot, Hey, do
- 39:27know what this is and yeah this is standard part of the Windows library that comes with this software.
- 39:33Okay now I can move on to something more important to include log files too.
- 39:37I'll have where we're doing firewall logs off an ASA firewall for instance and there's 20 gig worth of data that we have to go through.
- 39:45Now it used to be you'd have to separate it out, throw it into a database table, try and write some queries, go through the data.
- 39:51Now you can have Claude process that and say give me some statistical analysis of what's going on.
- 39:56what protocols are being used, what do you notice?
- 39:59And there was one incident where there was this process that I didn't know what it was, but it hit, its hit counter was increasing at the same rate as another software process.
- 40:09And Claude said, Hey, I'm not really sure what this is, but I do notice its hit rate is incrementing at the same rate as this other piece of software.
- 40:18Okay.
- 40:18Well, that's interesting.
- 40:19And I went and looked at it.
- 40:20Yeah, there was some correlation it was using.
- 40:22Never would have caught that with my eye.
- 40:24I never would
- 40:24have gone through and seen
- 40:26all these different log counters and said in any kind of correlation towards it.
- 40:30So I see it does a tremendous job on things like that.
- 40:34And it took the firewall logs built out an Excel spreadsheet for it said these are your top VPN users.
- 40:40These are the top IP addresses that are getting hit.
- 40:43Now I have something that's actionable instead of spending eight hours trying to just put that data together then trying to figure out what to do.
- 40:50It just did a tremendous job of just getting to the crunching of that information.
- 40:55I can have a decision point to make, right?
- 40:58~ And I think that's a phenomenal use of it.
- 41:01Yep, no, absolutely.
- 41:02And so, ~ interesting times.
- 41:04when I made the decision to come on board and you know, personally I was like, there's no way I'm gonna miss this run.
- 41:11I don't know what's gonna transpire, but you know, I came up through the internet boom, I've been through a a lot of ~ a lot of the excitement within technology.
- 41:19But nothing is more exciting than what the world we're in right now.
- 41:23And ~ again, going back to we can't predict the future, but I think the future's gonna be pretty exciting and bright.
- 41:28And the the changes that have already happened in a short amount of time, think about where we'll be in in five years.
- 41:34And some people think it's scary, I think it's exciting, and I I didn't want to be anywhere but in the mix and and ~ so you know, I think it sounds like you're in that same
- 41:44boat.
- 41:44I am.
- 41:45I'm very optimistic about it just for the fact that I'm able to do my job and stop cyber criminals quicker and faster.
- 41:52But at the same time, they're using the same platforms ~ against it.
- 41:56So it's kind of a we all have nuclear weapons from that perspective, from an AI ~ ingestion.
- 42:02But I think there's also some real concern when you have the CEOs of the company saying that we're all going to die from it in 10 years.
- 42:11I mean, I was asking, is that hyperbole?
- 42:13Is that just scared?
- 42:14tactics when they say we're all going to die.
- 42:16We really talk about Terminator 2 here and should we have the AR-15s ready to battle the machines here?
- 42:23I don't know.
- 42:24Some people really lined up to this.
- 42:25If you're having robots replace jobs and walk around the street and have the ability to have artificial intelligence, I don't know.
- 42:33It could be scary to a lot of people.
- 42:35Yeah, ~ not to get into it too much, but I I think ~ the the folks that were beating that drum, it was a bit self serving.
- 42:43And if you look at ~ the duopoly potentially that they wanted to create, they were I think trying to manipulate the the system a little bit to get that regulation.
- 42:52If you have regulation, you're not gonna have regulation on a hundred companies.
- 42:55You you might have you know, kinda going back to the the days of ATT and that where you have you know one or or maybe two companies that control control it all.
- 43:04So
- 43:04~ I don't believe we're gonna be extinct in in twenty thirty.
- 43:09~ but I do think going back to our the conversation we're having before, it's a responsibility of those CEOs and and leaders of those companies to make sure that ~ they
- 43:20put those guardrails on and and develop and ship products that aren't gonna destroy the world.
- 43:27that's kind of a that's kind of table stakes.
- 43:29And so ~ what should every CEO have on their risk dashboard that they probably don't today?
- 43:34Do they have risk management on their AI platforms?
- 43:38mean, I don't think they do as much.
- 43:41I think I think that's
- 43:42why, our business is is doing well because a lot of the opportunities that we have are greenfield.
- 43:47Companies that have been doing it the old way.
- 43:50you talked about the paper and pen or internal and so leveraging capabilities and tools like ours, we're not the only one, but there's a lot of good companies that provide that
- 43:59insight and information.
- 44:01~ so I think having that and I it it's not so much the CEO, I would say the CSO, but the C CEO listening.
- 44:10To his threat intel team, his chief security officer.
- 44:13And I think that's what's really changing.
- 44:16And and ~ making sure that ~ there's an open-mindedness at the top and a ~ seriousness about the information that's coming in.
- 44:25And you know, the proverbial sti fish stinks at the head.
- 44:29~ and so if the CEO is ~ leading from the front on that, then the rest of the company will follow, and I think that's really important.
- 44:36Yeah, yeah, absolutely.
- 44:38what is the real key differentiator between you and your competitors that I can really focus on?
- 44:42I can say, okay, SeeRist is the right because of this.
- 44:45Yeah, so ~ a lot a lot of companies can ~ use open source intelligence and we do that, you know, the X feeds, all the different we have we use fifty thousand different sources ~ as
- 44:58far as in collecting information.
- 45:00What we have that others don't is that human verified, human curated, validated ~ analyst over fifteen plus years of data.
