WEBVTT
00:00:05.200 --> 00:00:07.919
Hello, everyone, and welcome back to the SourceForge podcast.
00:00:08.000 --> 00:00:12.480
I'm your host, Bo Hamilton, senior editor and multimedia producer here at SourceForge.
00:00:12.720 --> 00:00:21.839
Today we are heading into the cybersecurity space with today's episode, where uh one of the oldest ideas in the field is quietly falling apart.
00:00:22.000 --> 00:00:30.000
For years, uh, the idea around security was was built around protecting a perimeter, uh, a really clearly defined boundary with your data inside it.
00:00:30.239 --> 00:00:36.399
But today, uh work happens across a number of different devices, laptops, SaaS apps, cloud services.
00:00:36.560 --> 00:00:43.119
You have, of course, generative AI tools and increasingly these AI agents that are taking over and accessing and moving data on their own.
00:00:43.280 --> 00:00:50.799
And that shift is forcing companies to really rethink not just how they protect sensitive information, but where those protections actually need to live.
00:00:51.119 --> 00:01:04.319
Now, my guest today is AJ Gulati, co-founder and CEO of Kite Cyber, an endpoint native cybersecurity company out of the Bay Area that puts data security right at its source, the the device where work actually happens.
00:01:04.480 --> 00:01:16.959
So instead of running five separate security tools, they roll data loss prevention, AI agent security, endpoint management, and zero trust, among other things, all into a single lightweight agent.
00:01:17.200 --> 00:01:20.799
Now, AJ's resume is uh is quite impressive.
00:01:20.879 --> 00:01:28.879
Before Kite Cyber, he was a senior architect and RD lead over at VMware, where he designed flagship products like DRS and storage DRS.
00:01:29.040 --> 00:01:31.840
He's got more than a dozen patents to his name.
00:01:31.920 --> 00:01:39.599
He's got a PhD from Rice, and he's founded and run multiple companies before this one, including two other AI companies in the Vision AI space.
00:01:39.840 --> 00:01:44.799
So he's uh he's seen a few of these platform shifts up close and personal, I would say.
00:01:45.120 --> 00:01:55.439
Now, uh in this uh conversation, we're gonna talk about why the endpoint is the right place to sort of draw that line, what a version of DLP data loss prevention people don't hate actually looks like.
00:01:55.599 --> 00:02:00.400
And then, of course, what security means when every employee has an AI agent working for them.
00:02:00.560 --> 00:02:01.920
So we've got a lot to get into.
00:02:02.079 --> 00:02:06.719
I know that was a little bit of a wordy introduction here, but AJ, I'm really happy to have you on the show.
00:02:06.879 --> 00:02:07.920
Glad you could join us.
00:02:08.639 --> 00:02:09.840
Bo, glad to be here.
00:02:09.919 --> 00:02:11.360
Thanks for having me.
00:02:12.080 --> 00:02:12.639
Of course.
00:02:12.800 --> 00:02:14.800
So let's start at the very top here.
00:02:15.039 --> 00:02:20.159
Somebody's hearing the name Kite Cyber for the first time right now, listening to this episode.
00:02:20.319 --> 00:02:22.879
Can you help just explain what you do?
00:02:23.039 --> 00:02:24.800
What is Kite Cyber?
00:02:25.199 --> 00:02:25.599
Sure.
00:02:25.840 --> 00:02:33.439
So, Bo, Kite Cyber is a Gen AI and data security company where our product runs directly on the endpoint.
00:02:33.599 --> 00:02:40.639
What I mean by endpoint is the laptops and devices that your team actually works on and uses day to day.
00:02:40.879 --> 00:02:50.960
Now, instead of routing everything through a network appliance or a cloud proxy, we put one lightweight agent on the device which can see the full picture.
00:02:51.199 --> 00:02:59.280
That includes device posture, OS activity, process activity, data classification, user activity, and network activity.
00:02:59.520 --> 00:03:15.680
And this single vantage point, which is the end point, lets us protect the sensitive data and enforce zero trust across both human as well as AI agent activity without the blind sports of traditional network-only or cloud-only tools.
00:03:16.080 --> 00:03:16.479
Got it.
00:03:16.719 --> 00:03:25.360
Okay, so you're you're sitting really uh on the device itself watching how data actually moves and not just where it lives.
00:03:25.520 --> 00:03:32.240
Um I I think that's interesting because I think most people still sort of picture security like as a wall around a building, right?
00:03:32.400 --> 00:03:34.159
You have that perimeter, as I mentioned earlier.
00:03:34.319 --> 00:03:38.479
And it sounds like that that building doesn't really exist anymore.
00:03:38.639 --> 00:03:40.400
Um I want to ask you about that.
00:03:40.479 --> 00:03:48.719
Like, what's what's actually different about the way people work now that makes the old security playbook just harder to lean on?
00:03:49.360 --> 00:03:54.479
So I would say there are two big shifts that we have seen, Bo, in the way people work.
00:03:54.879 --> 00:03:59.120
First is that the work has really left your office and network perimeter.
00:03:59.199 --> 00:04:02.000
And the shift actually started at the time of COVID.
00:04:02.400 --> 00:04:05.280
But literally now people work from anywhere.
00:04:05.439 --> 00:04:11.280
They could be on any network, they could be working using SaaS apps, Gen AI apps.
00:04:11.439 --> 00:04:18.079
So the old saying that guard the network edge model that doesn't work and it doesn't have the coverage anymore.
00:04:18.160 --> 00:04:22.480
You can't even get all the data to come to a single device in most cases.
00:04:23.040 --> 00:04:31.279
Second big shift, which has happened in, I would say, last one year or so, where endpoint is not owned by only humans now.
00:04:31.439 --> 00:04:36.079
I talk to so many companies and they say our team is using a bunch of agents.
00:04:36.240 --> 00:04:38.879
We don't know who is using what type of agent.
00:04:39.120 --> 00:04:42.319
And can you tell us what agents are being used?
00:04:42.560 --> 00:04:54.480
And that's another big shift where AI agents and co-pilots and assistants are acting on the device with the person's own session at machine speed.
00:04:54.720 --> 00:05:12.800
And based on some studies, they already outnumber human identities in the enterprise by roughly 40 to 1, which means that the previous generation tools, which were built to watch human activity at keyboard, simply they aren't designed to see and deal with the agent activity.
00:05:13.040 --> 00:05:19.600
And I feel the security also has to move where these agents are working, and that is the endpoint.
00:05:20.079 --> 00:05:21.680
That's a great explanation of it.
00:05:21.759 --> 00:05:34.639
Yeah, I mean it's 40 to 1 uh AI agents outnumbering the employee 40 to 1 in many cases, and that's just going to that number's just going to grow as as agents continue to uh get more uh prevalent.
00:05:34.879 --> 00:05:35.839
I want to ask you about that.
00:05:36.079 --> 00:05:42.079
So every every employee has Chat GPT open in a tab nowadays, and we've got these these agents acting on their own.
00:05:42.240 --> 00:05:53.920
When it's when it's so easy to paste, summarize, upload, or just hand data off to a tool, what's that that new risk that didn't exist a couple years ago?
00:05:54.160 --> 00:05:58.399
Can you help kind of explain that new sort of risk factor involved here?
00:05:59.199 --> 00:05:59.920
Sure, sure.
00:06:00.240 --> 00:06:08.000
So the thing is that most of the cybersecurity tools, they were designed to see one slice of data at a time.
00:06:08.240 --> 00:06:23.839
So for example, your network security tool would see the traffic, your SAS app visibility tool would see the login, your email tool will see the attachments, your device EDR or device management tool would know the device activity.
00:06:24.160 --> 00:06:28.319
Now the challenge is that nobody is stitching all of this together.
00:06:28.639 --> 00:06:39.120
Whereas when the agents are working on your data, you may have sensitive data on the device, you need to know what is sensitive data, then who is touching that data?
00:06:39.279 --> 00:06:40.879
Are they allowed to touch it?
00:06:41.120 --> 00:06:43.360
And where are they sending that data?
00:06:43.600 --> 00:06:51.360
And all this information about the sensitive data, who is touching, where is it going, is it uh operation allowed?
00:06:51.519 --> 00:06:55.120
That doesn't come under the purview of a single solution.
00:06:55.360 --> 00:07:07.279
And that makes it much harder for existing tools to deal with these Gen AI type of workloads as well as the behavior of employees when they are working with Gen AI tools.
00:07:07.680 --> 00:07:13.920
Well, that's the part that gets me is is it's not so much like uh malicious actors that you have to deal with.
00:07:14.079 --> 00:07:26.800
It's uh a lot of times it's just the well-meaning sort of employee that pastes a contract into a chatbot to summarize it or something, or it's an aid agent doing it for for them, um, carrying out that task for the employee.
00:07:27.120 --> 00:07:34.000
Um, which just yeah, just makes me sort of wonder how much of the security teams can even see because you can't stop what you don't know is happening, right?
00:07:34.399 --> 00:07:43.680
Um and that kind of gets me to that question of like, why is it so hard for security teams to just answer the question of where is our sensitive data actually going?
00:07:44.319 --> 00:07:45.199
True, true.
00:07:45.439 --> 00:08:02.560
See, the challenge is that if you look at just the network security tools, the fact that they have to decrypt and re-encrypt the data on the wire, which they can only do for certain subset of applications or sites, they can't do it for other uh applications.
00:08:02.959 --> 00:08:07.839
Any site which is end-to-end encrypted, they have to basically bypass that data.
