Transcript for "AI's Impact on Security: Transforming SecOps and Redefining Governance": Alright. Good afternoon. Thanks for joining us today. Welcome to our webinar on AI's impact on security and how it's transforming security operations and redefining governance. Today, we'll be speaking with leading experts across the industry as we explore the practical and strategic implications of AI across security operations, including detection through response, protecting these emerging large language models so we can safeguard sensitive assets, and, ultimately, how do you balance innovation versus control where you can deploy AI safely while maintaining ethics and compliance? I'm RB, your moderator and chief product officer for Activa. For the last twenty years, I've led product from managed security providers, SIM source software companies, and I'm on a mission to take friction out of software. I'd like to introduce our distinguished panel that's joining us today. Ankur Sheth, he's our senior managing director and the global head of cyber risk practice at Emcore Consulting, a global professional services firm. One of Emcore's key towers is their cybersecurity data privacy domain, where they work on both reactive events and proactive risk projects to help their clients in building their cyber program and building resilience. Dave Sampson is vice president of cyber risk and strategy at Thryv, a leading provider of next generation managed services and cybersecurity solutions. Dave leads the consulting practice at Thryv, which offers a variety of assessment products, compliance consulting, and strategic advisory services across a wide set of verticals and markets. Joshua Neals, a statistician, researcher, and a security leader with twenty five years of experience at the intersection of AI and threat detection. He's a CTO and cofounder of AlphaLevel, a threat detection company aimed at finding the breaches that are missed today without burning stock and false positives. Gentlemen, welcome. Thanks for joining us today. It's looking forward to the fun discussion. So with that, let's dive right into our first topic on security operations. You know, as I think about the onset of these LLMs, these large language models, it's really created one of the most significant inflection points in the technological world as the accessibility, adoption, usage of these tools has become pervasive and just part of our daily lives. We're using it at the office. We're using it at home. You know, it's it's everywhere you turn. You're seeing it on in every news, report. You know, AI itself, however, as a broader product category has been around for decades. And, you know, many of us on this panel have a lot of experience with that, whether it's machine learning models or virtual assistance like we see with Amazon and has been around for quite some time. These aren't new items. AI is really a roll up category of powerful tools that are really designed to address a broad array of challenges and opportunities. So but if we look at the inflection point we've hit with the onset of LLMs, and it can really be summarized in a couple key things. Just the massive scale and the availability and accessibility in the overall adoption of these tools that we've seen over the last, you know, short period of time is is something that unprecedented. And and if you compare to the, what we've done in technology over time, and really the outcomes that it's enabling across all functional areas. Right? This isn't just cybersecurity. It's not just r and d. It's in marketing. It's in sales. It's hitting all parts of of of your functional area in the business and really helping teams accelerate and do more with less. And for most times, you're getting better outcomes when when applied properly. But But when you think about it and you combine these accelerants and the new era that we're entering and we're in, there's an absolute need for safety and oversight. You know, guardrails and structure that allow us to manage key areas such as ethics, the weaponization of these tools. It's really places on a a spotlight on the need for governance and compliance. And doing this so that you don't slow down the innovation and don't prevent the, you know, your team members from doing what they need to do with these tools. So with that, let's dive a little deeper into how this bucket of technologies continues to reshape security operations, an area where scale is a challenge, analysts are inundated with the delusion alerts, and the world of AI is at the center of gravity. So, you know, Josh, I'll I'll turn it to you as the as the first. And, you know, if you think about this from a detection through response, it's evolved exponentially, and it was evolving before LLMs came into the play. You know, your your company's focused on enabling security operation centers to do more with less. Take us through how you're seeing the overall intersection of AI and how LLMs are are, really impacting the security operations center. Yeah. Thanks, RB. And, really looking forward to to this. So I'll I'll I'll sort of walk through, the history of this threat detection in a in a nutshell, and then I'll get to the modern day. In the early days, I sometimes I feel like Moses when I when I say this, but in the early days in, in the nineties and in in February, you know, threat detection was really eunuchs neckbeards, writing queries against logs. And, like, good engineers, whenever they had to do it more than once, they wrote a script, and it started running all the time. That's sort of the basic, you know, first step in threat detection is queries that are automated and and matching against logs in the data. In the mid two thousands, sort of 2005 and and onwards, we saw the emergence of SIMS, which allow for log aggregation and analytics, but also, a lot more visibility and and endpoint detection and response, which gave us, you know, endpoint visibility and alerts, coming from the endpoints. And then, you know, you just kinda put that on steroids and the proliferation of different technologies to protect plus the visibility to get logging and then alerting on top of all of those technologies, cloud, you know, firewalls, network, etcetera. What we've seen is just a growing number of alerts. And the whole goal with threat detection is find the bad guys. All of them have no false negatives, but also don't bury the sock in the alerts, have no false positives. So the utopia of threat detection is no false negatives, don't miss anything, but also don't, falsely claim something as a threat. What has happened in the last because of this sort of growth of both technology and the alerting logic layer on top of that is really a proliferation of alerts. And I think it's really come to a head maybe two or three years ago in which, we got way too many alerts, way too many. And so we've threat detection has gone from, you know, not missing the breach, the false negative side to burying the sock with too many