- 45:09So control risk, which is our ~ our partner,
- 45:13And our majority shareholder is a global consultancy that's been around for 50 years that ~ focuses on not only physical security but cyber defense and and provides ~ consulting
- 45:26services in the threat intel intel world.
- 45:29And so we leverage their data that has been, you know, forever.
- 45:33It's an exclusive data.
- 45:35You can't get what we have anywhere else in the world.
- 45:38You can't get it on the web, you can't get it from them.
- 45:40And so when you couple
- 45:41The open source intelligence with our human verified human in the loop, you correlate that together, ~ there's no one who has that.
- 45:48And so what that gives you, especially when we have a an AI bot, if you, if you will, called Askana, which you can type in information and ask about, you know, well, how's
- 45:58Mexico threat level or what have you, it'll give you information.
- 46:03The difference between what we do and a Claude or or some of the frontier models is that
- 46:08We have no hallucinations, we have no false positives, and it's a hundred percent accurate.
- 46:13And we don't have time to go into why it's a hundred percent accurate other than this information is been curated and validated for fifteen plus years.
- 46:22And when percentage points matter in threat intel, because you can't be wrong.
- 46:27And so we actually ran a scenario where we put all the ~ frontier models, the ones, you know, that out there, and then we put our our own Askana out there.
- 46:37And ~ we just blew them away with accuracy because Claude will answer a s a question, even if it doesn't have the answer, it'll make up something.
- 46:48we
- 46:48have orchestrated and built our product so that it can't do that.
- 46:52And so, you know, the the biggest thing is that protective mode, if you will, is that ~ the open source intelligence, the years of experience, but also the the human verified ~
- 47:02data.
- 47:04Yeah, that makes a lot of
- 47:05sense.
- 47:06How do you get Intel for Somalia?
- 47:08They can't have many different data sources for there.
- 47:11That's not class.
- 47:12be surprised.
- 47:13So we we do have a content team that their sole job is to source the world for unique content.
- 47:19So it could be, and I don't even know that this is a thing, but it could be the Somali News.
- 47:24~ it could be the local reporting.
- 47:26So there's there's plenty of data, but we actually have a team dedicated to scour the world for that intel that isn't readily available to feed
- 47:35our models.
- 47:35Yeah.
- 47:36Well, one example, when ~ Russia was going to invade Ukraine and they released intelligence that they knew the Russians were going to invade because they started moving
- 47:44packs of blood towards the front line.
- 47:46And that was a huge indicator, red flag of their sending soldiers over.
- 47:51They're anticipating casualties.
- 47:53They're going over.
- 47:54That's ~ a perishable commodity that you don't just send packs of blood there if you're going to fake an invasion.
- 48:01So I'm sure you have indicators like that from a risk management perspective that are higher up.
- 48:06on the chain.
- 48:07if you see this type of risk, this is weighted so much higher than any of this other stuff and it should be actionable to you.
- 48:14Yeah, and that goes back to the, establishing that baseline.
- 48:17Because if you have that baseline, you have the historical context, if you see blips like the the blood being transferred, you know, to the front lines, okay, that that tells you
- 48:27something.
- 48:28if you don't have that established baseline, it could just be another data point that you might might miss.
- 48:33So ~ yeah, absolutely.
- 48:35Well, Alex, this has been a great conversation.
- 48:37I really enjoyed talking with you about this.
- 48:39Where can we find out more information about SeeRist and everything you do and what's coming up in your neck of the woods.
- 48:45b the best way to go is go to our website at www.seerist.
- 48:49It's S-E-E-R-I-S-T dot com.
- 48:52And you can see our platform.
- 48:55~ you can book a demo.
- 48:57And we also have a lot of information and and free information on ~ analyst reporting.
- 49:02I'd also follow us on LinkedIn and follow our Twitter because we do a weekly ~ threat assessment and you can sign up for that, it doesn't cost anything, and we'll we'll give
- 49:12you this week was about ~
- 49:14~ Riyadh and and some of the the the challenges in the in the Middle East.
- 49:19But it's a weekly update newsletter, if you will, that gives you kind of the threat intel.
- 49:23So it's a it's a slice of what we do, very small slice, but ~ that's where I would go.
- 49:28Go to our website, follow us on LinkedIn, and ~ there's a lot of good content that we provide for
- 49:34Yeah, and from a customer perspective, I would have to give some of my data to you, right?
- 49:38To be able to curate that and combine that with your stuff.
- 49:42~
- 49:43some do, ~ and that's actually something that we're doing with our MCP server, but you know, it's we're providing the information and data.
- 49:50What they do provide is their assets.
- 49:52So one of the things that we just launched is ~ you have you look at the assets.
- 49:57So we we build out the capabilities, so all the locations, all their assets, and that's how we we ~ work with our our clients so that we're not giving them information on a city
- 50:09that they're not in.
- 50:10So we build that with them and that's really the and then the rest is ~ working working with them as they're looking strategically at where they're going or what they they might
- 50:18be doing.
- 50:19It's fascinating.
- 50:19I'm definitely gonna go sign up for your newsletter here.
- 50:22I want to be able to hear that information.
- 50:24And it sounds like you guys got a great product and a great niche that needed to be improved.
- 50:29And so great that you have that mindset and that companies has got this vision to go and address that.
- 50:35Glad to have you on the show, Alex.
- 50:37And just to all our listeners, make sure you go check out his site.
- 50:41Don't forget to hit that subscribe and like button.
- 50:43If you have any questions for him, just put that in the comments.
- 50:46and everybody stay secure.