Latest / Prompt to Prod / AI Hasn't Changed Incident Response | Prompt to Prod - with Kyle Smith

Transcript

AI Hasn't Changed Incident Response | Prompt to Prod - with Kyle Smith · Prompt to Prod

• Kyle Smith: AI hasn't really changed incident response. it it just hasn't. Yeah, it forces us to act faster, but again, it's the same data that's stored, processed, and transmitted. There's still phishing emails. There's still you know, malware at ingress, like you know, websites can still be taken over. It just happens faster. Aaron Mog: they are anthropic as Visa and OpenAI is MasterCard and Google is is Amex in this situation. get in a damn room and figure this out and stop complaining about the problems that you're creating. Hey, everybody. Welcome to Prompt the Prod podcast. I'm your host, Aaron Mog. I'm super excited that everybody's here listening to us today. great guest on the on the pod today, Kyle Smith, who been known for a while and known of for a while, and really interested in in what he has to say about where we're at with AI and instant response and his role and everything else. So, first of all, Kyle, thank you so much for being here. Appreciate you taking the time in. Kyle Smith: Yeah, absolutely. Happy to be here. Aaron Mog: So obviously people can find you on LinkedIn or whatever and learn more about you, but maybe you could give us just a a little bit of history on your, you know, role in cyber and kind of where you're at today. Kyle Smith: Yeah, so right now I serve as a manager of cyber incident response for a hospitality company. although I've been in a lot of different roles in cybersecurity and IT in general. started out in retail clothing industry, moved to medical certification, industrial supply, higher education, then healthcare, and then finally in hospitality now. So I've seen a lot, done a lot. I I like to joke that I've seen a lot of weird i in my career, across a lot of different industries, but What's interesting about it is although I've worked in infrastructure, help desk, server engineering and in compliance and now an incident response, as much as things are different, a lot of things are are the same too. So, it it's kind of comforting in a way. Aaron Mog: Yeah. Yeah, there's nothing new, right? It just comes back around. yeah, it's funny because I came up doing a lot of IR too and and it's always been weird, right? It's always been like, you know, you got your go bag, anything can happen, you know, working big breaches, working anonymous ops, like all these things I've done in my life. I think AI is about to make it weirder. but like, you know, in your kind of day-to-day life, you know, and and one of the things that I I saw recently is you gave a a talk about know doing incident response in the era of AI and things like that, which I I everybody should check out on your LinkedIn. I think it was at one of the universities, was it Kennesaw? Or did you do that? Yeah. I thought it was Kennesaw Kyle Smith: Yeah, can I start state? Yep. Mm-hmm. Aaron Mog: State. so that's great listen. Everybody should listen to that. Obviously you're gonna go much more in depth there than we will during this pod, but I would love to sort of just you know listen to you on where do you think's happening right now in IR? Like how are you feeling about it? Is it sort of you know do it day to day in a real live environment not from a vendor perspective. So how are you thinking about We're right. Kyle Smith: Yeah, i as much as this might be contrarian to the AI environment, I mean, IR hasn't really changed. primarily because the data is the same. The regulations around that data is the same. ultimately, AI just kinda gives a different context as far as how that data is stored, processed, and transmitted. And overall, it's just another tool. So, like from an incident response perspective, a lot of what my focus is is on How do we keep our processes general enough to where companies don't say, what do we need to change for AI? And it's like, we really don't. We just need to understand where we need to move faster. We need to understand what kind of actions that the users are taking within an organization that that either might put data where it's not supposed to be, or you know, the the shadow IT activities that are happening that, you know, make it more difficult from an incident response perspective to look at, say, like, logging or user access, that kind of thing. With that being said, it does force us to work a little bit faster, of course, given the fact that AI has shifted the economies of scale of what threat actors can do. so, there used to be a golden rule of cybersecurity and overall of IT is, you know, never spend more protecting something than what it's worth. And then there was the other side of that equation that threat actors had to pretty much follow of never spend more money than the thing that you're trying to attack. but given the fact that, there's so many tools out there and even in the advent of AI where, essentially tools have become essentially free, we can't rely on that side of the equation anymore. So, overall I see incident responses where, you know, we we just have to operate faster. and I I have a lot of thoughts on that that I can go into to give additional context, but you know, I I definitely want to give you the floor to to answer any additional questions Aaron Mog: No, it's Kyle Smith: you got. Aaron Mog: it's fascinating to me because, I think the draw, right? A lot of the draw of AI is velocity and do more with less and sort of that. But there's also, and I just had somebody that I was talking to about this about there's also for me a little bit of terror around patience. because you know, noise is our friend in the world of IR, right? Noise is how we sort of fish for our prey or whatever you whatever terminology what it is. And a lot of that was impatience on the threat actor side or the inside actor or person stealing data, whatever. It's like people get really impatient and that's where you screw up. That's how it works. But in the world of AI, it's like, well, I can build agents that attack you over the course of six to twelve months super Kyle Smith: Right. Aaron Mog: slow, and I'm not wasting any time on it. But you know, and that's an interesting dichotomy that is new to me, where it's like I just always count on the fact that. Hey, there's more network traffic here than there was yesterday. Let's look. that's how I found stuff. So in your world, you have the corporate overlords that are like, do more with AI, go faster, build faster, and and then you have the threat exercise things. how you you said you had a few things that you're thinking about. what would those be? where are you at with? Kyle Smith: Yeah, a a lot of what companies are going after is like try and move faster with AI, we want to compete with other companies, to your point, and ultimately they they want to utilize this new technology to operate more quickly and try and save money and that kind of thing. But I what I think a lot of companies lack in their approach to it is that they're lacking the human psychology behind it. So what that intends