Vollständiges Transkript von What DNS Can Reveal About Modern Cyber Threats

would be like the company Nvidia. 00:04:50.800 --> 00:04:57.920 You know, they they use DNS filter to be securing them and all their employees and some of their data centers from online threats. 00:04:58.079 --> 00:05:08.399 So I think an everyday use case on the threat situation might be like company has email security, endpoint security, whatever it may be. 00:05:08.639 --> 00:05:16.480 Bad email gets through, think like maybe a phishing email, like it's some chase, you know, looks like an email from Chase Bank or something like that. 00:05:16.800 --> 00:05:27.439 And it's fake, they go and they click on that link, and we will, you know, use our machine learning to detect it in real time and say that is not a genuine link, and we'll stop them, you know. 00:05:27.680 --> 00:05:37.360 So we kind of stop something from becoming bad before it ever happens because the connection is not actually formed in the first place. 00:05:38.639 --> 00:05:39.839 Yeah, it's really important. 00:05:40.000 --> 00:05:40.879 And why why is that? 00:05:40.959 --> 00:05:45.920 I mean, uh everyone in IP understands DNS is such an important place. 00:05:46.319 --> 00:05:54.160 So many issues come through DNS, whether inadvertent or or attacks, other things, configuration issues. 00:05:54.319 --> 00:05:55.680 But why cyber attacks? 00:05:55.759 --> 00:06:01.040 Why is it an important step or or barrier before they can reach users and devices? 00:06:02.399 --> 00:06:09.120 Yeah, well, you know, there is that high, it's there's literally a high queue, and it's it's you know about how it's always DNS. 00:06:09.199 --> 00:06:10.240 So you're right. 00:06:10.720 --> 00:06:13.040 You know, it tends to cause some problems. 00:06:13.199 --> 00:06:30.000 And I think it's generally because it's kind of it's the answer for why there's a, you know, often it not not with DNS filter, of course, but issues with the the technology in general and why it's also such a targeted layer, I think it comes down to really two things. 00:06:30.079 --> 00:06:34.240 Like one is just the fact that every single thing uses it. 00:06:34.480 --> 00:06:40.480 So you could imagine, even down to something like an MRI machine inside of a hospital. 00:06:40.639 --> 00:06:46.079 I mean, if it's internet connected, you can't necessarily install like endpoint security on it. 00:06:46.319 --> 00:06:59.040 So when you think there's there's it's an overlooked layer that a lot of people don't think about because it just when you get an internet connection from your ISP, it just comes with some server for DNS. 00:06:59.199 --> 00:07:04.560 You never even necessarily think or know about it, but it's tremendously powerful. 00:07:04.720 --> 00:07:14.319 Like 80, I think the statistic is just around 80% of all attacks out there do involve the DNS layer at some point. 00:07:14.720 --> 00:07:31.120 And it's important to use something trusted because when you think about it, it's like, I don't know, imagine a synonym or a

comparable situation would be like you're driving down the street and you ask somebody for directions, you don't know who that person is, right? 00:07:31.279 --> 00:07:38.399 And they tell you turn right and then you go and get carjacked, you know, because you believe them and that that's the that's the location you should go. 00:07:38.639 --> 00:07:40.399 Same thing with DNS, right? 00:07:40.480 --> 00:07:47.600 You have to you have to trust uh your your computer just uh your device just trusts that it's giving the right answer. 00:07:47.839 --> 00:08:08.000 So if you've configured it in a way such that it's using some third-party uh service you don't control or whatever, and somebody breaches that third party, every time you think you're going somewhere legitimate, it's very easy for the attacker to just direct you right to them as a middleman, and you may not even actually ever even know it. 00:08:08.079 --> 00:08:10.639 It's called a DNS poisoning attack. 00:08:56.129 --> 00:08:58.690 Yeah, that that's insidious to say the least. 00:08:58.930 --> 00:09:01.810 So talk about your launch this week, Luminate. 