00:08:08.160 --> 00:08:17.040
Second challenge is that by the time the request comes on the network, you already have lost the information of what may have happened on the device.
00:08:17.199 --> 00:08:22.000
So, for example, let's say there is a sensitive file and I want to exfiltrate that file.
00:08:22.160 --> 00:08:32.639
I can convert that file by doing a base 64 encoding or converting that into a PNG or some other format, which I can upload through a network security tool.
00:08:32.720 --> 00:08:37.600
And then once I get it on the other side, I can recreate that original document.
00:08:37.840 --> 00:08:48.960
And that makes it very difficult because you don't have the whole information of what file came to the device, what operation happened on the device, and then what came on the wire.
00:08:49.200 --> 00:08:50.879
And that makes it very difficult.
00:08:51.039 --> 00:08:55.200
Now, one can argue that what about the endpoint security solutions?
00:08:55.360 --> 00:08:57.200
They should be able to see that.
00:08:57.440 --> 00:09:08.159
Most of the endpoint security solutions like EDR or endpoint DLP, they are worried about what's happening on the endpoint and what's running is that safe or malicious.
00:09:08.320 --> 00:09:16.480
They don't have visibility into what's going on the wire and where it is going, is that approved or unsanctioned?
00:09:16.720 --> 00:09:28.399
So it's just there is a big context gap these days in various security tools where nobody has the complete context, and that leads to the security blind spots that the teams see.
00:09:28.960 --> 00:09:31.360
Okay, that that makes yeah, that makes a lot of sense.
00:09:31.440 --> 00:09:40.799
That the there's just so many, uh, so much data flowing through all these different channels that were sort of never maybe really designed to be monitored in the first place, I guess.
00:09:40.960 --> 00:09:45.919
And and seeing the the endpoint, um, the argument for the endpoint makes sense.
00:09:46.000 --> 00:09:49.440
I mean, your whole premise is sort of is that the endpoint is where this needs to happen, right?
00:09:49.519 --> 00:09:53.840
The the laptop or the device, um not so much the network or the cloud.
00:09:54.000 --> 00:09:58.399
Like what makes the endpoint sort of the right place to draw that line?
00:09:58.799 --> 00:10:09.600
The reason endpoint is really the main place to get all the information is because if you think about endpoint, on endpoint I can see the device posture.
00:10:09.759 --> 00:10:15.600
I know whether the device has hard disk encryption turned on or other compliance controls in place.
00:10:15.840 --> 00:10:18.559
I know which agents are running on the device.
00:10:18.799 --> 00:10:21.360
I know which files the agents are touching.
00:10:21.519 --> 00:10:24.720
I know if the files are sensitive or not sensitive.
00:10:24.960 --> 00:10:32.480
If the agent is touching a source code file and the agent is actually doing the work in terms of coding, it's a legitimate access.
00:10:32.720 --> 00:10:40.960
But if your coding agent is somehow reading a PDF file with your employee list and their salaries, there is a problem somewhere here.
00:10:41.519 --> 00:10:44.399
And then the agent is uploading it somewhere.
00:10:44.639 --> 00:10:52.480
The question is if the agent is talking to a standard LLM, okay, yes, the agent will send some data to LLM to get the information.
00:10:52.639 --> 00:11:00.320
But if the agent starts uploading that file onto a OneDrive or a Dropbox, you know there is a problem going on somewhere.
00:11:00.639 --> 00:11:20.720
So the reason we run on the endpoint is because we believe endpoint is the only single vantage point where you can see all the activity and you can make a decision if the file is sensitive, if the process which is touching the file is legitimate, if the network connection where the file is going is legitimate.
00:11:20.960 --> 00:11:29.840
So you can make a much more real-time decision on what's going on rather than dealing with this after the fact.
00:11:30.080 --> 00:11:43.279
It's like, you know, I usually tell people that, you know, when you have the whole information, you can actually prevent the leak and not write the obituary because otherwise stuff happens and then you are just writing about it.
00:11:43.440 --> 00:11:46.879
And which is the sad part of a lot of security tools.
00:11:47.360 --> 00:11:48.080
Oh, absolutely.
00:11:48.159 --> 00:11:48.399
Yeah.
00:11:48.480 --> 00:11:54.799
There's and there's uh you're you know, you're reading about all these different security blunders and and issues every day.
00:11:54.960 --> 00:11:59.279
You know, there's there's hundreds of stories, it seems like, every single day about various issues.
00:11:59.519 --> 00:12:00.879
Um, but that that makes sense.
00:12:00.960 --> 00:12:02.559
Thanks you for the the explanation there.
00:12:02.639 --> 00:12:16.720
And and just uh sort of every every one of those pathways on someone's device, um you know, it starts there, and so you catch it at the source, I guess, instead of the uh chasing it sort of downstream from these these networks and these cloud providers.
00:12:17.600 --> 00:12:22.240
Um so that vantage point, yeah, the vantage point um is is really is really important.
00:12:22.799 --> 00:12:31.440
Um and then not to have you kind of you know get too redundant here with with some of your um answers, but um what does that actually change?
00:12:31.519 --> 00:12:40.960
So when you're able to can actually see things as they happen, what does it actually change about how a company stops a leak, for example, versus you know just finding out about it after the fact?
00:12:41.600 --> 00:12:47.600
Yeah, so I would say fundamentally what happens is it takes your security from forensics to prevention.
00:12:47.840 --> 00:12:56.879
Instead of reading a report that the leak happened and now let's investigate, we want to stop it in the instant it's about to happen.
00:12:57.200 --> 00:13:00.960
And that is the fundamental change that we bring.
00:13:01.200 --> 00:13:07.679
And the reason we can do that is because we are on the endpoint where the activity is actually happening.
00:13:07.919 --> 00:13:12.240
So that way we can see the activity and then we can tell the person.
00:13:12.399 --> 00:13:19.440
And another interesting thing that we have found is in our tool, we do what is called as um continuous coaching.
00:13:19.679 --> 00:13:26.799
What that means is that if somebody, let's say, copies sensitive data from a file and they paste it into Chat GPT.
00:13:26.960 --> 00:13:28.240
Now they haven't sent it yet.
00:13:28.399 --> 00:13:30.559
They have literally just pasted the data.
00:13:30.799 --> 00:13:37.200
The moment they paste the data, we would show a pop-up saying you have copied and pasted sensitive data.
00:13:37.360 --> 00:13:40.639
Are you sure you are really trying to send it to this tool?
00:13:40.799 --> 00:13:43.360
It should not be allowed as per company policy.
00:13:43.600 --> 00:13:46.240
You better make sure this is an approved action.
00:13:46.480 --> 00:13:53.039
And now the person can make a judgment call because sometimes people might be doing it just out of ignorance.
00:13:53.200 --> 00:13:57.039
They just didn't know that what they are trying to do is actually not safe.
00:13:57.279 --> 00:14:31.519
And we have seen many customers tell us that just by the fact that we are nudging the employees on such operations, it has changed their behavior, which I believe is much better than the annual security training that companies go through, where once a year they will send you a uh PowerPoint to watch or a video that you see, and then they say, Okay, you have gone through your security training, the video tells you not to click on things, the video tells you not to send sensitive data, and 10 minutes after that video, the employee also has forgotten about the video.
00:14:32.080 --> 00:14:32.960
Yeah, absolutely.
00:14:33.120 --> 00:14:40.159
I mean, I I'm one of those people that that needs the reminders because I've I've got so many things, you know, just multitasking and going on.
00:14:40.240 --> 00:14:41.840
My attention span is all over the place.
00:14:41.919 --> 00:14:50.879
So just having the reminder uh to not paste, you know, sensitive information uh into a chat GPT box, for example, um, I can see the benefits there.
00:14:51.360 --> 00:14:52.879
Okay, so that's a great, that's a great feature.
00:14:52.960 --> 00:14:56.159
And I also love that you mentioned the forensics to prevention.
00:14:56.399 --> 00:15:06.720
Uh basically stopping it at the door is kind of uh the kind of big takeaway here, I guess, with with stopping a leak and and uh versus finding out after the fact.
00:15:07.200 --> 00:15:16.799
Um but I also want to get into the uh data loss prevention here, which has sort of been promising that stance um for the last couple decades or so.
00:15:17.200 --> 00:15:24.639
And I I don't think anyone sort of it's it my the general consensus I've gathered is DLP isn't something that's very um beloved.
00:15:25.039 --> 00:15:30.240
Um it's it kind of delivers a lot of false positive, a lot of IT teams end up turning it off.
00:15:30.480 --> 00:15:35.519
What does a a version of DLP that people don't hate look like?
00:15:36.000 --> 00:15:37.919
Yeah, that's very true, uh Bo.
00:15:38.399 --> 00:15:44.639
So DLP has a very bad reputation for being noisy and very complex to set up.
00:15:44.879 --> 00:15:46.320
And the reason is very simple.
00:15:46.480 --> 00:15:49.759
See, old DLP was around pattern matching.
00:15:50.000 --> 00:15:54.320
So you put a pattern, if that pattern hits in a file, you will get an alert.
00:15:54.480 --> 00:15:58.960
And it leads to a lot of false positives because it doesn't understand the context.
00:15:59.120 --> 00:16:01.039
And I'll give you a very simple example.
00:16:01.200 --> 00:16:03.440
Let's say you are looking for a date of birth.
00:16:03.600 --> 00:16:08.559
So you put a pattern saying if I see a date, it could be a date of birth, flag it.