is like, yes, I mean AI is pulling from a lot of different data, but at the moment, and I'm not saying this is gonna be forever. But AI is pulling from an average so and giving you the distinct average response of what you're asking, to essentially make that the best response that you could have at any given time. but especially in cybersecurity, I mean, your response to things are nuanced. It's gonna be like that might have been the greatest decision for the grander swath of incidents that you might run into, but there might be some nuance of like You might need to respond to the user in this way, or you might need to blog this particular IP for other reasons, or you may want to report a domain to security vendors to make sure that they market as malicious because of other threat actor activity. Like these are the decisions that we have to think about from like a a human perspective to add that nuance. But there's also the aspect of reputational. So newer generations of people, I mean They can spot AI in no time flat just because they're they're more attuned to the technology and how it's being used. And it it's putting a lot of people off that are younger generations. And the the way that I kind of think about it is I I'm not sure if you're familiar with the the movie Final Fantasy The Spirits Within when it came out. And like it was one of the first full movies that was supposed to like photorealistic people. throughout an entire film and a lot of people were talking about the Uncanny Valley where, you know, you had real looking characters acting throughout a whole movie and it wasn't just cutscenes in a video game. And it looked great, but it just kind of fell off. And I think that's still kind of where we're at with AI, not only with like what people are being presented with, but also like with attacks, defenses, like just about any and all aspects of AI. And it's getting better. But when it comes to incident response and and reputation, the thing that I've been fascinated with the idea of is that there's this concept. it's a service recovery paradox. And what that entails is there's a psychology behind the fact that customers when they've experienced an adverse issue from a company like you know, a customer service issue or otherwise. If the company recovers well and kind of makes that customer whole in a way that satisfies them essentially, they'll trust that company more. So one of the prime examples of that is like an airline that overbooks a flight, right? So they then give the the people that were displaced a voucher for, you know, ideally more money than they spent on the flight so that they can then fly somewhere else. and ultimately what that can sometimes and many times inspires the customer to do this is to say, they made this right for me. I'm inspired to fly with them not only for this voucher, but in the future as well. In my mind, the same can be said of incident response. So where my brain goes is while you know you've got Mythos that is out there finding vulnerabilities and can exploit them and that kind of thing. Ultimately businesses have to move so fast that it can Either cost too much money to try and protect all that and run systems in a hot hot configuration, for example, where they're paying double for infrastructure to be able to patch more quickly and safely. and so just using that as a as an example, you've now got businesses that really need to be focusing more on the reactive aspect of of cybersecurity incidents and and PR and everything like that, where if If you accentuate how fast your incident response teams and communications teams and legal teams can move when there's an incident, and be able to show customers the goodwill that there is in fixing an issue and performing well in a cybersecurity incident, in theory you can drive further con consumer trust because of the fact that you are able to react so quickly in an issue and you showed that you are prepared if something like that were to occur. And that's not me saying that we don't need to do our due diligence and due care as far as protecting our systems. It's more that there's an opportunity for us as businesses to prepare not only from a proactive but a reactive standpoint and essentially make it to where our teams can respond more quickly and keep that consumer trust. Cause ultimately, like customers understand that cybersecurity incidents happen. you know, even looking back at I believe it was twenty thirteen targets incident that it's like somebody got in through an HVAC system and got into card holder data, and that ultimately resulted in the, by my understanding, the PCI DSC having conversations of all right, everybody needs chips on their credit cards. And then, you know, that rolled into you know that being enforced by the PCI D S C by having merchants being forced to update their credit card readers. Like and so a an incident that occurred at Target then becomes something that enhances the industry as a whole and it essentially it ends up being like a a positive story overall because of all those advancements. So those are the things that that we should be thinking about in in the advent of AI is like how do we use adverse incidents that occur at companies as unfortunate as they are and use it to empower ourselves to be better at reacting to things. Aaron Mog: That's a super interesting paradigm because I I don't really always think of IR as customer service, right? It's because it's so it's such crisis mode stuff, right? But I think your point's super valid, done well. I so I grew up, working breaches as a vendor, and the expression was always never let a a good breach go to waste, right? that's the moment to sell them stuff. That's the moment that they can go get money to improve their program, which Theoretically is a net positive from a it's like losing weight after a heart attack or something. It's like, yeah, it happened, but it like I changed my life because of it. It's is the way it goes. But that was always opportunistic in the sense of let me get more people, more bodies, more money, more tools, using targeting as an example. you and I know they they use that incident to create one of the best security teams on the planet, right? And Kyle Smith: Mm-hmm. Aaron Mog: they definitely didn't let a good crisis go to waste. So, but as a as a a day-to-day customer service function, which makes sense because you work in a very customer service driven high-end company that, values that that's super interesting as an as an think something AI superpowers. So what does that look like? what how do you is that better communications? Is that investigations are just faster? how do you how do you make great customer service with AI? Kyle Smith: I I think it's just more a question of how do you use different types of tactics to better your partnership with the organization. So my focus in in my undergraduate studies and graduate studies was not only IT management but also marketing. So a Aaron Mog: interesting. Kyle Smith: a lot of what I learned was like brand management practices, sales practices, like ways that you can connect with your customer base and your