false positives. And I think that's the state of things today. What's coming next, it's not getting it's not gonna get a lot better in the near future because AI is coming a lot. And AI in the first place is connecting a lot of different data sources and there's a lot of, credentials that these things need in order to access stuff. So there's gonna be a there's more threat surface to protect for defenders. And then when you involve AI in producing alerts or detecting things, my experience as an AI threat detection guy is that that's gonna proliferate more false positives too. So I think we're seeing an acceleration of alert volumes in the next few years, and, you know, we gotta do something about it. I think I'll pause there, RB, and, you know, I'm not sure if we should start talking about solutions, but that's the kind of the state of threat detection today in a nutshell. So just a quick follow-up on that, Josh, is, you know, there's a lot of hype in the market, and there's been a lot of discussion around is the concept of AI gonna reduce the need for analysts. If you go back and have think about what you just kinda covered, we're gonna see some spikes. There's some changing in the in the tax surface. There's a lot of complexity to this. But how do you see the practical use of some of these technologies, the more modern, generative AI technology, helping security operations center scale? Yeah. Thanks. So okay. So first, I should say that, like you said earlier, AI has been penetrated into threat detection for a long time, and I you know, I've been doing it for a long time myself and a lot of other folks. The first thing, the major penetration is is in antivirus. And, machine learning and deep learning to detect, and block malware has been quite successful, especially sort of in the mid twenty tens, 2015, thereabout. We we got the the that malware, sort of detection and blocking to five or six nines of precision, which means we have very low false positives. And that means we can block automatically. What's coming next, though, is, that caused the adversary to pivot. They can't get in with malware as easily anymore, and I shouldn't say not at all, but as easily. And so they have started doing more behavioral. They get a credential somehow, and they just log in and live off the land and use regular system tools and so forth. As a result, there's more behavioral methods that are required to detect these things. You can't write a rule to detect, living off the land because you're gonna detect a lot of benign users that are just doing their regular things. So you have to look at behaviors and deviations and anomaly detection and UEBA, and all of that has been proliferating in the last few years, I think, in part because of the success of machine learning and antivirus. Where we're headed now, which is really what you asked, There is a need to look at the context around a situation at the time of an alert. So the state of things today is that we define detectors beforehand, and then we have to define exclusions or tuning of those to not alert on benign stuff. But that's all done before the attack is happening or before the situation that the alert is created is is happening. What what is what I'm seeing emerge and what alpha level is involved in and and other sort of AI sock, technologies is to look at the, the context around the alert at the time of the alert. Instead of at the time that you define the detector, it's now what's happening around this alert right now in in the context of of, the alerts time itself. And whether you use an, a large language model to do that contextualization or other methods, I think the most important thing is that we're understanding that the context needed to decide whether an alert is a true or false positive has to be done at the alert time as opposed to at the detector definition time. And so we're seeing an emergence of these kinds of products that are looking dynamically at the alert and the context around the alert in near real time as opposed to defining it in the detector. And I think I'll stop there. There's a whole lot more to say. Yeah. No. That's great. I think it's all a lot of it to me is all about the investigation. Dave, you live in this world and the 24 by seven SOC, and you're providing these services in in many facets. How are you seeing this emerge both internally as a tool, and and how is it transforming your your service portfolio? Yeah. So we certainly here at Thryv, you know, as a managed security services provider, and and we do, traditional managed services as well as virtual private cloud and some some AI development work for our customers. But, we were pretty much early adopters in that managed security services space and implementing the SIM and the SOAR technology and starting to address opportunities for, automation really as at the earliest stage. You know, challenges with cyber risk management, you know, we talk about the different tool sets we we utilize for for endpoint protection, email filtering, right, alerting. We have all of these different tools that are putting out data and logging, right, and correlating that data together, getting that data collected into a platform that can provide that single point of visibility, understand what matches with the event that we're looking at, perform the investigation around that to try to take some of that lifting and overhead off of a SOC engineer from a time saving perspective, are all pieces that we have invested in very heavily within our security platform. So, you know, really finding the opportunities to plug in those disparate tools that we deliver to customers as managed services. Also, having the ability for customers to plug in third party tools as well and correlate all of that data together into the SOC service And really looking at use cases such as a traditional alert that took a SOC engineer thirty minutes to investigate and act upon, leveraging the automation and AI capabilities of the Thryv security platform to perform a lot of that upfront work, chop down that investigation times that within maybe two minutes, that engineer is now presented with a opportunity to make a decision without having to consume the overhead of that time period of of doing the legwork first, which is something that's very significant. Right? When it comes to any threats, any alerts, we wanna act as quickly as possible. The other piece that we've seen at the same time is is running this large security platform and integrating the services that are being delivered to all of our customers into that platform. There's a lot of group benefit to that, whereby, you know, if specific customers are looking for, automations or triggers, the collective ultimately benefits from that. The learning that takes place within that platform natively as we collect more data and even to the point that there may be situations where, our systems and engineers can correlate alert data that comes into the platform that might be