00:16:08.720 --> 00:16:13.360
Now you know there are a lot of dates in a lot of documents which are not a date of birth.
00:16:13.600 --> 00:16:19.360
So then people use some heuristics around it saying, oh, there should be a DOB somewhere or things like that.
00:16:19.519 --> 00:16:23.120
But at the end of the day, it leads to a lot of false positives.
00:16:23.279 --> 00:16:27.120
And you have to set up so many of these pattern matching rules.
00:16:27.360 --> 00:16:39.279
Now, modern DLP solutions like Kite Cyber and few others, they use LLM-based classification, which means it can actually read and analyze the data the way a person would.
00:16:39.600 --> 00:16:48.720
So, for example, if I show you a document in which there are a bunch of dates, I'm sure you can tell very easily if it's a date of birth or if it's an actual regular date.
00:16:48.960 --> 00:16:52.559
And that is what a LLM-based engine can do.
00:16:52.799 --> 00:16:57.600
It can flag what actually matters and it stays quiet on the rest of the stuff.
00:16:57.840 --> 00:17:03.200
So the thing is, I usually tell people the problem with the old DLP wasn't that it cried wolf.
00:17:03.279 --> 00:17:04.160
Yes, it does.
00:17:04.400 --> 00:17:08.160
The problem is it can't tell the difference between a wolf and a dog.
00:17:08.480 --> 00:17:12.880
And then you would see a lot of these alerts and you have to deal with them now.
00:17:13.440 --> 00:17:27.279
Okay, so it really does come down to context, knowing, knowing the difference between uh like someone, someone doing their job and someone doing something risky, um, and then you know, not sort of blocking everything with the word confidential in it.
00:17:27.440 --> 00:17:30.720
So really understanding the the context is is is really key.
00:17:31.279 --> 00:17:37.519
Um so yeah, the you know, even the smartest systems, you know, they'll they they still uh they're still going to say no sometimes.
00:17:37.599 --> 00:17:45.680
And that's uh sort of where that you have that friction, I understand, with with a lot of employees um using some of these these platforms for the security platforms.
00:17:45.839 --> 00:17:53.440
How do you like how do you lock things down without employees just feeling like they're just fighting their own laptop all day?
00:17:53.759 --> 00:17:55.200
That's a very good point, Bo.
00:17:55.359 --> 00:18:01.759
I think security typically is sort of considered as a hindrance in productivity.
00:18:02.000 --> 00:18:07.039
It's a bother to employees, and it has that bad reputation as well.
00:18:07.200 --> 00:18:13.039
Most people I talk to, they say security has installed these eight different agents and tools on my device.
00:18:13.200 --> 00:18:19.119
My device takes 10 minutes to boot up and it's just hurting my productivity.
00:18:19.440 --> 00:18:27.359
Now, you know, the best security is the kind that people don't feel, and that is our core goal when we are designing the product.
00:18:27.599 --> 00:18:45.519
So, in our case, for example, we have one lightweight agent under 2% CPU overhead, and the policies are there where they only intervene when there is a genuine risky action, so that the remaining 99% of the day, nobody even notices that it's there.
00:18:45.920 --> 00:18:53.440
And we want to make it clear to the employee when an alert comes up, what's the reason for the alert?
00:18:53.599 --> 00:18:54.880
What were they trying to do?
00:18:55.039 --> 00:19:04.160
What policy it may be impacting, and when is it possible to get out of that blockade and get permission to bypass that control?
00:19:04.319 --> 00:19:11.359
So, for example, let's say you are trying to upload some file and you believe it's to a legitimate place and it should not be blocked.
00:19:11.680 --> 00:19:28.079
So we even give an option to employees where they can actually ask for an approval or they can do a self-attest where they can say, this is the file, and then here is where the file is going, and they can get permission to do that action without waiting too long.
00:19:28.319 --> 00:19:35.200
And the fact that people can get out of the problems is actually making a big difference in their user experience.
00:19:35.440 --> 00:19:46.079
Because typically what happens is people get stuck on some action, then they have to go and file a ticket, then IT or security would look at it, and two days later they will give you a permission.
00:19:46.240 --> 00:19:49.680
By that time, I mean people have lost the context.
00:19:49.839 --> 00:19:53.519
They were trying to do something and they feel stuck in the action.
00:19:53.759 --> 00:20:02.559
So I feel that if your employees are fighting the security tool, more than likely the employees will win and your data will lose.
00:20:02.799 --> 00:20:08.160
So don't make the tool fight the employees, make it work uh with them nicely.
00:20:08.640 --> 00:20:09.279
Absolutely.
00:20:09.440 --> 00:20:11.039
Yeah, yeah, very, very true.
00:20:11.200 --> 00:20:24.640
I mean, if there's if there's a uh if it's gonna slow down your productivity and and cause a bunch of obstacles and and pop-up boxes and whatnot, um employees are just are are going to find ways to get around it, right?
00:20:24.720 --> 00:20:27.279
And that leads to all sorts of security holes.
00:20:27.920 --> 00:20:58.880
Um so yeah, very, very uh very I imagine it's tough to find that balance of you know having robust, really robust security and and and working with employees and kind of the learning curve and the giving them the sort of the the education of like why the security tools are in place in the first place, because I think that's important to understand like why you even you know go through the the rigmarole of of um you know all these different like two-factor authentication and um having all these paste copy and paste reminders and whatnot.
00:20:59.680 --> 00:21:12.640
Um but it sounds like you have the a very capable lightweight agent that handles things, one agent, one console instead of you know a bunch of different tools that each cover a slice that don't talk to each other and cause a whole bunch of headaches for employees.
00:21:12.960 --> 00:21:13.519
True, true.
00:21:13.759 --> 00:21:16.640
I actually I see the same thing even in parenting as well.
00:21:16.799 --> 00:21:20.240
I think sometimes you have to set rules and say no to certain things.
00:21:20.400 --> 00:21:26.400
And at that time the kids may not realize what's the reason for that, and you have to explain it.
00:21:26.720 --> 00:21:32.559
But it's the same analogy that certain decisions are there just for everyone's safety.
00:21:32.960 --> 00:21:33.759
Yeah, very true.
00:21:33.839 --> 00:21:36.319
And like with parenting, it's like you do the best you can.
00:21:36.480 --> 00:21:40.799
There's no, you know, unfortunately, there's no perfect way to parent, but you just do the best you can.
00:21:41.039 --> 00:21:47.440
Now, let's pull the, let's pull the pull back the from kite cyber specifically for for a minute here with this next question.
00:21:47.519 --> 00:21:49.839
Um, because you've obviously been in this space for a long time.
00:21:49.920 --> 00:21:54.079
And I'm just really curious about what you see people sort of getting wrong.
00:21:54.240 --> 00:21:58.559
Uh, what's a maybe a misconception about cybersecurity that you keep running into?
00:21:58.640 --> 00:21:59.680
You know, something that maybe you wish.
00:22:00.160 --> 00:22:01.440
More people understood.
00:22:01.839 --> 00:22:04.000
That's a great question, Bo.
00:22:04.559 --> 00:22:12.640
I think basically the biggest misconception that I see is that more tools means more protection.
00:22:13.119 --> 00:22:21.599
And a lot of security teams, they have stacked up a dozen products for network, for email, for SAS app, for endpoint.
00:22:21.759 --> 00:22:24.319
And they believe that the coverage adds up.
00:22:24.480 --> 00:22:29.680
They have covered a lot of things using different tools, but unfortunately it doesn't.
00:22:30.000 --> 00:22:38.960
Because when every tool sees their own slice of information, then the gap between the tools is exactly where the data leaks happen.
00:22:39.200 --> 00:22:46.079
And the blind spot is not necessarily in one product, it's actually in the seams between the product.
00:22:46.559 --> 00:22:49.039
And that is a big challenge.
00:22:49.279 --> 00:22:50.640
And it's a misconception.
00:22:50.880 --> 00:22:54.000
Lot of leaders I talk to, they say, Ajay, I have eight tools.
00:22:54.079 --> 00:22:58.799
I'm thinking of this ninth tool to cover this one more gap that I have.
00:22:59.039 --> 00:23:12.559
Now, the second thing actually that I see, which is sort of related to it as a misconception, is that DLP is always painful, noisy, false positive ridden, and it's a full-time role to just keep tuning DLP.
00:23:12.640 --> 00:23:21.039
So that you write a rule, you realize too many false positives, you tweak the rule to reduce it, but you can't shrink it too much because then everything will go through.
00:23:21.359 --> 00:23:29.200
And that is where I think for pattern matching DLP, it was true, but that's not really a law of nature.
00:23:29.440 --> 00:23:41.440
And I feel with the advancement in Gen AI and where the classification really understands the context, the noise can severely drop and the tool gets out of people's way.
00:23:41.599 --> 00:23:51.279
And we have shown with our solution as well that we are able to eliminate almost 95% of the false positives from the DLP and data classification.
00:23:51.599 --> 00:23:56.799
So I would say to summarize, one buying more security tools doesn't close the gap.
00:23:56.960 --> 00:24:04.319
It actually adds more seams where the data can uh slip through and the leak is not inside the tool.
00:24:04.400 --> 00:24:08.799
It's typically the space between the tools that none of them is owning.
00:24:09.279 --> 00:24:11.039
Those are two great misconceptions.
00:24:11.759 --> 00:24:16.160
I want to uh continue uh along the those same lines here with this next question.