stakeholders. And One of the most powerful things that I've I've taken as a lesson is like brand management practices translated over to cybersecurity practices. and I mean these are things as simple as like customer perception. one of my favorite examples in in a book that I've read is like the old Betty Crocker cakes that come out of a box. Where when they were initially released, you could just essentially pop it into an oven and it was done. but Customers felt guilty about it. And the reason being is that like people would say, you know, this is great. Like, did you make this yourself? And they couldn't say yes because like they just got it out of a box. So like what Betty Crocker ended up doing as a company is they made it to where you had to crack an egg into it just to add that extra little bit of effort and get that customer acceptance of, hey, I did this myself. And like it it's things along those lines and those lessons where you could apply the same to cybersecurity where it's like, how can you have these discussions with users about how to do things better? How can you tell them a little bit about what cybersecurity incidents are happening in various different environments and empower them to say, Hey, I know about this. This is how I report this, or this is how I can protect myself. This is how I can protect my team. Like and not only that, but thinking outside the box of where cybersecurity teams can assist as well. So like How do you partner with your legal teams and your global IP teams to to action site takedowns or you know, typosquatting, that kind of thing? you know, how can you partner with your marketing teams to maintain brand standard and like the domino effect of you know, if anybody's hosting web content that isn't well managed and what that can do down the line of like emails getting yanked by email security? Like th these are the the kind of things that can happen across like any different type of technology that you're maintaining. And being able to have those conversations from a standpoint of this is how we're servicing you as somewhat of a provider of the company internally and essentially having to sell the theory of InfoSec to the organization. And it it it becomes very powerful from that perspective in that like you you become less a team of no, we can't do that from a cybersecurity perspective. and more of a team of partnership to say, this is how you do this right. Aaron Mog: So I found my I do a lot of marketing go to market things in my life. I've I've found that to be an incredibly useful part of AI because it speaks the language of marketing and and brochureware and it's trained on corporate bullshit, right? So it's very good at making those types of things versus maybe some other things. And so I I do think that's a tremendously under valued or overlooked part of cyber is like that is one of the complaints that you get about our industry, is like we don't communicate well. We don't sell right right inside of organizations. in and if you have that marketing spin in your brain, AI is like a superpower with that, right? To write better decks, to write better board presentations. And it is something like I see a million startups around AI SOC and AI malware analysis and AI red teaming. And it's like, where's the part of this that helps you get better budget? Where's the part of this Kyle Smith: Mm-hmm. Aaron Mog: that helps you write better decks? Right. and so I think that's that's great advice. Do you find in your day to day life, is that somewhere you spend a lot of time on AI? Is like, I want to make this look awesome or or sound better or be bit more visually engaging versus maybe the nerdy or both, I guess. But like do you use it for that? Do you make things like cooler with AI, I guess? Kyle Smith: That's a really great question. I tend to use AI to enhance my skepticism, is how I like to describe it. So Aaron Mog: Okay. Interesting. Kyle Smith: w the way that I primarily use AI is to enhance points about AI. So, like for example, if I'm constructing a presentation about AI, I'll use AI based images to either enhance a point or to make a joke. reason being is that Given that AI is so scary for so many people, levity is key. in making sure that people understand that it's a tool. It's not meant, you know, to to be world dominating or anything like that. Aaron Mog: Yeah. Yeah. Yeah. Yeah, we'll see. We'll see how the end of the movie shapes out. But yeah, yeah, I got you. Kyle Smith: Right. but that being said, like there there are a lot of uses of it to to kind of add to the humanity of situations. but at the same time, like I I prefer to use it in such a way that it makes the lens of AI clear from my perspective and also from other people's perspective. So the the best way that I can describe that and mean by that is I myself l still like to compose my own emails. I like to compose my own reports. I like to make sure that, I believe all the research that I'm doing. And a lot of what I would use AI to do is instead to reformulate what I've written to match my audience. Or if my audience in particular wants to see AI being used, I'll use AI in the context of like having them see that I used AI to compose something so that they're seeing that I'm using AI. I know that seems off, but Aaron Mog: Yeah, interesting. Kyle Smith: but the the idea of it is essentially to use it to market myself a little bit better, and have the audience understand that like these are still my ideas and I'm trying to formulate this in such a way that it inspires more user acceptance. Does that make sense? Aaron Mog: Yeah, this is I would say outside of cyber when I talk to people who are is the thing, is the AI flex, right? Which Kyle Smith: Mm-hmm. Aaron Mog: is like I used AI to do to I like I I'm very obviously showing you AI is involved in this, right? you know, I ship five thousand PRs a day or this deck has all these AI images or memes or what you know, like I I think and I don't know if it's just cyber the kind of people who do what we do, like We're almost embarrassed of it. Right. I was talking to a startup the other day and they're like trying to hide it. They're trying to hide AI. And the expression I always use and then you go to market size is this needs more cowbell, more AI. customers want to see AI. They want to understand that you're using AI. And I suppose inside of corporate America, it's probably like that too, where there's a little bit of a yeah, I'm embracing this. Like it and even if it is a little showy, I It's funny that you have a marketing background because that that is a little showy for a cyber person, but I think in a really positive way of like I because that's where corporate America is going. Right or wrong, that's the hype cycle we're in. It's like AI all the time. And I was telling some the other day, like, you want to get fired quick, like walk around telling people their AI stuff sucks. Like that's Kyle Smith: Mm-hmm. Aaron Mog: not a good way to get ahead at this moment. So in in your world, like you'll I guess sort of baseline something, write a deck. write an email, whatever. And then you're using AI as a the amplifier or sort of a flex of like editing or whatever. Is that is that kind of how you're thinking about it? Kyle Smith: Yeah, and if I can be a little bit facetious, more of a garnish. 