attacks from a similar source against different customers, at disparate locations. Right? So all of the threat intelligence that is coming in as a result of those alerts, as a result of that logging, that's something else that is really an an asset, for us to be able to to serve our customers better, but but certainly for the customers as well. You know, I've talked to some folks that have deployed their own SIM platforms in house. They've tried to put some store components in place. you. They don't really have the twenty four seven SOC capability, which I think is a challenge for many, organizations, you know, especially small to mid market organizations. They're not gonna be putting together their own twenty four seven presence. But being able to wrap the appropriate amount of capabilities and technology around AI and automation within the security platform to really accomplish these things, and then developing against that and really having the ability to understand the value from the platform that sits beneath them can be a big challenge. So so we, this is something that, you know, we have embraced from day one, but it's also something that's continually evolving and and something we remain very excited about. It's great to hear. So, you know, one of the things you touched on, which I've experienced when I was sat in in your role is the the proliferation of tools. Everybody's got different technologies across multiple product categories, and some of them are snowflakes, some of them are more mainstream. But there's a lot of telemetry, and there's a lot of data to integrate into. It's a bit of a leading question, but I'd love to get your take on how are you using some of these technologies, these again, these these broader AI capabilities to address that that that data problem of I gotta talk to a 100 different inter interfaces. And then. ultimately, to your point of enabling the investigation and bringing that context together as you and Josh are speaking to, how how is that kinda coming together into a, a force multiplier, if you will? Yeah. And I think that's actually part of part of the magic of what we are doing. So, having the the underlying technology, the underlying platform, wrapping our AI capabilities with that platform as well and continuing to develop against it. But you'd need that central point to bring in all of that telemetry and data into one place. Right? You can't look in four places to try to to match the data. And it's it's like it's almost a simple statement to say that the the magic is we're gonna bring all the data into a central place, but there's no, turnkey solution that exists to do that. That's the real challenge. That's the challenge for everybody, whether you're doing this internally or you're a service provider, whoever you are. And I had a conversation last week, with some other folks, and they said, well, which platform do we go out and purchase that will allow us to start to ingest all this data, understand it, and act on it, and kinda do that, generally speaking, on day one. That that platform doesn't really exist. You know, I think that's part of the experience and tenure within the security services space, and and the right amount of development and experience leveraging these tools. But, you know, we just continue to move up the food chain. When the store capabilities first really came to market with SIM technology, we were very excited about that and what was possible there. And now that has all just been ratcheted up exponentially. Yeah. Yeah. It is. It's it's interesting to see, and I think it all cuts back to I like to always say, don't be talked about the eye. They talk about the detect and the respond, but it's really the eye that you're enabling the investigation. How do you get them there faster? Ankur, you know, you guys talk to companies across the globe. You're seeing it in a lot of different way areas. How do you see, you know, what we're talking about here around the intersection of SecOps and and AI, and and where do you see it coming up the most in terms of how customers are engaging with you? Yeah. Thanks, Harvey, and and and thanks all for having having me today. Yeah. You know, we're more of a traditional consulting firm versus kind of managed services. So our I think our angle and our view is a little bit different in terms of what we're seeing and what and what our clients are doing more specifically. Right? I think, you know, the team here, Josh and and and Dave said a lot of things around what they're seeing in kinda traditional MDR and and SOC services. And, actually, you know, I have a client who I would think, you know, I would categorize them as as pretty mature in the AI space. And similar to what what they mentioned, they've replaced, you know, 30% of their their SOC analysts with agents. Right? And those agents are doing kind of the basic evaluation That all, you know, then moves to the human element of their their their team to actually validate and move forward, but they've actually moved in a direction of actually replacing a good chunk of their, their analysts or their their, you know, level one analysts to do some of that work. But but outside of that, I think there's a lot of other areas that that we see with our clients in terms of where AI is really is really jumping up and and really starting to make an impact, in the SecOps and and security world. And I'll just name a couple of them because I think these are the ones that are probably the most most relevant in terms of what we're seeing. One is around incident response. Right? Incident response has always been a huge component to every, to every company just because there's so many incidents that happen every year. But now with the use of AI, it's making it easier to actually do some of the automated components. Right? That could be part of your SOC and MDR solution. It may not be maybe something separate. But actually building in the response component, into your own systems using some AI has been been one big one. The other piece is around, you know, routine cyber tasks. Right? So security automation, which, again, not saying this hasn't been around, you know, previously, but we're seeing an extrapolation of some of these things because we have agents now that can do some of these routine security things. Think of it as, you know, things like vulnerability scanning as an example, right, where you have an agent that can actually kick off, you know, do the scan, produce the results, and actually analyze the results for you, you know, in in in a very short amount of time versus having an analyst do all that. Right? So that's that's really big as well. The other is enhanced fraud detection. Right? It it's more, to be fair, tied to to the FS industry. What we're seeing in terms of identifying patterns of misuse or identifying outwires in terms of usage of things like credit cards and things like that, That has enhanced a lot in terms of how many of our clients are utilizing AI to