Latest / Full Tech Ahead / Manage Your AI Security Debt

Transcript

Manage Your AI Security Debt · Full Tech Ahead

• 0:19
  SPEAKER_00: Hello and welcome to Full Tech Ahead.
• 0:22
  SPEAKER_00: I'm your host, Amanda Razzani, and I'm so excited to be here today with Nitty Agerwal.
• 0:27
  SPEAKER_00: She is the Chief Product Officer of Hacker One.
• 0:30
  SPEAKER_00: How are you doing today?
• 0:32
  SPEAKER_00: I'm doing very well, Amanda.
• 0:33
  SPEAKER_00: Thank you so much.
• 0:35
  SPEAKER_00: Thank you for having me.
• 0:36
  SPEAKER_00: Yes, happy to have you on the show.
• 0:38
  SPEAKER_00: Can you share first a little bit about Hacker One and the services that you provide?
• 0:43
  SPEAKER_01: Yeah, sure.
• 0:44
  SPEAKER_01: Hacker One is a continuous threat exposure management platform, and uh we help uh the biggest companies to help find vulnerabilities and validate them and remediate them.
• 0:56
  SPEAKER_01: So it's the find to fix uh life cycle.
• 0:59
  SPEAKER_01: That's uh those are the services we provide.
• 1:02
  SPEAKER_01: Wonderful.
• 1:03
  SPEAKER_00: Well, our topic for today is AI and software development and all the cybersecurity risks that are new and have been introduced because of it.
• 1:16
  SPEAKER_00: But first, I want to give you a chance to share your news.
• 1:21
  SPEAKER_00: You recently uh put out a new product, so I'd love for our audience to hear about that.
• 1:26
  SPEAKER_01: Sure, thank you.
• 1:28
  SPEAKER_01: Yes, we launched our H1 platform.
• 1:30
  SPEAKER_01: Uh, it is the continuous threat exposure management platform.
• 1:34
  SPEAKER_01: And the problem, as you talked about, is AI is accelerating software development and vulnerability discovery, but remediation has not kept pace.
• 1:45
  SPEAKER_01: So, like most CISOs are not looking for more vulnerabilities.
• 1:50
  SPEAKER_01: Everybody's inundated with vulnerabilities.
• 1:52
  SPEAKER_01: In fact, we saw that on our platform in April, the report volume surged more than 90% following the release of all of these advanced AI models, and that forced a deliberate conversation about what quality actually means on the platform.
• 2:09
  SPEAKER_01: And not all AI assisted volume is equal.
• 2:13
  SPEAKER_01: So we had to really validate what is true exposure, what out of these all of these reports are the kinds of vulnerabilities that uh represent true exposure for you, which means that they can be exploited, and which ones are already stopped by your security controls.
• 2:30
  SPEAKER_01: And then how do you prioritize them?
• 2:32
  SPEAKER_01: And the ones that are prioritized for you, how do you actually remediate or fix them?
• 2:36
  SPEAKER_01: Because that's the real thing, right?
• 2:38
  SPEAKER_01: If you are not going to fix something, knowing the problem doesn't solve the problem.
• 2:43
  SPEAKER_01: So that's the H1 platform, bridges the gap between finding the risk and fixing the risk.
• 2:50
  SPEAKER_01: That's the defining platform.
• 2:51
  SPEAKER_01: And H1 platform is built for continuous discovery, validated exploitability, prioritized action, and remediation at AI scale.
• 3:02
  SPEAKER_01: That's what we launched.
• 3:04
  SPEAKER_00: Wonderful.
• 3:04
  SPEAKER_00: Well, that will certainly be helpful.
• 3:06
  SPEAKER_00: And I feel that that is a good segue then into that topic.
• 3:10
  SPEAKER_00: So, from your experience, what are some of the newer or more recent cybersecurity risks or challenges that business leaders are facing with the use of AI and software development?
• 3:24
  SPEAKER_01: So the whole cybersecurity paradigm itself was built on the premise that uh uh security vulnerabilities, once they were discovered, you had a little bit of time uh before they could be exploited, and you had time to remediate them.