'Cause Aaron Mog: Right. No, that's perfect. Yeah, it makes sense. Kyle Smith: ultimately like what what that does for me is it it shows that I'm trying to stay open to using AI in in these various situations. But at the same time, I mean, I'll I'll be the same person that turns around and tries to champion the fact that like AI law hasn't caught up. and, you know, in the context of like a cybersecurity incident, I'm not confident that, a company would be able to maintain chain of custody if they run everything through an AI platform, for example, with regard to Yeah. and and Aaron Mog: I'm a hundred percent confident they get. Right. Yeah. Yeah. Kyle Smith: at the same time, you know, it's based on where the evidence is. I mean, you want to make sure that everything's legally admissible. You want to make sure that you've got the right people, you want to make sure that you're maintaining legal privilege, like all these different aspects that don't necessarily have Clear guidance from an AI perspective that are still going to require human interaction and like specifically sign off by a human to make sure that you're able to perform the actions necessary. So like while the ability to automate, you know, evidence collection, things like that is great from an AI perspective, that's the other side of it that like I'm always trying to champion and make sure that people are thinking about before they just go all in. Aaron Mog: So it's interesting because, that's sometimes the part of incident response, especially, corporate incident response that the world doesn't necessarily always understand is some of this is evidence driven, some of this is fraud cases and cider trading cases. And we do a lot in IR, right? It's not just, bad guy in Russia hacking me, stealing my shit. it's it's that. There's so little precedent. around AI. even in IT in general, we always struggle with even when cloud came along, it's like, how do you maintain integrity? And all these people can touch it and it's a vendor. And there's always these things. Even I remember even going to cloud-based email. I remember lawyers being like, we can't promise that nobody's altered this because it's at Gmail or whatever. And we got over it, courts ruled we got to the point where yes, Google can change their email, but they did. Right. So we're okay. We don't have that at all with AI, right? If that's does that do you find yourself then downshifting to more manual traditional processes if it is something that may be introduced as evidence or or could be related to a court case at some point? Kyle Smith: from the standpoint of incident response and just in general, I mean I think the the key is making sure that there are decision points when those key events happen. So like when I've had discussions about automation, my discussion whenever I'm a part of it is never how do I automate something from start to finish. It's more how do I automate the portions of the things that can be automated to the decision points where I need a human to say yes or no. And then from that perspective, be able to turn around and say, because we have a human at this juncture that's either cross checking this step to make sure that we've got the right data or the right information, or you know, somebody has doubly escalated something in the context of like a phishing email. 'Cause like I've worked in environments in the past that have a SOAR that, you know, tries to automate based on like intelligence that's in the platform to say, yes or no, this is a fish or this isn't a fish. Or yes or no, this is spam or isn't a spam. and then if it can't make that decision, you know, it either advises the user to enter another ticket or enters a ticket on the user's behalf to where a human has to look at it and be able to continue. I think those decisions points are still very powerful from the standpoint of like you're not trying to necessarily automate the whole process. You're just trying to get it to a decision point where somebody now has more time to be able to look at the the IOCs within. an email, for example, or they're able to look at the data and say, you know, yes, we're worried about this or no we're not. or, you know, that gives you the the ability to say escalate to your legal team and, you know, establish legal privilege on a conversation if it's a larger issue. Like those are the kind of things that I kind of see as opportunities, especially and I know I'm kind of exceeding the scope AI by talking specifically about automation, but AI is also applicable here too, is that you know, having something start to finish without human interaction, just can't happen in incident response. It can happen at the SOC level for automated alerts and such. Aaron Mog: Right. Kyle Smith: and I I think that's the the biggest conversation that I find myself having, not only in incident response, but cybersecurity in general, is making sure that, you know, when when you're looking into cybersecurity events and incidents and also just adverse activity in in general, that you're really looking at it from the lens of, you know, it might be that that one percent difference that, you know, causes you to look in a different direction and get to the right answer. Aaron Mog: So it sounds like, and I'm not gonna, you know, put words in your mouth necessarily, but like I I've and I talk to a lot of people about AI. There is a camp of people that are sort of like, now is the time to really define process, understand process, and understand architecturally where to implement AI in that process, right? Like that's the right way to do it. And then there are the and most of these are trying to sell you AI. That are basically going, just throw it at the model, get all the answers, big context windows, good prompts, good skills, let's go. the way that we did it in the past isn't true anymore because I've got this amazing thinking engine on my behalf. And I think obviously most people who are smart are in both those camps at sub-level. But do you think in IR right now, do you think people are getting ahead of themselves with AI? I guess would be my question. Do you still feel like I need to understand this process? Kyle Smith: think people are very excited about AI is is how I would say that. And I Aaron Mog: Right. Yeah, I guess that's what I mean. Yeah. Kyle Smith: and I think that it's and I've had discussions with people about this in the past as well, is it it's the same kind of excitement as software as a service when there were companies that were starting up with that and saying, Hey, we'll host everything for you and this service will just do what you need And it it also matches to cloud computing when that started becoming prominent when, you know, Microsoft came out with Azure and Amazon came out with AWS, so on and so forth. and there was a lot of excitement around it as far as people saying, well, I don't have to maintain hardware anymore. I can just host servers in, you