00:24:16.319 --> 00:24:27.839
If you could get if you could get every potential customer to understand one thing, you know, shout out from the rooftops, if only you do this one thing, what would that that one thing be?
00:24:28.000 --> 00:24:32.480
And it could be about you know cybersecurity, it could be about the your platform.
00:24:32.799 --> 00:24:35.839
Um feel free to answer it any any which way you please.
00:24:36.319 --> 00:24:41.440
I mean, I would say cybersecurity is a serious problem right now.
00:24:42.079 --> 00:24:53.279
And I find more people are actually underprotected because they feel cybersecurity is um too complex and they don't deploy enough solutions and they deal with it.
00:24:53.680 --> 00:25:01.759
The one thing I would like to mention to everybody is what's changing in the field and why they need to take it more seriously.
00:25:02.079 --> 00:25:15.920
So companies they have visibility into what their people do, but most of them have no visibility into what the AI agents acting on their users' behalf are doing with the same data and the same access.
00:25:16.319 --> 00:25:24.240
And the gap is that majority of activity on your endpoint is being driven by agents now and it's growing.
00:25:24.480 --> 00:25:32.559
And the thing to really understand is that deploying five tools to monitor five things to close that is not going to really help.
00:25:32.799 --> 00:25:39.759
You need to figure out which place you can get the best context and vantage to really close.
00:25:40.000 --> 00:25:48.480
And as I said, endpoint is the only vantage point which can watch your data device identity and the agent activity.
00:25:48.799 --> 00:25:52.720
And in real time, it can act at the moment where it matters.
00:25:52.960 --> 00:26:03.440
So I believe that people have to take this threat very seriously that agents are doing more and more of the work and they don't have visibility into when things go wrong.
00:26:03.680 --> 00:26:16.559
And existing tools, they are watching the exits when somebody has already left, and people have to do something where they can stop stuff or bad stuff from happening in real time.
00:26:17.039 --> 00:26:25.039
Because otherwise, with humans, yes, you could make a mistake, you could upload a bad file, things would happen at a certain speed.
00:26:25.200 --> 00:26:31.759
With agents, the bad stuff can happen at machine speed, which is way too fast for your team to act on.
00:26:32.160 --> 00:26:32.640
Oh, yeah.
00:26:32.720 --> 00:26:43.599
I mean, I can't, it's it's such a wild west right now with what's happening in AI and all these different um these tools and capabilities and this massive exchange of data um going on.
00:26:43.759 --> 00:26:47.440
I it's it's really fascinating to think about where things are going to go.
00:26:47.599 --> 00:26:50.559
The I mean the adoption's already um pretty remarkable now.
00:26:50.640 --> 00:26:55.599
So imagining things uh five years out from now is is almost an impossible task.
00:26:55.839 --> 00:27:03.680
But um, you know, I do I do have to ask, you know, I had I gotta ask, what does endpoint security, you know, look like five years out?
00:27:03.759 --> 00:27:07.279
Um if we can even sort of predict that far, maybe even a few years out.
00:27:07.599 --> 00:27:07.920
True.
00:27:08.000 --> 00:27:15.359
So I would say the biggest shift, first of all, that I see right now that is going to impact cybersecurity is agentic AI.
00:27:15.519 --> 00:27:20.880
And when I say agentic AI, I don't mean chatbot answering questions for users.
00:27:21.119 --> 00:27:36.240
I mean that there are autonomous agents that are running on your device, that are taking actions, they are reading documents, they are moving stuff, they are transforming data, sharing the data, uploading the data, doing all of this at machine speed.
00:27:36.400 --> 00:27:40.880
And this is the fastest growing category of activity on the internet right now.
00:27:41.119 --> 00:27:49.359
And as I said, in enterprise, non-human identities are already outnumbering the human identities almost 40 to 1.
00:27:49.599 --> 00:27:55.039
So I feel that in five years, agents won't be a feature of how work gets done.
00:27:55.279 --> 00:27:57.839
They will be most of how it gets done.
00:27:57.920 --> 00:28:05.279
And that single shift will break the assumption underneath most security products on the market right now.
00:28:05.519 --> 00:28:21.119
Because if you think about it, previous generation products were built to say this is how humans work, malware would work differently, and we can detect the speed of work and action between humans and malware, and we can detect malware.
00:28:21.359 --> 00:28:22.319
Now, guess what?
00:28:22.480 --> 00:28:27.200
Agents work at the same speed as malware because both are programs doing stuff.
00:28:27.440 --> 00:28:37.759
So now, if you were doing anomaly detection between human style and uh program doing bad stuff, that anomaly detection doesn't work between agent and a malware.
00:28:37.839 --> 00:28:39.599
They both would look similar.
00:28:39.920 --> 00:28:49.039
And I feel the industry's whole job over the next five years is this retooling to see and govern a workforce which is not human.
00:28:49.200 --> 00:28:53.359
And it can move thousand times faster than the people can manage.
00:28:53.519 --> 00:28:57.680
And it can follow instructions literally, including malicious ones.
00:28:57.839 --> 00:29:05.119
To give you an example, you know, there is a company that basically did this agent to do invoice processing.
00:29:05.359 --> 00:29:09.920
Now, the job of the agent is to read an invoice and then take action on it.
00:29:10.079 --> 00:29:10.960
Now, guess what?
00:29:11.119 --> 00:29:20.960
People can send an invoice to the agent where underneath the invoice, so the top is the regular invoice, but underneath they can put instructions for the agent itself.
00:29:21.279 --> 00:29:28.720
And not only can you put instructions, you can put it in instructions where it's very hard to even see or read them on the background.
00:29:28.880 --> 00:29:43.599
But the agent does the transcription, it would read the document, convert it to text, and it can read the instructions, and now you can guide the agent to take malicious actions, which agent would do because its job is to read that thing and act on it.
00:29:43.839 --> 00:29:49.680
So there are a lot of such attacks that are going to become possible that people wouldn't have thought of before.
00:29:49.839 --> 00:30:01.119
And now you have agents which are waiting for instructions that come from outside, and that's like you know, the attack is now not having a malicious code running on somebody's machine.
00:30:01.359 --> 00:30:04.559
The attack is just telling the agent to do something bad.
00:30:04.720 --> 00:30:07.599
So it's literally a prompt coming in from somewhere.
00:30:08.240 --> 00:30:21.599
Wow, yeah, those prompt injection uh hacks are are really uh gonna be the the big problem if they aren't already the number one sort of issue, you know, cybersecurity experts are are trying to um handle.
00:30:22.079 --> 00:30:32.319
I think that there's gonna be a lot of interested uh folks listening right now who who want to get their hands on uh with with uh kite cyber and the platform you're building.
00:30:32.559 --> 00:30:34.160
So I want to give you an opportunity.
00:30:34.319 --> 00:30:39.279
Um, can you direct those viewers and listeners to uh kite cyber?
00:30:39.359 --> 00:30:41.119
Where's the best place to go to learn more?
00:30:41.599 --> 00:30:46.000
I think the best place is they can go to the website, which is kitecyber.com.
00:30:46.240 --> 00:30:49.440
We have a free trial, they can sign up for the free trial.
00:30:49.680 --> 00:31:02.480
We also do demos, so they can sign up for a demo and then we get on a call, we show them the demo of the product, we show the kind of activity we are able to catch, the kind of stuff we are able to protect against.
00:31:02.640 --> 00:31:17.519
And the nice thing is because we capture a lot of context around different areas, in most cases, we are able to eliminate two or three different point solutions and deploy a single lightweight agent to give them much better protection.
00:31:17.759 --> 00:31:24.720
And I wish, Bo, I had a different answer than the fact that agents are growing and you have to worry about it.
00:31:24.960 --> 00:31:30.640
But the fact of the matter is employees themselves are going and adding this additional workforce.
00:31:30.799 --> 00:31:34.240
Companies themselves want employees to adopt more agents.
00:31:34.480 --> 00:31:44.160
I just want to make sure that they do it in a secure way and they don't uh get blindsided by some side effect that they didn't think of.
00:31:44.720 --> 00:31:45.279
Absolutely.
00:31:45.440 --> 00:31:53.279
Yeah, I mean, it it's that's just it's just the the nature of uh what's going on here in in in technology and and our our daily lives.
00:31:53.440 --> 00:31:59.599
The um the transformation is uh just fascinating to be um experiencing.
00:31:59.680 --> 00:32:04.079
Uh and and but yeah, I think what you're what you're doing is really impressive and important.
00:32:04.240 --> 00:32:08.480
So I appreciate uh I again I appreciate everything that you've you've shared with us.
00:32:08.799 --> 00:32:10.160
I think this has really been fantastic.
00:32:10.240 --> 00:32:15.839
And um, you know, uh viewers, if you're interested in learning more about kite cyber, again go to kitecyber.com.
00:32:15.920 --> 00:32:17.839
We'll place a link down below in the show notes.
00:32:18.319 --> 00:32:19.839
AJ, this has been fantastic.
00:32:20.000 --> 00:32:21.680
Thank you so much for everything you shared with us.
00:32:22.559 --> 00:32:24.000
Thanks for thanks for having me.
00:32:24.960 --> 00:32:25.279
Of course.
00:32:25.359 --> 00:32:28.000
And thank you all for listening to the SourceForge podcast.
00:32:28.079 --> 00:32:29.680
I am your host, uh Bo Hamilton.
00:32:30.000 --> 00:32:34.400
Make sure to subscribe to stay up to date with all of our upcoming B2B software related podcasts.
00:32:34.880 --> 00:32:36.400
I will talk to you in the next one.