00:09:02.210 --> 00:09:02.690 What is it? 00:09:02.769 --> 00:09:05.330 What's the big idea behind it? 00:09:06.610 --> 00:09:10.930 Yeah, so it's, you know, I I would say for our history. 00:09:11.009 --> 00:09:26.049 So, you know, as I said, we've kind of been around for about a decade, and for most of our, if actually all of our history until just yesterday, we've been doing one singular product, and it's been focused on providing this DNS service. 00:09:26.529 --> 00:09:36.610 And we think we did a good job at it, but you know, now there's customers who are asking for more, and there's the the world has changed a bit, of course, since we started. 00:09:36.850 --> 00:09:43.330 So Luminate is essentially a platform of five different product suites that we launched yesterday. 00:09:43.570 --> 00:09:58.129 In my mind, I think of it as nearly, you know, four four or five new products entirely, but it's out there to just combat the new threats that we're seeing out there in the world and how fast that we have to adjust to those. 00:09:58.370 --> 00:10:08.850 So, you know, I think one of one of the suites at the forefront of it that we're really focusing on the most is a feature that we call Agent Shield. 00:10:09.250 --> 00:10:15.250 As the name probably implies, it's you know, to protect you and your AI agents, right? 00:10:15.490 --> 00:10:21.970 So the main, the main idea there is that in the past there's been just a human using the device. 00:10:22.129 --> 00:10:28.450 And now there's, you know, or one being, I don't know what you would even call it at this point, but a human's been using it. 00:10:28.529 --> 00:10:34.450 Now there's a second, at least a second thing using your machine, most likely AI. 00:10:34.850 --> 00:10:39.730 And, you know, you can't take the same approach as the as we always have. 00:10:39.889 --> 00:10:44.610 So if

you think about like, I don't know, I like to use the finance example. 00:10:44.769 --> 00:10:50.689 Like, imagine you, Evan, worked on, you know, on a finance team side of an organization. 00:10:51.009 --> 00:11:06.769 I can't, I mean, I could, it would just be like the most cruel boss ever, but I can't say, hey, Evan, you know, you work in finance, so you're only allowed to go to Bancofamerica.com because that's who we use and NetSuite or something, and you can't use your machine for anything else. 00:11:06.929 --> 00:11:08.289 Like that would be terrible. 00:11:08.529 --> 00:11:12.289 But I can tell your agent to behave that way for sure, you know. 00:11:12.529 --> 00:11:24.689 So Agent Shield essentially separates out the traffic that Evan is doing from what Evan's agents are doing, and it allows us to apply a separate policy to each one. 00:11:25.009 --> 00:11:28.529 Additionally, I think there's a lot of organizations out there. 00:11:28.689 --> 00:11:37.490 I mean, we can see it in our data, it's it's crazy, but that don't even know that people are using different AI tools within the organization. 00:11:37.730 --> 00:11:55.169 So Agent Shield can kind of show you what's being used on your network or on your employees' devices, and then allow you to restrict, you know, what type of what platforms, what agents you do want to use, and then you know, specific agent-specific reporting and policies, effectively. 00:11:55.490 --> 00:12:01.570 So that's that's the main, that's the main corner say if I had to pick one of the whole of the whole suite. 00:12:01.730 --> 00:12:11.649 But there's also a threat intelligence component we launched, an encryption and privacy component that we launched, as well as a behavior analytics uh suite that we launched. 00:12:12.129 --> 00:12:13.889 Amazing, much needed. 00:12:14.049 --> 00:12:25.970 And of course, the attackers are early adopters of AI today, and the open source, freely available, almost frontier-level AI that they can just download is incredible. 00:12:26.210 --> 00:12:36.850 So, so from the attacker perspective, what changes have you seen in phishing and malware and malicious domains or otherwise with these new attacks? 00:12:37.330 --> 00:12:41.330 Well, I mean, you know, here we are at the end of October. 