know, a virtual environment in somebody else's structure, and you know, I'll just have to maintain, you know, depending on the the level of as a service we're going with, you know, either operating system level, s like machine level or, you know, only application level. And ultimately that large amount of excitement was great up until people started seeing the bills. And right. Aaron Mog: So it's all fun and games, right? It's also ready to check. Yeah. Kyle Smith: and you know, like when companies started driving up the prices and those bills started getting bigger, people had to start strategizing more. I think the same is gonna happen with AI as far as i it's gonna depend on the solution. Like Microsoft is trying to put copilot into everything so much that there are copilot instances within Copilot. which is problematic. but they're they're still licensing Copilot more at a level of like enterprise license keys as opposed to per token. Whereas, you know, you've got other platforms that are pricing per token based on, you know, the the processing that you're using. with with that being said, like the the pay as you go models with the the token use, I think there's gonna be a rude awakening with a lot of companies and there have already been some in the news where they're gonna realize how much it costs and kind of understand, you know, either we need to hire people back or we need to cut back on, you know, stuff for which we're using these tools and things like that. given the excitement around it though, I think there are a couple things that need to happen. for one, I think law and regulation need to catch up. as much as I feel that base control sets right now, you know, like NIST 800 171 and the grander NIST 853. you know, and of course like PCI DSS controls for systems that are in scope for that. HIPAA controls. I mean, all of those still apply in the context of AI because the data didn't change, as I noted before. it's just that people really want to use it and they really want to try and rely on contracts and and agreements to keep them protected. I don't know if that's gonna fully pass muster in you know, the context of PR and and otherwise if an averse event happens. my view is gonna be there's either going to be a landmark case either you know by way of a single company that has a major incident that causes people to have conversations. I thought the event with Amazon's AI that took down a bunch of AWS by taking down a bunch of systems and reprogramming them was going to that, but it wasn't really. I think it's also going to be like a class action lawsuit that that might end up being the the impetus of larger conversations. or, I mean it it could end up that, you know, like the the EU's AI laws that you know their either releasing or have released, forgive me, I don't have that in the top of my brain. but if it goes as well as GDPR has overall, as far as how that rolled out, I mean, yeah, there was some opposition to it, but overall I would consider GDPR as successful. those are the kind of things that that I think need to happen from an AI perspective to kind of quell people's excitement a little bit and be more realistic about it. Hopefully that answered the question. I know that was a bit of a long one. Aaron Mog: No, it's it's it's interesting because obviously, you know the environment today, right, as we're sitting here, is is is tough to envision what that looks like. Right. Because the labs are so powerful and the big companies are all incentivized to do it and the security vendors are growing so fast with the VC. Like it it's there aren't a lot of people at the table saying slow down. Like there just aren't. Kyle Smith: Mm-hmm. Aaron Mog: And and there's and it's also holding our economy up. There's a lot of of stuff going around AI. And a lot of that's falling on cyber people to navigate, right? I call it we're we're in the era of Yolo security, right? Which is like, I don't give a shit. I'm attaching this document to my claw chat. I don't care. we're self-breaching all day. I promise you, people in your org are every org I've ever seen, they're going to claude, they're clicking that plus sign, they're adding confidential data and they're chatting. they just are. There's very little that anybody's gonna do to stop that. So we're also not treating that like incidents, right? We're not investigating those things. We're not yelling at people, we're not yelling at our CFO to stop uploading financial declawed, at least not that I've seen anybody do. So we are still, in my opinion, more focused on adversarial because we can get our hands around it, right? the internal use of AI is, in my opinion, beyond most people most people's control at the moment because it's just going so fast and it's so violent. it, you talk about shadow AI earlier. good luck. Every vendor's adding AI, every vendor's using different models. Some of them are using overseas and Chinese models. what are we doing here? you know, I don't like it's hard to get your hands around. In your sort of world of, you know, waiting for regulation and sort of like being patient, like obviously that's part of it, but you can't always do that. You sometimes you gotta keep up with the business. Where have you found in your I guess where have the winds been? Where what have you done with AI? And you're like, that actually worked. I'm really happy with that. And then obviously I'm gonna ask you the next question, which is what was a disaster. So I'm just curious on in your day-to-day life, knowing that in the big abstract sense, you we aren't there yet. But what are you doing that you're like, yeah, that was that was pretty dope. Kyle Smith: Yeah, I think I if I can embellish a little bit, stuff like this, honestly, where having conversations about AI and trying to be a little bit more realistic about it, as opposed to you know, having the conversations to say AI will be the answer to all problems, which I've had those conversations with people as well. Aaron Mog: Sure, yeah. Kyle Smith: the the idea of just talking with people and adding realism into what AI actually is for companies, I think is probably the biggest win for me. 'Cause being able to flip that switch in people's brains of and I mean this this has been true of me for cybersecurity as well. you know, 'cause there there have been a bunch of folks that have come to me like in Laban's terms, like family, friends, that kind of thing, and you know, have come to me with like a cybersecurity incident and like, Do I need to be worried? And, you know, you have the conversation of, No, not necessarily, because it would have had to have been this, this and this and Aaron Mog: Right. Kyle Smith: you would have had to experience this, this and this. and so like being able to have the conversations with people about AI in the same context to say that, you know, like just be careful about how you use it. It's a tool. Like be careful about the data that you put into it because this is where that data could go. Like, I think those are probably the biggest wins for me at the moment from an AI perspective. 