do that enhanced level of fraud detection. Right? And the and the last piece I would say is predictive analysis. How are these systems using historical data to predict future events? Right? And and, you know, I I would just say, you know, all these things have existed, and and I think Josh and Dave said this as well, in some way, shape, or fashion in the past. Right? I think we're just seeing an extrapolation event and an and a maturity event with with the new versions of AI and Gen AI in terms of how these things now support our businesses. Right? So they've all been around in some some way, shape, or portion proportion, but I really think a lot of these have gotten to a point where they're now making a bigger impact to how we manage our, you know, our security operations. Those are great points. I think as I kinda summarize, you know, the the point each of you have been sharing, I'll go back to Dave. You know, when I was in the MDR world, we're trying to build that single pane of glass. And, ultimately, you're trying to enable the security analyst to do as much as they can, once the alert shows up as Josh points out, and give them as much context in real time as you can. And I think what one of the things that I've I've observed see if you guys agree to this or not. When it started getting exciting about AI and people were overusing the term, which it's constantly annoys me, but, It's the new cloud. it's the new cloud, and it's exactly it. But what's interesting is I would talk to folks that aren't necessarily in the domain, people doing some of the research on it from more of the, the financial impact. And I started explaining to them, sophisticated attacks aren't going to be detected through this magical generated AI that that's out there. Those these things are pattern recognition models, and they could they predict the next thing to do. You still need the human element, and you need the combination of all these technologies we're talking about So you can actually still detect the more sophisticated attacks, and that's where the people aren't gonna get displaced anytime soon. So you're gonna get scales, Encore pointed out, that you can you can, you know, reduce the dependency on on l analysts at the l one the level one level because some of that bespoke work that continuous work that has to be done all the time, you can you can, get it out of the way. But you still need those more sophisticated individuals that can go understand the context that Josh's technology surfaces or, Dave, your team looks at, you know, when really bad things happen tonight. You guys concur? Is that a fair. summary? I think that's actually and I'm glad you mentioned that because I was gonna interject a similar, thought. But, you know, a lot of folks will ask when is the totally independent autonomous SOC coming into play that's completely AI driven? And I don't have the crystal ball. I do know that where we are today from a evolution of AI perspective is that we're really at the infancy of what we will see. There's no question about that. But I don't know when we will get to that level of automation or or maybe ever. Right? I think part of what the opportunity is is to leverage the technology that is now available, use that in the most, creative and innovative ways to problem solve, and give our, human capital and those resources the additional capacity to attack those bigger problems, the more advanced problems. Right? We will take learnings from those. I anticipate those learnings will start to get integrated further and deeper within the platforms that we're developing, but I don't have a vision or or at least a line of sight at the moment to, you know, Yep. any elimination of talent as a result. Yeah. I did I agree with that, David. I'll just chime in and say that it's it's been a weird experience for me as a statistician to to watch the industry or the sort of at large efforts to use computers and algorithms to mimic humans. At this scene, that's that's always seemed like the wrong goal to me, and maybe I'm the only one. But there are things that computers do and algorithms that humans aren't very good at. Like, looking at petabyte of data and finding a statistical outlier. You can't if I showed you guys a petabyte of data, you wouldn't know what the heck to do with it. It's just a pile of numbers. And then there are things that humans do that computers aren't very good at. I think they're mostly related to memory, but, you know, you haven't got feel and intuition. Computers don't have intuition. And I think the gut feel comes from the synthesis of a lot of experience even from your childhood and as you grow in these things, but that's pretty hard to mimic with an algorithm or something. So, the way I see where us headed is that that AI, if you will, is gonna do the stuff that humans are good at. And then left is the stuff that human that humans are good at. And those kinds of tasks require creativity and intuition and the kind of things that are hard to encode into models. So I think that's where we're headed. The we should be able to get rid of a lot of garbage and repetitive stuff that the analyst has to look at. We should be able to get rid of that. That's what computers are good at. What's left is the interesting hard creative stuff that requires real brains, and I don't think that's going away ever. Well said. Well said. So let's let's build on that segue and think about it from the vector of protecting these technologies, protecting them from ourselves, protecting them from, you know, harm as well as the fact that people are weaponizing them. Right? So it's obviously there's been a mass adoption. We've seen a lot of examples in there about you can, create bias in these technologies either, you know, purposefully or accidentally. And, again, as Dave points out, it's the new cloud. And you think about the cloud adoption and all the things that happen in cloud adoption when people understood the shared security model, and you had to understand what the cloud owns versus what the users own. And we all know about the, you know, infamous s three misconfigurations that have plagued the cloud and, you know, you see that all the way. If you think about that concept and you look at it from the, LLM perspective and these generative AI technologies, you need the right controls and visibility, which is obviously an understatement. And we're seeing where there are many cases that these technologies can become more dangerous because you're trusting them or people using them to weaponize it. And, you know, you can see what the most recent news that Anthropic released in their self reported, cyber espionage campaign that they're speaking to. You know, there's a lot of ways to use this. Ankur, as you look at this and you're advising companies, you know, how do you suggest they they get out of the blocks on this one? You know, what's what's keeping them at night, and how much do they know about it, and and how much of it is FUD