• 3:38
  SPEAKER_01: But that paradigm itself has changed with AI.
• 3:42
  SPEAKER_01: We have something called the zero-day clock, which means that that is tracking how much time uh there is now between when a vulnerability is discovered before it is exploited.
• 3:53
  SPEAKER_01: That time has steadily gone down from it used to be about a month last year to a matter of a few hours now in this year with AI.
• 4:02
  SPEAKER_01: Because the moment it is discovered, it can be exploited.
• 4:05
  SPEAKER_01: In some cases, there are adversaries who've exploited vulnerabilities in less than 10 minutes.
• 4:11
  SPEAKER_01: So that's the scale.
• 4:13
  SPEAKER_01: And now you can do it at scale.
• 4:14
  SPEAKER_01: Everybody, every adversary who has an access to a model can try an attack.
• 4:20
  SPEAKER_01: So now you have to try and do your security defense also at machine scale.
• 4:26
  SPEAKER_01: You cannot operate at human uh speed.
• 4:29
  SPEAKER_01: So now defense has to operate at that AI offensive scale.
• 4:34
  SPEAKER_01: And with uh what we're seeing is the moment we are in is the cost of an attack is going down uh faster and faster.
• 4:41
  SPEAKER_01: It's almost coming down to zero.
• 4:43
  SPEAKER_01: Meanwhile, the attack surface is also growing uh really fast because uh recent surveys indicate that 73% of engineering teams now use AI coding tools daily, and AI-powered security tools are surfacing those vulnerabilities.
• 4:59
  SPEAKER_01: So now that remediation gap is increasing.
• 5:02
  SPEAKER_01: In fact, on our platform, we published this research that uh even as we are fixing vulnerability, the time to fix vulnerabilities is getting faster.
• 5:12
  SPEAKER_01: We can fix vulnerabilities now 80% faster.
• 5:16
  SPEAKER_01: The critical vulnerability backlog has grown 25x.
• 5:21
  SPEAKER_01: That's the gap that uh CISOs and organizations are facing.
• 5:27
  SPEAKER_01: So we need a complete redesign of our security architecture for this AI era.
• 5:34
  SPEAKER_00: Wow.
• 5:35
  SPEAKER_00: So what you're saying essentially too is we've got to fight AI with AI.
• 5:40
  SPEAKER_00: Yes.
• 5:40
  SPEAKER_00: Yeah.
• 5:41
  SPEAKER_00: So what is the the first place to start when it comes to better protection of companies and their software and and and their tools?
• 5:52
  SPEAKER_01: So the first place uh to start, I would say, uh, is do the basics right.
• 5:57
  SPEAKER_01: Take stock of what assets do you have?
• 6:00
  SPEAKER_01: Uh, do you know uh what assets are vulnerable in the sense of uh uh what is connected to the internet, what is your attack surface, what are the things that are uh most important uh to you?
• 6:13
  SPEAKER_01: For example, what are the crown rules?
• 6:15
  SPEAKER_01: And that is the first uh place to start.
• 6:18
  SPEAKER_01: Uh do an after doing the inventory for your code, uh have a static analysis of your code.
• 6:24
  SPEAKER_01: Uh do the analysis, what is my code vulnerability?
• 6:27
  SPEAKER_01: It's a defense in-depth approach.
• 6:29
  SPEAKER_01: Then move up the stack and say, how can I now see when this code is dynamically?
• 6:35
  SPEAKER_01: How do I test for that?
• 6:37
  SPEAKER_01: Then test it adversarially.
• 6:39
  SPEAKER_01: Okay, I've tested it defensively, but an attacker is going to use uh is going to test it adversarially.
• 6:45
  SPEAKER_01: How do I test it in that motion adversarially?
• 6:48
  SPEAKER_01: And do that continuously with AI.
• 6:51
  SPEAKER_01: Don't do periodic testing because the periodic testing was maybe quarterly or annually, that speed doesn't work anymore.
• 6:59
  SPEAKER_01: And then at the end, you still have to have like you do all of this with AI.