'cause it's challenging to talk about wins as an incident response professional. Because you're more concerned about what can go wrong. but Aaron Mog: Sure. So nature of our lives. Yeah, yeah, for sure. Kyle Smith: right. but at the same time, I feel like the the biggest win that I see when I talk about incident response with common professionals as well is and I mentioned it before, so there's a comfort in that as much as things change, many things are still the same. And for me, that's a win from the standpoint of like My skill set doesn't necessarily need to change. It just needs a few tweaks. Does that make Aaron Mog: Right. Kyle Smith: sense? Aaron Mog: Sure. Yeah. So, within the world of IR, right, in in you know, I'm sure in your role you get a million pitches from vendors trying to sell you AI stuff and you know, all that. You know, I come from the world of like forensics, right? We're like, it has to be that. It's that hash. It's this is the you know, the world, right? And AI is so non deterministic, right? And it's like getting the same answer. out of AI twice in a row is been my challenge with IR and malware research Kyle Smith: Mm-hmm. Aaron Mog: and detection engineering, all the things that I do. In in your world, is that like you know you're talking about the data being the same, but like, you know, if you're gonna move faster, one of the things you can do is throw a lot of data against a model or through a skill or through a harness and have it do at least part of an investigation for you. Is that something you're thinking about? Are you thinking about like harnessing models and and looking at data as a superpower for IR or you just don't trust it yet. Kyle Smith: From an IR perspective, because in my brain I separate out incident response and security operations center, primarily Aaron Mog: Mm-hmm. Kyle Smith: because Security Operations Center is more of a proactive function that you know is trying to weed out the noise to a point and actioning things that are easily actioned via quick procedures. smaller information security teams will combine those two functions, you know, IR and SOC, just because Aaron Mog: Shark. Yeah. Kyle Smith: that budget and also it it makes sense for smaller teams. from an IR perspective, it's it's one of those areas that I find difficult to be able to incorporate AI into a lot of the things that an incident response team specifically would do because it requires longer investigation to look for root cause, unless it's something that's like a larger campaign where you can, you know, can responses or or otherwise to, you know, i essentially, you know, fend off the wildfire. of questions about something while you get to the root cause. those are the areas that I think it helps most from an incident response perspective. where I find the biggest challenges from an incident response perspective, and I know that was a little bit outside of the scope of your question, but I feel like it goes hand in hand. Aaron Mog: Yeah, go for it. Kyle Smith: the threat actors are are using older tactics and making them better. And I I feel like that's that's the biggest challenge. And and it's the same as, one could say of Mythos finding, vulnerabilities that, have been around a long time. It just ha so happens that, they can be exploited in a different way or, in a different context in, a newer platform. Much can be said about incident response. I mean, Microsoft posted an article, I think in April, about device code fishing, for example, where threat actors were using AI to use a former device code fishing tactic, but make it more efficient and make it a lot more annoying for incident responders. those are the kind of things that worry me from an AI perspective. Because it's like you're defending from the same thing. It's just that it's made more efficient. So, you know, it's like a a campaign that somebody might have given up on in the past and an incident response team might not have been as actively alerting because they're more focused on more recent campaigns. It almost makes it to where some of those alerts that a team may have retired because they haven't seen that campaign anymore, or alerts that you know, seem like they wouldn't apply given, you know, newer systems and environments, we now have to think about, you know, do we really need to sunset or retire certain alerts? Like, should we? you know, should we put it in monitoring mode as opposed to alerting mode just to see if anything comes in? Like I I think it inspires those kinds of questions. Aaron Mog: Do you and I've I've heard this argument, right? So a lot of people who worked in and around the hugging face stuff and the and they know that animal gets out of the lab inside the frontiers and hacking and stuff like that. There's this argument. And again, I don't I feel like people telling me this are trying to sell me something, but basically you need AI to investigate AI. It's too noisy, it's too fast. Do you think you need AI to investigate AI? Kyle Smith: Not necessarily. I think it's more you AI can make it a little bit faster to find what AI has exploited. I'll give it that. I don't necessarily think you need AI to understand like your environment. I think it's more a matter of how many How many resources and how much budget do you have to have a mature information security team versus how much budget do you have to you know have a smaller team and supplement with AI to get yourself to an enterprise class environment? I think that's the bigger question. I think if a company has a larger information security team, they have the right personnel to be able to understand what kind of vulnerabilities are the environment and like the the gaps that are there and have those discussions with the organization about. which gaps can we fill, which which controls can we put in place either technologically or administratively? you know, what resources can we allocate to these things? How can we do things better? and you probably don't need AI as much for that level of maturity in a company. whereas on the flip side, if you've got like a a smaller, not necessarily mom and pop business, but you know, private company that doesn't necessarily deal worldwide or anything like that, and they're just trying to supplement their incident response program or even their cybersecurity program, I I think AI could be a very positive tool to to help give them additional context of, you know, what could be going on in their environment that they might need to address. without immediately having to order expensive pen testing, auditing, that kind of thing. not necessarily saying they don't need that. It just Will help prepare them to Aaron Mog: Right. Kyle Smith: have those larger conversations. Aaron Mog: Yeah, I think there's a a set of people, ideas, vendors, startups, whatever, that are thinking about, taking you, taking a Kyle Smith, turning you into an agent and then selling you to people who can't have you. and and I think there is an i it is an interesting pitch because, at the end of the day, experts are still today the best thing to have in the chair, but not having anything in the chair is a disaster too, right? So being able to up