00:12:41.570 --> 00:13:00.049 This month is being referred to as Black October, I'm pretty sure, in the in the cybersecurity world, because there have been so many different attacks that occurred just in the last week or two that each one individually would have been one of, if not the largest, in any one of the previous years. 00:13:00.129 --> 00:13:03.809 And we had like six happen all at the same time. 00:13:04.769 --> 00:13:07.409 So, you know, it's a different world to get used to. 00:13:07.570 --> 00:13:14.210 That's why, you know, I'm thankful that we we've had machine learning going for years now, trying to stay ahead of this. 00:13:14.370 --> 00:13:16.850 But yeah, you have to pivot super fast now. 00:13:16.929 --> 00:13:24.289 I mean, patches have to happen in you know, inside of a day, or if not hours, as opposed to weeks. 00:13:24.529 --> 00:13:32.929 You know, I think the scariest thing, I'd love to talk about some of the stats that we saw with with some of those like open weight models. 00:13:33.169 --> 00:13:55.409 But you know, bottom line is I guess the way I look at it is that, you know, a year ago, if if you were sitting here a year ago, you would have to be, you know, top 10 security researcher, good or bad, in the world, to do some of what has happened inside of the past week or two. 00:13:55.649 --> 00:14:00.929 And even even that, I don't know that that's maybe even more than that, right? 00:14:01.009 --> 00:14:06.850 Because some of these vulnerabilities have existed out there in the wild, unknown for a decade or more. 00:14:07.090 --> 00:14:10.210 And now you're putting it's just a matter of money, right? 00:14:10.289 --> 00:14:26.529 If you have the resources, the GPU processing power to run these models, it kind of puts like a major weapon in the hand of anybody out there to, you know, do what they might want to do that previously would take a whole lifetime to learn. 00:14:26.689 --> 00:14:28.289 So it is a little scary. 00:14:28.450 --> 00:14:54.769 And I think, you know, there's a potential that for, you know, I think it's probably gonna get worse before it gets better, but uh everybody's gonna just have to be prepared to react a lot faster and in my opinion, use some of these tools against themselves, which is what we're actually doing right now at DNS filter, you know, to see basically breaking into our own systems, leveraging the same tools the bad guys have. 00:14:55.649 --> 00:14:56.529 Wow, amazing. 00:14:56.610 --> 00:15:09.409 Yeah, just anecdotally, I personally, although I'm kind of a high profile person, have seen, you know, 10x increase in phishing emails and in text phishing just over the past two, three, four weeks. 00:15:09.570 --> 00:15:12.610 It's it's really unbelievable what's happening. 00:15:12.769 --> 00:15:17.649 And oh yeah, there's the the the enterprise is now it's a 24-7 attack. 00:15:17.730 --> 00:15:21.250 It's not it's not just a few attacks a day. 00:15:21.409 --> 00:15:22.769 So kind of shocking. 00:15:22.929 --> 00:15:31.009 And so how does DNS filter use AI to identify those new threats before maybe the more traditional security tools catch them? 00:15:31.330 --> 00:15:31.889 Yeah. 00:15:32.210 --> 00:15:32.689 Yeah. 00:15:32.850 --> 00:15:35.250 So yeah, I'll I'll tell I'll tell you. 00:15:35.330 --> 00:15:38.049 And also I'd come back to the local model thing. 00:15:38.210 --> 00:15:49.330 But the uh so DNS filter, we basically we've been using, you know, I guess you could call it AI, we've been calling it machine learning for since 20, late 2018. 00:15:50.610 --> 00:15:57.409 We use it to we use it to categorize domains, good or bad, and you know, stop threats that