from your perspective versus real world, exposure? Yeah. Yeah. I think, you know, I think organizations, like most tech, are are are quick to jump into without actually thinking through, you know, some of the implications of those decisions. Right? You know, I view, you know, AI, like other technology, as an enabler. Right? It helps us do certain things faster, more efficiently. But there are, you know, as with most tech, good and bad. Right? Both sides of the equation. So So when I think about how and how we've helped organizations think about this, there's a couple things, and and there's more than this, but just a couple I'll highlight a few things just to kinda start the conversation. But one, I see a lot of organizations start to deploy some level of AI without actually understanding what they're trying to achieve. Right? So what are, you know, what are your goals? What are your objectives of having this AI solution in your organization? Right? And conducting an assessment on that, right, and understanding the potential risks and benefits that are associated with it. Right? A lot of people are just deploying, you know, enterprise GPT or or or whatever it might be, right, to support the organization, but are they do really understanding what what are they trying to get out of it? Are they actually trying to solve certain use cases? So I think actually stepping back as a starting point and actually thinking through what are you trying to solve, what are you trying to achieve with this AI solution or multiple AI solutions is really important. Right? Tied to that, I would also say, you know, kinda education. Right? Again, and I know we're gonna talk about kinda shadow why AI and stuff like that in a minute, but, you know, a lot of individuals and, you know, most us on the phone, at least us that are presenting today are all all tech people, but most of our organizations or our colleagues are not. So helping them understand what are the pros and, what are the, the do's and don'ts of using AI becomes really important to helping reduce risk. Right? Because how I can't tell you how many times we found individuals putting sensitive information and things like that into public AI models that really should not be there. Right? And the last one I'll mention, and there's more, but just to kinda start the conversation is, you know, governance, compliance, and monitoring. Right? So how how are organizations actually monitoring and governing the use of AI, and are they being compliant with whatever laws, you know, may may exist? As an example, for those who don't know, Colorado is the first was the first US state to to drop an AI law. Right? So they have a Colorado AI act that if you're working in Colorado or a business in Colorado, you have to follow, you know, the NIST AI framework for governance of AI. But that but also monitoring and and managing how AI systems are you use, putting guardrails in to actually make sure that, people aren't doing things maliciously. So I think like most tech, there's there's controls that need to be put in place to really help the users and the community not hurt themselves. Because, again, you know, like most test tech, you can do things incorrectly or inadvertently, which could could have bigger impacts. Yeah. It's interesting. And I think the governance model to your point, Ankur, we're just getting started. Right? Just like the the whole. proliferation of technologies there, we're just we're just entering the first inning, if you will. And and it's good to see some of these frameworks out there, but there's definitely gonna be some maturing on that. You know, Dave, again, as you look at it, there's and I'm gonna oversimplify this use case for a moment, so bear with me. You know, you can use these LLMs to extend your services much like we've been talking about in in this conversation. You can use it to, you know, give scale to your security operation center. But at the end of the year, you have to protect these systems too. Yeah. It's another attack factor. Right? How do you do it? How do you think about that at Thryv, and and what are you what are you seeing it as a as an offering, as a demand, as a need, or is it more emerging still? So so there certainly is demand and need. It's probably all of those things, to be honest with you. Right? I think one of the the pieces here that exists is that, especially throughout this year, folks have really come to understand what the possibilities might be around some of this new AI technology. Right? And they're starting to have the wherewithal to think, differently and in creative ways about how they might be able to embrace that technology, but but readiness is certainly a challenge. And I think that readiness is probably more of a challenge for many organizations than they may realize. So we think about, you know, if we're gonna deploy some solution, enterprise based LLM, how do we put the right protections, identity management, all of these types of pieces around that. Right? But I actually more often than not, I'm getting even a step before that and collaborating with customers around, okay. What is your current risk profile look like? How is your your data existing within the organization? Have you classified that data? Is the data actually, permissioned in ways that you expect? And as we look towards implementing an AI engine within the customer environment and start to ingest data, are we ingesting the data that we think we're ingesting, or do we have the opportunity to ingest beyond that? And a simple example, I think, is, you know, Microsoft Copilot. So, organization x wants to implement Microsoft Copilot. They go out and they buy the licenses. They activate Copilot, and suddenly, it ingests every piece of data that is within their three sixty five tenant. And suddenly, sensitive pieces of information are now available, throughout the organization based on that. Right? So, wherever you are in your AI journey and and this certainly will be a journey for everyone, Step one, thinking about that security first approach. Right? And then we also have a privacy component here as well. But regardless of where you stand from an innovation, development, implementation perspective around AI specifically, I highly encourage everyone to understand their risk profile, but also start to make those moves to get your house in order. And I think we've always understood that to be a best practice. Right? How is our data structured? How is it permissioned? Having done professional service with clients for tens of years and and many, many assessments during my tenure with Thryv, I don't know of a lot of examples of folks that are doing that well or that it's as accurate as they think it will be. Right? So, I always recommend to folks, okay. You know, whether you're just starting down the road or you anticipate going down this road later, now is the time to start taking a look at that data, understanding where your data lives, how it's permissioned, classifying