00:00:05.200 --> 00:00:07.919
Hello, everyone, and welcome back to the SourceForge podcast.
00:00:08.000 --> 00:00:12.480
I'm your host, Bo Hamilton, senior editor and multimedia producer here at SourceForge.
00:00:12.720 --> 00:00:21.839
Today we are heading into the cybersecurity space with today's episode, where uh one of the oldest ideas in the field is quietly falling apart.
00:00:22.000 --> 00:00:30.000
For years, uh, the idea around security was was built around protecting a perimeter, uh, a really clearly defined boundary with your data inside it.
00:00:30.239 --> 00:00:36.399
But today, uh work happens across a number of different devices, laptops, SaaS apps, cloud services.
00:00:36.560 --> 00:00:43.119
You have, of course, generative AI tools and increasingly these AI agents that are taking over and accessing and moving data on their own.
00:00:43.280 --> 00:00:50.799
And that shift is forcing companies to really rethink not just how they protect sensitive information, but where those protections actually need to live.
00:00:51.119 --> 00:01:04.319
Now, my guest today is AJ Gulati, co-founder and CEO of Kite Cyber, an endpoint native cybersecurity company out of the Bay Area that puts data security right at its source, the the device where work actually happens.
00:01:04.480 --> 00:01:16.959
So instead of running five separate security tools, they roll data loss prevention, AI agent security, endpoint management, and zero trust, among other things, all into a single lightweight agent.
00:01:17.200 --> 00:01:20.799
Now, AJ's resume is uh is quite impressive.
00:01:20.879 --> 00:01:28.879
Before Kite Cyber, he was a senior architect and RD lead over at VMware, where he designed flagship products like DRS and storage DRS.
00:01:29.040 --> 00:01:31.840
He's got more than a dozen patents to his name.
00:01:31.920 --> 00:01:39.599
He's got a PhD from Rice, and he's founded and run multiple companies before this one, including two other AI companies in the Vision AI space.
00:01:39.840 --> 00:01:44.799
So he's uh he's seen a few of these platform shifts up close and personal, I would say.
00:01:45.120 --> 00:01:55.439
Now, uh in this uh conversation, we're gonna talk about why the endpoint is the right place to sort of draw that line, what a version of DLP data loss prevention people don't hate actually looks like.
00:01:55.599 --> 00:02:00.400
And then, of course, what security means when every employee has an AI agent working for them.
00:02:00.560 --> 00:02:01.920
So we've got a lot to get into.
00:02:02.079 --> 00:02:06.719
I know that was a little bit of a wordy introduction here, but AJ, I'm really happy to have you on the show.
00:02:06.879 --> 00:02:07.920
Glad you could join us.
00:02:08.639 --> 00:02:09.840
Bo, glad to be here.
00:02:09.919 --> 00:02:11.360
Thanks for having me.
00:02:12.080 --> 00:02:12.639
Of course.
00:02:12.800 --> 00:02:14.800
So let's start at the very top here.
00:02:15.039 --> 00:02:20.159
Somebody's hearing the name Kite Cyber for the first time right now, listening to this episode.
00:02:20.319 --> 00:02:22.879
Can you help just explain what you do?
00:02:23.039 --> 00:02:24.800
What is Kite Cyber?
00:02:25.199 --> 00:02:25.599
Sure.
00:02:25.840 --> 00:02:33.439
So, Bo, Kite Cyber is a Gen AI and data security company where our product runs directly on the endpoint.
00:02:33.599 --> 00:02:40.639
What I mean by endpoint is the laptops and devices that your team actually works on and uses day to day.
00:02:40.879 --> 00:02:50.960
Now, instead of routing everything through a network appliance or a cloud proxy, we put one lightweight agent on the device which can see the full picture.
00:02:51.199 --> 00:02:59.280
That includes device posture, OS activity, process activity, data classification, user activity, and network activity.
00:02:59.520 --> 00:03:15.680
And this single vantage point, which is the end point, lets us protect the sensitive data and enforce zero trust across both human as well as AI agent activity without the blind sports of traditional network-only or cloud-only tools.
00:03:16.080 --> 00:03:16.479
Got it.
00:03:16.719 --> 00:03:25.360
Okay, so you're you're sitting really uh on the device itself watching how data actually moves and not just where it lives.
00:03:25.520 --> 00:03:32.240
Um I I think that's interesting because I think most people still sort of picture security like as a wall around a building, right?
00:03:32.400 --> 00:03:34.159
You have that perimeter, as I mentioned earlier.
00:03:34.319 --> 00:03:38.479
And it sounds like that that building doesn't really exist anymore.
00:03:38.639 --> 00:03:40.400
Um I want to ask you about that.
00:03:40.479 --> 00:03:48.719
Like, what's what's actually different about the way people work now that makes the old security playbook just harder to lean on?
00:03:49.360 --> 00:03:54.479
So I would say there are two big shifts that we have seen, Bo, in the way people work.
00:03:54.879 --> 00:03:59.120
First is that the work has really left your office and network perimeter.
00:03:59.199 --> 00:04:02.000
And the shift actually started at the time of COVID.
00:04:02.400 --> 00:04:05.280
But literally now people work from anywhere.
00:04:05.439 --> 00:04:11.280
They could be on any network, they could be working using SaaS apps, Gen AI apps.
00:04:11.439 --> 00:04:18.079
So the old saying that guard the network edge model that doesn't work and it doesn't have the coverage anymore.
00:04:18.160 --> 00:04:22.480
You can't even get all the data to come to a single device in most cases.
00:04:23.040 --> 00:04:31.279
Second big shift, which has happened in, I would say, last one year or so, where endpoint is not owned by only humans now.
00:04:31.439 --> 00:04:36.079
I talk to so many companies and they say our team is using a bunch of agents.
00:04:36.240 --> 00:04:38.879
We don't know who is using what type of agent.
00:04:39.120 --> 00:04:42.319
And can you tell us what agents are being used?
00:04:42.560 --> 00:04:54.480
And that's another big shift where AI agents and co-pilots and assistants are acting on the device with the person's own session at machine speed.
00:04:54.720 --> 00:05:12.800
And based on some studies, they already outnumber human identities in the enterprise by roughly 40 to 1, which means that the previous generation tools, which were built to watch human activity at keyboard, simply they aren't designed to see and deal with the agent activity.
00:05:13.040 --> 00:05:19.600
And I feel the security also has to move where these agents are working, and that is the endpoint.
00:05:20.079 --> 00:05:21.680
That's a great explanation of it.
00:05:21.759 --> 00:05:34.639
Yeah, I mean it's 40 to 1 uh AI agents outnumbering the employee 40 to 1 in many cases, and that's just going to that number's just going to grow as as agents continue to uh get more uh prevalent.
00:05:34.879 --> 00:05:35.839
I want to ask you about that.
00:05:36.079 --> 00:05:42.079
So every every employee has Chat GPT open in a tab nowadays, and we've got these these agents acting on their own.
00:05:42.240 --> 00:05:53.920
When it's when it's so easy to paste, summarize, upload, or just hand data off to a tool, what's that that new risk that didn't exist a couple years ago?
00:05:54.160 --> 00:05:58.399
Can you help kind of explain that new sort of risk factor involved here?
00:05:59.199 --> 00:05:59.920
Sure, sure.
00:06:00.240 --> 00:06:08.000
So the thing is that most of the cybersecurity tools, they were designed to see one slice of data at a time.
00:06:08.240 --> 00:06:23.839
So for example, your network security tool would see the traffic, your SAS app visibility tool would see the login, your email tool will see the attachments, your device EDR or device management tool would know the device activity.
00:06:24.160 --> 00:06:28.319
Now the challenge is that nobody is stitching all of this together.
00:06:28.639 --> 00:06:39.120
Whereas when the agents are working on your data, you may have sensitive data on the device, you need to know what is sensitive data, then who is touching that data?
00:06:39.279 --> 00:06:40.879
Are they allowed to touch it?
00:06:41.120 --> 00:06:43.360
And where are they sending that data?
00:06:43.600 --> 00:06:51.360
And all this information about the sensitive data, who is touching, where is it going, is it uh operation allowed?
00:06:51.519 --> 00:06:55.120
That doesn't come under the purview of a single solution.
00:06:55.360 --> 00:07:07.279
And that makes it much harder for existing tools to deal with these Gen AI type of workloads as well as the behavior of employees when they are working with Gen AI tools.
00:07:07.680 --> 00:07:13.920
Well, that's the part that gets me is is it's not so much like uh malicious actors that you have to deal with.
00:07:14.079 --> 00:07:26.800
It's uh a lot of times it's just the well-meaning sort of employee that pastes a contract into a chatbot to summarize it or something, or it's an aid agent doing it for for them, um, carrying out that task for the employee.
00:07:27.120 --> 00:07:34.000
Um, which just yeah, just makes me sort of wonder how much of the security teams can even see because you can't stop what you don't know is happening, right?
00:07:34.399 --> 00:07:43.680
Um and that kind of gets me to that question of like, why is it so hard for security teams to just answer the question of where is our sensitive data actually going?
00:07:44.319 --> 00:07:45.199
True, true.
00:07:45.439 --> 00:08:02.560
See, the challenge is that if you look at just the network security tools, the fact that they have to decrypt and re-encrypt the data on the wire, which they can only do for certain subset of applications or sites, they can't do it for other uh applications.
00:08:02.959 --> 00:08:07.839
Any site which is end-to-end encrypted, they have to basically bypass that data.