way. 00:15:57.570 --> 00:16:03.009 So it kind of shows up that we're blocking threats on average 10 days faster than the competition. 00:16:03.250 --> 00:16:08.929 So if you think about us, we we have a very wide range of use cases. 00:16:09.169 --> 00:16:20.610 Everything from we do tens of millions of homes through like a leading mesh Wi-Fi router out there to you know, inside of companies like Nvidia, retailers. 00:16:20.769 --> 00:16:24.289 So I'm not saying all this to to brag or anything. 00:16:24.450 --> 00:16:30.529 It's just that it's kind of unique to be in a situation where you're not doing just corporate networks, you know. 00:16:30.689 --> 00:16:33.090 So we see a lot of different traffic. 00:16:33.330 --> 00:16:39.889 Often you often a lot of the stuff that you see that ends up in a corporate network can actually start at a home network first. 00:16:40.129 --> 00:16:45.409 So we're we are looking at every single domain that somebody requests through our system. 00:16:46.210 --> 00:16:52.210 If we have not seen it before, we can actually crawl and categorize it in real time. 00:16:52.370 --> 00:16:56.210 And then once we learn that, it helps every single customer in the world. 00:16:56.370 --> 00:17:06.529 And then obviously, you know, on a nearly daily basis, we're refreshing our entire database in case something has changed, because that's that's an angle too. 00:17:06.690 --> 00:17:30.690 You know, some company, maybe like a dentist's office, had a website, they're around for 25 years, you know, the the owner retires, they let go of the domain, a bad actor picks up that domain and now tries to leverage the reputation of that dentist's website that was not doing anything bad for 25 years to do something bad with it, you know. 00:17:30.850 --> 00:17:40.289 So that machine learning just really helps us stay on top of it and not trust that just because yesterday this site was good, tomorrow it's gonna be good again. 00:17:40.690 --> 00:17:43.250 I guess is the Yeah, didn't think about that scenario. 00:17:43.330 --> 00:17:45.090 That that's a pretty ugly one. 00:17:45.330 --> 00:17:48.850 So you mentioned DNS is a pretty aging technology. 00:17:49.090 --> 00:17:56.530 You know, what are the limits of DNS-based security and you know, things like encrypted internet traffic or other limits? 00:17:56.610 --> 00:18:00.130 And how are you trying to get over, get around those? 00:18:00.690 --> 00:18:03.570 Well, we can definitely deal with the encryption aspect. 00:18:03.650 --> 00:18:12.050 I'd say, you know, no, no one product is ever going to be good enough to be the only thing that you use. 00:18:12.290 --> 00:18:38.290 I think though, you know, I'm pretty biased, but I think DNS is it has it has its limits, as in, you know, you could there's, you know, there's a possibility that you could go to a site that had something bad on it that we didn't know about, which is pretty rare, or you know, you can still have an email come through with

an attachment, like we're we're you know, Gmail, for example, would be a trusted domain. 00:18:38.530 --> 00:18:44.690 So we we we can't tell you if you go download that attachment necessarily that that's going to be bad. 00:18:44.850 --> 00:18:52.210 So I think there's other layers you have to look at, like email security, antivirus, or even EDR type product. 00:18:52.530 --> 00:18:59.890 But, you know, just I think that the least limited technology out there from a threat perspective has to be DNS. 00:19:00.050 --> 00:19:06.290 And just by definition, the fact that it sits between you and every potential connection. 00:19:06.530 --> 00:19:10.450 And then not to mention what I said earlier about like the MRI machine. 00:19:10.530 --> 00:19:16.370 I mean, I know you don't have an MRI machine in your house, most likely or in your in your office, right? 00:19:16.610 --> 00:19:33.010 But like you do have a printer, you do have smart thermostats, IoT devices, you know, other things that often, I mean, we we found one actually just just checking out a new technology on our our chief people officer the other day. 00:19:33.090 --> 00:19:46.370 We actually found out that one of her smart devices in her home that she had brought in there had been compromised before it got on the network, being used as an endpoint for you know a proxy, right? 00:19:46.450 --> 00:19:56.050 So those are the types of things that DNS will will stop that you wouldn't necessarily find with like a traditional solution that you can install on an endpoint. 00:19:56.850 --> 00:19:57.650 Fantastic. 00:19:57.730 --> 00:19:58.850 Well, nice catch. 00:19:59.010 --> 00:20:03.170 So you've grown to almost 60,000 organizations, customers. 