it especially around those those sensitive intellectual property, data privacy, internal financials, whatever that might be. That is definitely square one. Those are great points, and you really shine a light on that that balance of your copilot's great example. It's reading everything that you have in your system, and that's not necessarily a good thing if you don't know what's all sitting in the system and where it's sitting and and if it's not tagged and and detailed. And I think to your point, you know, very few companies have that down to a science. So if. you flip think I'll just. interject one one point there, but I think one of the important pieces of that as well is understanding the value you're going to get from some of these tools. Right? Because some of the customers I've talked to have almost looked at it from the perspective of, we're going to gain so much value from turning on $3.65. We'd like to rush to the punch and and disregard the staging that you're recommending because we're gonna get so much value on day one. But the balance. of that argument is not real. I mean, it would it's like training wheels. You need to have a sandbox environment. You need to understand the implications of what this thing can do. I don't think people fully appreciate we're not gonna go back and change the permissions are on our data or pull data back. Right? Once you've once I I guess this is the toothpaste out of the tube example. Right? But it's it's not generally going back in. It's very challenging to do that. Yeah. Yeah. No. It's there's a lot more to it, and I think you and Ankur are highlighting just, you know, tip of the spear things to be considering. You know, Josh, as you look at this from the other vector of the bad guys and how they're weaponizing these tools and using it to really accelerate, which allows them to do more and take advantage of some of the situations Encore and and Dave highlight here and, you know, exploit those. You know, how do you see this really, you know, enabling the bad guys to do more harm? I know. The first thing I wanna say is that cybersecurity is sort of really happy to stare at shiny objects and shiny toys, and I don't think we should be freaking out about the AI threat. Okay? I wanna I wanna make sure that we put out a moderated message of this is coming. We're only seeing sort of early signs of weaponization. It's clunky and and artificial. No pun intended. I think this is perhaps should be taken as a warning for the future and where we're headed as opposed to what's happening right now. So but what I what I am seeing right now is I mean, the first thing that we saw was better phishing emails. Large language models generate language. And so let's generate better phishing emails, more compelling emails. Obviously, no grammatical or spelling mistakes. That sort of table stakes, but then also sort of, coercive a better coercive language to get you to click on a link or or download an attachment or whatever. The next thing, let's see. I have some notes. So the the, I'll give the I'll give the the uninteresting one, Okay. which is is really about what I see as democratization of attacking of attacks rather than any kind of real new bleeding edge attack. It's just making it easier to do attacks. And the example I'll give is one from my background, which is steganography. And I did some work in in hidden messages and embedding messages and images in my past. And that used to be pretty hard. You'd have to be pretty nerdy to know how to embed a message in an image. You gotta write some code. Eventually, some libraries came around, but you gotta be pretty nerdy to do all of that, like me. But then I saw I saw I can't I couldn't find the article again, but somebody was generating you know, do you just go to a, diffusion, algorithm in image generator and tell it, hey. You know, make an image of a roller coaster, but embed this message in it in a hidden way. You you know. And and so I played around with that in preparation for this call, and I got proper steganography. It was used in least significant bit stag, which is sort of the simplest thing you can do. But, you know, I think anybody could do that. And, so now we can hide messages. Even more nefarious is that I could embed, an exploit code in a PDF, let's say. And then when the PDF reader, you know, punch you know, reads in that malicious PDF, then you compromise, you exploit some vulnerability in the PDF reader, and now you've got more nefarious access. And I don't think this is very hard to get an LLM plus sort of an image generator, PDF generator to to do nowadays. So we've democratized or made easier stuff that we already knew how to do, but now everybody can do and, you know, and so that's, I think that's a big threat. I'll touch on the anthropic thing briefly because I need to because it's sort of in the news and everything And I've read a whole bunch about it. I am not a I'm really not a, like, an offensive AI researcher, so I'll try to give just a little summary of it. You know, there was a lot of human interaction. The human would pick a target, maybe a target enterprise, then the, the AI, which is Claude Hodes, was given access to an m p MCP server. The MCP server had a bunch of open source weapon tools, attack tools, like Metasploit and scanning tools and other things. And then it went and, apparently gathered intelligence, about what were high value assets for a given organization, then that resulted in a a report that went back to a human. Then the human decided I wanna do this. I wanna take advantage of this exploit because I want that high value asset. The AI developed the exploit code, and then delivered it to the victim enterprises. And then I think there was some validation in terms of being able to get the data back out, and there was some exfiltration at least anthropic complaint, claims some exfiltration from the 30 target organizations. So the and then, you know, the punch line on all of this, I think, is that a bunch of existing tools that got automated into a pipeline. And the real sort of difference here is the speed at which that was able to do. So it was, according to Anthropic, I think, you know, at one point it was admitting thousands of requests and it was doing more than 10 per second. That's not something a human team of attackers could could replicate. So the speed at which this was, done is sort of this. If anything is scary about that, it's the scary that's the scary part is there is yeah. Well, now, well, that implies that if it's sub second, especially a post breach sort of lateral movement and and all of that, that, you know, now we need more automated methods on defense. Otherwise, the whole gig is up before the humans can even react to it. I think that's that's sort of the lessons there, and and I probably missed a whole lot of stuff, but that's kind of a quick summary of of weaponization as I as I see it. Yeah. Look. I I think thank you for that. Going back to your