00:08:08.160 --> 00:08:17.040
Second challenge is that by the time the request comes on the network, you already have lost the information of what may have happened on the device.
00:08:17.199 --> 00:08:22.000
So, for example, let's say there is a sensitive file and I want to exfiltrate that file.
00:08:22.160 --> 00:08:32.639
I can convert that file by doing a base 64 encoding or converting that into a PNG or some other format, which I can upload through a network security tool.
00:08:32.720 --> 00:08:37.600
And then once I get it on the other side, I can recreate that original document.
00:08:37.840 --> 00:08:48.960
And that makes it very difficult because you don't have the whole information of what file came to the device, what operation happened on the device, and then what came on the wire.
00:08:49.200 --> 00:08:50.879
And that makes it very difficult.
00:08:51.039 --> 00:08:55.200
Now, one can argue that what about the endpoint security solutions?
00:08:55.360 --> 00:08:57.200
They should be able to see that.
00:08:57.440 --> 00:09:08.159
Most of the endpoint security solutions like EDR or endpoint DLP, they are worried about what's happening on the endpoint and what's running is that safe or malicious.
00:09:08.320 --> 00:09:16.480
They don't have visibility into what's going on the wire and where it is going, is that approved or unsanctioned?
00:09:16.720 --> 00:09:28.399
So it's just there is a big context gap these days in various security tools where nobody has the complete context, and that leads to the security blind spots that the teams see.
00:09:28.960 --> 00:09:31.360
Okay, that that makes yeah, that makes a lot of sense.
00:09:31.440 --> 00:09:40.799
That the there's just so many, uh, so much data flowing through all these different channels that were sort of never maybe really designed to be monitored in the first place, I guess.
00:09:40.960 --> 00:09:45.919
And and seeing the the endpoint, um, the argument for the endpoint makes sense.
00:09:46.000 --> 00:09:49.440
I mean, your whole premise is sort of is that the endpoint is where this needs to happen, right?
00:09:49.519 --> 00:09:53.840
The the laptop or the device, um not so much the network or the cloud.
00:09:54.000 --> 00:09:58.399
Like what makes the endpoint sort of the right place to draw that line?
00:09:58.799 --> 00:10:09.600
The reason endpoint is really the main place to get all the information is because if you think about endpoint, on endpoint I can see the device posture.
00:10:09.759 --> 00:10:15.600
I know whether the device has hard disk encryption turned on or other compliance controls in place.
00:10:15.840 --> 00:10:18.559
I know which agents are running on the device.
00:10:18.799 --> 00:10:21.360
I know which files the agents are touching.
00:10:21.519 --> 00:10:24.720
I know if the files are sensitive or not sensitive.
00:10:24.960 --> 00:10:32.480
If the agent is touching a source code file and the agent is actually doing the work in terms of coding, it's a legitimate access.
00:10:32.720 --> 00:10:40.960
But if your coding agent is somehow reading a PDF file with your employee list and their salaries, there is a problem somewhere here.
00:10:41.519 --> 00:10:44.399
And then the agent is uploading it somewhere.
00:10:44.639 --> 00:10:52.480
The question is if the agent is talking to a standard LLM, okay, yes, the agent will send some data to LLM to get the information.
00:10:52.639 --> 00:11:00.320
But if the agent starts uploading that file onto a OneDrive or a Dropbox, you know there is a problem going on somewhere.
00:11:00.639 --> 00:11:20.720
So the reason we run on the endpoint is because we believe endpoint is the only single vantage point where you can see all the activity and you can make a decision if the file is sensitive, if the process which is touching the file is legitimate, if the network connection where the file is going is legitimate.
00:11:20.960 --> 00:11:29.840
So you can make a much more real-time decision on what's going on rather than dealing with this after the fact.
00:11:30.080 --> 00:11:43.279
It's like, you know, I usually tell people that, you know, when you have the whole information, you can actually prevent the leak and not write the obituary because otherwise stuff happens and then you are just writing about it.
00:11:43.440 --> 00:11:46.879
And which is the sad part of a lot of security tools.
00:11:47.360 --> 00:11:48.080
Oh, absolutely.
00:11:48.159 --> 00:11:48.399
Yeah.
00:11:48.480 --> 00:11:54.799
There's and there's uh you're you know, you're reading about all these different security blunders and and issues every day.
00:11:54.960 --> 00:11:59.279
You know, there's there's hundreds of stories, it seems like, every single day about various issues.
00:11:59.519 --> 00:12:00.879
Um, but that that makes sense.
00:12:00.960 --> 00:12:02.559
Thanks you for the the explanation there.
00:12:02.639 --> 00:12:16.720
And and just uh sort of every every one of those pathways on someone's device, um you know, it starts there, and so you catch it at the source, I guess, instead of the uh chasing it sort of downstream from these these networks and these cloud providers.
00:12:17.600 --> 00:12:22.240
Um so that vantage point, yeah, the vantage point um is is really is really important.
00:12:22.799 --> 00:12:31.440
Um and then not to have you kind of you know get too redundant here with with some of your um answers, but um what does that actually change?
00:12:31.519 --> 00:12:40.960
So when you're able to can actually see things as they happen, what does it actually change about how a company stops a leak, for example, versus you know just finding out about it after the fact?
00:12:41.600 --> 00:12:47.600
Yeah, so I would say fundamentally what happens is it takes your security from forensics to prevention.
00:12:47.840 --> 00:12:56.879
Instead of reading a report that the leak happened and now let's investigate, we want to stop it in the instant it's about to happen.
00:12:57.200 --> 00:13:00.960
And that is the fundamental change that we bring.
00:13:01.200 --> 00:13:07.679
And the reason we can do that is because we are on the endpoint where the activity is actually happening.
00:13:07.919 --> 00:13:12.240
So that way we can see the activity and then we can tell the person.
00:13:12.399 --> 00:13:19.440
And another interesting thing that we have found is in our tool, we do what is called as um continuous coaching.
00:13:19.679 --> 00:13:26.799
What that means is that if somebody, let's say, copies sensitive data from a file and they paste it into Chat GPT.
00:13:26.960 --> 00:13:28.240
Now they haven't sent it yet.
00:13:28.399 --> 00:13:30.559
They have literally just pasted the data.
00:13:30.799 --> 00:13:37.200
The moment they paste the data, we would show a pop-up saying you have copied and pasted sensitive data.
00:13:37.360 --> 00:13:40.639
Are you sure you are really trying to send it to this tool?
00:13:40.799 --> 00:13:43.360
It should not be allowed as per company policy.
00:13:43.600 --> 00:13:46.240
You better make sure this is an approved action.
00:13:46.480 --> 00:13:53.039
And now the person can make a judgment call because sometimes people might be doing it just out of ignorance.
00:13:53.200 --> 00:13:57.039
They just didn't know that what they are trying to do is actually not safe.
00:13:57.279 --> 00:14:31.519
And we have seen many customers tell us that just by the fact that we are nudging the employees on such operations, it has changed their behavior, which I believe is much better than the annual security training that companies go through, where once a year they will send you a uh PowerPoint to watch or a video that you see, and then they say, Okay, you have gone through your security training, the video tells you not to click on things, the video tells you not to send sensitive data, and 10 minutes after that video, the employee also has forgotten about the video.
00:14:32.080 --> 00:14:32.960
Yeah, absolutely.
00:14:33.120 --> 00:14:40.159
I mean, I I'm one of those people that that needs the reminders because I've I've got so many things, you know, just multitasking and going on.
00:14:40.240 --> 00:14:41.840
My attention span is all over the place.
00:14:41.919 --> 00:14:50.879
So just having the reminder uh to not paste, you know, sensitive information uh into a chat GPT box, for example, um, I can see the benefits there.
00:14:51.360 --> 00:14:52.879
Okay, so that's a great, that's a great feature.
00:14:52.960 --> 00:14:56.159
And I also love that you mentioned the forensics to prevention.
00:14:56.399 --> 00:15:06.720
Uh basically stopping it at the door is kind of uh the kind of big takeaway here, I guess, with with stopping a leak and and uh versus finding out after the fact.
00:15:07.200 --> 00:15:16.799
Um but I also want to get into the uh data loss prevention here, which has sort of been promising that stance um for the last couple decades or so.
00:15:17.200 --> 00:15:24.639
And I I don't think anyone sort of it's it my the general consensus I've gathered is DLP isn't something that's very um beloved.
00:15:25.039 --> 00:15:30.240
Um it's it kind of delivers a lot of false positive, a lot of IT teams end up turning it off.
00:15:30.480 --> 00:15:35.519
What does a a version of DLP that people don't hate look like?
00:15:36.000 --> 00:15:37.919
Yeah, that's very true, uh Bo.
00:15:38.399 --> 00:15:44.639
So DLP has a very bad reputation for being noisy and very complex to set up.
00:15:44.879 --> 00:15:46.320
And the reason is very simple.
00:15:46.480 --> 00:15:49.759
See, old DLP was around pattern matching.
00:15:50.000 --> 00:15:54.320
So you put a pattern, if that pattern hits in a file, you will get an alert.
00:15:54.480 --> 00:15:58.960
And it leads to a lot of false positives because it doesn't understand the context.
00:15:59.120 --> 00:16:01.039
And I'll give you a very simple example.
00:16:01.200 --> 00:16:03.440
Let's say you are looking for a date of birth.
00:16:03.600 --> 00:16:08.559
So you put a pattern saying if I see a date, it could be a date of birth, flag it.