00:20:03.410 --> 00:20:05.650 That's an amazing milestone. 00:20:05.970 --> 00:20:08.130 What's the opportunity to scale? 00:20:08.210 --> 00:20:16.050 And and is AI part of that opportunity in terms of customer support and service and RD and development. 00:20:16.370 --> 00:20:19.090 It must be playing a big role there as well. 00:20:19.730 --> 00:20:21.090 Yeah, absolutely. 00:20:21.330 --> 00:20:23.970 I mean, I think sky's the limit for us. 00:20:24.130 --> 00:20:28.770 I mean, it it feels like we're just getting started, even though we're 10 years in. 00:20:29.010 --> 00:20:32.050 It, you know, there's no shortage of things connected to the internet. 00:20:32.130 --> 00:20:33.730 So that's pretty awesome for us. 00:20:33.890 --> 00:20:40.050 But in terms of AI, I think, you know, within the organization, it's definitely helping us to move faster. 00:20:40.290 --> 00:20:45.890 We're leveraging a lot more in every aspect from product to probably data. 00:20:46.050 --> 00:20:53.090 Like, you know, we have we have a massive amount of DNS data that AI is helping us tackle and sift through. 00:20:53.330 --> 00:21:10.610 I think, you know, I had to give it a stat yesterday that if you were to convert all of the DNS data that we house to lyrics for songs, the songs would play for over 11,000 years nonstop before it would run out. 00:21:10.770 --> 00:21:14.290 So being able to sift through that with AI has been awesome. 00:21:14.530 --> 00:21:31.410 And then from like an expansion perspective, I think, you know, I don't know if I I know Cloud, I think it was Cloudflare a few months ago made a statement that AI, that agents are gonna outnumber human traffic on the internet by like thousands of times. 00:21:31.650 --> 00:21:38.850 I'm not so sure I completely agree with that statement, but I do think they are going to outnumber the human users. 00:21:39.090 --> 00:22:01.410 So we're definitely seeing like even having to adjust maybe pricing models or anything like that, where there's going to be essentially, I was just talking with our CTO the other day, there's going to be more than one worker per human at this point, and each one with a different set of unique rules and you know supposed responsibilities that have to be protected. 00:22:01.650 --> 00:22:04.850 So I think it's a it's a crazy challenge. 00:22:05.010 --> 00:22:06.210 Things are moving so fast. 00:22:06.370 --> 00:22:11.570 The biggest challenge is probably that nobody quite knows exactly how to deal with it. 00:22:11.650 --> 00:22:15.330 So everybody's trying to come up with their own unique way right now. 00:22:15.490 --> 00:22:20.770 But it's it is kind of the Wild West, I would say, at the moment in terms of AI and AI. 00:22:21.250 --> 00:22:21.970 Indeed. 00:22:22.770 --> 00:22:24.690 And it's a strange moment. 00:22:24.770 --> 00:22:34.050 You mentioned Wild West, Black October, which is ironic because you talk to friends and family outside the IT or security industry, and no clue. 00:22:34.130 --> 00:22:37.410 It's everything, everything seems fine. 00:22:37.730 --> 00:22:42.770 But in the meanwhile, those CIO CISOs are kind of running around with hair on fire. 00:22:42.850 --> 00:22:43.570 Is it really? 00:22:44.450 --> 00:22:45.250 Challenging moment. 00:22:45.410 --> 00:22:55.730 Any advice to them, besides working with DNS Filter, obviously, any advice to them over the next weeks and months to kind of get through this period or what the next period might be? 00:22:56.050 --> 00:23:00.610 Yeah, well, they probably just didn't have enough time to call their friends and family to even tell them yet. 00:23:01.010 --> 00:23:02.450 That's probably what happened. 00:23:02.690 --> 00:23:07.890 But I think, you know, I think that I would say you have to get ahead of them. 00:23:07.970 --> 00:23:10.450 Like you not using DNS Filter or not. 00:23:10.530 --> 00:23:17.730 I really I'm a big proponent of using some of these tools against yourself if you can, and not to underestimate that. 00:23:17.890 --> 00:23:26.290 You know, I think before organizations, including DNS Filter, would do like pen testing and things like that with third parties. 00:23:26.370 --> 00:23:37.090 And you do it on a less regular basis, I would say, you know, a