• 7:04
  SPEAKER_01: The ultimate test is how do you think like adversely, who is a human with powered with AI, right?
• 7:12
  SPEAKER_01: There is a human with AI.
• 7:14
  SPEAKER_01: That's where the ethical researchers, the security researchers come into play.
• 7:18
  SPEAKER_01: The security researchers are also adopting AI.
• 7:21
  SPEAKER_01: On our platform, we see that.
• 7:23
  SPEAKER_01: Like a lot of our uh most of our researchers are now finding vulnerabilities using AI.
• 7:28
  SPEAKER_01: That's the test.
• 7:29
  SPEAKER_01: Like, how are they uh testing your environment so that defense-in-depth approach helps you protect at multiple layers?
• 7:36
  SPEAKER_01: There is no silver bullet.
• 7:38
  SPEAKER_01: You have to use AI to scale, and you have to use human creativity and discernment to find the novel and edge cases.
• 7:46
  SPEAKER_01: And that those two loops have to work together.
• 7:49
  SPEAKER_00: Yeah, the human is still a very important part of the process.
• 7:53
  SPEAKER_01: Yeah.
• 7:54
  SPEAKER_01: The human cannot be in the critical path, but the human is very important for that uh creativity and the adversarial judgment.
• 8:03
  SPEAKER_00: Absolutely.
• 8:04
  SPEAKER_00: Well, so AI is advancing and it's evolving.
• 8:09
  SPEAKER_00: And so, what is the next thing that business leaders need to be on the lookout for and prepared for?
• 8:16
  SPEAKER_01: So, business leaders need to be on the uh lookout for one, the it's not about a particular model, right?
• 8:24
  SPEAKER_01: We hear a lot about this model or that model, this model has gotten this capability.
• 8:29
  SPEAKER_01: From now on, the models are going to get better and better.
• 8:33
  SPEAKER_01: We are in an era where most models, uh, right, and open source models or frontier models will have the capability to discover new vulnerabilities.
• 8:44
  SPEAKER_01: So we have to prepare for that world.
• 8:46
  SPEAKER_01: Um, it's uh uh so we have to prepare for a world where attacks will come faster, attacks will come at scale, and it's continuous.
• 8:54
  SPEAKER_01: So defense has to be continuous.
• 8:56
  SPEAKER_01: This is where to your point earlier: fight AI with AI.
• 8:59
  SPEAKER_01: Prepare for that world where you are defending yourself continuously, you are testing continuously, you are validating what is actual risk continuously, and then you are prioritizing continuously and then remediating continuously.
• 9:15
  SPEAKER_01: So you can't afford to have cycles where remediation takes longer and longer, and you are not uh making security a priority.
• 9:23
  SPEAKER_01: So security becomes a board-level conversation.
• 9:27
  SPEAKER_01: Uh, we have a concept called exposure debt.
• 9:29
  SPEAKER_01: Uh, so the exposure debt is how many critical high vulnerabilities are sitting in your staff that you haven't yet remediated.
• 9:39
  SPEAKER_01: You have to think of it like technical debt or something that is sitting on your balance sheet, and that is the risk you're taking in the business.
• 9:47
  SPEAKER_01: And you have to have plans to draw it down.
• 9:51
  SPEAKER_01: And that's the conversation, that's the world we have to prepare for.
• 9:55
  SPEAKER_00: Do you think that it's important to do regular, like deep dive pen testing to just test to test and make sure there's no vulnerabilities?
• 10:06
  SPEAKER_01: So when I talk about continuous testing, continuous testing is uh pen testing.
• 10:11
  SPEAKER_01: Okay.
• 10:11
  SPEAKER_01: Uh it is AI-driven pen testing, it is uh right, a combination of human and AI pen testing, and you have to do both what we call black box pen testing, which is outside in, thinking like an adversary, and then a combination of what we call white box pen testing, where you have access to the source code.
• 10:29
  SPEAKER_01: So you do it deeper because you know the context of the code, and then you can have a much deeper analysis of what is the application trying to do.
• 10:38
  SPEAKER_01: So, what are the kinds of vulnerabilities that you should remediate?