00:16:08.720 --> 00:16:13.360
Now you know there are a lot of dates in a lot of documents which are not a date of birth.
00:16:13.600 --> 00:16:19.360
So then people use some heuristics around it saying, oh, there should be a DOB somewhere or things like that.
00:16:19.519 --> 00:16:23.120
But at the end of the day, it leads to a lot of false positives.
00:16:23.279 --> 00:16:27.120
And you have to set up so many of these pattern matching rules.
00:16:27.360 --> 00:16:39.279
Now, modern DLP solutions like Kite Cyber and few others, they use LLM-based classification, which means it can actually read and analyze the data the way a person would.
00:16:39.600 --> 00:16:48.720
So, for example, if I show you a document in which there are a bunch of dates, I'm sure you can tell very easily if it's a date of birth or if it's an actual regular date.
00:16:48.960 --> 00:16:52.559
And that is what a LLM-based engine can do.
00:16:52.799 --> 00:16:57.600
It can flag what actually matters and it stays quiet on the rest of the stuff.
00:16:57.840 --> 00:17:03.200
So the thing is, I usually tell people the problem with the old DLP wasn't that it cried wolf.
00:17:03.279 --> 00:17:04.160
Yes, it does.
00:17:04.400 --> 00:17:08.160
The problem is it can't tell the difference between a wolf and a dog.
00:17:08.480 --> 00:17:12.880
And then you would see a lot of these alerts and you have to deal with them now.
00:17:13.440 --> 00:17:27.279
Okay, so it really does come down to context, knowing, knowing the difference between uh like someone, someone doing their job and someone doing something risky, um, and then you know, not sort of blocking everything with the word confidential in it.
00:17:27.440 --> 00:17:30.720
So really understanding the the context is is is really key.
00:17:31.279 --> 00:17:37.519
Um so yeah, the you know, even the smartest systems, you know, they'll they they still uh they're still going to say no sometimes.
00:17:37.599 --> 00:17:45.680
And that's uh sort of where that you have that friction, I understand, with with a lot of employees um using some of these these platforms for the security platforms.
00:17:45.839 --> 00:17:53.440
How do you like how do you lock things down without employees just feeling like they're just fighting their own laptop all day?
00:17:53.759 --> 00:17:55.200
That's a very good point, Bo.
00:17:55.359 --> 00:18:01.759
I think security typically is sort of considered as a hindrance in productivity.
00:18:02.000 --> 00:18:07.039
It's a bother to employees, and it has that bad reputation as well.
00:18:07.200 --> 00:18:13.039
Most people I talk to, they say security has installed these eight different agents and tools on my device.
00:18:13.200 --> 00:18:19.119
My device takes 10 minutes to boot up and it's just hurting my productivity.
00:18:19.440 --> 00:18:27.359
Now, you know, the best security is the kind that people don't feel, and that is our core goal when we are designing the product.
00:18:27.599 --> 00:18:45.519
So, in our case, for example, we have one lightweight agent under 2% CPU overhead, and the policies are there where they only intervene when there is a genuine risky action, so that the remaining 99% of the day, nobody even notices that it's there.
00:18:45.920 --> 00:18:53.440
And we want to make it clear to the employee when an alert comes up, what's the reason for the alert?
00:18:53.599 --> 00:18:54.880
What were they trying to do?
00:18:55.039 --> 00:19:04.160
What policy it may be impacting, and when is it possible to get out of that blockade and get permission to bypass that control?
00:19:04.319 --> 00:19:11.359
So, for example, let's say you are trying to upload some file and you believe it's to a legitimate place and it should not be blocked.
00:19:11.680 --> 00:19:28.079
So we even give an option to employees where they can actually ask for an approval or they can do a self-attest where they can say, this is the file, and then here is where the file is going, and they can get permission to do that action without waiting too long.
00:19:28.319 --> 00:19:35.200
And the fact that people can get out of the problems is actually making a big difference in their user experience.
00:19:35.440 --> 00:19:46.079
Because typically what happens is people get stuck on some action, then they have to go and file a ticket, then IT or security would look at it, and two days later they will give you a permission.
00:19:46.240 --> 00:19:49.680
By that time, I mean people have lost the context.
00:19:49.839 --> 00:19:53.519
They were trying to do something and they feel stuck in the action.
00:19:53.759 --> 00:20:02.559
So I feel that if your employees are fighting the security tool, more than likely the employees will win and your data will lose.
00:20:02.799 --> 00:20:08.160
So don't make the tool fight the employees, make it work uh with them nicely.
00:20:08.640 --> 00:20:09.279
Absolutely.
00:20:09.440 --> 00:20:11.039
Yeah, yeah, very, very true.
00:20:11.200 --> 00:20:24.640
I mean, if there's if there's a uh if it's gonna slow down your productivity and and cause a bunch of obstacles and and pop-up boxes and whatnot, um employees are just are are going to find ways to get around it, right?
00:20:24.720 --> 00:20:27.279
And that leads to all sorts of security holes.
00:20:27.920 --> 00:20:58.880
Um so yeah, very, very uh very I imagine it's tough to find that balance of you know having robust, really robust security and and and working with employees and kind of the learning curve and the giving them the sort of the the education of like why the security tools are in place in the first place, because I think that's important to understand like why you even you know go through the the rigmarole of of um you know all these different like two-factor authentication and um having all these paste copy and paste reminders and whatnot.
00:20:59.680 --> 00:21:12.640
Um but it sounds like you have the a very capable lightweight agent that handles things, one agent, one console instead of you know a bunch of different tools that each cover a slice that don't talk to each other and cause a whole bunch of headaches for employees.
00:21:12.960 --> 00:21:13.519
True, true.
00:21:13.759 --> 00:21:16.640
I actually I see the same thing even in parenting as well.
00:21:16.799 --> 00:21:20.240
I think sometimes you have to set rules and say no to certain things.
00:21:20.400 --> 00:21:26.400
And at that time the kids may not realize what's the reason for that, and you have to explain it.
00:21:26.720 --> 00:21:32.559
But it's the same analogy that certain decisions are there just for everyone's safety.
00:21:32.960 --> 00:21:33.759
Yeah, very true.
00:21:33.839 --> 00:21:36.319
And like with parenting, it's like you do the best you can.
00:21:36.480 --> 00:21:40.799
There's no, you know, unfortunately, there's no perfect way to parent, but you just do the best you can.
00:21:41.039 --> 00:21:47.440
Now, let's pull the, let's pull the pull back the from kite cyber specifically for for a minute here with this next question.
00:21:47.519 --> 00:21:49.839
Um, because you've obviously been in this space for a long time.
00:21:49.920 --> 00:21:54.079
And I'm just really curious about what you see people sort of getting wrong.
00:21:54.240 --> 00:21:58.559
Uh, what's a maybe a misconception about cybersecurity that you keep running into?
00:21:58.640 --> 00:21:59.680
You know, something that maybe you wish.
00:22:00.160 --> 00:22:01.440
More people understood.
00:22:01.839 --> 00:22:04.000
That's a great question, Bo.
00:22:04.559 --> 00:22:12.640
I think basically the biggest misconception that I see is that more tools means more protection.
00:22:13.119 --> 00:22:21.599
And a lot of security teams, they have stacked up a dozen products for network, for email, for SAS app, for endpoint.
00:22:21.759 --> 00:22:24.319
And they believe that the coverage adds up.
00:22:24.480 --> 00:22:29.680
They have covered a lot of things using different tools, but unfortunately it doesn't.
00:22:30.000 --> 00:22:38.960
Because when every tool sees their own slice of information, then the gap between the tools is exactly where the data leaks happen.
00:22:39.200 --> 00:22:46.079
And the blind spot is not necessarily in one product, it's actually in the seams between the product.
00:22:46.559 --> 00:22:49.039
And that is a big challenge.
00:22:49.279 --> 00:22:50.640
And it's a misconception.
00:22:50.880 --> 00:22:54.000
Lot of leaders I talk to, they say, Ajay, I have eight tools.
00:22:54.079 --> 00:22:58.799
I'm thinking of this ninth tool to cover this one more gap that I have.
00:22:59.039 --> 00:23:12.559
Now, the second thing actually that I see, which is sort of related to it as a misconception, is that DLP is always painful, noisy, false positive ridden, and it's a full-time role to just keep tuning DLP.
00:23:12.640 --> 00:23:21.039
So that you write a rule, you realize too many false positives, you tweak the rule to reduce it, but you can't shrink it too much because then everything will go through.
00:23:21.359 --> 00:23:29.200
And that is where I think for pattern matching DLP, it was true, but that's not really a law of nature.
00:23:29.440 --> 00:23:41.440
And I feel with the advancement in Gen AI and where the classification really understands the context, the noise can severely drop and the tool gets out of people's way.
00:23:41.599 --> 00:23:51.279
And we have shown with our solution as well that we are able to eliminate almost 95% of the false positives from the DLP and data classification.
00:23:51.599 --> 00:23:56.799
So I would say to summarize, one buying more security tools doesn't close the gap.
00:23:56.960 --> 00:24:04.319
It actually adds more seams where the data can uh slip through and the leak is not inside the tool.
00:24:04.400 --> 00:24:08.799
It's typically the space between the tools that none of them is owning.
00:24:09.279 --> 00:24:11.039
Those are two great misconceptions.
00:24:11.759 --> 00:24:16.160
I want to uh continue uh along the those same lines here with this next question.
00:24:16.319 --> 00:24:27.839
If you could get if you could get every potential customer to understand one thing, you know, shout out from the rooftops, if only you do this one thing, what would that that one thing be?