lot of companies, maybe it's sort of quarterly, annually, maybe monthly, in some more aggressive situations. 00:23:37.810 --> 00:23:52.450 I think you have to consider as a as a CISO, somebody leading a security department, consider using these tools to start doing this on more of a daily, weekly basis, um, and get a lot more aggressive. 00:23:52.610 --> 00:24:09.410 It's a little a little sidebar, interesting thing is that so I had this is where this is what really resonated for me is that I went to a sort of a private security trust group meetup, I would say, back in August after Black Hat. 00:24:09.730 --> 00:24:23.330 We had somebody come in who was a previous uh ran security over at an intelligence agency previously, and they they gave some stats on some of what the models were capable of at that point. 00:24:23.570 --> 00:24:37.170 And, you know, they were kind of comparing the local models, the the Chinese-based local models like Deep Seek, GLM and everything, compared to like, you know, Mythos and all the ones, you know, the ones Astro, the ones that you normally hear about in the news. 00:24:37.410 --> 00:24:44.690 And it was scary to see that they kind of broke the tasks down in low, medium, high, and extra high difficulty. 00:24:44.930 --> 00:25:09.570 And the US frontier models made by, you know, anthropic and and open AI and the such, on the extra high and the high, they outperformed these local open weight models by factors of high dozens or low hundreds to even thousands of times better when it got to like, you know, the extra high levels of uh difficulty. 00:25:09.810 --> 00:25:18.530 But on the low and medium tasks, the open weight models, believe it or not, actually outperform the uh the frontier models today. 00:25:18.850 --> 00:25:20.370 I mean, that was the case back in August. 00:25:20.450 --> 00:25:21.970 I'm sure it's only got better. 00:25:22.130 --> 00:25:23.650 And it's only going to keep getting better. 00:25:23.810 --> 00:25:37.810 And you think about somebody can just go onto Hugging Face and download one of those models right now with a powerful enough machine that you're talking not even$5,000, kind of weaponize themselves. 00:25:37.970 --> 00:25:47.010 So I think as a CISO, you have to start thinking about doing some of that against yourself and be prepared to move a lot faster and more aggressively than before. 00:25:47.410 --> 00:25:48.370 Wow, great advice. 00:25:48.530 --> 00:25:50.130 First time I've I've heard that one. 00:25:50.290 --> 00:25:52.770 And well, congratulations on the on the great work. 00:25:52.930 --> 00:25:57.410 Where can people meet you or the team over the next couple of months in the run up to year end? 00:25:57.490 --> 00:26:00.530 Any any events or other plans worth calling out? 00:26:00.850 --> 00:26:03.410 Yeah, well, owe DNSfilter.com. 00:26:03.650 --> 00:26:04.690 So that's a good one. 00:26:04.930 --> 00:26:10.530 We're gonna be at IT Nation in uh Orlando next week, which was a big MSP conference. 00:26:10.690 --> 00:26:13.970 And then the next major one is probably gonna be RSA next year. 00:26:14.050 --> 00:26:18.690 You know, we're always at RSA, Black Hat, Falcon, all the big conferences. 00:26:18.850 --> 00:26:20.450 So definitely stop by. 00:26:20.530 --> 00:26:26.450 I'll probably be there and definitely happy to talk to anybody who wants to chat about this stuff. 00:26:26.610 --> 00:26:27.890 I'm really passionate about it. 00:26:28.210 --> 00:26:32.050 Well, it's come through and congratulations on the incredible work to you and the team. 00:26:32.130 --> 00:26:33.010 Thanks so much, Jen. 00:26:33.410 --> 00:26:34.210 Thank you, Evan. 00:26:34.450 --> 00:26:34.930 Appreciate it. 00:26:35.010 --> 00:26:35.810 Have a great day. 00:26:36.130 --> 00:26:38.210 Thanks, and thanks everyone for listening and watching. 00:26:38.290 --> 00:26:47.090 And also check out our TV show, techimpact.tv and cyberimpact.tv on Bloomberg Television and Fox Business Monthly. 00:26:47.250 --> 00:26:47.810 Thanks, everyone. 00:26:47.890 --> 00:26:48.690 Thanks, Ken. 00:26:48.930 --> 00:26:49.330 Thank you. 00:26:49.490 --> 00:26:49.890 Bye bye.