point, I think as I was thinking about it, it definitely wasn't meant to be, fear and certainty doubt, but it is the fact that you say, well, democratization. It's more the aperture is increasing in terms of the accessibility to the to, malicious, technologies. The the instrumentation of it makes it easier. So it used to be really sophisticated. Hackers would do the bad things. Now more people can do, with less sophistication because the tools have matured, which then to me just naturally opens up the aperture of the attacks. Right? They used to go after the enterprise and the government. Now you can go after after every company because it's just easier because they've all got an online presence. So it's more awareness. And to your point, just you gotta be aware of this and more thoughtful of how you approach all this, which really kinda gets us into our third topic, which I'm, kinda. calling I can if I can, just. add one thing to that, I think just one important point, not just the democratization, but also, I feel like individuals now don't need to be as technical. Right? Where in the past, you know, you had to be very technical, hands on keyboard, developing malware, whatever it might be now because of AI tools or even manipulating AI through prompt injections. Right? You don't need to be technical. to do that. And I think that's really also changed the game a lot in terms of, threats. So it's not just the guy in the the hood behind his keyboard in the basement. Right? It's it's everyone that now has access to this and and can become a bad actor if they want to. So I just wanna add that in. Sorry. it's a it's a great point, and I think it really underscores the the the error we're kind of evolving into, which is just more of a evolution of where we've been coming from. So I use this analogy, kids running around with scissors. If you think about this, we're all using this technology at home. We're using in the office. We don't have our governance all down like we're speaking to. We're trying to be good custodians of data. We've got an AUP. I'm sure every everybody on this call is operating under AUPs, except we use policies and trying to be the right thing. But just like the shadow IT movement, we've got shadow AI. It's there. And it's okay to say we we that's the reality. And I think, Dave, you hit it really well. Like, one of your customers is trying to, you know, as opposed to ready, aim, fire, ready, fire, aim. They they wanna jump right into the deep end of the ocean and start using the technology to to innovate. And that's we I admire that and, you know, we're doing a lot of that in the r and d world of of of Apptika as well. But you've gotta find balance between governance and innovation. You've got to bring that into a world where it's you know, the employees are educated like Ankur, you mentioned. You understand the use cases. You've got sandbox environments where you're kinda keeping the house safe. And look, the governance will continue to mature. And, you know, I think, uncle, you were touching on this. Maybe you can elaborate a little bit more about how do you find that balance of of enabling innovation at your at the customer side while helping them govern this so that they're still moving at a good pace, but not, you know, wildly out of control in creating, you know, exposures and risks for their business unknowingly? Yeah. Yeah. And and it's a it's a complicated point. Let's put it that way. So, you know, I will say, you know, Dave mentioned something I was gonna mention as well, which I think is an an underlying component to to all this, which is understanding your data. Right? Because everything we're doing around LLMs is is data driven, and understanding what data you're putting in there, what type of information that is. Is it sensitive? Is it confidential? How is it classified? That becomes a prerequisite to kinda everything we do if we wanna do it the right way. Right? Which, again, I know, like you said, people are just firing off right now without actually thinking about this. But that becomes a really important part of how can we do this in a way that makes sense that fosters innovation and growth, but also puts the guardrails into actually con control how our teams are actually using AI. Right? And, you know, the example we talked about, and I I met I mentioned earlier is was putting sensitive information into AI models that may be in the public domain. Right? That's great as a you know, that's great in terms of something we wanna stop. But how are you gonna stop it if you don't actually tag those data assets and understand, you know, this file has SSN numbers in it or whatever it might be? Right? So going back to that, that data classification piece becomes, in my mind, very, important in terms of being able to implement any types of controls for how people are using AI. And then going back to kind of the original question, right, around, you know, innovation and and and this and that, I think when we think about that, it's it's really about, again, like like most technology, putting in controls that will actually help monitor usage, but not restrict the key use cases and key things we want individuals to be doing. Right? So if we think about you know, I'm gonna use a basic example of, like, a health organization that wants to look at patient records and things like that. Right? Monitoring what type of data is being put into those models and blocking the data that shouldn't be in those models, right, to not, poison it with, data that shouldn't be there or to make sure that, you know, other data is not being leaked out. Right? So what we talk about is different types of controls. Some of those are, you know, as you mentioned, policy related. Some of those are technical in terms of tools and technologies that can actually be used to monitor and sit in the middle of how you interact with your AI solutions, and some are process focused. Right? People process technology. So, I I really I really like to think about how do we implement components across all three of those areas to really help, put some governance and control around how we use our AI systems. Like I said, policies, around AUPs, monitoring with tools and technologies, and working with the different business teams and and and and use, users to really set forth the right use cases that they should be using the tools for. Great perspective. Dave, you've implemented a lot of this internally at Thrive, it sounds like. How did you approach it, from a governance perspective to, to get to where you are? Yeah. So we are really getting kind of that foundational AI policy in place for the organization as well as user education. Everything involving risk, cyber risk, and it rolls right into the AI equation, but, that education with users is always critical, and, we do this internally. We also do this for our customers, via our VCISO group. But, you know, shadow AI is something that, you know, really is a a problem for a lot of