00:24:28.000 --> 00:24:32.480
And it could be about you know cybersecurity, it could be about the your platform.
00:24:32.799 --> 00:24:35.839
Um feel free to answer it any any which way you please.
00:24:36.319 --> 00:24:41.440
I mean, I would say cybersecurity is a serious problem right now.
00:24:42.079 --> 00:24:53.279
And I find more people are actually underprotected because they feel cybersecurity is um too complex and they don't deploy enough solutions and they deal with it.
00:24:53.680 --> 00:25:01.759
The one thing I would like to mention to everybody is what's changing in the field and why they need to take it more seriously.
00:25:02.079 --> 00:25:15.920
So companies they have visibility into what their people do, but most of them have no visibility into what the AI agents acting on their users' behalf are doing with the same data and the same access.
00:25:16.319 --> 00:25:24.240
And the gap is that majority of activity on your endpoint is being driven by agents now and it's growing.
00:25:24.480 --> 00:25:32.559
And the thing to really understand is that deploying five tools to monitor five things to close that is not going to really help.
00:25:32.799 --> 00:25:39.759
You need to figure out which place you can get the best context and vantage to really close.
00:25:40.000 --> 00:25:48.480
And as I said, endpoint is the only vantage point which can watch your data device identity and the agent activity.
00:25:48.799 --> 00:25:52.720
And in real time, it can act at the moment where it matters.
00:25:52.960 --> 00:26:03.440
So I believe that people have to take this threat very seriously that agents are doing more and more of the work and they don't have visibility into when things go wrong.
00:26:03.680 --> 00:26:16.559
And existing tools, they are watching the exits when somebody has already left, and people have to do something where they can stop stuff or bad stuff from happening in real time.
00:26:17.039 --> 00:26:25.039
Because otherwise, with humans, yes, you could make a mistake, you could upload a bad file, things would happen at a certain speed.
00:26:25.200 --> 00:26:31.759
With agents, the bad stuff can happen at machine speed, which is way too fast for your team to act on.
00:26:32.160 --> 00:26:32.640
Oh, yeah.
00:26:32.720 --> 00:26:43.599
I mean, I can't, it's it's such a wild west right now with what's happening in AI and all these different um these tools and capabilities and this massive exchange of data um going on.
00:26:43.759 --> 00:26:47.440
I it's it's really fascinating to think about where things are going to go.
00:26:47.599 --> 00:26:50.559
The I mean the adoption's already um pretty remarkable now.
00:26:50.640 --> 00:26:55.599
So imagining things uh five years out from now is is almost an impossible task.
00:26:55.839 --> 00:27:03.680
But um, you know, I do I do have to ask, you know, I had I gotta ask, what does endpoint security, you know, look like five years out?
00:27:03.759 --> 00:27:07.279
Um if we can even sort of predict that far, maybe even a few years out.
00:27:07.599 --> 00:27:07.920
True.
00:27:08.000 --> 00:27:15.359
So I would say the biggest shift, first of all, that I see right now that is going to impact cybersecurity is agentic AI.
00:27:15.519 --> 00:27:20.880
And when I say agentic AI, I don't mean chatbot answering questions for users.
00:27:21.119 --> 00:27:36.240
I mean that there are autonomous agents that are running on your device, that are taking actions, they are reading documents, they are moving stuff, they are transforming data, sharing the data, uploading the data, doing all of this at machine speed.
00:27:36.400 --> 00:27:40.880
And this is the fastest growing category of activity on the internet right now.
00:27:41.119 --> 00:27:49.359
And as I said, in enterprise, non-human identities are already outnumbering the human identities almost 40 to 1.
00:27:49.599 --> 00:27:55.039
So I feel that in five years, agents won't be a feature of how work gets done.
00:27:55.279 --> 00:27:57.839
They will be most of how it gets done.
00:27:57.920 --> 00:28:05.279
And that single shift will break the assumption underneath most security products on the market right now.
00:28:05.519 --> 00:28:21.119
Because if you think about it, previous generation products were built to say this is how humans work, malware would work differently, and we can detect the speed of work and action between humans and malware, and we can detect malware.
00:28:21.359 --> 00:28:22.319
Now, guess what?
00:28:22.480 --> 00:28:27.200
Agents work at the same speed as malware because both are programs doing stuff.
00:28:27.440 --> 00:28:37.759
So now, if you were doing anomaly detection between human style and uh program doing bad stuff, that anomaly detection doesn't work between agent and a malware.
00:28:37.839 --> 00:28:39.599
They both would look similar.
00:28:39.920 --> 00:28:49.039
And I feel the industry's whole job over the next five years is this retooling to see and govern a workforce which is not human.
00:28:49.200 --> 00:28:53.359
And it can move thousand times faster than the people can manage.
00:28:53.519 --> 00:28:57.680
And it can follow instructions literally, including malicious ones.
00:28:57.839 --> 00:29:05.119
To give you an example, you know, there is a company that basically did this agent to do invoice processing.
00:29:05.359 --> 00:29:09.920
Now, the job of the agent is to read an invoice and then take action on it.
00:29:10.079 --> 00:29:10.960
Now, guess what?
00:29:11.119 --> 00:29:20.960
People can send an invoice to the agent where underneath the invoice, so the top is the regular invoice, but underneath they can put instructions for the agent itself.
00:29:21.279 --> 00:29:28.720
And not only can you put instructions, you can put it in instructions where it's very hard to even see or read them on the background.
00:29:28.880 --> 00:29:43.599
But the agent does the transcription, it would read the document, convert it to text, and it can read the instructions, and now you can guide the agent to take malicious actions, which agent would do because its job is to read that thing and act on it.
00:29:43.839 --> 00:29:49.680
So there are a lot of such attacks that are going to become possible that people wouldn't have thought of before.
00:29:49.839 --> 00:30:01.119
And now you have agents which are waiting for instructions that come from outside, and that's like you know, the attack is now not having a malicious code running on somebody's machine.
00:30:01.359 --> 00:30:04.559
The attack is just telling the agent to do something bad.
00:30:04.720 --> 00:30:07.599
So it's literally a prompt coming in from somewhere.
00:30:08.240 --> 00:30:21.599
Wow, yeah, those prompt injection uh hacks are are really uh gonna be the the big problem if they aren't already the number one sort of issue, you know, cybersecurity experts are are trying to um handle.
00:30:22.079 --> 00:30:32.319
I think that there's gonna be a lot of interested uh folks listening right now who who want to get their hands on uh with with uh kite cyber and the platform you're building.
00:30:32.559 --> 00:30:34.160
So I want to give you an opportunity.
00:30:34.319 --> 00:30:39.279
Um, can you direct those viewers and listeners to uh kite cyber?
00:30:39.359 --> 00:30:41.119
Where's the best place to go to learn more?
00:30:41.599 --> 00:30:46.000
I think the best place is they can go to the website, which is kitecyber.com.
00:30:46.240 --> 00:30:49.440
We have a free trial, they can sign up for the free trial.
00:30:49.680 --> 00:31:02.480
We also do demos, so they can sign up for a demo and then we get on a call, we show them the demo of the product, we show the kind of activity we are able to catch, the kind of stuff we are able to protect against.
00:31:02.640 --> 00:31:17.519
And the nice thing is because we capture a lot of context around different areas, in most cases, we are able to eliminate two or three different point solutions and deploy a single lightweight agent to give them much better protection.
00:31:17.759 --> 00:31:24.720
And I wish, Bo, I had a different answer than the fact that agents are growing and you have to worry about it.
00:31:24.960 --> 00:31:30.640
But the fact of the matter is employees themselves are going and adding this additional workforce.
00:31:30.799 --> 00:31:34.240
Companies themselves want employees to adopt more agents.
00:31:34.480 --> 00:31:44.160
I just want to make sure that they do it in a secure way and they don't uh get blindsided by some side effect that they didn't think of.
00:31:44.720 --> 00:31:45.279
Absolutely.
00:31:45.440 --> 00:31:53.279
Yeah, I mean, it it's that's just it's just the the nature of uh what's going on here in in in technology and and our our daily lives.
00:31:53.440 --> 00:31:59.599
The um the transformation is uh just fascinating to be um experiencing.
00:31:59.680 --> 00:32:04.079
Uh and and but yeah, I think what you're what you're doing is really impressive and important.
00:32:04.240 --> 00:32:08.480
So I appreciate uh I again I appreciate everything that you've you've shared with us.
00:32:08.799 --> 00:32:10.160
I think this has really been fantastic.
00:32:10.240 --> 00:32:15.839
And um, you know, uh viewers, if you're interested in learning more about kite cyber, again go to kitecyber.com.
00:32:15.920 --> 00:32:17.839
We'll place a link down below in the show notes.
00:32:18.319 --> 00:32:19.839
AJ, this has been fantastic.
00:32:20.000 --> 00:32:21.680
Thank you so much for everything you shared with us.
00:32:22.559 --> 00:32:24.000
Thanks for thanks for having me.
00:32:24.960 --> 00:32:25.279
Of course.
00:32:25.359 --> 00:32:28.000
And thank you all for listening to the SourceForge podcast.
00:32:28.079 --> 00:32:29.680
I am your host, uh Bo Hamilton.
00:32:30.000 --> 00:32:34.400
Make sure to subscribe to stay up to date with all of our upcoming B2B software related podcasts.
00:32:34.880 --> 00:32:36.400
I will talk to you in the next one.