level with AI, I think is really True. I guess and it doesn't seem like you are, but there are a subset of cyber people who are terrified of what's coming. what happens when we add these superpowers to an already, you know, adversarial ace, you know, like they're already there's already that argument and I don't know how true it is that like if they want to, they're gonna get in, they're gonna win, you know, discovery and Detection is what matters because they're but you add AI to that. Now you're talking about really, really getting your ass kicked, right? And so in the in the world of AI driven threats and foam pocalypse, whatever you want to call it, where are you? I guess on the worry meter if you're like, it's overhyped, or is it like I think a wave's coming and I'm terrified? Kyle Smith: gosh, I'm gonna sound really blasé by saying this. I'm really not worried. it it's more of Aaron Mog: No, it's a it's perfectly valid opinion. That's what I'm asking. Kyle Smith: it it's more a concern that it it's being seen in the wrong lens is more my concern. in that like cybersecurity incidents are gonna happen and people understand that. It's much like with how credit card companies have been for a long time. And as you can probably tell, I'm pretty passionate about PCI just because I think it's such a great standard. Because like it's it's handled by the companies that that run it. they can make their decisions, it exceeds international boulders, like any and all things that that make it so great. They're there. But the the unique thing about how banks handle it now. And and I think cybersecurity incidents are gonna you're gonna get to that point is it used to be you know, having your credit card number stolen was just an act of a deity to try and recover from. you know, where like, you know, somebody would take your credit card, they would make a bunch of purchases, you'd have to try and get that money back, you may or may may not be successful. and nowadays there's so much data behind it that the bank will normally see that something has happened and say, Hey, we see something wrong that's gone on your credit card. If this wasn't you, we're just gonna Aaron Mog: yeah. Kyle Smith: cancel this, you know, roll back the charges and send you a new credit card and you know, no harm, no foul. I'm not saying there's no harm, no foul in cybersecurity incidents, but like given the way things are moving, I can imagine a world where the same thing happens with companies that experience cybersecurity incidents. they're they're gonna have enough data to say, there's been adverse activity. This is what we need to do. these are the identity accounts that we need to create for users if there was PII affected. these are the statements that we need to release. this is the statement that we need to submit to our in cybersecurity insurance provider, like essentially make it making it so canned to the point that like a company can recover quickly. Just like with how, credit cards have become. so I I more see it as a catalyst for how companies are going to operate during adverse events. But I think it's also going to result in a level of user acceptance of like, hey, this is the world we live in now. And I I feel like they're that level with like card holder data because people understand that somebody can walk past you in supermarket, gas station, what have you, skim your credit card, you know, try and make a couple of purchases, and you know, you're like, well, that's not great, but this is what has to happen and I'm just gonna get a new credit card, Aaron Mog: Yeah. Yeah. Kyle Smith: right? you know, and like I'll I'll give a personal example of like I had my card number stolen I I think by a skimmer, I'm not sure but it was right when the PS5 came out and I had made a pre order through PayPal, for a day one PlayStation 5, and it was through GameStop. So the reason I tell the story is that because my credit card was associated through PayPal and onto GameStop, they were telling me that I needed to contact the other to try and change my card number to be able to support that purchase. And so from a a customer standpoint, it's like I understood that my card number was stolen, but what I couldn't understand is why I couldn't talk to either company to change the card number that was associated to like that purchase. and I I know this is kind of like a long stretch to make this comparison, but I I think cybersecurity incidents have have started to become the same way where it's like people understand that their information is out there. They understand that that there can be breaches, and they understand that companies have adverse events. It it matters how we react. It matters how the companies associate events. and you know, the example that I'll give here is talk about the the CrowdStrike incident from a couple of years ago where they released a bad update that caused Windows machines to fail to boot. Because it affected the kernel level access. or rather, CrowdStrike had kernel level access and the update made it to where like the machines couldn't boot. Yeah. Aaron Mog: Right. Crash half the world. Yeah, I remember. Yeah. Kyle Smith: and the interesting part about that is Microsoft had to issue a statement because what customers saw was that their machines wouldn't boot. What they didn't necessarily initially realize is that it unless they were in cybersecurity or the engineering teams that were maintaining CrowdStrike. Those users didn't understand that it was, you know, an EDR problem rather than an operating system problem. so I raised that example to say that like you've got a lot of customers that are going to Microsoft going, What's going on? when Microsoft's like, It's not us, we swear. and Aaron Mog: It's not us. Yeah, that's a tough day for them. Kyle Smith: right, exactly. And so I think that's the thing that companies really need to focus on is like consumer perception when it comes to cybersecurity. Because the more focus that they put on the customers that that they're serving from an information security perspective as well as other stakeholders, I think it positions them better to prepare not only proactively but reactively. Aaron Mog: Yeah, I I couldn't agree more. I I I think I was in the first QSA class in the United States, and loved working on PCI. And I think it's the ultimate example of the best self governance we've ever had in cyber Kyle Smith: Agreed. Aaron Mog: by mile, right? Like they're so good and they align together even though they're competitors, not like I would love to see the frontier labs do something like that, right? Like a PCI type of initiative. where they're thinking through the problem space, how to gain consumer confidence. think of to your point, think of how little people think about that now versus when target happened. nobody cares. you get a text from your visa company this looks like fraud. Yeah, that's me. It's not me. If you get fraud, you issue new card right away, it comes without you asking. they have dialed it in. But part of the reason they did that is the financial incentives were massive. Right. When you think when you look at