organizations from the perspective of, is that sensitive company information or privacy, regulated data being plugged into the public platforms? Who who's using these tools for what? We know statistically that, shadow AI events cause higher costs and data loss, data leakage when events do occur. So so understanding what exists, is something that is important from an organizational perspective. I think there's some creative ways to attack it. From a consulting perspective, we have gone out and, helped customers identify what platforms it appears their users are leveraging, and that could happen a number of different ways. It could happen through, understanding email data. It could happen from, DNS data, right, from secure DNS platforms, even even credit cards. We have customers that list, can you review our credit card statements? We're trying to see where the shadow a AI and the shadow IT operations are occurring. There's a lot of different things we can do from a technical perspective to layer controls in. There's a lot of educational initiatives we can take. But at the end of the day, there are things that still will happen regardless of all the the governance we're trying to layer in place. There are some technologies that are that are being developed and and some being rolled out around, increased monitoring specifically for this type of data leakage, specifically for, leveraging AI tools and what that looks like. So, again, that's something that's continually evolving. Making sure you have the the foundation set, the expectation set with users, helping users understand what the risk looks like, I I think is really one of the most important steps an organization can take today regardless of where they are just from the perspective of, avoiding what might be possible. Right? Because, you know, users develop habits. They start using tools. These tools make their jobs easier and more efficient. They're not necessarily thinking about that, you know, higher level risk or consequences that could come from leveraging public platforms with sensitive data, and and, ultimately, you can get painted into a corner that you don't wanna be in. That's I I'll just I'll just add to that, because I know I know, Josh is going back? You know, for those who follow, you know, there there's a in in, for web app development, there's an OWASP top 10. Right? That that kinda highlights the top 10 vulnerabilities for for web applications that, you know, as ethical hackers and pen testers look at. They have now published the same thing for AI models. Right? So that was top 10 for AI. And this really, again, back to Dave Dave's point, right, highlights what, you know, the organization views as the top thing top 10 risks to AI models, which include, you know, prompt injection and and, you know, things like that. Right? So that's a good starting point if you're just trying to get into this and you're trying to learn about it in terms of the vulnerabilities that may exist from a security perspective. That's a good place to start just to kinda get your bearings, and then you can pivot and go deeper from there. So I just wanna highlight that because I think that's a a good starting place for those who are not well versed in security risk for AI. No. The great points. I appreciate you gentlemen sharing your experiences. I think it's helpful for the audience. It it gives you you know, for those that are still getting out of the blocks, it gives them some nice ways to think about it. And, again, you know, these are solvable problems. They're complex. They're nuances as you guys are highlighting, but they're solvable, and it doesn't prevent you from, leveraging and getting the benefits from it, but just proceed with caution and and take the time to invest a little bit in there. Any closing thoughts for me, folks, before we we wrap it up? I think I just first of all, thank you for the opportunity. I I really appreciate, getting online with you guys today. I think this was a great discussion, and and this time has passed very quickly, but I know that we could talk about this, for quite a while. But. just kinda just a couple high level points. You know, really taking that proactive approach, doing the staging in advance, making sure that you're taking the right steps around secure security, privacy, governance before you get down the road, will certainly help you out in the long term. Also just understanding what current state looks like. You know, inventorying your risk profiles from a cyber perspective, as well as you go down the AI road and making sure that you're leveraging evidence based validation and being completely honest with yourself, when it comes to risk. Everybody has the the right to determine their own risk profile, their own risk tolerance, but, you know, make sure that you know, the reality of where you stand and even your capabilities around redundancy, backups, business continuity. These are things that folks need to be thinking about because finding out the hard way is really challenging. But I think the biggest takeaway on the AI front is that the sky is the limit and really layering the right type of, critical thinking, problem solving, and and really the goals of the business together, to understand what's possible will really lead to the best results as we go down this road. That was great. Thanks, Dave. Ankur, anything from you. before I'll just, yeah. yeah, I'll just say I'll just say one thing. I think Dave had a lot of great points. I'll just say, you know, take a breath. Right? Step back. I think everyone's so eager to jump into this world and and and use it for a lot of great reasons. But just take a step back and take a breath and think about what are you actually trying to do and achieve. And then that will help you think through what are your potential risks that you may may be bringing on to the organization that you wanna help plan and mitigate for. Right? So, you know, just take a breath before you kind of dive head first, which I know is hard, because I think it'll help everyone, you know, down the road. No. Thanks. I I appreciate it. We lost our our other panelist, Josh. He was on the mobile technology, and I think Battery cheated him out of his final few minutes. But, we wanna appreciate I appreciate Josh's time. Dave, Ankur, great conversation. Hope it's been valuable to the audience. Like you said, we could be talking about this all day. We should do a podcast. I love this. Let's get there. Appreciate everybody joining. One last, comment if, you know, you enjoyed this discussion. Matriga's got our product launch event on December 3. If you're interested in that, please visit our website. You can sign up. It's gonna be exciting. We got a lot of new cool things that we're launching, and as a product guy, I always like to talk about new cool things we bring in the market. With that, everybody enjoy the rest of your day, and, have a happy Thanksgiving. Thank you all. Thank you. so much. Take care. Thank you.