• 10:42
  SPEAKER_01: Uh, so you have to do both of those continuously and not do the pen test as a mechanism for compliance checkbox, but for truly security-oriented outcomes.
• 10:53
  SPEAKER_01: You're trying to draw down the, you're trying to manage your exposure.
• 10:57
  SPEAKER_01: So you have to take a risk-based approach now versus a compliance-based approach.
• 11:02
  SPEAKER_00: And how has, I know in the past, you know, and probably still, companies look at risk and they determine, okay, can they let this risk slide?
• 11:12
  SPEAKER_00: Okay, this risk is more important.
• 11:14
  SPEAKER_00: But how has that changed where it's a little bit more difficult to say, oh, we're okay with this level of risk because, you know, AI introduces so many different challenges?
• 11:27
  SPEAKER_01: It has changed because now the number of critical vulnerabilities that you're going to get has risen up.
• 11:35
  SPEAKER_01: What we saw early on with AI was there was a lot of what's called AI slot, which meant that AI was finding a lot of vulnerabilities.
• 11:43
  SPEAKER_01: Uh, but when you actually looked through it, uh, most of those vulnerabilities you couldn't actually exploit them in the environment.
• 11:51
  SPEAKER_01: Your security rules would have, right?
• 11:53
  SPEAKER_01: Your security controls would have stopped them.
• 11:55
  SPEAKER_01: Uh, or uh those vulnerabilities were low-level vulnerabilities, they didn't really matter.
• 12:01
  SPEAKER_01: They were informational.
• 12:03
  SPEAKER_01: But over time, uh, what we've seen on our platform is almost a bifurcation.
• 12:07
  SPEAKER_01: Either we see vulnerabilities that are false positives.
• 12:11
  SPEAKER_01: You can't truly uh exploit them.
• 12:13
  SPEAKER_01: Or we've seen some really good quality vulnerabilities.
• 12:17
  SPEAKER_01: Those are critical, they really are something you should pay attention to and remediate uh really quickly.
• 12:23
  SPEAKER_01: So now you have to take that risk into account much faster and do the remediation.
• 12:29
  SPEAKER_01: So that's where now you have to have the ability to identify that risk much faster, prioritize it, and remediate it much faster.
• 12:40
  SPEAKER_01: So that's how it has changed.
• 12:42
  SPEAKER_01: It is no longer that even distribution of you get a few vulnerabilities that are critical, once in a blue moon, and then the rest are sort of your medium grade risk and you can fix them over time.
• 12:55
  SPEAKER_01: It used to be that finding a zero-day vulnerability required a lot of talent, expertise, and finding that used to be once you found them, it was like, wow, something big has happened.
• 13:07
  SPEAKER_01: Now it's becoming way more common.
• 13:11
  SPEAKER_01: Right.
• 13:12
  SPEAKER_00: Yeah.
• 13:12
  SPEAKER_00: Well, if there was one key takeaway or piece of advice that you could give to business leaders in this day and age, what would it be?
• 13:20
  SPEAKER_01: The big advice would be offense is defense.
• 13:23
  SPEAKER_01: So you have to think offensively.
• 13:25
  SPEAKER_01: You have to get into the mindset of the adversary and think how they would be attacking you.
• 13:30
  SPEAKER_01: So you have to do continuous discovery on your own perimeter.
• 13:34
  SPEAKER_01: You have to have continuous validation that are you testing for the right things?
• 13:38
  SPEAKER_01: Are you prioritizing the right things?
• 13:40
  SPEAKER_01: And are you then remediating them at machine speed while at the same time keeping the human judgment and discernment in that process so that you are ahead of the adversaries?
• 13:54
  SPEAKER_00: All right.
• 13:55
  SPEAKER_00: Well, thank you so much for sharing your insights with us today.
• 13:59
  SPEAKER_00: Thank you so much for having me.
• 14:01
  SPEAKER_00: And thank you to our audience.
• 14:02
  SPEAKER_00: If you have questions about this or comments, please leave them and I will try to respond as soon as possible.
• 14:07
  SPEAKER_00: And have a wonderful week.