how much money Visa makes and how much money MasterCard makes, how much money Am like it is in their interest. And I do I do not understand why the labs aren't doing the same thing to your point. Because it's in their in Right. I and I I Talk to AI experts all the time. And I'm like, I'm so exhausted with this argument of all these companies are running around starting fires and then blaming other people to put them out. Like you did this. Like you're the one offering mythos. Like nobody made you do that. So why wouldn't it be your responsibility? but I also think the other problem is like they're being sold this version of AI that doesn't come with the tax, where cyber is a tax on AI, like it has to be. So like you and I both remember how much companies hated paying for PCI on it and how much they hated remediations and building, cardholder data environments and all this memory like tokenization. What a nightmare that was. But it worked, it fixed the whole industry, right? Nobody thinks about it anymore. so yeah, Kyle Smith: Mm-hmm. Aaron Mog: I I a hundred percent agree that we need something like PCI in the AI world. so yeah, if anybody from Anthropic or OpenAI is listening, go talk to MX and Bisa and see how they did it. And or talk to RH ISEC, they're they're good at it too. so I I think it's great. I think within the world of IR, I'm curious. I know you just gave a talk about it to a bunch of people and things like that. Like in AI, in IR, like the actual day to day of IR, is there anything that you're seeing where you're like, that's cool or people should look at that, or like using a model specific way, or like if somebody's in IR and they're like, I want to use AI, like where where could they go? Where would you recommend they start? Kyle Smith: I I think the best place to start, honestly, would be looking for site registrations and, you know, trying to go for for takedowns. that's in my mind probably the the biggest use for the squeeze at the moment. 'cause ultimately, I mean, those are gonna be the the first areas of activity for somebody to, you know, create spoofing fish or they're gonna create fake websites to implant via SEO poisoning. those are the areas that you know can monitor for trends based on what people are purchasing. You can kind of track threat actors that are, you know, scripting site creations. Like I think AI would be really good for that area because it's it's an area that you know it is easy to kind of look out there and and check for. and I know that there are parties that are doing that. That is not my original idea. but that being said, like Aaron Mog: Sure, but it's a good use case. Yeah. Kyle Smith: yeah, and and there's there's no downside to doing that, I think is the key, is that you can monitor for these things and you can you know with assistance from your legal team, like as long as there aren't adverse effects on, you know, the amount of requests that submit, like you could automate DMC re or DMCA requests, you can automate site recategorizations. You can automate all these different kinds of things if if sites are malicious. It and then, you know, based on the responses that you get back, you can then action them from a human perspective. So, you know, it's like, you know, site owner doesn't agree that they're violating any trademarks or or anything like that. You get that response back and then your legal teams can say, Yes they are and here's why. So there from that standpoint there's not really a downside to doing that and there's not really an area from an incident response perspective where, you'd be necessarily taking that to a courtroom aside from, for the love of all that is holy, just take the site down. but like Aaron Mog: Yeah, no, I yes, I agree. Yeah. that's a great Kyle Smith: but the the Aaron Mog: idea for an agent. Yeah. It's a really good idea. Kyle Smith: And and that's the thing, is like it's stuff like that where I think AI can be very powerful in that you really have to look at things that don't really have a downside. if if there can be adverse effects in, you know, AI overstepping or, you know, moving too far forward, you know, and putting the spaceship before the horse, like, you're you're gonna get to that point where AI's taking actions that you didn't sanction and ultimately like You then have to explain that to your stakeholders, your customers and otherwise. Aaron Mog: Yeah. So yeah, I think that's great advice to start with. Not that takedowns and domain monitoring are low impact because they could be incredibly impactful, but I think to your point, Kyle Smith: absolutely. Aaron Mog: they're low risk, right? versus like, you know, case management inside of a core incident inside your like and and I understand why vendors go there first because that's like there's RY there, there's money there, like you know, we're gonna do IR with you for you with AI versus a l lower stakes important thing like understanding internet data or, I saw one the other day. It was it was really focused on user counseling around fishing. you could provide the the email to an agent and it would say, Well, yeah, this is probably fish, right? because of this, this, and this, you should report. It was like it was just a little hook in the way of the user journey. It wasn't determining and it wasn't taking the place of a formal fish report. It was like a step between. It's like that's really clever. that's a great place to inject some AI. maybe you get occasional false positive, this isn't phishing, and then it is like that could happen. But by the way, help does does that all the time too. so probably about the same ratio. so I think that's really great advice. It's really cool. so people can find you on LinkedIn, people can find you I UN X or any other platforms. Kyle Smith: just professionally on LinkedIn for now. that Aaron Mog: Awesome. Kyle Smith: said if I expand other speaking engagements I I might create a professional profile otherwise, but just LinkedIn for now. Aaron Mog: Awesome. and I I'll link to that in the show description so people can find you. I did ask AI about you in one of these prep things that I was doing. It was like, there are too many Kyle Smiths. Can you be more specific? And I was like, Yeah, I because like you're Kyle Smith to me. You're like the Kyle Smith I know, but like it is it's a it's not a a rare name. So I'll link to your your LinkedIn in the in the show description so people can find you and give you a follow. you know, please don't connect with him and try to sell him something right away. you know, just it's good content though. thank you so much for making the time to be on, man. I think you have a lot of wisdom in this space and hopefully people get something out of that. And and you know, obviously they've got cool IR ideas or ways to use AI. I'm sure, you know, both you and I are all the years, post about it, send it to us. I'd love to read it. and thank you so much for taking the time in. Kyle Smith: Yeah, absolutely. agree with all your points and thanks again for having me. Really appreciated the chat. Aaron Mog: Awesome. Thanks, bye. Kyle Smith: All right, thanks a lot.